@kensio/yulin 0.37.0 → 0.39.0

package/dist/service/kms/error/sim-kms.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms.error.js","sourceRoot":"","sources":["../../../../src/service/kms/error/sim-kms.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAAwB,EAAE;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IAC7B,IAAI,GAAG,mBAAmB,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,WAAW;IAClC,IAAI,GAAG,wBAAwB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IAC7B,IAAI,GAAG,mBAAmB,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,2BAA4B,SAAQ,WAAW;IACjC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,gCAAiC,SAAQ,WAAW;IACtC,IAAI,GAAG,4BAA4B,CAAC;IAE7D,YAAY,OAAO,GAAG,oDAAoD;QACxE,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA4B,SAAQ,WAAW;IACjC,IAAI,GAAG,uBAAuB,CAAC;IAExD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,WAAW;IAC/B,IAAI,GAAG,qBAAqB,CAAC;IAEtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,8BAA+B,SAAQ,WAAW;IACpC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/kms/index.d.ts

@@ -0,0 +1,8 @@
+export { SimKms, type SimKmsRequestOptions } from "./sim-kms.js";
+export { SimKmsKey, SimKmsKeyManager, SimKmsKeyState, type SimKmsKeyId, } from "./key/sim-kms-key.js";
+export { SimKmsAlias } from "./key/sim-kms-alias.js";
+export { SimKmsKeyPolicy } from "./key/sim-kms-key-policy.js";
+export type { SimKmsEncryptionContext } from "./key/sim-kms-encryption-context.js";
+export type { SimKmsKeyMetadata } from "./key/sim-kms-key-metadata.js";
+export { SimKmsAlreadyExistsException, SimKmsDisabledException, SimKmsError, SimKmsIncorrectKeyException, SimKmsInvalidCiphertextException, SimKmsInvalidKeyUsageException, SimKmsInvalidStateException, SimKmsNotFoundException, SimKmsValidationException, } from "./error/sim-kms.error.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/service/kms/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/kms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,KAAK,WAAW,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,YAAY,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/service/kms/index.js

@@ -0,0 +1,6 @@
+export { SimKms } from "./sim-kms.js";
+export { SimKmsKey, SimKmsKeyManager, SimKmsKeyState, } from "./key/sim-kms-key.js";
+export { SimKmsAlias } from "./key/sim-kms-alias.js";
+export { SimKmsKeyPolicy } from "./key/sim-kms-key-policy.js";
+export { SimKmsAlreadyExistsException, SimKmsDisabledException, SimKmsError, SimKmsIncorrectKeyException, SimKmsInvalidCiphertextException, SimKmsInvalidKeyUsageException, SimKmsInvalidStateException, SimKmsNotFoundException, SimKmsValidationException, } from "./error/sim-kms.error.js";
+//# sourceMappingURL=index.js.map

package/dist/service/kms/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/kms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA6B,MAAM,cAAc,CAAC;AACjE,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,cAAc,GAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/service/kms/key/sim-kms-alias.d.ts

@@ -0,0 +1,45 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimKmsKeyId } from "./sim-kms-key.js";
+/**
+ * The prefix every KMS alias name carries.
+ */
+export declare const simKmsAliasPrefix = "alias/";
+/**
+ * The prefix reserved for aliases of AWS managed keys, such as
+ * `alias/aws/s3`. Real KMS refuses to let a customer create one.
+ */
+export declare const simKmsAwsAliasPrefix = "alias/aws/";
+interface SimKmsAliasProperties {
+    readonly aliasName: string;
+    readonly targetKeyId: SimKmsKeyId;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * An alias pointing at one simulated KMS key.
+ *
+ * An alias is a mutable name for a key rather than part of the key, so it is
+ * stored separately: retargeting an alias must not disturb the key, and
+ * deleting an alias must leave the key alone.
+ */
+export declare class SimKmsAlias {
+    readonly aliasName: string;
+    readonly arn: string;
+    readonly targetKeyId: SimKmsKeyId;
+    constructor(properties: SimKmsAliasProperties);
+}
+/**
+ * Checks alias names against the rules real KMS applies.
+ *
+ * Failing an invalid name here rather than storing it keeps a test from
+ * passing on an alias that CreateAlias would reject on real AWS.
+ */
+export declare class SimKmsAliasName {
+    private static readonly allowed;
+    private static readonly maxLength;
+    /**
+     * Validate an alias name a customer asked to create.
+     */
+    validateCustomerAlias(aliasName: string): void;
+}
+export {};
+//# sourceMappingURL=sim-kms-alias.d.ts.map

