@kensio/yulin 0.37.0 → 0.39.0

package/dist/service/kms/key/sim-kms-key-store.js

@@ -0,0 +1,121 @@
+import { SimKmsAlreadyExistsException, SimKmsNotFoundException, SimKmsValidationException, } from "../error/sim-kms.error.js";
+import { SimKmsAlias, simKmsAwsAliasPrefix } from "./sim-kms-alias.js";
+import { SimKmsKeyIdentifierParser } from "./sim-kms-key-identifier.js";
+import { SimKmsKeyManager, } from "./sim-kms-key.js";
+/**
+ * The keys and aliases of one simulated KMS scope, and how a KeyId resolves.
+ *
+ * Every KMS operation takes its target as a `KeyId` that may be a key ID, a
+ * key ARN, an alias name or an alias ARN, so resolution belongs in one place
+ * rather than in each command handler.
+ */
+export class SimKmsKeyStore {
+    keys = new Map();
+    aliases = new Map();
+    accountRegionScope;
+    keyFactory;
+    identifiers;
+    constructor(properties) {
+        this.accountRegionScope = properties.accountRegionScope;
+        this.keyFactory = properties.keyFactory;
+        this.identifiers = new SimKmsKeyIdentifierParser(properties.accountRegionScope);
+    }
+    /**
+     * Store a newly created key.
+     */
+    add(key) {
+        this.keys.set(key.keyId, key);
+    }
+    /**
+     * Resolve a KeyId to the key it names, or refuse.
+     */
+    require(keyId) {
+        if (keyId === undefined || keyId === "") {
+            throw new SimKmsValidationException("KeyId is required");
+        }
+        const key = this.find(keyId);
+        if (key === undefined) {
+            throw new SimKmsNotFoundException(`Key '${keyId}' does not exist in Account ${this.accountRegionScope.accountId} Region ${this.accountRegionScope.regionName}`);
+        }
+        return key;
+    }
+    /**
+     * Resolve a KeyId in any of the forms real KMS accepts.
+     *
+     * An alias of an AWS managed key resolves to a key created on demand, since
+     * that is how such a key comes into existence on real AWS: the service that
+     * needs it asks for it, and it appears without anyone creating it.
+     */
+    find(keyId) {
+        const identifier = this.identifiers.parse(keyId);
+        if (identifier.aliasName !== undefined) {
+            return this.findByAlias(identifier.aliasName);
+        }
+        if (identifier.keyId === undefined) {
+            return undefined;
+        }
+        return this.keys.get(identifier.keyId);
+    }
+    /**
+     * Point an alias at a key, refusing a name already in use.
+     */
+    addAlias(aliasName, targetKey) {
+        if (this.aliases.has(aliasName)) {
+            throw new SimKmsAlreadyExistsException(`Alias '${aliasName}' already exists`);
+        }
+        const alias = new SimKmsAlias({
+            aliasName,
+            targetKeyId: targetKey.keyId,
+            accountRegionScope: this.accountRegionScope,
+        });
+        this.aliases.set(aliasName, alias);
+        return alias;
+    }
+    /**
+     * Find a stored alias by its name.
+     *
+     * Unlike `find`, this does not materialise an AWS managed key for a reserved
+     * `alias/aws/` name: it reports the alias that exists, not the key one would
+     * reach.
+     */
+    findAlias(aliasName) {
+        return this.aliases.get(aliasName);
+    }
+    /**
+     * The aliases pointing at one key, or all of them.
+     */
+    aliasesFor(keyId) {
+        const all = this.aliases.values().toArray();
+        if (keyId === undefined) {
+            return all;
+        }
+        return all.filter((alias) => alias.targetKeyId === keyId);
+    }
+    /**
+     * Find the key an alias points at, creating an AWS managed key if the alias
+     * is a reserved one that has not been used yet.
+     */
+    findByAlias(aliasName) {
+        const alias = this.aliases.get(aliasName);
+        if (alias !== undefined) {
+            return this.keys.get(alias.targetKeyId);
+        }
+        if (!aliasName.startsWith(simKmsAwsAliasPrefix)) {
+            return undefined;
+        }
+        return this.makeAwsManagedKey(aliasName);
+    }
+    /**
+     * Create an AWS managed key on first reference to its reserved alias.
+     */
+    makeAwsManagedKey(aliasName) {
+        const key = this.keyFactory.make({
+            description: `Default key that protects my ${aliasName.slice(simKmsAwsAliasPrefix.length)} resources when no other key is defined`,
+            keyManager: SimKmsKeyManager.Aws,
+        });
+        this.add(key);
+        this.addAlias(aliasName, key);
+        return key;
+    }
+}
+//# sourceMappingURL=sim-kms-key-store.js.map

