@kensio/yulin 1.12.0 → 1.13.0

package/dist/service/kms/command/sign/sign.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/sign/sign.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAE1C;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;CAC7C;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/kms/command/sign/sign.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sign.command.js.map

package/dist/service/kms/command/sign/sign.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.command.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/sign/sign.command.ts"],"names":[],"mappings":""}

package/dist/service/kms/command/sign/sim-kms-sign-commands.d.ts

@@ -0,0 +1,40 @@
+import type { SimKmsKeyStore } from "../../key/sim-kms-key-store.js";
+import type { SimKmsAuthorizer } from "../authorize/sim-kms-authorizer.js";
+import type { SimKmsRequestOptions } from "../sim-kms-request-options.js";
+import type { SimGetPublicKeyCommand, SimGetPublicKeyCommandOutput, SimSignCommand, SimSignCommandOutput, SimVerifyCommand, SimVerifyCommandOutput } from "./sign.command.js";
+interface SimKmsSignCommandsProperties {
+    readonly keys: SimKmsKeyStore;
+    readonly authorizer: SimKmsAuthorizer;
+}
+/**
+ * The Sign, Verify and GetPublicKey commands of one simulated KMS scope.
+ *
+ * The three go together: they are the operations an asymmetric signing key
+ * answers, they share the key store and the authorizer, and each of them has
+ * to refuse a key whose usage is not SIGN_VERIFY.
+ */
+export declare class SimKmsSignCommands {
+    private readonly keys;
+    private readonly authorizer;
+    private readonly message;
+    constructor(properties: SimKmsSignCommandsProperties);
+    /**
+     * Sign a message under a key.
+     */
+    sign(command: SimSignCommand, options?: SimKmsRequestOptions): SimSignCommandOutput;
+    /**
+     * Check a signature against a message and a key.
+     *
+     * A signature that does not check out fails rather than returning false.
+     * That is what real KMS does, so a caller that only handles the exception is
+     * not left believing an unverified signature was good.
+     */
+    verify(command: SimVerifyCommand, options?: SimKmsRequestOptions): SimVerifyCommandOutput;
+    /**
+     * Get a key's public key.
+     */
+    getPublicKey(command: SimGetPublicKeyCommand, options?: SimKmsRequestOptions): SimGetPublicKeyCommandOutput;
+    private authorizedKey;
+}
+export {};
+//# sourceMappingURL=sim-kms-sign-commands.d.ts.map

package/dist/service/kms/command/sign/sim-kms-sign-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-sign-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/sign/sim-kms-sign-commands.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,mBAAmB,CAAC;AAE3B,UAAU,4BAA4B;IACpC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IAErD,YAAY,UAAU,EAAE,4BAA4B,EAGnD;IAED;;OAEG;IACH,IAAI,CACF,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,oBAAoB,CAgBtB;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,sBAAsB,CAuBxB;IAED;;OAEG;IACH,YAAY,CACV,OAAO,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,4BAA4B,CAiB9B;IAED,OAAO,CAAC,aAAa;CAUtB"}

package/dist/service/kms/command/sign/sim-kms-sign-commands.js

@@ -0,0 +1,76 @@
+import { SimKmsInvalidSignatureException } from "../../error/sim-kms.error.js";
+import { SimKmsSignedMessage } from "./sim-kms-signed-message.js";
+/**
+ * The Sign, Verify and GetPublicKey commands of one simulated KMS scope.
+ *
+ * The three go together: they are the operations an asymmetric signing key
+ * answers, they share the key store and the authorizer, and each of them has
+ * to refuse a key whose usage is not SIGN_VERIFY.
+ */
+export class SimKmsSignCommands {
+    keys;
+    authorizer;
+    message = new SimKmsSignedMessage();
+    constructor(properties) {
+        this.keys = properties.keys;
+        this.authorizer = properties.authorizer;
+    }
+    /**
+     * Sign a message under a key.
+     */
+    sign(command, options) {
+        const message = this.message.require(command.input.Message, command.input.MessageType);
+        const key = this.authorizedKey("kms:Sign", command.input.KeyId, options);
+        const algorithm = key.keySpec.requireSigningAlgorithm(command.input.SigningAlgorithm);
+        return {
+            $metadata: {},
+            KeyId: key.arn,
+            Signature: key.sign(message, algorithm),
+            SigningAlgorithm: algorithm.name,
+        };
+    }
+    /**
+     * Check a signature against a message and a key.
+     *
+     * A signature that does not check out fails rather than returning false.
+     * That is what real KMS does, so a caller that only handles the exception is
+     * not left believing an unverified signature was good.
+     */
+    verify(command, options) {
+        const message = this.message.require(command.input.Message, command.input.MessageType);
+        const key = this.authorizedKey("kms:Verify", command.input.KeyId, options);
+        const algorithm = key.keySpec.requireSigningAlgorithm(command.input.SigningAlgorithm);
+        const signature = this.message.requireSignature(command.input.Signature);
+        if (!key.verify(message, signature, algorithm)) {
+            throw new SimKmsInvalidSignatureException(`The signature was not verified by key ${key.arn} under ${algorithm.name}`);
+        }
+        return {
+            $metadata: {},
+            KeyId: key.arn,
+            SignatureValid: true,
+            SigningAlgorithm: algorithm.name,
+        };
+    }
+    /**
+     * Get a key's public key.
+     */
+    getPublicKey(command, options) {
+        const key = this.authorizedKey("kms:GetPublicKey", command.input.KeyId, options);
+        const keySpec = key.keySpec;
+        return {
+            $metadata: {},
+            KeyId: key.arn,
+            PublicKey: key.publicKeyDer(),
+            KeySpec: keySpec.name,
+            CustomerMasterKeySpec: keySpec.name,
+            KeyUsage: keySpec.keyUsage,
+            SigningAlgorithms: keySpec.signingAlgorithmNames(),
+        };
+    }
+    authorizedKey(action, keyId, options) {
+        const key = this.keys.require(keyId);
+        this.authorizer.authorizeKey(action, key, options);
+        return key;
+    }
+}
+//# sourceMappingURL=sim-kms-sign-commands.js.map