package/dist/service/kms/key/sim-kms-alias.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-alias.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-alias.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAE1F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;GAEG;AACH,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;GAMG;AACH,qBAAa,WAAW;IACtB,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,WAAW,EAAE,WAAW,CAAC;IAEzC,YAAY,UAAU,EAAE,qBAAqB,EAM5C;CACF;AAED;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAgB;IAC/C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAO;IAExC;;OAEG;IACH,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CA8B7C;CACF"}

package/dist/service/kms/key/sim-kms-alias.js

@@ -0,0 +1,59 @@
+import { SimKmsValidationException } from "../error/sim-kms.error.js";
+/**
+ * The prefix every KMS alias name carries.
+ */
+export const simKmsAliasPrefix = "alias/";
+/**
+ * The prefix reserved for aliases of AWS managed keys, such as
+ * `alias/aws/s3`. Real KMS refuses to let a customer create one.
+ */
+export const simKmsAwsAliasPrefix = "alias/aws/";
+/**
+ * An alias pointing at one simulated KMS key.
+ *
+ * An alias is a mutable name for a key rather than part of the key, so it is
+ * stored separately: retargeting an alias must not disturb the key, and
+ * deleting an alias must leave the key alone.
+ */
+export class SimKmsAlias {
+    aliasName;
+    arn;
+    targetKeyId;
+    constructor(properties) {
+        const { accountRegionScope } = properties;
+        this.aliasName = properties.aliasName;
+        this.arn = `arn:aws:kms:${accountRegionScope.regionName}:${accountRegionScope.accountId}:${properties.aliasName}`;
+        this.targetKeyId = properties.targetKeyId;
+    }
+}
+/**
+ * Checks alias names against the rules real KMS applies.
+ *
+ * Failing an invalid name here rather than storing it keeps a test from
+ * passing on an alias that CreateAlias would reject on real AWS.
+ */
+export class SimKmsAliasName {
+    static allowed = /^[\w/-]+$/u;
+    static maxLength = 256;
+    /**
+     * Validate an alias name a customer asked to create.
+     */
+    validateCustomerAlias(aliasName) {
+        if (aliasName.length > SimKmsAliasName.maxLength) {
+            throw new SimKmsValidationException(`Alias '${aliasName}' is longer than the ${String(SimKmsAliasName.maxLength)} character limit`);
+        }
+        if (aliasName === simKmsAliasPrefix) {
+            throw new SimKmsValidationException(`Alias must name something after '${simKmsAliasPrefix}'`);
+        }
+        if (!aliasName.startsWith(simKmsAliasPrefix)) {
+            throw new SimKmsValidationException(`Alias must start with '${simKmsAliasPrefix}': ${aliasName}`);
+        }
+        if (aliasName.startsWith(simKmsAwsAliasPrefix)) {
+            throw new SimKmsValidationException(`Alias '${aliasName}' is reserved for AWS managed keys`);
+        }
+        if (!SimKmsAliasName.allowed.test(aliasName)) {
+            throw new SimKmsValidationException(`Alias '${aliasName}' contains characters KMS does not allow`);
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-alias.js.map