package/dist/service/kms/key/sim-kms-key-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-store.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-store.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EACL,gBAAgB,GAGjB,MAAM,kBAAkB,CAAC;AAQ1B;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IACT,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAC;IACzC,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAExC,kBAAkB,CAA2B;IAC7C,UAAU,CAAmB;IAC7B,WAAW,CAA4B;IAExD,YAAY,UAAoC;QAC9C,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,yBAAyB,CAC9C,UAAU,CAAC,kBAAkB,CAC9B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,GAAc;QAChB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,KAAyB;QAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,yBAAyB,CAAC,mBAAmB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE7B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,KAAK,+BAA+B,IAAI,CAAC,kBAAkB,CAAC,SAAS,WAAW,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAC7H,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,KAAa;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,SAAiB,EAAE,SAAoB;QAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,4BAA4B,CACpC,UAAU,SAAS,kBAAkB,CACtC,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;YAC5B,SAAS;YACT,WAAW,EAAE,SAAS,CAAC,KAAK;YAC5B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAEnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,SAAiB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,KAA8B;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QAE5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,SAAiB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,SAAiB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAC/B,WAAW,EAAE,gCAAgC,SAAS,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,yCAAyC;YAClI,UAAU,EAAE,gBAAgB,CAAC,GAAG;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE9B,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key.d.ts

@@ -0,0 +1,88 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimKmsCiphertextBlobParts } from "./sim-kms-ciphertext-blob.js";
+import type { SimKmsEncryptionContext } from "./sim-kms-encryption-context.js";
+import { type SimKmsKeyState } from "./sim-kms-key-lifecycle.js";
+import type { SimKmsKeyMaterial } from "./sim-kms-key-material.js";
+import type { SimKmsKeyPolicy } from "./sim-kms-key-policy.js";
+export { SimKmsKeyState } from "./sim-kms-key-lifecycle.js";
+/**
+ * Who created and controls a key. AWS managed keys are created by a service
+ * on first use rather than by the customer, and cannot be deleted.
+ */
+export declare const SimKmsKeyManager: {
+    readonly Aws: "AWS";
+    readonly Customer: "CUSTOMER";
+};
+export type SimKmsKeyManager = (typeof SimKmsKeyManager)[keyof typeof SimKmsKeyManager];
+export type SimKmsKeyId = string;
+interface SimKmsKeyProperties {
+    readonly keyId: SimKmsKeyId;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly material: SimKmsKeyMaterial;
+    readonly policy: SimKmsKeyPolicy;
+    readonly creationDate: Date;
+    readonly description?: string | undefined;
+    readonly keyManager?: SimKmsKeyManager | undefined;
+}
+/**
+ * A stored simulated KMS key.
+ *
+ * The key owns its material, its policy and its lifecycle, because all three
+ * live exactly as long as the key does and every cryptographic operation needs
+ * to consult all three.
+ */
+export declare class SimKmsKey {
+    readonly keyId: SimKmsKeyId;
+    readonly arn: string;
+    readonly creationDate: Date;
+    readonly keyManager: SimKmsKeyManager;
+    readonly policy: SimKmsKeyPolicy;
+    readonly description: string;
+    private readonly material;
+    private readonly lifecycle;
+    constructor(properties: SimKmsKeyProperties);
+    /**
+     * The key's current lifecycle state.
+     */
+    get keyState(): SimKmsKeyState;
+    /**
+     * Whether the key is enabled, as DescribeKey reports it.
+     */
+    get isEnabled(): boolean;
+    /**
+     * When the key is due to be deleted, if deletion is scheduled.
+     */
+    get deletionDate(): Date | undefined;
+    /**
+     * Enable the key.
+     */
+    enable(): void;
+    /**
+     * Disable the key, leaving it present but unusable.
+     */
+    disable(): void;
+    /**
+     * Schedule the key for deletion after a recovery window.
+     *
+     * An AWS managed key is refused. The service that owns it created it and
+     * only that service can remove it, so letting a test delete one would let
+     * the test pass on something real AWS would not allow. The failure is
+     * reported as an invalid state, which is one of the errors real
+     * ScheduleKeyDeletion returns, rather than claiming to know exactly which
+     * error AWS picks for this case.
+     */
+    scheduleDeletion(deletionDate: Date): void;
+    /**
+     * Cancel a scheduled deletion, leaving the key disabled.
+     */
+    cancelDeletion(): void;
+    /**
+     * Encrypt plaintext under this key.
+     */
+    encrypt(plaintext: Uint8Array, encryptionContext?: SimKmsEncryptionContext): Uint8Array;
+    /**
+     * Decrypt a ciphertext produced under this key.
+     */
+    decrypt(parts: SimKmsCiphertextBlobParts, encryptionContext?: SimKmsEncryptionContext): Uint8Array;
+}
+//# sourceMappingURL=sim-kms-key.d.ts.map

