@kensio/yulin 1.12.0 → 1.13.0

package/dist/service/kms/key/sim-kms-key-material.js

@@ -1,74 +1,63 @@
-import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-import { SimKmsInvalidCiphertextException } from "../error/sim-kms.error.js";
-import { SimKmsCiphertextBlobParts, } from "./sim-kms-ciphertext-blob.js";
-import { SimKmsEncryptionContextAad, } from "./sim-kms-encryption-context.js";
-/**
- * The cipher backing a simulated symmetric KMS key.
- *
- * Real KMS symmetric keys are AES-256-GCM, so this uses the same thing rather
- * than a stand-in. Encryption in this simulation is real encryption: a
- * ciphertext genuinely cannot be read without the key, and the authentication
- * tag genuinely fails on a tampered blob or a mismatched encryption context.
- */
-const algorithm = "aes-256-gcm";
-const keyLength = 32;
-const ivLength = 12;
+import { SimKmsInvalidKeyUsageException, SimKmsUnsupportedOperationException, } from "../error/sim-kms.error.js";
 /**
  * The key material of one simulated KMS key, and the operations that use it.
  *
- * The bytes are generated here and never leave: nothing exposes them, exactly
- * as real key material never leaves KMS. That is a modelling choice rather
- * than a security boundary, since this all runs in one process and anything
- * sharing that process can reach the object.
+ * The bytes are generated in the subclass and never leave, exactly as real key
+ * material never leaves KMS. That is a modelling choice rather than a security
+ * boundary, since this all runs in one process and anything sharing that
+ * process can reach the object.
+ *
+ * Every operation is declared here and refused by default, because that is how
+ * AWS answers one: an `Encrypt` against a signing key is not an unknown
+ * operation, it is `InvalidKeyUsageException` on a key that cannot do it. A
+ * subclass overrides the operations its usage allows and inherits the refusal
+ * for the rest.
  */
 export class SimKmsKeyMaterial {
+    keySpec;
     keyArn;
-    blob;
-    bytes;
-    aad = new SimKmsEncryptionContextAad();
     constructor(properties) {
         this.keyArn = properties.keyArn;
-        this.blob = properties.blob;
-        this.bytes = properties.bytes ?? randomBytes(keyLength);
+        this.keySpec = properties.keySpec;
     }
     /**
      * Encrypt plaintext under this key, binding the encryption context.
      */
-    encrypt(plaintext, encryptionContext) {
-        const iv = randomBytes(ivLength);
-        const cipher = createCipheriv(algorithm, this.bytes, iv);
-        cipher.setAAD(this.aad.serialise(encryptionContext));
-        const ciphertext = Buffer.concat([
-            cipher.update(plaintext),
-            cipher.final(),
-        ]);
-        const authTag = cipher.getAuthTag();
-        return this.blob.encode(new SimKmsCiphertextBlobParts({
-            keyArn: this.keyArn,
-            iv: Uint8Array.from(iv),
-            authTag: Uint8Array.from(authTag),
-            ciphertext: Uint8Array.from(ciphertext),
-        }));
+    encrypt(_plaintext, _encryptionContext) {
+        throw this.notForThisUsage("Encrypt");
     }
     /**
      * Decrypt a ciphertext produced under this key.
+     */
+    decrypt(_parts, _encryptionContext) {
+        throw this.notForThisUsage("Decrypt");
+    }
+    /**
+     * Sign a message under this key.
+     */
+    sign(_message, _algorithm) {
+        throw this.notForThisUsage("Sign");
+    }
+    /**
+     * Check a signature made under this key.
+     */
+    verify(_message, _signature, _algorithm) {
+        throw this.notForThisUsage("Verify");
+    }
+    /**
+     * This key's public key, as DER SubjectPublicKeyInfo.
      *
-     * A wrong encryption context fails the GCM authentication tag rather than an
-     * explicit comparison, so the failure comes from the cipher for the same
-     * reason it does on real KMS.
+     * A symmetric key has no public key at all, which real KMS reports as an
+     * unsupported operation rather than as a key usage that does not allow it.
+     */
+    publicKeyDer() {
+        throw new SimKmsUnsupportedOperationException(`GetPublicKey cannot be used with key ${this.keyArn}: its KeySpec is ${this.keySpec.name}, which holds no public key`);
+    }
+    /**
+     * The refusal for an operation this key's usage does not allow.
      */
-    decrypt(parts, encryptionContext) {
-        const decipher = createDecipheriv(algorithm, this.bytes, parts.iv);
-        decipher.setAAD(this.aad.serialise(encryptionContext));
-        decipher.setAuthTag(parts.authTag);
-        try {
-            return Uint8Array.from(Buffer.concat([decipher.update(parts.ciphertext), decipher.final()]));
-        }
-        catch {
-            throw new SimKmsInvalidCiphertextException("The ciphertext could not be decrypted: it was produced under a " +
-                "different key, with a different encryption context, or has been " +
-                "altered");
-        }
+    notForThisUsage(operation) {
+        return new SimKmsInvalidKeyUsageException(`${operation} cannot be used with key ${this.keyArn}: its KeyUsage is ${this.keySpec.keyUsage}`);
     }
 }
 //# sourceMappingURL=sim-kms-key-material.js.map

