@kensio/yulin 0.37.0 → 0.39.0

package/dist/service/kms/cfn/sim-cfn-kms-property-parser.d.ts

@@ -0,0 +1,56 @@
+import type { SimCfnResource } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValue } from "../../cloudformation/template/value/sim-cfn-template-value.js";
+interface SimCfnKmsPropertyParserProperties {
+    readonly resourceType: string;
+}
+/**
+ * Validates individual AWS::KMS::* CloudFormation property values, failing
+ * with a diagnostic naming the Resource type, the property and the logical ID.
+ *
+ * The Resource type is carried here because KMS creates two of them, and a
+ * message naming the wrong one would send a reader to the wrong template
+ * entry.
+ */
+export declare class SimCfnKmsPropertyParser {
+    private readonly resourceType;
+    constructor(properties: SimCfnKmsPropertyParserProperties);
+    /**
+     * Parse a property value that must be a string when present.
+     */
+    optionalString(resource: SimCfnResource, value: SimCfnTemplateValue | undefined, label: string): string | undefined;
+    /**
+     * Parse a property value that has to be there and has to be a string.
+     */
+    requiredString(resource: SimCfnResource, value: SimCfnTemplateValue | undefined, label: string): string;
+    /**
+     * Parse a property value that must be a boolean when present.
+     *
+     * CloudFormation carries template booleans as the strings "true" and "false"
+     * in places, so both forms are accepted, as CloudFormation itself accepts
+     * them.
+     */
+    optionalBoolean(resource: SimCfnResource, value: SimCfnTemplateValue | undefined, label: string): boolean | undefined;
+    /**
+     * Parse a policy document property, which CloudFormation carries as an
+     * object but which the KMS API takes as a JSON string.
+     *
+     * A string is passed through so a template that inlined the JSON itself
+     * still works, which is what CDK's `PolicyDocument.toJSON` output and a
+     * hand-written `!Sub` both end up producing.
+     */
+    optionalPolicyJson(resource: SimCfnResource, value: SimCfnTemplateValue | undefined, label: string): string | undefined;
+    /**
+     * Build the diagnostic error for a malformed property value.
+     */
+    invalidPropertyError(resource: SimCfnResource, label: string, expected: string): TypeError;
+    /**
+     * Build the diagnostic error for a Resource this simulator refuses.
+     */
+    propertyError(resource: SimCfnResource, reason: string): Error;
+    /**
+     * Narrow a template value to an object, refusing anything else.
+     */
+    private record;
+}
+export {};
+//# sourceMappingURL=sim-cfn-kms-property-parser.d.ts.map

package/dist/service/kms/cfn/sim-cfn-kms-property-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-kms-property-parser.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/cfn/sim-cfn-kms-property-parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AACxF,OAAO,KAAK,EACV,mBAAmB,EAEpB,MAAM,+DAA+D,CAAC;AAEvE,UAAU,iCAAiC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IAEtC,YAAY,UAAU,EAAE,iCAAiC,EAExD;IAED;;OAEG;IACH,cAAc,CACZ,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,mBAAmB,GAAG,SAAS,EACtC,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAUpB;IAED;;OAEG;IACH,cAAc,CACZ,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,mBAAmB,GAAG,SAAS,EACtC,KAAK,EAAE,MAAM,GACZ,MAAM,CAQR;IAED;;;;;;OAMG;IACH,eAAe,CACb,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,mBAAmB,GAAG,SAAS,EACtC,KAAK,EAAE,MAAM,GACZ,OAAO,GAAG,SAAS,CAcrB;IAED;;;;;;;OAOG;IACH,kBAAkB,CAChB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,mBAAmB,GAAG,SAAS,EACtC,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAUpB;IAED;;OAEG;IACH,oBAAoB,CAClB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,SAAS,CAKX;IAED;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAI7D;IAED;;OAEG;IACH,OAAO,CAAC,MAAM;CAWf"}