package/dist/service/kms/command/sign/sim-kms-sign-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-sign-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/sign/sim-kms-sign-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AAK/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAelE;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACZ,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,OAAO,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAErD,YAAY,UAAwC;QAClD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,IAAI,CACF,OAAuB,EACvB,OAA8B;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAClC,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,OAAO,CAAC,KAAK,CAAC,WAAW,CAC1B,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,uBAAuB,CACnD,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAC/B,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,GAAG,CAAC,GAAG;YACd,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;YACvC,gBAAgB,EAAE,SAAS,CAAC,IAAI;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAAyB,EACzB,OAA8B;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAClC,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,OAAO,CAAC,KAAK,CAAC,WAAW,CAC1B,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,uBAAuB,CACnD,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAC/B,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEzE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,+BAA+B,CACvC,yCAAyC,GAAG,CAAC,GAAG,UAAU,SAAS,CAAC,IAAI,EAAE,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,GAAG,CAAC,GAAG;YACd,cAAc,EAAE,IAAI;YACpB,gBAAgB,EAAE,SAAS,CAAC,IAAI;SACjC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,YAAY,CACV,OAA+B,EAC/B,OAA8B;QAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAC5B,kBAAkB,EAClB,OAAO,CAAC,KAAK,CAAC,KAAK,EACnB,OAAO,CACR,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAE5B,OAAO;YACL,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,GAAG,CAAC,GAAG;YACd,SAAS,EAAE,GAAG,CAAC,YAAY,EAAE;YAC7B,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,qBAAqB,EAAE,OAAO,CAAC,IAAI;YACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,iBAAiB,EAAE,OAAO,CAAC,qBAAqB,EAAE;SACnD,CAAC;IACJ,CAAC;IAEO,aAAa,CACnB,MAAc,EACd,KAAyB,EACzB,OAAyC;QAEzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAEnD,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/service/kms/command/sign/sim-kms-signed-message.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Reads the message a Sign or Verify request carries.
+ *
+ * `MessageType: DIGEST` is refused rather than answered. Node has no way to
+ * sign a digest that has already been computed: `crypto.sign` with no
+ * algorithm hashes what it is given rather than signing it, so the signature
+ * would not be the one real KMS makes and would not verify against the message
+ * anywhere outside this simulation. A wrong signature that passes here is the
+ * worst outcome available, so this fails closed.
+ */
+export declare class SimKmsSignedMessage {
+    /**
+     * The message bytes to sign or verify.
+     */
+    require(message: Uint8Array | undefined, messageType: string | undefined): Uint8Array;
+    /**
+     * The signature bytes to check.
+     *
+     * A missing signature is a request AWS refuses before it does any
+     * cryptography, so it fails as validation here rather than as a signature
+     * that did not verify. The two mean different things to a caller.
+     */
+    requireSignature(signature: Uint8Array | undefined): Uint8Array;
+    private requireRawMessageType;
+}
+//# sourceMappingURL=sim-kms-signed-message.d.ts.map

package/dist/service/kms/command/sign/sim-kms-signed-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-signed-message.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/sign/sim-kms-signed-message.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;GASG;AACH,qBAAa,mBAAmB;IAC9B;;OAEG;IACH,OAAO,CACL,OAAO,EAAE,UAAU,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,UAAU,CAcZ;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,SAAS,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,CAY9D;IAED,OAAO,CAAC,qBAAqB;CAS9B"}