package/dist/service/kms/key/sim-kms-key-material.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-material.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-material.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EACL,yBAAyB,GAE1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,0BAA0B,GAE3B,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAC;AAQpB;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACX,MAAM,CAAS;IACf,IAAI,CAAuB;IAC3B,KAAK,CAAa;IAClB,GAAG,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAExD,YAAY,UAAuC;QACjD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,OAAO,CACL,SAAqB,EACrB,iBAA2C;QAE3C,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAErD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACxB,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CACrB,IAAI,yBAAyB,CAAC;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YACjC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;SACxC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,KAAgC,EAChC,iBAA2C;QAE3C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACnE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvD,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC;YACH,OAAO,UAAU,CAAC,IAAI,CACpB,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CACrE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gCAAgC,CACxC,iEAAiE;gBAC/D,kEAAkE;gBAClE,SAAS,CACZ,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-kms-key-material.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-material.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AAWnC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAgB,iBAAiB;IACrB,OAAO,CAAgB;IAEpB,MAAM,CAAS;IAElC,YAAY,UAAuC;QACjD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO,CACL,UAAsB,EACtB,kBAA4C;QAE5C,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,OAAO,CACL,MAAiC,EACjC,kBAA4C;QAE5C,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,QAAoB,EAAE,UAAkC;QAC3D,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,QAAoB,EACpB,UAAsB,EACtB,UAAkC;QAElC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,YAAY;QACV,MAAM,IAAI,mCAAmC,CAC3C,wCAAwC,IAAI,CAAC,MAAM,oBAAoB,IAAI,CAAC,OAAO,CAAC,IAAI,6BAA6B,CACtH,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,SAAiB;QACvC,OAAO,IAAI,8BAA8B,CACvC,GAAG,SAAS,4BAA4B,IAAI,CAAC,MAAM,qBAAqB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAChG,CAAC;IACJ,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-metadata.d.ts

@@ -1,29 +1,7 @@
 import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
-import type { SimKmsKey, SimKmsKeyManager, SimKmsKeyState } from "./sim-kms-key.js";
-/**
- * The KeyMetadata structure CreateKey and DescribeKey return.
- *
- * Only symmetric encryption keys are simulated, so the fields describing key
- * type are constants rather than stored state. They are reported anyway
- * because application code reads them to decide what a key can do.
- */
-export interface SimKmsKeyMetadata {
-    readonly AWSAccountId: SimAwsAccountId;
-    readonly KeyId: string;
-    readonly Arn: string;
-    readonly CreationDate: Date;
-    readonly Enabled: boolean;
-    readonly Description: string;
-    readonly KeyUsage: "ENCRYPT_DECRYPT";
-    readonly KeyState: SimKmsKeyState;
-    readonly DeletionDate?: Date | undefined;
-    readonly Origin: "AWS_KMS";
-    readonly KeyManager: SimKmsKeyManager;
-    readonly KeySpec: "SYMMETRIC_DEFAULT";
-    readonly CustomerMasterKeySpec: "SYMMETRIC_DEFAULT";
-    readonly EncryptionAlgorithms: readonly ["SYMMETRIC_DEFAULT"];
-    readonly MultiRegion: false;
-}
+import type { SimKmsKey } from "./sim-kms-key.js";
+import type { SimKmsKeyMetadata } from "./sim-kms-key-metadata.type.js";
+export type { SimKmsKeyMetadata } from "./sim-kms-key-metadata.type.js";
 /**
  * Builds the AWS-shaped view of a stored key.
  *
@@ -37,6 +15,14 @@ export declare class SimKmsKeyMetadataView {
      * Describe a key the way KMS reports it.
      */
     describe(key: SimKmsKey): SimKmsKeyMetadata;
+    /**
+     * An algorithm list, or nothing at all where the key has none.
+     *
+     * Real KMS omits the list that does not apply rather than returning it
+     * empty, so an encryption key reports no SigningAlgorithms and a signing key
+     * reports no EncryptionAlgorithms.
+     */
+    private listed;
     /**
      * Copy a date, so the response never hands out the key's own instance.
      */