package/dist/service/kms/cfn/sim-cfn-kms-property-parser.js

@@ -0,0 +1,95 @@
+/**
+ * Validates individual AWS::KMS::* CloudFormation property values, failing
+ * with a diagnostic naming the Resource type, the property and the logical ID.
+ *
+ * The Resource type is carried here because KMS creates two of them, and a
+ * message naming the wrong one would send a reader to the wrong template
+ * entry.
+ */
+export class SimCfnKmsPropertyParser {
+    resourceType;
+    constructor(properties) {
+        this.resourceType = properties.resourceType;
+    }
+    /**
+     * Parse a property value that must be a string when present.
+     */
+    optionalString(resource, value, label) {
+        if (value === undefined) {
+            return undefined;
+        }
+        if (typeof value !== "string") {
+            throw this.invalidPropertyError(resource, label, "a string");
+        }
+        return value;
+    }
+    /**
+     * Parse a property value that has to be there and has to be a string.
+     */
+    requiredString(resource, value, label) {
+        const parsed = this.optionalString(resource, value, label);
+        if (parsed === undefined) {
+            throw this.invalidPropertyError(resource, label, "a string");
+        }
+        return parsed;
+    }
+    /**
+     * Parse a property value that must be a boolean when present.
+     *
+     * CloudFormation carries template booleans as the strings "true" and "false"
+     * in places, so both forms are accepted, as CloudFormation itself accepts
+     * them.
+     */
+    optionalBoolean(resource, value, label) {
+        if (value === undefined) {
+            return undefined;
+        }
+        if (typeof value === "boolean") {
+            return value;
+        }
+        if (value === "true" || value === "false") {
+            return value === "true";
+        }
+        throw this.invalidPropertyError(resource, label, "a boolean");
+    }
+    /**
+     * Parse a policy document property, which CloudFormation carries as an
+     * object but which the KMS API takes as a JSON string.
+     *
+     * A string is passed through so a template that inlined the JSON itself
+     * still works, which is what CDK's `PolicyDocument.toJSON` output and a
+     * hand-written `!Sub` both end up producing.
+     */
+    optionalPolicyJson(resource, value, label) {
+        if (value === undefined) {
+            return undefined;
+        }
+        if (typeof value === "string") {
+            return value;
+        }
+        return JSON.stringify(this.record(resource, value, label));
+    }
+    /**
+     * Build the diagnostic error for a malformed property value.
+     */
+    invalidPropertyError(resource, label, expected) {
+        return new TypeError(`Invalid ${this.resourceType} ${resource.logicalId}: ` +
+            `${label} must be ${expected}`);
+    }
+    /**
+     * Build the diagnostic error for a Resource this simulator refuses.
+     */
+    propertyError(resource, reason) {
+        return new Error(`Invalid ${this.resourceType} Resource ${resource.logicalId}: ${reason}`);
+    }
+    /**
+     * Narrow a template value to an object, refusing anything else.
+     */
+    record(resource, value, label) {
+        if (typeof value !== "object" || value === null || Array.isArray(value)) {
+            throw this.invalidPropertyError(resource, label, "an object");
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=sim-cfn-kms-property-parser.js.map

package/dist/service/kms/cfn/sim-cfn-kms-property-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-kms-property-parser.js","sourceRoot":"","sources":["../../../../src/service/kms/cfn/sim-cfn-kms-property-parser.ts"],"names":[],"mappings":"AAUA;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IACjB,YAAY,CAAS;IAEtC,YAAY,UAA6C;QACvD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,QAAwB,EACxB,KAAsC,EACtC,KAAa;QAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,QAAwB,EACxB,KAAsC,EACtC,KAAa;QAEb,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAE3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CACb,QAAwB,EACxB,KAAsC,EACtC,KAAa;QAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YAC1C,OAAO,KAAK,KAAK,MAAM,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAChB,QAAwB,EACxB,KAAsC,EACtC,KAAa;QAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,oBAAoB,CAClB,QAAwB,EACxB,KAAa,EACb,QAAgB;QAEhB,OAAO,IAAI,SAAS,CAClB,WAAW,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,SAAS,IAAI;YACpD,GAAG,KAAK,YAAY,QAAQ,EAAE,CACjC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,QAAwB,EAAE,MAAc;QACpD,OAAO,IAAI,KAAK,CACd,WAAW,IAAI,CAAC,YAAY,aAAa,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CACzE,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CACZ,QAAwB,EACxB,KAA0B,EAC1B,KAAa;QAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/kms/cfn/sim-cfn-kms-resource-factory.d.ts