package/dist/service/kms/key/sim-kms-alias.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-alias.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-alias.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAGtE;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAQjD;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACN,SAAS,CAAS;IAClB,GAAG,CAAS;IACZ,WAAW,CAAc;IAEzC,YAAY,UAAiC;QAC3C,MAAM,EAAE,kBAAkB,EAAE,GAAG,UAAU,CAAC;QAE1C,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,GAAG,GAAG,eAAe,kBAAkB,CAAC,UAAU,IAAI,kBAAkB,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QAClH,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAClB,MAAM,CAAU,OAAO,GAAG,YAAY,CAAC;IACvC,MAAM,CAAU,SAAS,GAAG,GAAG,CAAC;IAExC;;OAEG;IACH,qBAAqB,CAAC,SAAiB;QACrC,IAAI,SAAS,CAAC,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,yBAAyB,CACjC,UAAU,SAAS,wBAAwB,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,kBAAkB,CAC/F,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YACpC,MAAM,IAAI,yBAAyB,CACjC,oCAAoC,iBAAiB,GAAG,CACzD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,yBAAyB,CACjC,0BAA0B,iBAAiB,MAAM,SAAS,EAAE,CAC7D,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,yBAAyB,CACjC,UAAU,SAAS,oCAAoC,CACxD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,yBAAyB,CACjC,UAAU,SAAS,0CAA0C,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-ciphertext-blob.d.ts

@@ -0,0 +1,43 @@
+interface SimKmsCiphertextBlobPartsProperties {
+    readonly keyArn: string;
+    readonly iv: Uint8Array;
+    readonly authTag: Uint8Array;
+    readonly ciphertext: Uint8Array;
+}
+/**
+ * The parts of one ciphertext blob.
+ */
+export declare class SimKmsCiphertextBlobParts {
+    readonly keyArn: string;
+    readonly iv: Uint8Array;
+    readonly authTag: Uint8Array;
+    readonly ciphertext: Uint8Array;
+    constructor(properties: SimKmsCiphertextBlobPartsProperties);
+}
+/**
+ * Encodes and decodes the opaque ciphertext blob KMS hands back.
+ *
+ * Real KMS blobs are opaque to the caller but not to KMS: a blob names the key
+ * that produced it, which is why Decrypt needs no KeyId for a symmetric key.
+ * This layout keeps that property, carrying the key ARN alongside the AES-GCM
+ * initialisation vector and authentication tag.
+ *
+ * Opaque means callers must not read it. It is not encrypted, and it is not
+ * portable to real AWS or between simulations.
+ */
+export declare class SimKmsCiphertextBlob {
+    /**
+     * Encode the parts of an encryption into one blob.
+     */
+    encode(parts: SimKmsCiphertextBlobParts): Uint8Array;
+    /**
+     * Read the parts back out of a blob.
+     *
+     * Anything that is not a blob this simulation produced is an invalid
+     * ciphertext, which is the same answer real KMS gives for bytes it cannot
+     * make sense of.
+     */
+    decode(blob: Uint8Array): SimKmsCiphertextBlobParts;
+}
+export {};
+//# sourceMappingURL=sim-kms-ciphertext-blob.d.ts.map

package/dist/service/kms/key/sim-kms-ciphertext-blob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-ciphertext-blob.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-ciphertext-blob.ts"],"names":[],"mappings":"AAkBA,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,EAAE,EAAE,UAAU,CAAC;IAC/B,SAAgB,OAAO,EAAE,UAAU,CAAC;IACpC,SAAgB,UAAU,EAAE,UAAU,CAAC;IAEvC,YAAY,UAAU,EAAE,mCAAmC,EAK1D;CACF;AAED;;;;;;;;;;GAUG;AACH,qBAAa,oBAAoB;IAC/B;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,UAAU,CAgBnD;IAED;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,yBAAyB,CA2BlD;CACF"}