package/dist/service/kms/key/sim-kms-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAE1F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,gBAAgB;aAC3B,GAAG,EAAE,KAAK;aACV,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAC1B,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE3D,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;GAMG;AACH,qBAAa,SAAS;IACpB,SAAgB,KAAK,EAAE,WAAW,CAAC;IACnC,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,IAAI,CAAC;IACnC,SAAgB,UAAU,EAAE,gBAAgB,CAAC;IAC7C,SAAgB,MAAM,EAAE,eAAe,CAAC;IACxC,SAAgB,WAAW,EAAE,MAAM,CAAC;IAEpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAE/C,YAAY,UAAU,EAAE,mBAAmB,EAW1C;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,cAAc,CAE7B;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,IAAI,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,MAAM,IAAI,IAAI,CAEb;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAEd;IAED;;;;;;;;;OASG;IACH,gBAAgB,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAQzC;IAED;;OAEG;IACH,cAAc,IAAI,IAAI,CAErB;IAED;;OAEG;IACH,OAAO,CACL,SAAS,EAAE,UAAU,EACrB,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAGZ;IAED;;OAEG;IACH,OAAO,CACL,KAAK,EAAE,yBAAyB,EAChC,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAGZ;CACF"}

package/dist/service/kms/key/sim-kms-key.js

@@ -0,0 +1,106 @@
+import { SimKmsInvalidStateException } from "../error/sim-kms.error.js";
+import { SimKmsKeyLifecycle, } from "./sim-kms-key-lifecycle.js";
+export { SimKmsKeyState } from "./sim-kms-key-lifecycle.js";
+/**
+ * Who created and controls a key. AWS managed keys are created by a service
+ * on first use rather than by the customer, and cannot be deleted.
+ */
+export const SimKmsKeyManager = {
+    Aws: "AWS",
+    Customer: "CUSTOMER",
+};
+/**
+ * A stored simulated KMS key.
+ *
+ * The key owns its material, its policy and its lifecycle, because all three
+ * live exactly as long as the key does and every cryptographic operation needs
+ * to consult all three.
+ */
+export class SimKmsKey {
+    keyId;
+    arn;
+    creationDate;
+    keyManager;
+    policy;
+    description;
+    material;
+    lifecycle;
+    constructor(properties) {
+        const { accountRegionScope } = properties;
+        this.keyId = properties.keyId;
+        this.arn = `arn:aws:kms:${accountRegionScope.regionName}:${accountRegionScope.accountId}:key/${properties.keyId}`;
+        this.material = properties.material;
+        this.policy = properties.policy;
+        this.creationDate = properties.creationDate;
+        this.description = properties.description ?? "";
+        this.keyManager = properties.keyManager ?? SimKmsKeyManager.Customer;
+        this.lifecycle = new SimKmsKeyLifecycle(this.arn);
+    }
+    /**
+     * The key's current lifecycle state.
+     */
+    get keyState() {
+        return this.lifecycle.state;
+    }
+    /**
+     * Whether the key is enabled, as DescribeKey reports it.
+     */
+    get isEnabled() {
+        return this.lifecycle.isEnabled;