@@ -0,0 +1,23 @@
+import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
+import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimKms } from "../sim-kms.js";
+interface SimKmsCfnResourceFactoryProperties {
+    readonly kms: SimKms;
+}
+/**
+ * CloudFormation Resource factory for simulated KMS resources.
+ */
+export declare class SimKmsCfnResourceFactory implements SimCfnServiceResourceFactory {
+    private readonly keyCreator;
+    private readonly aliasCreator;
+    constructor(properties: SimKmsCfnResourceFactoryProperties);
+    /**
+     * Create a simulated KMS resource from a CloudFormation Resource.
+     *
+     * Grants and replica keys are not simulated, so their Resource types are
+     * reported as unsupported rather than quietly treated as deployed.
+     */
+    create(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceCreateContext): Promise<object | undefined>;
+}
+export {};
+//# sourceMappingURL=sim-cfn-kms-resource-factory.d.ts.map

package/dist/service/kms/cfn/sim-cfn-kms-resource-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-kms-resource-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/cfn/sim-cfn-kms-resource-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AAC3H,OAAO,KAAK,EACV,cAAc,EACd,sCAAsC,EACvC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAI5C,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,wBAAyB,YAAW,4BAA4B;IAC3E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwB;IAErD,YAAY,UAAU,EAAE,kCAAkC,EAGzD;IAED;;;;;OAKG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAgB7B;CACF"}

package/dist/service/kms/cfn/sim-cfn-kms-resource-factory.js

@@ -0,0 +1,34 @@
+import { SimCfnKmsAliasCreator } from "./alias/sim-cfn-kms-alias-creator.js";
+import { SimCfnKmsKeyCreator } from "./key/sim-cfn-kms-key-creator.js";
+/**
+ * CloudFormation Resource factory for simulated KMS resources.
+ */
+export class SimKmsCfnResourceFactory {
+    keyCreator;
+    aliasCreator;
+    constructor(properties) {
+        this.keyCreator = new SimCfnKmsKeyCreator({ kms: properties.kms });
+        this.aliasCreator = new SimCfnKmsAliasCreator({ kms: properties.kms });
+    }
+    /**
+     * Create a simulated KMS resource from a CloudFormation Resource.
+     *
+     * Grants and replica keys are not simulated, so their Resource types are
+     * reported as unsupported rather than quietly treated as deployed.
+     */
+    async create(resourceTypeName, resource, context) {
+        const properties = context.resolvedProperties ?? resource.properties;
+        switch (resourceTypeName) {
+            case "Key": {
+                return await this.keyCreator.create(resource, properties);
+            }
+            case "Alias": {
+                return await this.aliasCreator.create(resource, properties);
+            }
+            default: {
+                throw new Error(`Unsupported sim KMS CloudFormation Resource ${resourceTypeName}`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-cfn-kms-resource-factory.js.map

package/dist/service/kms/cfn/sim-cfn-kms-resource-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-kms-resource-factory.js","sourceRoot":"","sources":["../../../../src/service/kms/cfn/sim-cfn-kms-resource-factory.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAMvE;;GAEG;AACH,MAAM,OAAO,wBAAwB;IAClB,UAAU,CAAsB;IAChC,YAAY,CAAwB;IAErD,YAAY,UAA8C;QACxD,IAAI,CAAC,UAAU,GAAG,IAAI,mBAAmB,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CACV,gBAAwB,EACxB,QAAwB,EACxB,OAA+C;QAE/C,MAAM,UAAU,GAAG,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAAC;QAErE,QAAQ,gBAAgB,EAAE,CAAC;YACzB,KAAK,KAAK,EAAE,CAAC;gBACX,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC5D,CAAC;YACD,KAAK,OAAO,EAAE,CAAC;gBACb,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC9D,CAAC;YACD,SAAS,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,+CAA+C,gBAAgB,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/command/alias/alias.command.d.ts