package/dist/service/kms/key/sim-kms-ciphertext-blob.js

@@ -0,0 +1,89 @@
+import { SimKmsInvalidCiphertextException } from "../error/sim-kms.error.js";
+/**
+ * Marks a byte string as one of this simulation's ciphertext blobs, so that
+ * arbitrary bytes handed to Decrypt are rejected rather than misread as a
+ * short blob.
+ */
+const magic = Buffer.from("YULINKMS", "ascii");
+/**
+ * Blob layout version, so a future change to the layout can be told apart
+ * from a blob this simulation cannot read at all.
+ */
+const version = 1;
+const ivLength = 12;
+const authTagLength = 16;
+/**
+ * The parts of one ciphertext blob.
+ */
+export class SimKmsCiphertextBlobParts {
+    keyArn;
+    iv;
+    authTag;
+    ciphertext;
+    constructor(properties) {
+        this.keyArn = properties.keyArn;
+        this.iv = properties.iv;
+        this.authTag = properties.authTag;
+        this.ciphertext = properties.ciphertext;
+    }
+}
+/**
+ * Encodes and decodes the opaque ciphertext blob KMS hands back.
+ *
+ * Real KMS blobs are opaque to the caller but not to KMS: a blob names the key
+ * that produced it, which is why Decrypt needs no KeyId for a symmetric key.
+ * This layout keeps that property, carrying the key ARN alongside the AES-GCM
+ * initialisation vector and authentication tag.
+ *
+ * Opaque means callers must not read it. It is not encrypted, and it is not
+ * portable to real AWS or between simulations.
+ */
+export class SimKmsCiphertextBlob {
+    /**
+     * Encode the parts of an encryption into one blob.
+     */
+    encode(parts) {
+        const keyArn = Buffer.from(parts.keyArn, "utf8");
+        const header = Buffer.alloc(2);
+        header.writeUInt8(version, 0);
+        header.writeUInt8(keyArn.length, 1);
+        return Uint8Array.from(Buffer.concat([
+            magic,
+            header,
+            keyArn,
+            parts.iv,
+            parts.authTag,
+            parts.ciphertext,
+        ]));
+    }
+    /**
+     * Read the parts back out of a blob.
+     *
+     * Anything that is not a blob this simulation produced is an invalid
+     * ciphertext, which is the same answer real KMS gives for bytes it cannot
+     * make sense of.
+     */
+    decode(blob) {
+        const buffer = Buffer.from(blob);
+        const keyArnStart = magic.length + 2;
+        if (buffer.length < keyArnStart ||
+            !buffer.subarray(0, magic.length).equals(magic) ||
+            buffer.readUInt8(magic.length) !== version) {
+            throw new SimKmsInvalidCiphertextException();
+        }
+        const keyArnLength = buffer.readUInt8(magic.length + 1);
+        const ivStart = keyArnStart + keyArnLength;
+        const authTagStart = ivStart + ivLength;
+        const ciphertextStart = authTagStart + authTagLength;
+        if (buffer.length < ciphertextStart) {
+            throw new SimKmsInvalidCiphertextException();
+        }
+        return new SimKmsCiphertextBlobParts({
+            keyArn: buffer.subarray(keyArnStart, ivStart).toString("utf8"),
+            iv: Uint8Array.from(buffer.subarray(ivStart, authTagStart)),
+            authTag: Uint8Array.from(buffer.subarray(authTagStart, ciphertextStart)),
+            ciphertext: Uint8Array.from(buffer.subarray(ciphertextStart)),
+        });
+    }
+}
+//# sourceMappingURL=sim-kms-ciphertext-blob.js.map