+    }
+    /**
+     * When the key is due to be deleted, if deletion is scheduled.
+     */
+    get deletionDate() {
+        return this.lifecycle.deletionDate;
+    }
+    /**
+     * Enable the key.
+     */
+    enable() {
+        this.lifecycle.enable();
+    }
+    /**
+     * Disable the key, leaving it present but unusable.
+     */
+    disable() {
+        this.lifecycle.disable();
+    }
+    /**
+     * Schedule the key for deletion after a recovery window.
+     *
+     * An AWS managed key is refused. The service that owns it created it and
+     * only that service can remove it, so letting a test delete one would let
+     * the test pass on something real AWS would not allow. The failure is
+     * reported as an invalid state, which is one of the errors real
+     * ScheduleKeyDeletion returns, rather than claiming to know exactly which
+     * error AWS picks for this case.
+     */
+    scheduleDeletion(deletionDate) {
+        if (this.keyManager === SimKmsKeyManager.Aws) {
+            throw new SimKmsInvalidStateException(`Key ${this.arn} is an AWS managed key and cannot be scheduled for deletion`);
+        }
+        this.lifecycle.scheduleDeletion(deletionDate);
+    }
+    /**
+     * Cancel a scheduled deletion, leaving the key disabled.
+     */
+    cancelDeletion() {
+        this.lifecycle.cancelDeletion();
+    }
+    /**
+     * Encrypt plaintext under this key.
+     */
+    encrypt(plaintext, encryptionContext) {
+        this.lifecycle.requireUsable();
+        return this.material.encrypt(plaintext, encryptionContext);
+    }
+    /**
+     * Decrypt a ciphertext produced under this key.
+     */
+    decrypt(parts, encryptionContext) {
+        this.lifecycle.requireUsable();
+        return this.material.decrypt(parts, encryptionContext);
+    }
+}
+//# sourceMappingURL=sim-kms-key.js.map

package/dist/service/kms/key/sim-kms-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAGxE,OAAO,EACL,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,GAAG,EAAE,KAAK;IACV,QAAQ,EAAE,UAAU;CACZ,CAAC;AAiBX;;;;;;GAMG;AACH,MAAM,OAAO,SAAS;IACJ,KAAK,CAAc;IACnB,GAAG,CAAS;IACZ,YAAY,CAAO;IACnB,UAAU,CAAmB;IAC7B,MAAM,CAAkB;IACxB,WAAW,CAAS;IAEnB,QAAQ,CAAoB;IAC5B,SAAS,CAAqB;IAE/C,YAAY,UAA+B;QACzC,MAAM,EAAE,kBAAkB,EAAE,GAAG,UAAU,CAAC;QAE1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,eAAe,kBAAkB,CAAC,UAAU,IAAI,kBAAkB,CAAC,SAAS,QAAQ,UAAU,CAAC,KAAK,EAAE,CAAC;QAClH,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QACrE,IAAI,CAAC,SAAS,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;;;OASG;IACH,gBAAgB,CAAC,YAAkB;QACjC,IAAI,IAAI,CAAC,UAAU,KAAK,gBAAgB,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,2BAA2B,CACnC,OAAO,IAAI,CAAC,GAAG,6DAA6D,CAC7E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,OAAO,CACL,SAAqB,EACrB,iBAA2C;QAE3C,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,OAAO,CACL,KAAgC,EAChC,iBAA2C;QAE3C,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-policy-document.d.ts