@@ -0,0 +1,43 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+/**
+ * Minimal structural sim KMS CreateAlias command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/CreateAliasCommand/
+ */
+export interface SimCreateAliasCommand {
+    readonly input: SimCreateAliasCommandInput;
+}
+export interface SimCreateAliasCommandInput {
+    readonly AliasName?: string | undefined;
+    readonly TargetKeyId?: string | undefined;
+}
+export interface SimCreateAliasCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS ListAliases command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/ListAliasesCommand/
+ */
+export interface SimListAliasesCommand {
+    readonly input?: SimListAliasesCommandInput | undefined;
+}
+export interface SimListAliasesCommandInput {
+    /**
+     * Narrows the result to the aliases of one key. Real KMS returns every alias
+     * in the Region when this is omitted.
+     */
+    readonly KeyId?: string | undefined;
+    readonly Limit?: number | undefined;
+}
+export interface SimListAliasesCommandEntry {
+    readonly AliasName: string;
+    readonly AliasArn: string;
+    readonly TargetKeyId: string;
+}
+export interface SimListAliasesCommandOutput {
+    readonly Aliases?: readonly SimListAliasesCommandEntry[] | undefined;
+    readonly Truncated?: boolean | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=alias.command.d.ts.map

package/dist/service/kms/command/alias/alias.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/alias.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAE3F;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;CAC5C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACzD;AAED,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,0BAA0B,EAAE,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/kms/command/alias/alias.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=alias.command.js.map

package/dist/service/kms/command/alias/alias.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias.command.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/alias.command.ts"],"names":[],"mappings":""}

package/dist/service/kms/command/alias/sim-kms-alias-commands.d.ts

@@ -0,0 +1,34 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
+import type { SimCreateAliasCommand, SimCreateAliasCommandOutput, SimListAliasesCommand, SimListAliasesCommandOutput } from "./alias.command.js";
+interface SimKmsAliasCommandsProperties {
+    readonly keys: SimKmsKeyStore;
+    readonly authorizer: SimKmsAuthorizer;
+}
+interface SimKmsAliasCommandOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * The alias commands of one simulated KMS scope.
+ */
+export declare class SimKmsAliasCommands {
+    private readonly keys;
+    private readonly authorizer;
+    private readonly aliasName;
+    constructor(properties: SimKmsAliasCommandsProperties);
+    /**
+     * Point a new alias at a key.
+     *
+     * Real KMS checks kms:CreateAlias against both the alias and the target key.
+     * Only the key is checked here, because the key is what the alias gives
+     * access to and it is the half that carries a policy.
+     */
+    create(command: SimCreateAliasCommand, options?: SimKmsAliasCommandOptions): SimCreateAliasCommandOutput;
+    /**
+     * List aliases, optionally narrowed to one key's.
+     */
+    list(command: SimListAliasesCommand, options?: SimKmsAliasCommandOptions): SimListAliasesCommandOutput;
+}
+export {};
+//# sourceMappingURL=sim-kms-alias-commands.d.ts.map

package/dist/service/kms/command/alias/sim-kms-alias-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-alias-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/sim-kms-alias-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,oBAAoB,CAAC;AAE5B,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,UAAU,yBAAyB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IAEnD,YAAY,UAAU,EAAE,6BAA6B,EAGpD;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,yBAAyB,GAClC,2BAA2B,CAc7B;IAED;;OAEG;IACH,IAAI,CACF,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,yBAAyB,GAClC,2BAA2B,CAyB7B;CACF"}