package/dist/service/kms/key/sim-kms-key-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-metadata.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,cAAc,EACf,MAAM,kBAAkB,CAAC;AAE1B;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;IACpD,QAAQ,CAAC,oBAAoB,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC9D,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;CAC7B;AAED;;;;;GAKG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAE5C,YAAY,SAAS,EAAE,eAAe,EAErC;IAED;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,GAAG,iBAAiB,CAkB1C;IAED;;OAEG;IACH,OAAO,CAAC,MAAM;CAOf"}
+{"version":3,"file":"sim-kms-key-metadata.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;;;;GAKG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAE5C,YAAY,SAAS,EAAE,eAAe,EAErC;IAED;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,GAAG,iBAAiB,CAqB1C;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAQd;;OAEG;IACH,OAAO,CAAC,MAAM;CAOf"}

package/dist/service/kms/key/sim-kms-key-metadata.js

@@ -13,6 +13,7 @@ export class SimKmsKeyMetadataView {
      * Describe a key the way KMS reports it.
      */
     describe(key) {
+        const keySpec = key.keySpec;
         return {
             AWSAccountId: this.accountId,
             KeyId: key.keyId,
@@ -20,17 +21,31 @@ export class SimKmsKeyMetadataView {
             CreationDate: new Date(key.creationDate),
             Enabled: key.isEnabled,
             Description: key.description,
-            KeyUsage: "ENCRYPT_DECRYPT",
+            KeyUsage: keySpec.keyUsage,
             KeyState: key.keyState,
             DeletionDate: this.copied(key.deletionDate),
             Origin: "AWS_KMS",
             KeyManager: key.keyManager,
-            KeySpec: "SYMMETRIC_DEFAULT",
-            CustomerMasterKeySpec: "SYMMETRIC_DEFAULT",
-            EncryptionAlgorithms: ["SYMMETRIC_DEFAULT"],
+            KeySpec: keySpec.name,
+            CustomerMasterKeySpec: keySpec.name,
+            EncryptionAlgorithms: this.listed(keySpec.encryptionAlgorithms),
+            SigningAlgorithms: this.listed(keySpec.signingAlgorithmNames()),
             MultiRegion: false,
         };
     }
+    /**
+     * An algorithm list, or nothing at all where the key has none.
+     *
+     * Real KMS omits the list that does not apply rather than returning it
+     * empty, so an encryption key reports no SigningAlgorithms and a signing key
+     * reports no EncryptionAlgorithms.
+     */
+    listed(algorithms) {
+        if (algorithms.length === 0) {
+            return undefined;
+        }
+        return algorithms;
+    }
     /**
      * Copy a date, so the response never hands out the key's own instance.
      */

package/dist/service/kms/key/sim-kms-key-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-metadata.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-metadata.ts"],"names":[],"mappings":"AAgCA;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACf,SAAS,CAAkB;IAE5C,YAAY,SAA0B;QACpC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,GAAc;QACrB,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,SAAS;YAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,YAAY,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACxC,OAAO,EAAE,GAAG,CAAC,SAAS;YACtB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,QAAQ,EAAE,iBAAiB;YAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;YAC3C,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,mBAAmB;YAC5B,qBAAqB,EAAE,mBAAmB;YAC1C,oBAAoB,EAAE,CAAC,mBAAmB,CAAC;YAC3C,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,IAAsB;QACnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"sim-kms-key-metadata.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-metadata.ts"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACf,SAAS,CAAkB;IAE5C,YAAY,SAA0B;QACpC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,GAAc;QACrB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAE5B,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,SAAS;YAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,YAAY,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACxC,OAAO,EAAE,GAAG,CAAC,SAAS;YACtB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;YAC3C,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,qBAAqB,EAAE,OAAO,CAAC,IAAI;YACnC,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC;YAC/D,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;YAC/D,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,UAA6B;QAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,IAAsB;QACnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-key-metadata.type.d.ts

@@ -0,0 +1,28 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import type { SimKmsKeyUsage } from "./spec/sim-kms-key-spec.js";
+import type { SimKmsKeyManager, SimKmsKeyState } from "./sim-kms-key.js";
+/**
+ * The KeyMetadata structure CreateKey and DescribeKey return.
+ *
+ * The key type fields are read from the key's own spec. Application code uses
+ * them to decide what a key can do, so a key that signs has to say so.
+ */
+export interface SimKmsKeyMetadata {
+    readonly AWSAccountId: SimAwsAccountId;
+    readonly KeyId: string;
+    readonly Arn: string;
+    readonly CreationDate: Date;
+    readonly Enabled: boolean;
+    readonly Description: string;
+    readonly KeyUsage: SimKmsKeyUsage;
+    readonly KeyState: SimKmsKeyState;
+    readonly DeletionDate?: Date | undefined;
+    readonly Origin: "AWS_KMS";
+    readonly KeyManager: SimKmsKeyManager;
+    readonly KeySpec: string;
+    readonly CustomerMasterKeySpec: string;
+    readonly EncryptionAlgorithms?: readonly string[] | undefined;
+    readonly SigningAlgorithms?: readonly string[] | undefined;
+    readonly MultiRegion: false;
+}
+//# sourceMappingURL=sim-kms-key-metadata.type.d.ts.map