@@ -0,0 +1,30 @@
+import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
+/**
+ * Reads a key policy from the JSON string the real KMS API takes.
+ *
+ * CreateKey and PutKeyPolicy both take the policy this way, so parsing it, and
+ * refusing it in the same terms when it is not a policy document, belongs in
+ * one place.
+ */
+export declare class SimKmsPolicyDocument {
+    /**
+     * Parse a policy, or refuse if it is not valid JSON.
+     *
+     * A document object is accepted too, because writing one inline is the
+     * obvious thing to do from a test and stringifying it adds nothing.
+     */
+    parse(policy: string | SimIamPolicyDocument): SimIamPolicyDocument;
+    /**
+     * Parse an optional policy, leaving it undefined when none was given.
+     */
+    parseOptional(policy: string | undefined): SimIamPolicyDocument | undefined;
+    /**
+     * A policy has to be a JSON object. `null`, an array and a bare scalar are
+     * all valid JSON and none of them is a policy document, so refusing them
+     * here reports the problem where it was made rather than at the point some
+     * later authorization tries to evaluate them.
+     */
+    private requireDocument;
+    private parsed;
+}
+//# sourceMappingURL=sim-kms-policy-document.d.ts.map

package/dist/service/kms/key/sim-kms-policy-document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-policy-document.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-policy-document.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC/B;;;;;OAKG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,oBAAoB,CAMjE;IAED;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAM1E;IAED;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,MAAM;CASf"}

package/dist/service/kms/key/sim-kms-policy-document.js

@@ -0,0 +1,54 @@
+import { SimKmsValidationException } from "../error/sim-kms.error.js";
+/**
+ * Reads a key policy from the JSON string the real KMS API takes.
+ *
+ * CreateKey and PutKeyPolicy both take the policy this way, so parsing it, and
+ * refusing it in the same terms when it is not a policy document, belongs in
+ * one place.
+ */
+export class SimKmsPolicyDocument {
+    /**
+     * Parse a policy, or refuse if it is not valid JSON.
+     *
+     * A document object is accepted too, because writing one inline is the
+     * obvious thing to do from a test and stringifying it adds nothing.
+     */
+    parse(policy) {
+        if (typeof policy !== "string") {
+            return policy;
+        }
+        return this.requireDocument(this.parsed(policy));
+    }
+    /**
+     * Parse an optional policy, leaving it undefined when none was given.
+     */
+    parseOptional(policy) {
+        if (policy === undefined) {
+            return undefined;
+        }
+        return this.parse(policy);
+    }
+    /**
+     * A policy has to be a JSON object. `null`, an array and a bare scalar are
+     * all valid JSON and none of them is a policy document, so refusing them
+     * here reports the problem where it was made rather than at the point some
+     * later authorization tries to evaluate them.
+     */
+    requireDocument(parsed) {
+        if (typeof parsed !== "object" ||
+            parsed === null ||
+            Array.isArray(parsed)) {
+            throw new SimKmsValidationException("Policy is not a valid JSON policy document");
+        }
+        return parsed;
+    }
+    parsed(policy) {
+        try {
+            return JSON.parse(policy);
+        }
+        catch {
+            throw new SimKmsValidationException("Policy is not a valid JSON policy document");
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-policy-document.js.map

package/dist/service/kms/key/sim-kms-policy-document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-policy-document.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-policy-document.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAGtE;;;;;;GAMG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;;;;OAKG;IACH,KAAK,CAAC,MAAqC;QACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAA0B;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,MAAe;QACrC,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,MAAc;QAC3B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,yBAAyB,CACjC,4CAA4C,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/sdk/sim-kms-sdk-command-router.d.ts