package/dist/service/kms/command/alias/sim-kms-alias-commands.js

@@ -0,0 +1,56 @@
+import { SimKmsValidationException } from "../../error/sim-kms.error.js";
+import { SimKmsAliasName } from "../../key/sim-kms-alias.js";
+/**
+ * The alias commands of one simulated KMS scope.
+ */
+export class SimKmsAliasCommands {
+    keys;
+    authorizer;
+    aliasName = new SimKmsAliasName();
+    constructor(properties) {
+        this.keys = properties.keys;
+        this.authorizer = properties.authorizer;
+    }
+    /**
+     * Point a new alias at a key.
+     *
+     * Real KMS checks kms:CreateAlias against both the alias and the target key.
+     * Only the key is checked here, because the key is what the alias gives
+     * access to and it is the half that carries a policy.
+     */
+    create(command, options) {
+        const aliasName = command.input.AliasName;
+        if (aliasName === undefined) {
+            throw new SimKmsValidationException("AliasName is required");
+        }
+        this.aliasName.validateCustomerAlias(aliasName);
+        const key = this.keys.require(command.input.TargetKeyId);
+        this.authorizer.authorizeKey("kms:CreateAlias", key, options?.caller);
+        this.keys.addAlias(aliasName, key);
+        return { $metadata: {} };
+    }
+    /**
+     * List aliases, optionally narrowed to one key's.
+     */
+    list(command, options) {
+        this.authorizer.authorizeAccount("kms:ListAliases", options?.caller);
+        const keyId = command.input?.KeyId;
+        const aliases = this.keys
+            .aliasesFor(keyId === undefined ? undefined : this.keys.require(keyId).keyId)
+            .map((alias) => ({
+            AliasName: alias.aliasName,
+            AliasArn: alias.arn,
+            TargetKeyId: alias.targetKeyId,
+        }));
+        const limit = command.input?.Limit;
+        if (limit === undefined || aliases.length <= limit) {
+            return { $metadata: {}, Aliases: aliases, Truncated: false };
+        }
+        return {
+            $metadata: {},
+            Aliases: aliases.slice(0, limit),
+            Truncated: true,
+        };
+    }
+}
+//# sourceMappingURL=sim-kms-alias-commands.js.map

package/dist/service/kms/command/alias/sim-kms-alias-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-alias-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/alias/sim-kms-alias-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAmB7D;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACb,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IAEnD,YAAY,UAAyC;QACnD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAA8B,EAC9B,OAAmC;QAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAE1C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEnC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,CACF,OAA8B,EAC9B,OAAmC;QAEnC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAErE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI;aACtB,UAAU,CACT,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CACjE;aACA,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,GAAG;YACnB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC,CAAC;QAEN,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QAEnC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YACnD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;QAED,OAAO;YACL,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;YAChC,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;CACF"}

package/dist/service/kms/command/authorize/sim-kms-authorizer.d.ts

@@ -0,0 +1,38 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimKmsKey } from "../../key/sim-kms-key.js";
+interface SimKmsAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * Applies simulated IAM authorization to KMS requests.
+ *
+ * KMS splits into two kinds of request, and they authorize differently:
+ *
+ * - operations on an existing key, where the key policy is mandatory and must
+ *   allow the request, so an identity policy alone never reaches the key;
+ * - operations with no key to speak of, such as CreateKey and ListKeys, which
+ *   real KMS gives no resource-level permissions and so are authorized against
+ *   `*` with identity policies alone.
+ */
+export declare class SimKmsAuthorizer {
+    private readonly iam;
+    private readonly accountRegionScope;
+    constructor(properties: SimKmsAuthorizerProperties);
+    /**
+     * Ensure the caller may perform an action on a key.
+     *
+     * The key's policy is supplied as the resource side and is required to
+     * allow: this is the rule that makes a KMS key policy the root of trust for
+     * its key rather than one more input to the decision.
+     */
+    authorizeKey(action: string, key: SimKmsKey, caller?: SimAwsCaller): void;
+    /**
+     * Ensure the caller may perform an action that names no particular key.
+     */
+    authorizeAccount(action: string, caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=sim-kms-authorizer.d.ts.map