package/dist/service/kms/key/sim-kms-ciphertext-blob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-ciphertext-blob.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-ciphertext-blob.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAE7E;;;;GAIG;AACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAE/C;;;GAGG;AACH,MAAM,OAAO,GAAG,CAAC,CAAC;AAElB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,aAAa,GAAG,EAAE,CAAC;AASzB;;GAEG;AACH,MAAM,OAAO,yBAAyB;IACpB,MAAM,CAAS;IACf,EAAE,CAAa;IACf,OAAO,CAAa;IACpB,UAAU,CAAa;IAEvC,YAAY,UAA+C;QACzD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;OAEG;IACH,MAAM,CAAC,KAAgC;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAEpC,OAAO,UAAU,CAAC,IAAI,CACpB,MAAM,CAAC,MAAM,CAAC;YACZ,KAAK;YACL,MAAM;YACN,MAAM;YACN,KAAK,CAAC,EAAE;YACR,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,UAAU;SACjB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,IAAgB;QACrB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAErC,IACE,MAAM,CAAC,MAAM,GAAG,WAAW;YAC3B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/C,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,OAAO,EAC1C,CAAC;YACD,MAAM,IAAI,gCAAgC,EAAE,CAAC;QAC/C,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,WAAW,GAAG,YAAY,CAAC;QAC3C,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,CAAC;QACxC,MAAM,eAAe,GAAG,YAAY,GAAG,aAAa,CAAC;QAErD,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,EAAE,CAAC;QAC/C,CAAC;QAED,OAAO,IAAI,yBAAyB,CAAC;YACnC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9D,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC3D,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;YACxE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-encryption-context.d.ts

@@ -0,0 +1,34 @@
+/**
+ * An AWS KMS encryption context: non-secret key/value pairs bound to a
+ * ciphertext.
+ */
+export type SimKmsEncryptionContext = Readonly<Record<string, string>>;
+/**
+ * Serialises an encryption context into the additional authenticated data of
+ * an AES-GCM operation.
+ *
+ * The encryption context is exactly what AAD is for: it is not secret, it is
+ * not stored in the ciphertext, and supplying a different one on decryption
+ * has to fail. Binding it as AAD gets that behaviour from the cipher itself
+ * rather than from a comparison the simulator would have to remember to make.
+ *
+ * Real KMS treats the context as an unordered map, so the serialisation sorts
+ * by key. Two contexts with the same pairs written in a different order have
+ * to produce the same AAD, or a decryption that AWS would allow would fail
+ * here.
+ */
+export declare class SimKmsEncryptionContextAad {
+    /**
+     * Serialise an encryption context to the bytes bound into the ciphertext.
+     */
+    serialise(context: SimKmsEncryptionContext | undefined): Uint8Array;
+    /**
+     * The canonical string form of an encryption context.
+     *
+     * Pairs are sorted by key and both halves are escaped, so that no pair of
+     * distinct contexts can serialise to the same string by placing a separator
+     * inside a key or a value.
+     */
+    private canonical;
+}
+//# sourceMappingURL=sim-kms-encryption-context.d.ts.map

package/dist/service/kms/key/sim-kms-encryption-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-encryption-context.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-encryption-context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,qBAAa,0BAA0B;IACrC;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE,uBAAuB,GAAG,SAAS,GAAG,UAAU,CAElE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;CAalB"}

package/dist/service/kms/key/sim-kms-encryption-context.js

@@ -0,0 +1,39 @@
+/**
+ * Serialises an encryption context into the additional authenticated data of
+ * an AES-GCM operation.
+ *
+ * The encryption context is exactly what AAD is for: it is not secret, it is
+ * not stored in the ciphertext, and supplying a different one on decryption
+ * has to fail. Binding it as AAD gets that behaviour from the cipher itself
+ * rather than from a comparison the simulator would have to remember to make.
+ *
+ * Real KMS treats the context as an unordered map, so the serialisation sorts
+ * by key. Two contexts with the same pairs written in a different order have
+ * to produce the same AAD, or a decryption that AWS would allow would fail
+ * here.
+ */
+export class SimKmsEncryptionContextAad {
+    /**
+     * Serialise an encryption context to the bytes bound into the ciphertext.
+     */
+    serialise(context) {
+        return Buffer.from(this.canonical(context), "utf8");
+    }
+    /**
+     * The canonical string form of an encryption context.
+     *
+     * Pairs are sorted by key and both halves are escaped, so that no pair of
+     * distinct contexts can serialise to the same string by placing a separator
+     * inside a key or a value.
+     */
+    canonical(context) {
+        if (context === undefined) {
+            return "";
+        }
+        return Object.entries(context)
+            .toSorted(([left], [right]) => left.localeCompare(right))
+            .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)
+            .join("&");
+    }
+}
+//# sourceMappingURL=sim-kms-encryption-context.js.map