package/dist/service/kms/command/sign/sim-kms-signed-message.js

@@ -0,0 +1,62 @@
+import { SimKmsValidationException } from "../../error/sim-kms.error.js";
+const rawMessageType = "RAW";
+/**
+ * The largest message Sign and Verify accept.
+ *
+ * Real KMS takes 4096 bytes for a RAW message, which is the limit that pushes
+ * a caller signing something larger towards hashing it first.
+ */
+const maxMessageBytes = 4096;
+/**
+ * The largest signature Verify accepts, which is what an RSA_4096 signature
+ * needs room for.
+ */
+const maxSignatureBytes = 6144;
+/**
+ * Reads the message a Sign or Verify request carries.
+ *
+ * `MessageType: DIGEST` is refused rather than answered. Node has no way to
+ * sign a digest that has already been computed: `crypto.sign` with no
+ * algorithm hashes what it is given rather than signing it, so the signature
+ * would not be the one real KMS makes and would not verify against the message
+ * anywhere outside this simulation. A wrong signature that passes here is the
+ * worst outcome available, so this fails closed.
+ */
+export class SimKmsSignedMessage {
+    /**
+     * The message bytes to sign or verify.
+     */
+    require(message, messageType) {
+        this.requireRawMessageType(messageType);
+        if (message === undefined || message.length === 0) {
+            throw new SimKmsValidationException("Message is required");
+        }
+        if (message.length > maxMessageBytes) {
+            throw new SimKmsValidationException(`Message of ${String(message.length)} bytes exceeds the ${String(maxMessageBytes)} byte limit`);
+        }
+        return message;
+    }
+    /**
+     * The signature bytes to check.
+     *
+     * A missing signature is a request AWS refuses before it does any
+     * cryptography, so it fails as validation here rather than as a signature
+     * that did not verify. The two mean different things to a caller.
+     */
+    requireSignature(signature) {
+        if (signature === undefined || signature.length === 0) {
+            throw new SimKmsValidationException("Signature is required");
+        }
+        if (signature.length > maxSignatureBytes) {
+            throw new SimKmsValidationException(`Signature of ${String(signature.length)} bytes exceeds the ${String(maxSignatureBytes)} byte limit`);
+        }
+        return signature;
+    }
+    requireRawMessageType(messageType) {
+        if (messageType === undefined || messageType === rawMessageType) {
+            return;
+        }
+        throw new SimKmsValidationException(`MessageType '${messageType}' is not simulated: simulated KMS signs ${rawMessageType} messages, and hashes them itself`);
+    }
+}
+//# sourceMappingURL=sim-kms-signed-message.js.map

package/dist/service/kms/command/sign/sim-kms-signed-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-signed-message.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/sign/sim-kms-signed-message.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAEzE,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B;;;;;;;;;GASG;AACH,MAAM,OAAO,mBAAmB;IAC9B;;OAEG;IACH,OAAO,CACL,OAA+B,EAC/B,WAA+B;QAE/B,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAExC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACrC,MAAM,IAAI,yBAAyB,CACjC,cAAc,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,MAAM,CAAC,eAAe,CAAC,aAAa,CAC/F,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,SAAiC;QAChD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACzC,MAAM,IAAI,yBAAyB,CACjC,gBAAgB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,sBAAsB,MAAM,CAAC,iBAAiB,CAAC,aAAa,CACrG,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,qBAAqB,CAAC,WAA+B;QAC3D,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;YAChE,OAAO;QACT,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,gBAAgB,WAAW,2CAA2C,cAAc,mCAAmC,CACxH,CAAC;IACJ,CAAC;CACF"}

package/dist/service/kms/command/sim-kms-command.types.d.ts

@@ -7,4 +7,5 @@
 export type { SimCreateAliasCommand, SimCreateAliasCommandOutput, SimDeleteAliasCommand, SimDeleteAliasCommandOutput, SimListAliasesCommand, SimListAliasesCommandOutput, } from "./alias/alias.command.js";
 export type { SimDecryptCommand, SimDecryptCommandOutput, SimEncryptCommand, SimEncryptCommandOutput, SimGenerateDataKeyCommand, SimGenerateDataKeyCommandOutput, } from "./crypto/crypto.command.js";
 export type { SimCancelKeyDeletionCommand, SimCancelKeyDeletionCommandOutput, SimCreateKeyCommand, SimCreateKeyCommandOutput, SimDescribeKeyCommand, SimDescribeKeyCommandOutput, SimDisableKeyCommand, SimDisableKeyCommandOutput, SimEnableKeyCommand, SimEnableKeyCommandOutput, SimGetKeyPolicyCommand, SimGetKeyPolicyCommandOutput, SimListKeysCommand, SimListKeysCommandOutput, SimPutKeyPolicyCommand, SimPutKeyPolicyCommandOutput, SimScheduleKeyDeletionCommand, SimScheduleKeyDeletionCommandOutput, } from "./key/key.command.js";
+export type { SimGetPublicKeyCommand, SimGetPublicKeyCommandOutput, SimSignCommand, SimSignCommandOutput, SimVerifyCommand, SimVerifyCommandOutput, } from "./sign/sign.command.js";
 //# sourceMappingURL=sim-kms-command.types.d.ts.map