package/dist/service/kms/key/sim-kms-key-metadata.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-metadata.type.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-metadata.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;CAC7B"}

package/dist/service/kms/key/sim-kms-key-metadata.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-kms-key-metadata.type.js.map

package/dist/service/kms/key/sim-kms-key-metadata.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-key-metadata.type.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key-metadata.type.ts"],"names":[],"mappings":""}

package/dist/service/kms/key/sim-kms-key.d.ts

@@ -4,6 +4,8 @@ import type { SimKmsEncryptionContext } from "./sim-kms-encryption-context.js";
 import { type SimKmsKeyState } from "./sim-kms-key-lifecycle.js";
 import type { SimKmsKeyMaterial } from "./sim-kms-key-material.js";
 import type { SimKmsKeyPolicy } from "./sim-kms-key-policy.js";
+import type { SimKmsKeySpec } from "./spec/sim-kms-key-spec.js";
+import type { SimKmsSigningAlgorithm } from "./spec/sim-kms-signing-algorithm.js";
 export { SimKmsKeyState } from "./sim-kms-key-lifecycle.js";
 /**
  * Who created and controls a key. AWS managed keys are created by a service
@@ -41,6 +43,10 @@ export declare class SimKmsKey {
     private readonly material;
     private readonly lifecycle;
     constructor(properties: SimKmsKeyProperties);
+    /**
+     * The spec this key was created with, which is what says what it can do.
+     */
+    get keySpec(): SimKmsKeySpec;
     /**
      * The key's current lifecycle state.
      */
@@ -84,5 +90,20 @@ export declare class SimKmsKey {
      * Decrypt a ciphertext produced under this key.
      */
     decrypt(parts: SimKmsCiphertextBlobParts, encryptionContext?: SimKmsEncryptionContext): Uint8Array;
+    /**
+     * Sign a message under this key.
+     */
+    sign(message: Uint8Array, algorithm: SimKmsSigningAlgorithm): Uint8Array;
+    /**
+     * Check a signature made under this key.
+     */
+    verify(message: Uint8Array, signature: Uint8Array, algorithm: SimKmsSigningAlgorithm): boolean;
+    /**
+     * This key's public key, as DER SubjectPublicKeyInfo.
+     *
+     * A disabled key still has one on real KMS, but GetPublicKey refuses it, so
+     * this goes through the same usability check every other operation does.
+     */
+    publicKeyDer(): Uint8Array;
 }
 //# sourceMappingURL=sim-kms-key.d.ts.map

package/dist/service/kms/key/sim-kms-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAE1F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,gBAAgB;aAC3B,GAAG,EAAE,KAAK;aACV,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAC1B,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE3D,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;GAMG;AACH,qBAAa,SAAS;IACpB,SAAgB,KAAK,EAAE,WAAW,CAAC;IACnC,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,IAAI,CAAC;IACnC,SAAgB,UAAU,EAAE,gBAAgB,CAAC;IAC7C,SAAgB,MAAM,EAAE,eAAe,CAAC;IACxC,SAAgB,WAAW,EAAE,MAAM,CAAC;IAEpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAE/C,YAAY,UAAU,EAAE,mBAAmB,EAW1C;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,cAAc,CAE7B;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,IAAI,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,MAAM,IAAI,IAAI,CAEb;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAEd;IAED;;;;;;;;;OASG;IACH,gBAAgB,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAQzC;IAED;;OAEG;IACH,cAAc,IAAI,IAAI,CAErB;IAED;;OAEG;IACH,OAAO,CACL,SAAS,EAAE,UAAU,EACrB,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAGZ;IAED;;OAEG;IACH,OAAO,CACL,KAAK,EAAE,yBAAyB,EAChC,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAGZ;CACF"}
+{"version":3,"file":"sim-kms-key.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAE1F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAElF,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,gBAAgB;aAC3B,GAAG,EAAE,KAAK;aACV,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAC1B,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE3D,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;GAMG;AACH,qBAAa,SAAS;IACpB,SAAgB,KAAK,EAAE,WAAW,CAAC;IACnC,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,IAAI,CAAC;IACnC,SAAgB,UAAU,EAAE,gBAAgB,CAAC;IAC7C,SAAgB,MAAM,EAAE,eAAe,CAAC;IACxC,SAAgB,WAAW,EAAE,MAAM,CAAC;IAEpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAE/C,YAAY,UAAU,EAAE,mBAAmB,EAW1C;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,aAAa,CAE3B;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,cAAc,CAE7B;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,IAAI,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,MAAM,IAAI,IAAI,CAEb;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAEd;IAED;;;;;;;;;OASG;IACH,gBAAgB,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAQzC;IAED;;OAEG;IACH,cAAc,IAAI,IAAI,CAErB;IAED;;OAEG;IACH,OAAO,CACL,SAAS,EAAE,UAAU,EACrB,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAGZ;IAED;;OAEG;IACH,OAAO,CACL,KAAK,EAAE,yBAAyB,EAChC,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAGZ;IAED;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,sBAAsB,GAAG,UAAU,CAGvE;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,sBAAsB,GAChC,OAAO,CAGT;IAED;;;;;OAKG;IACH,YAAY,IAAI,UAAU,CAGzB;CACF"}