package/dist/service/kms/key/sim-kms-encryption-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-encryption-context.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-encryption-context.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,0BAA0B;IACrC;;OAEG;IACH,SAAS,CAAC,OAA4C;QACpD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACK,SAAS,CAAC,OAA4C;QAC5D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;aAC3B,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACxD,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAC5D;aACA,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-factory.d.ts

@@ -0,0 +1,36 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+import { SimKmsKey, type SimKmsKeyManager } from "./sim-kms-key.js";
+interface SimKmsKeyFactoryProperties {
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly clock: SimClock;
+}
+interface SimKmsMakeKeyProperties {
+    readonly description?: string | undefined;
+    readonly policy?: SimIamPolicyDocument | undefined;
+    readonly keyManager?: SimKmsKeyManager | undefined;
+}
+/**
+ * Builds simulated KMS keys, including their key material.
+ *
+ * Key creation has to assemble an identifier, an ARN, real AES key material
+ * and a policy that all agree with each other, so it happens in one place
+ * rather than at each call site that needs a key.
+ */
+export declare class SimKmsKeyFactory {
+    private readonly accountRegionScope;
+    private readonly clock;
+    private readonly blob;
+    constructor(properties: SimKmsKeyFactoryProperties);
+    /**
+     * Make a new key with fresh key material.
+     *
+     * Real key IDs are UUIDs, and code in the wild parses them that way, so
+     * these are real UUIDs rather than a shorter simulator-only identifier.
+     */
+    make(properties?: SimKmsMakeKeyProperties): SimKmsKey;
+    private keyPolicy;
+}
+export {};
+//# sourceMappingURL=sim-kms-key-factory.d.ts.map

package/dist/service/kms/key/sim-kms-key-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-factory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAIpE,UAAU,0BAA0B;IAClC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;IAEnD,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;;;;OAKG;IACH,IAAI,CAAC,UAAU,GAAE,uBAA4B,GAAG,SAAS,CAaxD;IAED,OAAO,CAAC,SAAS;CAUlB"}

package/dist/service/kms/key/sim-kms-key-factory.js

@@ -0,0 +1,47 @@
+import { randomUUID } from "node:crypto";
+import { SimKmsCiphertextBlob } from "./sim-kms-ciphertext-blob.js";
+import { SimKmsKey } from "./sim-kms-key.js";
+import { SimKmsKeyMaterial } from "./sim-kms-key-material.js";
+import { SimKmsKeyPolicy } from "./sim-kms-key-policy.js";
+/**
+ * Builds simulated KMS keys, including their key material.
+ *
+ * Key creation has to assemble an identifier, an ARN, real AES key material
+ * and a policy that all agree with each other, so it happens in one place
+ * rather than at each call site that needs a key.
+ */
+export class SimKmsKeyFactory {
+    accountRegionScope;
+    clock;
+    blob = new SimKmsCiphertextBlob();
+    constructor(properties) {
+        this.accountRegionScope = properties.accountRegionScope;
+        this.clock = properties.clock;
+    }
+    /**
+     * Make a new key with fresh key material.
+     *
+     * Real key IDs are UUIDs, and code in the wild parses them that way, so
+     * these are real UUIDs rather than a shorter simulator-only identifier.
+     */
+    make(properties = {}) {
+        const keyId = randomUUID();
+        const arn = `arn:aws:kms:${this.accountRegionScope.regionName}:${this.accountRegionScope.accountId}:key/${keyId}`;
+        return new SimKmsKey({
+            keyId,
+            accountRegionScope: this.accountRegionScope,
+            material: new SimKmsKeyMaterial({ keyArn: arn, blob: this.blob }),
+            policy: this.keyPolicy(arn, properties.policy),
+            creationDate: this.clock.now(),
+            description: properties.description,
+            keyManager: properties.keyManager,
+        });
+    }
+    keyPolicy(keyArn, document) {
+        if (document === undefined) {
+            return SimKmsKeyPolicy.default(keyArn, this.accountRegionScope.accountId);
+        }
+        return new SimKmsKeyPolicy(keyArn, document);
+    }
+}
+//# sourceMappingURL=sim-kms-key-factory.js.map