package/dist/service/kms/command/sim-kms-command.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-command.types.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/command/sim-kms-command.types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,YAAY,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,2BAA2B,EAC3B,iCAAiC,EACjC,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,4BAA4B,EAC5B,6BAA6B,EAC7B,mCAAmC,GACpC,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"sim-kms-command.types.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/command/sim-kms-command.types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,YAAY,EACV,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,2BAA2B,EAC3B,iCAAiC,EACjC,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,4BAA4B,EAC5B,6BAA6B,EAC7B,mCAAmC,GACpC,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC"}

package/dist/service/kms/error/sim-kms.error.d.ts

@@ -85,4 +85,26 @@ export declare class SimKmsInvalidKeyUsageException extends SimKmsError {
     readonly name = "InvalidKeyUsageException";
     constructor(message: string);
 }
+/**
+ * Simulated KMS UnsupportedOperationException error.
+ *
+ * Real KMS keeps this apart from InvalidKeyUsageException, and GetPublicKey is
+ * where the difference shows: a symmetric key has no public key to hand out at
+ * all, rather than having one it is not allowed to use for the operation.
+ */
+export declare class SimKmsUnsupportedOperationException extends SimKmsError {
+    readonly name = "UnsupportedOperationException";
+    constructor(message: string);
+}
+/**
+ * Simulated KMS KMSInvalidSignatureException error.
+ *
+ * Verify reports a signature that does not check out by failing rather than by
+ * returning SignatureValid false, which is what real KMS does and what code
+ * written against it handles.
+ */
+export declare class SimKmsInvalidSignatureException extends SimKmsError {
+    readonly name = "KMSInvalidSignatureException";
+    constructor(message: string);
+}
 //# sourceMappingURL=sim-kms.error.d.ts.map

package/dist/service/kms/error/sim-kms.error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms.error.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/error/sim-kms.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAGlB,SAAS,EAAE,mBAAmB;IAFhD,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,mBAAwB,EAGpD;CACF;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,WAAW;IACtD,SAAyB,IAAI,uBAAuB;IAEpD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,WAAW;IAC3D,SAAyB,IAAI,4BAA4B;IAEzD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,WAAW;IACtD,SAAyB,IAAI,uBAAuB;IAEpD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,WAAW;IAC1D,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,gCAAiC,SAAQ,WAAW;IAC/D,SAAyB,IAAI,gCAAgC;IAE7D,YAAY,OAAO,SAAuD,EAEzE;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,2BAA4B,SAAQ,WAAW;IAC1D,SAAyB,IAAI,2BAA2B;IAExD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,WAAW;IACxD,SAAyB,IAAI,yBAAyB;IAEtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,8BAA+B,SAAQ,WAAW;IAC7D,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}
+{"version":3,"file":"sim-kms.error.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/error/sim-kms.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAGlB,SAAS,EAAE,mBAAmB;IAFhD,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,mBAAwB,EAGpD;CACF;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,WAAW;IACtD,SAAyB,IAAI,uBAAuB;IAEpD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,WAAW;IAC3D,SAAyB,IAAI,4BAA4B;IAEzD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,WAAW;IACtD,SAAyB,IAAI,uBAAuB;IAEpD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,WAAW;IAC1D,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,gCAAiC,SAAQ,WAAW;IAC/D,SAAyB,IAAI,gCAAgC;IAE7D,YAAY,OAAO,SAAuD,EAEzE;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,2BAA4B,SAAQ,WAAW;IAC1D,SAAyB,IAAI,2BAA2B;IAExD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,WAAW;IACxD,SAAyB,IAAI,yBAAyB;IAEtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,8BAA+B,SAAQ,WAAW;IAC7D,SAAyB,IAAI,8BAA8B;IAE3D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,mCAAoC,SAAQ,WAAW;IAClE,SAAyB,IAAI,mCAAmC;IAEhE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,+BAAgC,SAAQ,WAAW;IAC9D,SAAyB,IAAI,kCAAkC;IAE/D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}

package/dist/service/kms/error/sim-kms.error.js

@@ -98,4 +98,30 @@ export class SimKmsInvalidKeyUsageException extends SimKmsError {
         super(message, { httpStatusCode: 400 });
     }
 }
+/**
+ * Simulated KMS UnsupportedOperationException error.
+ *
+ * Real KMS keeps this apart from InvalidKeyUsageException, and GetPublicKey is
+ * where the difference shows: a symmetric key has no public key to hand out at
+ * all, rather than having one it is not allowed to use for the operation.
+ */
+export class SimKmsUnsupportedOperationException extends SimKmsError {
+    name = "UnsupportedOperationException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated KMS KMSInvalidSignatureException error.
+ *
+ * Verify reports a signature that does not check out by failing rather than by
+ * returning SignatureValid false, which is what real KMS does and what code
+ * written against it handles.
+ */
+export class SimKmsInvalidSignatureException extends SimKmsError {
+    name = "KMSInvalidSignatureException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
 //# sourceMappingURL=sim-kms.error.js.map