package/dist/service/kms/command/authorize/sim-kms-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/authorize/sim-kms-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEtG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,UAAU,0BAA0B;IAClC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAE9D,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAgBxE;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAY5D;CACF"}

package/dist/service/kms/command/authorize/sim-kms-authorizer.js

@@ -0,0 +1,58 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies simulated IAM authorization to KMS requests.
+ *
+ * KMS splits into two kinds of request, and they authorize differently:
+ *
+ * - operations on an existing key, where the key policy is mandatory and must
+ *   allow the request, so an identity policy alone never reaches the key;
+ * - operations with no key to speak of, such as CreateKey and ListKeys, which
+ *   real KMS gives no resource-level permissions and so are authorized against
+ *   `*` with identity policies alone.
+ */
+export class SimKmsAuthorizer {
+    iam;
+    accountRegionScope;
+    constructor(properties) {
+        this.iam = properties.iam;
+        this.accountRegionScope = properties.accountRegionScope;
+    }
+    /**
+     * Ensure the caller may perform an action on a key.
+     *
+     * The key's policy is supplied as the resource side and is required to
+     * allow: this is the rule that makes a KMS key policy the root of trust for
+     * its key rather than one more input to the decision.
+     */
+    authorizeKey(action, key, caller) {
+        const decision = this.iam.authorize({
+            action,
+            resource: key.arn,
+            caller,
+            resourcePolicies: [key.policy.asResourcePolicy()],
+            requiresResourcePolicyAllow: true,
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action,
+                resource: key.arn,
+            });
+        }
+    }
+    /**
+     * Ensure the caller may perform an action that names no particular key.
+     */
+    authorizeAccount(action, caller) {
+        const resource = `arn:aws:kms:${this.accountRegionScope.regionName}:${this.accountRegionScope.accountId}:key/*`;
+        const decision = this.iam.authorize({ action, resource, caller });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action,
+                resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-authorizer.js.map

package/dist/service/kms/command/authorize/sim-kms-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/authorize/sim-kms-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAQzE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gBAAgB;IACV,GAAG,CAA0B;IAC7B,kBAAkB,CAA2B;IAE9D,YAAY,UAAsC;QAChD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,MAAc,EAAE,GAAc,EAAE,MAAqB;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM;YACN,QAAQ,EAAE,GAAG,CAAC,GAAG;YACjB,MAAM;YACN,gBAAgB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACjD,2BAA2B,EAAE,IAAI;SAClC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ,EAAE,GAAG,CAAC,GAAG;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAc,EAAE,MAAqB;QACpD,MAAM,QAAQ,GAAG,eAAe,IAAI,CAAC,kBAAkB,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,QAAQ,CAAC;QAEhH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAElE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/kms/command/crypto/crypto.command.d.ts