package/dist/service/kms/key/sim-kms-key.js

@@ -36,6 +36,12 @@ export class SimKmsKey {
         this.keyManager = properties.keyManager ?? SimKmsKeyManager.Customer;
         this.lifecycle = new SimKmsKeyLifecycle(this.arn);
     }
+    /**
+     * The spec this key was created with, which is what says what it can do.
+     */
+    get keySpec() {
+        return this.material.keySpec;
+    }
     /**
      * The key's current lifecycle state.
      */
@@ -102,5 +108,29 @@ export class SimKmsKey {
         this.lifecycle.requireUsable();
         return this.material.decrypt(parts, encryptionContext);
     }
+    /**
+     * Sign a message under this key.
+     */
+    sign(message, algorithm) {
+        this.lifecycle.requireUsable();
+        return this.material.sign(message, algorithm);
+    }
+    /**
+     * Check a signature made under this key.
+     */
+    verify(message, signature, algorithm) {
+        this.lifecycle.requireUsable();
+        return this.material.verify(message, signature, algorithm);
+    }
+    /**
+     * This key's public key, as DER SubjectPublicKeyInfo.
+     *
+     * A disabled key still has one on real KMS, but GetPublicKey refuses it, so
+     * this goes through the same usability check every other operation does.
+     */
+    publicKeyDer() {
+        this.lifecycle.requireUsable();
+        return this.material.publicKeyDer();
+    }
 }
 //# sourceMappingURL=sim-kms-key.js.map

package/dist/service/kms/key/sim-kms-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAGxE,OAAO,EACL,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,GAAG,EAAE,KAAK;IACV,QAAQ,EAAE,UAAU;CACZ,CAAC;AAiBX;;;;;;GAMG;AACH,MAAM,OAAO,SAAS;IACJ,KAAK,CAAc;IACnB,GAAG,CAAS;IACZ,YAAY,CAAO;IACnB,UAAU,CAAmB;IAC7B,MAAM,CAAkB;IACxB,WAAW,CAAS;IAEnB,QAAQ,CAAoB;IAC5B,SAAS,CAAqB;IAE/C,YAAY,UAA+B;QACzC,MAAM,EAAE,kBAAkB,EAAE,GAAG,UAAU,CAAC;QAE1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,eAAe,kBAAkB,CAAC,UAAU,IAAI,kBAAkB,CAAC,SAAS,QAAQ,UAAU,CAAC,KAAK,EAAE,CAAC;QAClH,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QACrE,IAAI,CAAC,SAAS,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;;;OASG;IACH,gBAAgB,CAAC,YAAkB;QACjC,IAAI,IAAI,CAAC,UAAU,KAAK,gBAAgB,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,2BAA2B,CACnC,OAAO,IAAI,CAAC,GAAG,6DAA6D,CAC7E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,OAAO,CACL,SAAqB,EACrB,iBAA2C;QAE3C,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,OAAO,CACL,KAAgC,EAChC,iBAA2C;QAE3C,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACzD,CAAC;CACF"}
+{"version":3,"file":"sim-kms-key.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAGxE,OAAO,EACL,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,GAAG,EAAE,KAAK;IACV,QAAQ,EAAE,UAAU;CACZ,CAAC;AAiBX;;;;;;GAMG;AACH,MAAM,OAAO,SAAS;IACJ,KAAK,CAAc;IACnB,GAAG,CAAS;IACZ,YAAY,CAAO;IACnB,UAAU,CAAmB;IAC7B,MAAM,CAAkB;IACxB,WAAW,CAAS;IAEnB,QAAQ,CAAoB;IAC5B,SAAS,CAAqB;IAE/C,YAAY,UAA+B;QACzC,MAAM,EAAE,kBAAkB,EAAE,GAAG,UAAU,CAAC;QAE1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,eAAe,kBAAkB,CAAC,UAAU,IAAI,kBAAkB,CAAC,SAAS,QAAQ,UAAU,CAAC,KAAK,EAAE,CAAC;QAClH,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QACrE,IAAI,CAAC,SAAS,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;;;OASG;IACH,gBAAgB,CAAC,YAAkB;QACjC,IAAI,IAAI,CAAC,UAAU,KAAK,gBAAgB,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,2BAA2B,CACnC,OAAO,IAAI,CAAC,GAAG,6DAA6D,CAC7E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,OAAO,CACL,SAAqB,EACrB,iBAA2C;QAE3C,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,OAAO,CACL,KAAgC,EAChC,iBAA2C;QAE3C,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,OAAmB,EAAE,SAAiC;QACzD,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAAmB,EACnB,SAAqB,EACrB,SAAiC;QAEjC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;OAKG;IACH,YAAY;QACV,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IACtC,CAAC;CACF"}