package/dist/service/kms/error/sim-kms.error.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms.error.js","sourceRoot":"","sources":["../../../../src/service/kms/error/sim-kms.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAAwB,EAAE;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IAC7B,IAAI,GAAG,mBAAmB,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,WAAW;IAClC,IAAI,GAAG,wBAAwB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IAC7B,IAAI,GAAG,mBAAmB,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,2BAA4B,SAAQ,WAAW;IACjC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,gCAAiC,SAAQ,WAAW;IACtC,IAAI,GAAG,4BAA4B,CAAC;IAE7D,YAAY,OAAO,GAAG,oDAAoD;QACxE,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA4B,SAAQ,WAAW;IACjC,IAAI,GAAG,uBAAuB,CAAC;IAExD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,WAAW;IAC/B,IAAI,GAAG,qBAAqB,CAAC;IAEtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,8BAA+B,SAAQ,WAAW;IACpC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"sim-kms.error.js","sourceRoot":"","sources":["../../../../src/service/kms/error/sim-kms.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAAwB,EAAE;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IAC7B,IAAI,GAAG,mBAAmB,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,4BAA6B,SAAQ,WAAW;IAClC,IAAI,GAAG,wBAAwB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IAC7B,IAAI,GAAG,mBAAmB,CAAC;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,2BAA4B,SAAQ,WAAW;IACjC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,gCAAiC,SAAQ,WAAW;IACtC,IAAI,GAAG,4BAA4B,CAAC;IAE7D,YAAY,OAAO,GAAG,oDAAoD;QACxE,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA4B,SAAQ,WAAW;IACjC,IAAI,GAAG,uBAAuB,CAAC;IAExD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,WAAW;IAC/B,IAAI,GAAG,qBAAqB,CAAC;IAEtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,8BAA+B,SAAQ,WAAW;IACpC,IAAI,GAAG,0BAA0B,CAAC;IAE3D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,mCAAoC,SAAQ,WAAW;IACzC,IAAI,GAAG,+BAA+B,CAAC;IAEhE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,+BAAgC,SAAQ,WAAW;IACrC,IAAI,GAAG,8BAA8B,CAAC;IAE/D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/kms/index.d.ts

@@ -5,5 +5,7 @@ export { SimKmsAlias } from "./key/sim-kms-alias.js";
 export { SimKmsKeyPolicy } from "./key/sim-kms-key-policy.js";
 export type { SimKmsEncryptionContext } from "./key/sim-kms-encryption-context.js";
 export type { SimKmsKeyMetadata } from "./key/sim-kms-key-metadata.js";
-export { SimKmsAlreadyExistsException, SimKmsDisabledException, SimKmsError, SimKmsIncorrectKeyException, SimKmsInvalidCiphertextException, SimKmsInvalidKeyUsageException, SimKmsInvalidStateException, SimKmsNotFoundException, SimKmsValidationException, } from "./error/sim-kms.error.js";
+export { SimKmsKeySpec, SimKmsKeyUsage } from "./key/spec/sim-kms-key-spec.js";
+export { simKmsKeySpecs } from "./key/spec/sim-kms-key-specs.js";
+export { SimKmsAlreadyExistsException, SimKmsDisabledException, SimKmsError, SimKmsIncorrectKeyException, SimKmsInvalidCiphertextException, SimKmsInvalidKeyUsageException, SimKmsInvalidSignatureException, SimKmsInvalidStateException, SimKmsNotFoundException, SimKmsUnsupportedOperationException, SimKmsValidationException, } from "./error/sim-kms.error.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/service/kms/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/kms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,KAAK,WAAW,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,YAAY,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/kms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,KAAK,WAAW,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,YAAY,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,EAC9B,+BAA+B,EAC/B,2BAA2B,EAC3B,uBAAuB,EACvB,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/service/kms/index.js

@@ -2,5 +2,7 @@ export { SimKms } from "./sim-kms.js";
 export { SimKmsKey, SimKmsKeyManager, SimKmsKeyState, } from "./key/sim-kms-key.js";
 export { SimKmsAlias } from "./key/sim-kms-alias.js";
 export { SimKmsKeyPolicy } from "./key/sim-kms-key-policy.js";
-export { SimKmsAlreadyExistsException, SimKmsDisabledException, SimKmsError, SimKmsIncorrectKeyException, SimKmsInvalidCiphertextException, SimKmsInvalidKeyUsageException, SimKmsInvalidStateException, SimKmsNotFoundException, SimKmsValidationException, } from "./error/sim-kms.error.js";
+export { SimKmsKeySpec, SimKmsKeyUsage } from "./key/spec/sim-kms-key-spec.js";
+export { simKmsKeySpecs } from "./key/spec/sim-kms-key-specs.js";
+export { SimKmsAlreadyExistsException, SimKmsDisabledException, SimKmsError, SimKmsIncorrectKeyException, SimKmsInvalidCiphertextException, SimKmsInvalidKeyUsageException, SimKmsInvalidSignatureException, SimKmsInvalidStateException, SimKmsNotFoundException, SimKmsUnsupportedOperationException, SimKmsValidationException, } from "./error/sim-kms.error.js";
 //# sourceMappingURL=index.js.map