@@ -0,0 +1,18 @@
+import { type SimSdkCommandRoute, type SimSdkCommandRouter } from "../../../sdk/index.js";
+import type { SimKms } from "../sim-kms.js";
+/**
+ * Routes intercepted SDK Commands to one scoped simulated KMS instance.
+ */
+export declare class SimKmsSdkCommandRouter implements SimSdkCommandRouter {
+    private readonly routes;
+    constructor(simKms: SimKms);
+    /**
+     * The SDK Command names simulated KMS can handle.
+     */
+    supportedCommandNames(): readonly string[];
+    /**
+     * Get the route for an SDK Command name, if simulated KMS supports it.
+     */
+    route(commandName: string): SimSdkCommandRoute | undefined;
+}
+//# sourceMappingURL=sim-kms-sdk-command-router.d.ts.map

package/dist/service/kms/sdk/sim-kms-sdk-command-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-sdk-command-router.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/sdk/sim-kms-sdk-command-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAqB/B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C;;GAEG;AACH,qBAAa,sBAAuB,YAAW,mBAAmB;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAEjE,YAAY,MAAM,EAAE,MAAM,EAmHzB;IAED;;OAEG;IACH,qBAAqB,IAAI,SAAS,MAAM,EAAE,CAEzC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEzD;CACF"}

package/dist/service/kms/sdk/sim-kms-sdk-command-router.js

@@ -0,0 +1,80 @@
+import { simSdkCallerOptions, } from "../../../sdk/index.js";
+/**
+ * Routes intercepted SDK Commands to one scoped simulated KMS instance.
+ */
+export class SimKmsSdkCommandRouter {
+    routes;
+    constructor(simKms) {
+        this.routes = new Map([
+            [
+                "CreateKeyCommand",
+                async (command, context) => await simKms.createKey(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DescribeKeyCommand",
+                async (command, context) => await simKms.describeKey(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "ListKeysCommand",
+                async (command, context) => await simKms.listKeys(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetKeyPolicyCommand",
+                async (command, context) => await simKms.getKeyPolicy(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "PutKeyPolicyCommand",
+                async (command, context) => await simKms.putKeyPolicy(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "EnableKeyCommand",
+                async (command, context) => await simKms.enableKey(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DisableKeyCommand",
+                async (command, context) => await simKms.disableKey(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "ScheduleKeyDeletionCommand",
+                async (command, context) => await simKms.scheduleKeyDeletion(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "CancelKeyDeletionCommand",
+                async (command, context) => await simKms.cancelKeyDeletion(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "CreateAliasCommand",
+                async (command, context) => await simKms.createAlias(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "ListAliasesCommand",
+                async (command, context) => await simKms.listAliases(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "EncryptCommand",
+                async (command, context) => await simKms.encrypt(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DecryptCommand",
+                async (command, context) => await simKms.decrypt(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GenerateDataKeyCommand",
+                async (command, context) => await simKms.generateDataKey(command, simSdkCallerOptions(context)),
+            ],
+        ]);
+    }
+    /**
+     * The SDK Command names simulated KMS can handle.
+     */
+    supportedCommandNames() {
+        return this.routes.keys().toArray();
+    }
+    /**
+     * Get the route for an SDK Command name, if simulated KMS supports it.
+     */
+    route(commandName) {
+        return this.routes.get(commandName);
+    }
+}
+//# sourceMappingURL=sim-kms-sdk-command-router.js.map