package/dist/service/kms/key/sim-kms-key-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-factory.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,SAAS,EAAyB,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAa1D;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IACV,kBAAkB,CAA2B;IAC7C,KAAK,CAAW;IAChB,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAEnD,YAAY,UAAsC;QAChD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,UAAU,GAA4B,EAAE;QAC3C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,eAAe,IAAI,CAAC,kBAAkB,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,QAAQ,KAAK,EAAE,CAAC;QAElH,OAAO,IAAI,SAAS,CAAC;YACnB,KAAK;YACL,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;YAC9C,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,UAAU,EAAE,UAAU,CAAC,UAAU;SAClC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CACf,MAAc,EACd,QAA0C;QAE1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-identifier.d.ts

@@ -0,0 +1,44 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+/**
+ * What a KeyId names: an alias, a key, or nothing this scope can resolve.
+ */
+export declare class SimKmsKeyIdentifier {
+    readonly aliasName: string | undefined;
+    readonly keyId: string | undefined;
+    private constructor();
+    /**
+     * An identifier naming nothing resolvable here.
+     */
+    static none(): SimKmsKeyIdentifier;
+    /**
+     * An identifier naming an alias.
+     */
+    static alias(aliasName: string): SimKmsKeyIdentifier;
+    /**
+     * An identifier naming a key.
+     */
+    static key(keyId: string): SimKmsKeyIdentifier;
+}
+/**
+ * Reads the four forms of KeyId real KMS accepts, within one scope.
+ *
+ * A key ARN and an alias ARN both name an Account and a Region, and KMS keys
+ * are scoped to both. An ARN belonging to somewhere else therefore resolves to
+ * nothing here rather than having its identifier pulled out and looked up
+ * locally, which would let a foreign ARN reach a key that happens to share an
+ * identifier.
+ */
+export declare class SimKmsKeyIdentifierParser {
+    private readonly accountRegionScope;
+    constructor(accountRegionScope: SimAwsAccountRegionScope);
+    /**
+     * Read what a KeyId names.
+     */
+    parse(keyId: string): SimKmsKeyIdentifier;
+    /**
+     * Read a key or alias ARN, refusing one belonging to another scope.
+     */
+    private parseArn;
+    private parseArnResource;
+}
+//# sourceMappingURL=sim-kms-key-identifier.d.ts.map

package/dist/service/kms/key/sim-kms-key-identifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-identifier.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-identifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAG1F;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,SAAgB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C,OAAO,eAMN;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,IAAI,mBAAmB,CAEjC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAEnD;IAED;;OAEG;IACH,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAE7C;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAE9D,YAAY,kBAAkB,EAAE,wBAAwB,EAEvD;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAUxC;IAED;;OAEG;IACH,OAAO,CAAC,QAAQ;IAgBhB,OAAO,CAAC,gBAAgB;CAazB"}