package/dist/service/kms/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/kms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,cAAc,GAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/kms/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,cAAc,GAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,WAAW,EACX,2BAA2B,EAC3B,gCAAgC,EAChC,8BAA8B,EAC9B,+BAA+B,EAC/B,2BAA2B,EAC3B,uBAAuB,EACvB,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/service/kms/key/sim-kms-key-factory.d.ts

@@ -2,6 +2,7 @@ import type { SimClock } from "../../../util/clock/sim-clock.js";
 import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
 import type { SimIamPolicyDocument } from "../../iam/policy/sim-iam-policy.js";
 import { SimKmsKey } from "./sim-kms-key.js";
+import type { SimKmsKeySpec } from "./spec/sim-kms-key-spec.js";
 interface SimKmsKeyFactoryProperties {
     readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly clock: SimClock;
@@ -9,6 +10,11 @@ interface SimKmsKeyFactoryProperties {
 interface SimKmsMakeKeyProperties {
     readonly description?: string | undefined;
     readonly policy?: SimIamPolicyDocument | undefined;
+    /**
+     * The spec the key is made to. Omitting it gets a symmetric encryption key,
+     * which is what CreateKey gives a request naming no KeySpec.
+     */
+    readonly keySpec?: SimKmsKeySpec | undefined;
     /**
      * The service an AWS managed key belongs to, such as `ssm`.
      *

package/dist/service/kms/key/sim-kms-key-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-factory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,EAAE,SAAS,EAAoB,MAAM,kBAAkB,CAAC;AAK/D,UAAU,0BAA0B;IAClC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAEnD;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;IAEnD,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;;;;OAKG;IACH,IAAI,CAAC,UAAU,GAAE,uBAA4B,GAAG,SAAS,CAaxD;IAED;;OAEG;IACH,OAAO,CAAC,UAAU;IAUlB;;;OAGG;IACH,OAAO,CAAC,SAAS;CAuBlB"}
+{"version":3,"file":"sim-kms-key-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-factory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,EAAE,SAAS,EAAoB,MAAM,kBAAkB,CAAC;AAI/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAGhE,UAAU,0BAA0B;IAClC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAEnD;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAE7C;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;IAEnD,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;;;;OAKG;IACH,IAAI,CAAC,UAAU,GAAE,uBAA4B,GAAG,SAAS,CAiBxD;IAED;;OAEG;IACH,OAAO,CAAC,UAAU;IAUlB;;;OAGG;IACH,OAAO,CAAC,SAAS;CAuBlB"}

package/dist/service/kms/key/sim-kms-key-factory.js

@@ -1,9 +1,10 @@
 import { randomUUID } from "node:crypto";
 import { SimKmsCiphertextBlob } from "./sim-kms-ciphertext-blob.js";
 import { SimKmsKey, SimKmsKeyManager } from "./sim-kms-key.js";
-import { SimKmsKeyMaterial } from "./sim-kms-key-material.js";
+import { makeSimKmsKeyMaterial } from "./sim-kms-key-material-factory.js";
 import { SimKmsKeyPolicy } from "./sim-kms-key-policy.js";
 import { SimKmsViaService } from "./sim-kms-via-service.js";
+import { simKmsSymmetricKeySpec } from "./spec/sim-kms-key-specs.js";
 /**
  * Builds simulated KMS keys, including their key material.
  *
@@ -31,7 +32,11 @@ export class SimKmsKeyFactory {
         return new SimKmsKey({
             keyId,
             accountRegionScope: this.accountRegionScope,
-            material: new SimKmsKeyMaterial({ keyArn: arn, blob: this.blob }),
+            material: makeSimKmsKeyMaterial({
+                keyArn: arn,
+                keySpec: properties.keySpec ?? simKmsSymmetricKeySpec,
+                blob: this.blob,
+            }),
             policy: this.keyPolicy(arn, properties),
             creationDate: this.clock.now(),
             description: properties.description,