package/dist/service/kms/sdk/sim-kms-sdk-command-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-sdk-command-router.js","sourceRoot":"","sources":["../../../../src/service/kms/sdk/sim-kms-sdk-command-router.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,uBAAuB,CAAC;AAuB/B;;GAEG;AACH,MAAM,OAAO,sBAAsB;IAChB,MAAM,CAA0C;IAEjE,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAA6B;YAChD;gBACE,kBAAkB;gBAClB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,SAAS,CACpB,OAA8B,EAC9B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,oBAAoB;gBACpB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,WAAW,CACtB,OAAgC,EAChC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,iBAAiB;gBACjB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,QAAQ,CACnB,OAA6B,EAC7B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,qBAAqB;gBACrB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,YAAY,CACvB,OAAiC,EACjC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,qBAAqB;gBACrB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,YAAY,CACvB,OAAiC,EACjC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,kBAAkB;gBAClB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,SAAS,CACpB,OAA8B,EAC9B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,mBAAmB;gBACnB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,UAAU,CACrB,OAA+B,EAC/B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,4BAA4B;gBAC5B,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,mBAAmB,CAC9B,OAAwC,EACxC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,0BAA0B;gBAC1B,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,iBAAiB,CAC5B,OAAsC,EACtC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,oBAAoB;gBACpB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,WAAW,CACtB,OAAgC,EAChC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,oBAAoB;gBACpB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,WAAW,CACtB,OAAgC,EAChC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,gBAAgB;gBAChB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,OAAO,CAClB,OAA4B,EAC5B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,gBAAgB;gBAChB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,OAAO,CAClB,OAA4B,EAC5B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,wBAAwB;gBACxB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,eAAe,CAC1B,OAAoC,EACpC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAmB;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;CACF"}