package/dist/service/kms/key/sim-kms-signing-key-material.d.ts

@@ -0,0 +1,38 @@
+import { SimKmsKeyMaterial } from "./sim-kms-key-material.js";
+import type { SimKmsKeySpec } from "./spec/sim-kms-key-spec.js";
+import type { SimKmsSigningAlgorithm } from "./spec/sim-kms-signing-algorithm.js";
+interface SimKmsSigningKeyMaterialProperties {
+    readonly keyArn: string;
+    readonly keySpec: SimKmsKeySpec;
+}
+/**
+ * The key pair of one simulated asymmetric KMS signing key.
+ *
+ * The pair is a real one and the signatures are real signatures: a signature
+ * made here verifies against the public key GetPublicKey hands out, using any
+ * verifier, and one made over a different message does not. ECDSA signatures
+ * come out DER encoded, which is the encoding real KMS returns.
+ *
+ * The private key never leaves, the same as the AES bytes of a symmetric key.
+ */
+export declare class SimKmsSigningKeyMaterial extends SimKmsKeyMaterial {
+    private readonly keyPair;
+    constructor(properties: SimKmsSigningKeyMaterialProperties);
+    /**
+     * Sign a message under this key.
+     */
+    sign(message: Uint8Array, algorithm: SimKmsSigningAlgorithm): Uint8Array;
+    /**
+     * Check a signature made under this key.
+     */
+    verify(message: Uint8Array, signature: Uint8Array, algorithm: SimKmsSigningAlgorithm): boolean;
+    /**
+     * This key's public key, as DER SubjectPublicKeyInfo.
+     *
+     * That is the encoding real GetPublicKey returns, so a caller can hand the
+     * bytes straight to a verifier without knowing they came from a simulator.
+     */
+    publicKeyDer(): Uint8Array;
+}
+export {};
+//# sourceMappingURL=sim-kms-signing-key-material.d.ts.map

package/dist/service/kms/key/sim-kms-signing-key-material.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-signing-key-material.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-signing-key-material.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAElF,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAOD;;;;;;;;;GASG;AACH,qBAAa,wBAAyB,SAAQ,iBAAiB;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IAExC,YAAY,UAAU,EAAE,kCAAkC,EAIzD;IAED;;OAEG;IACM,IAAI,CACX,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,sBAAsB,GAChC,UAAU,CAQZ;IAED;;OAEG;IACM,MAAM,CACb,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,sBAAsB,GAChC,OAAO,CAOT;IAED;;;;;OAKG;IACM,YAAY,IAAI,UAAU,CAIlC;CACF"}

package/dist/service/kms/key/sim-kms-signing-key-material.js

@@ -0,0 +1,56 @@
+import { generateKeyPairSync, sign, verify } from "node:crypto";
+import { SimKmsKeyMaterial } from "./sim-kms-key-material.js";
+/**
+ * The key pair of one simulated asymmetric KMS signing key.
+ *
+ * The pair is a real one and the signatures are real signatures: a signature
+ * made here verifies against the public key GetPublicKey hands out, using any
+ * verifier, and one made over a different message does not. ECDSA signatures
+ * come out DER encoded, which is the encoding real KMS returns.
+ *
+ * The private key never leaves, the same as the AES bytes of a symmetric key.
+ */
+export class SimKmsSigningKeyMaterial extends SimKmsKeyMaterial {
+    keyPair;
+    constructor(properties) {
+        super(properties);
+        this.keyPair = generateSimKmsKeyPair(properties.keySpec);
+    }
+    /**
+     * Sign a message under this key.
+     */
+    sign(message, algorithm) {
+        return Uint8Array.from(sign(algorithm.digest, message, algorithm.keyInput(this.keyPair.privateKey)));
+    }
+    /**
+     * Check a signature made under this key.
+     */
+    verify(message, signature, algorithm) {
+        return verify(algorithm.digest, message, algorithm.keyInput(this.keyPair.publicKey), signature);
+    }
+    /**
+     * This key's public key, as DER SubjectPublicKeyInfo.
+     *
+     * That is the encoding real GetPublicKey returns, so a caller can hand the
+     * bytes straight to a verifier without knowing they came from a simulator.
+     */
+    publicKeyDer() {
+        return Uint8Array.from(this.keyPair.publicKey.export({ type: "spki", format: "der" }));
+    }
+}
+/**
+ * Generate the key pair a key spec calls for.
+ *
+ * Kept out of the class so the spec-to-Node translation is one expression
+ * rather than a branch inside a constructor.
+ */
+function generateSimKmsKeyPair(keySpec) {
+    const parameters = keySpec.keyPairParameters();
+    if (parameters.type === "ec") {
+        return generateKeyPairSync("ec", { namedCurve: parameters.namedCurve });
+    }
+    return generateKeyPairSync("rsa", {
+        modulusLength: parameters.modulusLength,
+    });
+}
+//# sourceMappingURL=sim-kms-signing-key-material.js.map