package/dist/service/kms/key/sim-kms-key-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-factory.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAqB5D;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IACV,kBAAkB,CAA2B;IAC7C,KAAK,CAAW;IAChB,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAEnD,YAAY,UAAsC;QAChD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,UAAU,GAA4B,EAAE;QAC3C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,eAAe,IAAI,CAAC,kBAAkB,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,QAAQ,KAAK,EAAE,CAAC;QAElH,OAAO,IAAI,SAAS,CAAC;YACnB,KAAK;YACL,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC;YACvC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,UAAU,CAChB,UAAmC;QAEnC,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,gBAAgB,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACK,SAAS,CACf,MAAc,EACd,UAAmC;QAEnC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC;QAEpD,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,OAAO,eAAe,CAAC,UAAU,CAC/B,MAAM,EACN,SAAS,EACT,IAAI,gBAAgB,CAClB,UAAU,CAAC,iBAAiB,EAC5B,IAAI,CAAC,kBAAkB,CAAC,UAAU,CACnC,CACF,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;CACF"}
+{"version":3,"file":"sim-kms-key-factory.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AA2BrE;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IACV,kBAAkB,CAA2B;IAC7C,KAAK,CAAW;IAChB,IAAI,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAEnD,YAAY,UAAsC;QAChD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,UAAU,GAA4B,EAAE;QAC3C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,eAAe,IAAI,CAAC,kBAAkB,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,QAAQ,KAAK,EAAE,CAAC;QAElH,OAAO,IAAI,SAAS,CAAC;YACnB,KAAK;YACL,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,qBAAqB,CAAC;gBAC9B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,sBAAsB;gBACrD,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC;YACF,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC;YACvC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,UAAU,CAChB,UAAmC;QAEnC,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,gBAAgB,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACK,SAAS,CACf,MAAc,EACd,UAAmC;QAEnC,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC;QAEpD,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,OAAO,eAAe,CAAC,UAAU,CAC/B,MAAM,EACN,SAAS,EACT,IAAI,gBAAgB,CAClB,UAAU,CAAC,iBAAiB,EAC5B,IAAI,CAAC,kBAAkB,CAAC,UAAU,CACnC,CACF,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-material-factory.d.ts

@@ -0,0 +1,18 @@
+import type { SimKmsCiphertextBlob } from "./sim-kms-ciphertext-blob.js";
+import type { SimKmsKeyMaterial } from "./sim-kms-key-material.js";
+import type { SimKmsKeySpec } from "./spec/sim-kms-key-spec.js";
+interface SimKmsMakeKeyMaterialProperties {
+    readonly keyArn: string;
+    readonly keySpec: SimKmsKeySpec;
+    readonly blob: SimKmsCiphertextBlob;
+}
+/**
+ * Make the key material a key spec calls for: an AES key or a key pair.
+ *
+ * Which of the two a spec means is the only thing the key factory would have
+ * to know about key material, so it lives here instead and the factory stays
+ * about assembling a key.
+ */
+export declare function makeSimKmsKeyMaterial(properties: SimKmsMakeKeyMaterialProperties): SimKmsKeyMaterial;
+export {};
+//# sourceMappingURL=sim-kms-key-material-factory.d.ts.map

package/dist/service/kms/key/sim-kms-key-material-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-material-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-material-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAGnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,UAAU,+BAA+B;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,+BAA+B,GAC1C,iBAAiB,CAYnB"}

package/dist/service/kms/key/sim-kms-key-material-factory.js

@@ -0,0 +1,21 @@
+import { SimKmsSigningKeyMaterial } from "./sim-kms-signing-key-material.js";
+import { SimKmsSymmetricKeyMaterial } from "./sim-kms-symmetric-key-material.js";
+/**
+ * Make the key material a key spec calls for: an AES key or a key pair.
+ *
+ * Which of the two a spec means is the only thing the key factory would have
+ * to know about key material, so it lives here instead and the factory stays
+ * about assembling a key.
+ */
+export function makeSimKmsKeyMaterial(properties) {
+    const { keyArn, keySpec } = properties;
+    if (keySpec.isAsymmetric) {
+        return new SimKmsSigningKeyMaterial({ keyArn, keySpec });
+    }
+    return new SimKmsSymmetricKeyMaterial({
+        keyArn,
+        keySpec,
+        blob: properties.blob,
+    });
+}
+//# sourceMappingURL=sim-kms-key-material-factory.js.map

package/dist/service/kms/key/sim-kms-key-material-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-material-factory.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-material-factory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AASjF;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAA2C;IAE3C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC;IAEvC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,IAAI,wBAAwB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,IAAI,0BAA0B,CAAC;QACpC,MAAM;QACN,OAAO;QACP,IAAI,EAAE,UAAU,CAAC,IAAI;KACtB,CAAC,CAAC;AACL,CAAC"}