package/dist/service/kms/key/sim-kms-key-identifier.js

@@ -0,0 +1,81 @@
+import { simKmsAliasPrefix } from "./sim-kms-alias.js";
+/**
+ * What a KeyId names: an alias, a key, or nothing this scope can resolve.
+ */
+export class SimKmsKeyIdentifier {
+    aliasName;
+    keyId;
+    constructor(aliasName, keyId) {
+        this.aliasName = aliasName;
+        this.keyId = keyId;
+    }
+    /**
+     * An identifier naming nothing resolvable here.
+     */
+    static none() {
+        return new SimKmsKeyIdentifier(undefined, undefined);
+    }
+    /**
+     * An identifier naming an alias.
+     */
+    static alias(aliasName) {
+        return new SimKmsKeyIdentifier(aliasName, undefined);
+    }
+    /**
+     * An identifier naming a key.
+     */
+    static key(keyId) {
+        return new SimKmsKeyIdentifier(undefined, keyId);
+    }
+}
+/**
+ * Reads the four forms of KeyId real KMS accepts, within one scope.
+ *
+ * A key ARN and an alias ARN both name an Account and a Region, and KMS keys
+ * are scoped to both. An ARN belonging to somewhere else therefore resolves to
+ * nothing here rather than having its identifier pulled out and looked up
+ * locally, which would let a foreign ARN reach a key that happens to share an
+ * identifier.
+ */
+export class SimKmsKeyIdentifierParser {
+    accountRegionScope;
+    constructor(accountRegionScope) {
+        this.accountRegionScope = accountRegionScope;
+    }
+    /**
+     * Read what a KeyId names.
+     */
+    parse(keyId) {
+        if (keyId.startsWith("arn:")) {
+            return this.parseArn(keyId);
+        }
+        if (keyId.startsWith(simKmsAliasPrefix)) {
+            return SimKmsKeyIdentifier.alias(keyId);
+        }
+        return SimKmsKeyIdentifier.key(keyId);
+    }
+    /**
+     * Read a key or alias ARN, refusing one belonging to another scope.
+     */
+    parseArn(arn) {
+        const [, partition, service, regionName, accountId, ...rest] = arn.split(":");
+        if (partition !== "aws" ||
+            service !== "kms" ||
+            regionName !== this.accountRegionScope.regionName ||
+            accountId !== this.accountRegionScope.accountId) {
+            return SimKmsKeyIdentifier.none();
+        }
+        return this.parseArnResource(rest.join(":"));
+    }
+    parseArnResource(resource) {
+        if (resource.startsWith(simKmsAliasPrefix)) {
+            return SimKmsKeyIdentifier.alias(resource);
+        }
+        const keyId = /^key\/(.+)$/u.exec(resource)?.[1];
+        if (keyId === undefined) {
+            return SimKmsKeyIdentifier.none();
+        }
+        return SimKmsKeyIdentifier.key(keyId);
+    }
+}
+//# sourceMappingURL=sim-kms-key-identifier.js.map

package/dist/service/kms/key/sim-kms-key-identifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-identifier.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-identifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACd,SAAS,CAAqB;IAC9B,KAAK,CAAqB;IAE1C,YACE,SAA6B,EAC7B,KAAyB;QAEzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI;QACT,OAAO,IAAI,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,SAAiB;QAC5B,OAAO,IAAI,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,GAAG,CAAC,KAAa;QACtB,OAAO,IAAI,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,yBAAyB;IACnB,kBAAkB,CAA2B;IAE9D,YAAY,kBAA4C;QACtD,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAa;QACjB,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACxC,OAAO,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACK,QAAQ,CAAC,GAAW;QAC1B,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,GAC1D,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEjB,IACE,SAAS,KAAK,KAAK;YACnB,OAAO,KAAK,KAAK;YACjB,UAAU,KAAK,IAAI,CAAC,kBAAkB,CAAC,UAAU;YACjD,SAAS,KAAK,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAC/C,CAAC;YACD,OAAO,mBAAmB,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAEO,gBAAgB,CAAC,QAAgB;QACvC,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC3C,OAAO,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAEjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC;QAED,OAAO,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;CACF"}