package/dist/service/kms/sim-kms.d.ts

@@ -0,0 +1,120 @@
+import { type BackgroundScheduler } from "../../util/background/background.js";
+import type { SimAwsCaller } from "../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimSdkCommandRouter } from "../../sdk/router/sim-sdk-command-router.type.js";
+import type * as simKmsCommands from "./command/sim-kms-command.types.js";
+import { SimKmsCfnResourceFactory } from "./cfn/sim-cfn-kms-resource-factory.js";
+import type { SimKmsAlias } from "./key/sim-kms-alias.js";
+import type { SimKmsKey } from "./key/sim-kms-key.js";
+export interface SimKmsRequestOptions {
+    readonly caller?: SimAwsCaller;
+}
+interface SimKmsProperties {
+    readonly accountRegionScope?: SimAwsAccountRegionScope;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+/**
+ * Simulated KMS. Handles SDK commands. Emulates AWS behaviour and state.
+ *
+ * Encryption here is real encryption, not a stand-in: each key holds real
+ * AES-256 key material and the operations run through Node's crypto. A
+ * ciphertext genuinely cannot be read without its key, and a decryption with
+ * the wrong encryption context genuinely fails.
+ */
+export declare class SimKms {
+    private readonly keys;
+    private readonly keyCommands;
+    private readonly listKeysCommand;
+    private readonly lifecycleCommands;
+    private readonly policyCommands;
+    private readonly aliasCommands;
+    private readonly cryptoCommands;
+    private readonly generateDataKeyCommand;
+    private readonly background;
+    private readonly sdkRouter;
+    private readonly cfnFactory;
+    constructor(properties?: SimKmsProperties);
+    /**
+     * Find a key by key ID, key ARN, alias name or alias ARN.
+     *
+     * This is the simulator's own accessor, for tests seeding or inspecting key
+     * state without going through a Command and its authorization.
+     */
+    findKey(keyId: string): SimKmsKey | undefined;
+    /**
+     * Find an alias by name.
+     *
+     * This is the simulator's own accessor, alongside `findKey`, for tests and
+     * for CloudFormation Resource creation to get at the alias it just made.
+     */
+    findAlias(aliasName: string): SimKmsAlias | undefined;
+    /**
+     * Handle a CreateKey Command from the SDK.
+     */
+    createKey(command: simKmsCommands.SimCreateKeyCommand, options?: SimKmsRequestOptions): Promise<simKmsCommands.SimCreateKeyCommandOutput>;
+    /**
+     * Handle a DescribeKey Command from the SDK.
+     */
+    describeKey(command: simKmsCommands.SimDescribeKeyCommand, options?: SimKmsRequestOptions): Promise<simKmsCommands.SimDescribeKeyCommandOutput>;
+    /**
+     * Handle a ListKeys Command from the SDK.
+     */
+    listKeys(command: simKmsCommands.SimListKeysCommand, options?: SimKmsRequestOptions): Promise<simKmsCommands.SimListKeysCommandOutput>;
+    /**
+     * Handle a GetKeyPolicy Command from the SDK.
+     */
+    getKeyPolicy(command: simKmsCommands.SimGetKeyPolicyCommand, options?: SimKmsRequestOptions): Promise<simKmsCommands.SimGetKeyPolicyCommandOutput>;
+    /**
+     * Handle a PutKeyPolicy Command from the SDK.
+     */
+    putKeyPolicy(command: simKmsCommands.SimPutKeyPolicyCommand, options?: SimKmsRequestOptions): Promise<simKmsCommands.SimPutKeyPolicyCommandOutput>;
+    /**
+     * Handle an EnableKey Command from the SDK.
+     */
+    enableKey(command: simKmsCommands.SimEnableKeyCommand, options?: SimKmsRequestOptions): Promise<simKmsCommands.SimEnableKeyCommandOutput>;
+    /**
+     * Handle a DisableKey Command from the SDK.
+     */
+    disableKey(command: simKmsCommands.SimDisableKeyCommand, options?: SimKmsRequestOptions): Promise<simKmsCommands.SimDisableKeyCommandOutput>;
+    /**
+     * Handle a ScheduleKeyDeletion Command from the SDK.
+     */
+    scheduleKeyDeletion(command: simKmsCommands.SimScheduleKeyDeletionCommand, options?: SimKmsRequestOptions): Promise<simKmsCommands.SimScheduleKeyDeletionCommandOutput>;
+    /**
+     * Handle a CancelKeyDeletion Command from the SDK.
+     */
+    cancelKeyDeletion(command: simKmsCommands.SimCancelKeyDeletionCommand, options?: SimKmsRequestOptions): Promise<simKmsCommands.SimCancelKeyDeletionCommandOutput>;
+    /**
+     * Handle a CreateAlias Command from the SDK.
+     */
+    createAlias(command: simKmsCommands.SimCreateAliasCommand, options?: SimKmsRequestOptions): Promise<simKmsCommands.SimCreateAliasCommandOutput>;
+    /**
+     * Handle a ListAliases Command from the SDK.
+     */
+    listAliases(command: simKmsCommands.SimListAliasesCommand, options?: SimKmsRequestOptions): Promise<simKmsCommands.SimListAliasesCommandOutput>;
+    /**
+     * Handle an Encrypt Command from the SDK.
+     */
+    encrypt(command: simKmsCommands.SimEncryptCommand, options?: SimKmsRequestOptions): Promise<simKmsCommands.SimEncryptCommandOutput>;
+    /**
+     * Handle a Decrypt Command from the SDK.
+     */
+    decrypt(command: simKmsCommands.SimDecryptCommand, options?: SimKmsRequestOptions): Promise<simKmsCommands.SimDecryptCommandOutput>;
+    /**
+     * Handle a GenerateDataKey Command from the SDK.
+     */
+    generateDataKey(command: simKmsCommands.SimGenerateDataKeyCommand, options?: SimKmsRequestOptions): Promise<simKmsCommands.SimGenerateDataKeyCommandOutput>;
+    /**
+     * Get this service's CloudFormation Resource factory, which creates
+     * simulated keys and aliases from AWS::KMS::* Resources.
+     */
+    cfnResourceFactory(): SimKmsCfnResourceFactory;
+    /**
+     * Get this service's SDK Command router for SDK client interception.
+     */
+    sdkCommandRouter(): SimSdkCommandRouter;
+}
+export {};
+//# sourceMappingURL=sim-kms.d.ts.map