@@ -0,0 +1,68 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimKmsEncryptionContext } from "../../key/sim-kms-encryption-context.js";
+/**
+ * Minimal structural sim KMS Encrypt command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/EncryptCommand/
+ */
+export interface SimEncryptCommand {
+    readonly input: SimEncryptCommandInput;
+}
+export interface SimEncryptCommandInput {
+    readonly KeyId?: string | undefined;
+    readonly Plaintext?: Uint8Array | undefined;
+    readonly EncryptionContext?: SimKmsEncryptionContext | undefined;
+    readonly EncryptionAlgorithm?: string | undefined;
+}
+export interface SimEncryptCommandOutput {
+    readonly CiphertextBlob?: Uint8Array | undefined;
+    readonly KeyId?: string | undefined;
+    readonly EncryptionAlgorithm?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS Decrypt command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/DecryptCommand/
+ */
+export interface SimDecryptCommand {
+    readonly input: SimDecryptCommandInput;
+}
+export interface SimDecryptCommandInput {
+    readonly CiphertextBlob?: Uint8Array | undefined;
+    /**
+     * Optional for a symmetric key, because the ciphertext names the key that
+     * produced it. Supplying it asks KMS to check that expectation, and the
+     * request fails if the ciphertext came from a different key.
+     */
+    readonly KeyId?: string | undefined;
+    readonly EncryptionContext?: SimKmsEncryptionContext | undefined;
+    readonly EncryptionAlgorithm?: string | undefined;
+}
+export interface SimDecryptCommandOutput {
+    readonly Plaintext?: Uint8Array | undefined;
+    readonly KeyId?: string | undefined;
+    readonly EncryptionAlgorithm?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS GenerateDataKey command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/GenerateDataKeyCommand/
+ */
+export interface SimGenerateDataKeyCommand {
+    readonly input: SimGenerateDataKeyCommandInput;
+}
+export interface SimGenerateDataKeyCommandInput {
+    readonly KeyId?: string | undefined;
+    readonly KeySpec?: string | undefined;
+    readonly NumberOfBytes?: number | undefined;
+    readonly EncryptionContext?: SimKmsEncryptionContext | undefined;
+}
+export interface SimGenerateDataKeyCommandOutput {
+    readonly CiphertextBlob?: Uint8Array | undefined;
+    readonly Plaintext?: Uint8Array | undefined;
+    readonly KeyId?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=crypto.command.d.ts.map

package/dist/service/kms/command/crypto/crypto.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/crypto.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAEvF;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAEjD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,8BAA8B,CAAC;CAChD;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;CAClE;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/kms/command/crypto/crypto.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=crypto.command.js.map

package/dist/service/kms/command/crypto/crypto.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.command.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/crypto.command.ts"],"names":[],"mappings":""}

package/dist/service/kms/command/crypto/sim-kms-ciphertext-key.d.ts

@@ -0,0 +1,40 @@
+import type { SimKmsKey } from "../../key/sim-kms-key.js";
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+/**
+ * The only encryption algorithm a symmetric KMS key supports.
+ */
+export declare const simKmsSymmetricAlgorithm = "SYMMETRIC_DEFAULT";
+/**
+ * Resolves the key behind a ciphertext, and checks the caller's expectations.
+ *
+ * Decrypt is the one KMS operation whose target key comes from the ciphertext
+ * rather than the request, so working out which key that is, and what to say
+ * when it is not the one the caller expected, is its own small job.
+ */
+export declare class SimKmsCiphertextKey {
+    private readonly keys;
+    constructor(keys: SimKmsKeyStore);
+    /**
+     * Find the key a ciphertext was produced under.
+     *
+     * A blob naming a key this scope does not have is an unreadable ciphertext
+     * rather than a missing key, because the caller never named the key and so
+     * cannot be told which one is missing.
+     */
+    behind(keyArn: string): SimKmsKey;
+    /**
+     * Check a supplied KeyId against the key the ciphertext actually names.
+     *
+     * A KeyId naming no key at all is a missing key rather than the wrong one,
+     * so it is resolved the same way every other operation resolves its target.
+     */
+    requireExpected(keyId: string | undefined, key: SimKmsKey): void;
+    /**
+     * Refuse an encryption algorithm this simulation does not model.
+     *
+     * Only symmetric keys are simulated, so an asymmetric algorithm is refused
+     * rather than quietly treated as the symmetric one.
+     */
+    requireSymmetricAlgorithm(algorithm: string | undefined): void;
+}
+//# sourceMappingURL=sim-kms-ciphertext-key.d.ts.map

package/dist/service/kms/command/crypto/sim-kms-ciphertext-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-ciphertext-key.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/crypto/sim-kms-ciphertext-key.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE;;GAEG;AACH,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAE5D;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IAEtC,YAAY,IAAI,EAAE,cAAc,EAE/B;IAED;;;;;;OAMG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAQhC;IAED;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,SAAS,GAAG,IAAI,CAU/D;IAED;;;;;OAKG;IACH,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAM7D;CACF"}