package/dist/service/kms/key/sim-kms-signing-key-material.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-signing-key-material.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-signing-key-material.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAc9D;;;;;;;;;GASG;AACH,MAAM,OAAO,wBAAyB,SAAQ,iBAAiB;IAC5C,OAAO,CAAgB;IAExC,YAAY,UAA8C;QACxD,KAAK,CAAC,UAAU,CAAC,CAAC;QAElB,IAAI,CAAC,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACM,IAAI,CACX,OAAmB,EACnB,SAAiC;QAEjC,OAAO,UAAU,CAAC,IAAI,CACpB,IAAI,CACF,SAAS,CAAC,MAAM,EAChB,OAAO,EACP,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAC5C,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACM,MAAM,CACb,OAAmB,EACnB,SAAqB,EACrB,SAAiC;QAEjC,OAAO,MAAM,CACX,SAAS,CAAC,MAAM,EAChB,OAAO,EACP,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAC1C,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACM,YAAY;QACnB,OAAO,UAAU,CAAC,IAAI,CACpB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC/D,CAAC;IACJ,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,OAAsB;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAE/C,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,mBAAmB,CAAC,KAAK,EAAE;QAChC,aAAa,EAAE,UAAU,CAAC,aAAa;KACxC,CAAC,CAAC;AACL,CAAC"}

package/dist/service/kms/key/sim-kms-symmetric-key-material.d.ts

@@ -0,0 +1,38 @@
+import { SimKmsCiphertextBlobParts, type SimKmsCiphertextBlob } from "./sim-kms-ciphertext-blob.js";
+import { type SimKmsEncryptionContext } from "./sim-kms-encryption-context.js";
+import { SimKmsKeyMaterial } from "./sim-kms-key-material.js";
+import type { SimKmsKeySpec } from "./spec/sim-kms-key-spec.js";
+interface SimKmsSymmetricKeyMaterialProperties {
+    readonly keyArn: string;
+    readonly keySpec: SimKmsKeySpec;
+    readonly blob: SimKmsCiphertextBlob;
+    readonly bytes?: Uint8Array | undefined;
+}
+/**
+ * The AES key material of one simulated symmetric KMS key.
+ *
+ * The bytes are generated here and never leave: nothing exposes them, exactly
+ * as real key material never leaves KMS. That is a modelling choice rather
+ * than a security boundary, since this all runs in one process and anything
+ * sharing that process can reach the object.
+ */
+export declare class SimKmsSymmetricKeyMaterial extends SimKmsKeyMaterial {
+    private readonly blob;
+    private readonly bytes;
+    private readonly aad;
+    constructor(properties: SimKmsSymmetricKeyMaterialProperties);
+    /**
+     * Encrypt plaintext under this key, binding the encryption context.
+     */
+    encrypt(plaintext: Uint8Array, encryptionContext?: SimKmsEncryptionContext): Uint8Array;
+    /**
+     * Decrypt a ciphertext produced under this key.
+     *
+     * A wrong encryption context fails the GCM authentication tag rather than an
+     * explicit comparison, so the failure comes from the cipher for the same
+     * reason it does on real KMS.
+     */
+    decrypt(parts: SimKmsCiphertextBlobParts, encryptionContext?: SimKmsEncryptionContext): Uint8Array;
+}
+export {};
+//# sourceMappingURL=sim-kms-symmetric-key-material.d.ts.map

package/dist/service/kms/key/sim-kms-symmetric-key-material.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-symmetric-key-material.d.ts","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-symmetric-key-material.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,yBAAyB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAehE,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA2B,SAAQ,iBAAiB;IAC/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoC;IAExD,YAAY,UAAU,EAAE,oCAAoC,EAK3D;IAED;;OAEG;IACM,OAAO,CACd,SAAS,EAAE,UAAU,EACrB,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAoBZ;IAED;;;;;;OAMG;IACM,OAAO,CACd,KAAK,EAAE,yBAAyB,EAChC,iBAAiB,CAAC,EAAE,uBAAuB,GAC1C,UAAU,CAgBZ;CACF"}