package/dist/service/kms/key/sim-kms-key-material.d.ts

@@ -1,36 +1,56 @@
-import { SimKmsCiphertextBlobParts, type SimKmsCiphertextBlob } from "./sim-kms-ciphertext-blob.js";
-import { type SimKmsEncryptionContext } from "./sim-kms-encryption-context.js";
+import type { SimKmsSigningAlgorithm } from "./spec/sim-kms-signing-algorithm.js";
+import type { SimKmsKeySpec } from "./spec/sim-kms-key-spec.js";
+import type { SimKmsCiphertextBlobParts } from "./sim-kms-ciphertext-blob.js";
+import type { SimKmsEncryptionContext } from "./sim-kms-encryption-context.js";
 interface SimKmsKeyMaterialProperties {
     readonly keyArn: string;
-    readonly blob: SimKmsCiphertextBlob;
-    readonly bytes?: Uint8Array | undefined;
+    readonly keySpec: SimKmsKeySpec;
 }
 /**
  * The key material of one simulated KMS key, and the operations that use it.
  *
- * The bytes are generated here and never leave: nothing exposes them, exactly
- * as real key material never leaves KMS. That is a modelling choice rather
- * than a security boundary, since this all runs in one process and anything
- * sharing that process can reach the object.
+ * The bytes are generated in the subclass and never leave, exactly as real key
+ * material never leaves KMS. That is a modelling choice rather than a security
+ * boundary, since this all runs in one process and anything sharing that
+ * process can reach the object.
+ *
+ * Every operation is declared here and refused by default, because that is how
+ * AWS answers one: an `Encrypt` against a signing key is not an unknown
+ * operation, it is `InvalidKeyUsageException` on a key that cannot do it. A
+ * subclass overrides the operations its usage allows and inherits the refusal
+ * for the rest.
  */
-export declare class SimKmsKeyMaterial {
-    private readonly keyArn;
-    private readonly blob;
-    private readonly bytes;
-    private readonly aad;
+export declare abstract class SimKmsKeyMaterial {
+    readonly keySpec: SimKmsKeySpec;
+    protected readonly keyArn: string;
     constructor(properties: SimKmsKeyMaterialProperties);
     /**
      * Encrypt plaintext under this key, binding the encryption context.
      */
-    encrypt(plaintext: Uint8Array, encryptionContext?: SimKmsEncryptionContext): Uint8Array;
+    encrypt(_plaintext: Uint8Array, _encryptionContext?: SimKmsEncryptionContext): Uint8Array;
     /**
      * Decrypt a ciphertext produced under this key.
+     */
+    decrypt(_parts: SimKmsCiphertextBlobParts, _encryptionContext?: SimKmsEncryptionContext): Uint8Array;
+    /**
+     * Sign a message under this key.
+     */
+    sign(_message: Uint8Array, _algorithm: SimKmsSigningAlgorithm): Uint8Array;
+    /**
+     * Check a signature made under this key.
+     */
+    verify(_message: Uint8Array, _signature: Uint8Array, _algorithm: SimKmsSigningAlgorithm): boolean;
+    /**
+     * This key's public key, as DER SubjectPublicKeyInfo.
      *
-     * A wrong encryption context fails the GCM authentication tag rather than an
-     * explicit comparison, so the failure comes from the cipher for the same
-     * reason it does on real KMS.
+     * A symmetric key has no public key at all, which real KMS reports as an
+     * unsupported operation rather than as a key usage that does not allow it.
+     */
+    publicKeyDer(): Uint8Array;
+    /**
+     * The refusal for an operation this key's usage does not allow.
      */
-    decrypt(parts: SimKmsCiphertextBlobParts, encryptionContext?: SimKmsEncryptionContext): Uint8Array;
+    private notForThisUsage;
 }
 export {};
 //# sourceMappingURL=sim-kms-key-material.d.ts.map

package/dist/service/kms/key/sim-kms-key-material.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-material.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-material.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,yBAAyB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,iCAAiC,CAAC;AAezC,UAAU,2BAA2B;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoC;IAExD,YAAY,UAAU,EAAE,2BAA2B,EAIlD;IAED;;OAEG;IACH,OAAO,CACL,SAAS,EAAE,UAAU,EACrB,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAoBZ;IAED;;;;;;OAMG;IACH,OAAO,CACL,KAAK,EAAE,yBAAyB,EAChC,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAgBZ;CACF"}
+{"version":3,"file":"sim-kms-key-material.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-material.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E,UAAU,2BAA2B;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,8BAAsB,iBAAiB;IACrC,SAAgB,OAAO,EAAE,aAAa,CAAC;IAEvC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAElC,YAAY,UAAU,EAAE,2BAA2B,EAGlD;IAED;;OAEG;IACH,OAAO,CACL,UAAU,EAAE,UAAU,EACtB,kBAAkB,CAAC,EAAE,uBAAuB,GAC3C,UAAU,CAEZ;IAED;;OAEG;IACH,OAAO,CACL,MAAM,EAAE,yBAAyB,EACjC,kBAAkB,CAAC,EAAE,uBAAuB,GAC3C,UAAU,CAEZ;IAED;;OAEG;IACH,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,GAAG,UAAU,CAEzE;IAED;;OAEG;IACH,MAAM,CACJ,QAAQ,EAAE,UAAU,EACpB,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,sBAAsB,GACjC,OAAO,CAET;IAED;;;;;OAKG;IACH,YAAY,IAAI,UAAU,CAIzB;IAED;;OAEG;IACH,OAAO,CAAC,eAAe;CAKxB"}