package/dist/service/kms/key/sim-kms-symmetric-key-material.js

@@ -0,0 +1,74 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { SimKmsInvalidCiphertextException } from "../error/sim-kms.error.js";
+import { SimKmsCiphertextBlobParts, } from "./sim-kms-ciphertext-blob.js";
+import { SimKmsEncryptionContextAad, } from "./sim-kms-encryption-context.js";
+import { SimKmsKeyMaterial } from "./sim-kms-key-material.js";
+/**
+ * The cipher backing a simulated symmetric KMS key.
+ *
+ * Real KMS symmetric keys are AES-256-GCM, so this uses the same thing rather
+ * than a stand-in. Encryption in this simulation is real encryption: a
+ * ciphertext genuinely cannot be read without the key, and the authentication
+ * tag genuinely fails on a tampered blob or a mismatched encryption context.
+ */
+const algorithm = "aes-256-gcm";
+const keyLength = 32;
+const ivLength = 12;
+/**
+ * The AES key material of one simulated symmetric KMS key.
+ *
+ * The bytes are generated here and never leave: nothing exposes them, exactly
+ * as real key material never leaves KMS. That is a modelling choice rather
+ * than a security boundary, since this all runs in one process and anything
+ * sharing that process can reach the object.
+ */
+export class SimKmsSymmetricKeyMaterial extends SimKmsKeyMaterial {
+    blob;
+    bytes;
+    aad = new SimKmsEncryptionContextAad();
+    constructor(properties) {
+        super({ keyArn: properties.keyArn, keySpec: properties.keySpec });
+        this.blob = properties.blob;
+        this.bytes = properties.bytes ?? randomBytes(keyLength);
+    }
+    /**
+     * Encrypt plaintext under this key, binding the encryption context.
+     */
+    encrypt(plaintext, encryptionContext) {
+        const iv = randomBytes(ivLength);
+        const cipher = createCipheriv(algorithm, this.bytes, iv);
+        cipher.setAAD(this.aad.serialise(encryptionContext));
+        const ciphertext = Buffer.concat([
+            cipher.update(plaintext),
+            cipher.final(),
+        ]);
+        const authTag = cipher.getAuthTag();
+        return this.blob.encode(new SimKmsCiphertextBlobParts({
+            keyArn: this.keyArn,
+            iv: Uint8Array.from(iv),
+            authTag: Uint8Array.from(authTag),
+            ciphertext: Uint8Array.from(ciphertext),
+        }));
+    }
+    /**
+     * Decrypt a ciphertext produced under this key.
+     *
+     * A wrong encryption context fails the GCM authentication tag rather than an
+     * explicit comparison, so the failure comes from the cipher for the same
+     * reason it does on real KMS.
+     */
+    decrypt(parts, encryptionContext) {
+        const decipher = createDecipheriv(algorithm, this.bytes, parts.iv);
+        decipher.setAAD(this.aad.serialise(encryptionContext));
+        decipher.setAuthTag(parts.authTag);
+        try {
+            return Uint8Array.from(Buffer.concat([decipher.update(parts.ciphertext), decipher.final()]));
+        }
+        catch {
+            throw new SimKmsInvalidCiphertextException("The ciphertext could not be decrypted: it was produced under a " +
+                "different key, with a different encryption context, or has been " +
+                "altered");
+        }
+    }
+}
+//# sourceMappingURL=sim-kms-symmetric-key-material.js.map

package/dist/service/kms/key/sim-kms-symmetric-key-material.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-kms-symmetric-key-material.js","sourceRoot":"","sources":["../../../../src/service/kms/key/sim-kms-symmetric-key-material.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EACL,yBAAyB,GAE1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,0BAA0B,GAE3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAC;AASpB;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA2B,SAAQ,iBAAiB;IAC9C,IAAI,CAAuB;IAC3B,KAAK,CAAa;IAClB,GAAG,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAExD,YAAY,UAAgD;QAC1D,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAElE,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACM,OAAO,CACd,SAAqB,EACrB,iBAA2C;QAE3C,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAErD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACxB,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CACrB,IAAI,yBAAyB,CAAC;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YACjC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;SACxC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACM,OAAO,CACd,KAAgC,EAChC,iBAA2C;QAE3C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACnE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvD,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC;YACH,OAAO,UAAU,CAAC,IAAI,CACpB,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CACrE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gCAAgC,CACxC,iEAAiE;gBAC/D,kEAAkE;gBAClE,SAAS,CACZ,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}