@kensio/yulin 1.12.0 → 1.13.0

package/dist/service/route53/dnssec/sim-route53-dnskey-rdata.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The raw X and Y coordinates inside a DER SubjectPublicKeyInfo.
+ *
+ * DNSSEC publishes the point on its own, with no ASN.1 around it and no
+ * uncompressed-point marker, so the tail of the DER encoding is what is
+ * wanted. The marker is checked rather than assumed, since a compressed point
+ * would silently produce the wrong key.
+ */
+export declare function simRoute53EcPoint(publicKeyDer: Uint8Array): Uint8Array;
+/**
+ * The DNSKEY RDATA: flags, protocol, algorithm, then the public key.
+ *
+ * This is the byte sequence both the key tag and the delegation signer digest
+ * are computed over, which is why it is built once and kept.
+ */
+export declare function simRoute53DnskeyRdata(point: Uint8Array): Uint8Array;
+//# sourceMappingURL=sim-route53-dnskey-rdata.d.ts.map

package/dist/service/route53/dnssec/sim-route53-dnskey-rdata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-dnskey-rdata.d.ts","sourceRoot":"","sources":["../../../../src/service/route53/dnssec/sim-route53-dnskey-rdata.ts"],"names":[],"mappings":"AAeA;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,UAAU,GAAG,UAAU,CAatE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CASnE"}

package/dist/service/route53/dnssec/sim-route53-dnskey-rdata.js

@@ -0,0 +1,41 @@
+import { concatenateBytes } from "../dns/wire/dns-bytes.js";
+import { SimRoute53InvalidInput } from "../error/sim-route53.error.js";
+import { simRoute53DnskeyProtocol, simRoute53KskFlag, simRoute53SigningAlgorithmType, } from "./sim-route53-dnssec-algorithm.js";
+/**
+ * An uncompressed elliptic curve point starts with this marker, and the 64
+ * bytes after it are the X and Y coordinates DNSSEC publishes.
+ */
+const uncompressedPointMarker = 0x04;
+const p256PointLength = 65;
+/**
+ * The raw X and Y coordinates inside a DER SubjectPublicKeyInfo.
+ *
+ * DNSSEC publishes the point on its own, with no ASN.1 around it and no
+ * uncompressed-point marker, so the tail of the DER encoding is what is
+ * wanted. The marker is checked rather than assumed, since a compressed point
+ * would silently produce the wrong key.
+ */
+export function simRoute53EcPoint(publicKeyDer) {
+    const point = publicKeyDer.subarray(publicKeyDer.length - p256PointLength);
+    if (point.length !== p256PointLength ||
+        point[0] !== uncompressedPointMarker) {
+        throw new SimRoute53InvalidInput("The key-signing key's public key is not an uncompressed P-256 point");
+    }
+    return point.subarray(1);
+}
+/**
+ * The DNSKEY RDATA: flags, protocol, algorithm, then the public key.
+ *
+ * This is the byte sequence both the key tag and the delegation signer digest
+ * are computed over, which is why it is built once and kept.
+ */
+export function simRoute53DnskeyRdata(point) {
+    const header = Uint8Array.from([
+        (simRoute53KskFlag >> 8) & 0xff,
+        simRoute53KskFlag & 0xff,
+        simRoute53DnskeyProtocol,
+        simRoute53SigningAlgorithmType,
+    ]);
+    return concatenateBytes([header, point]);
+}
+//# sourceMappingURL=sim-route53-dnskey-rdata.js.map

package/dist/service/route53/dnssec/sim-route53-dnskey-rdata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-dnskey-rdata.js","sourceRoot":"","sources":["../../../../src/service/route53/dnssec/sim-route53-dnskey-rdata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAE3C;;;GAGG;AACH,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAwB;IACxD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;IAE3E,IACE,KAAK,CAAC,MAAM,KAAK,eAAe;QAChC,KAAK,CAAC,CAAC,CAAC,KAAK,uBAAuB,EACpC,CAAC;QACD,MAAM,IAAI,sBAAsB,CAC9B,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAiB;IACrD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC;QAC7B,CAAC,iBAAiB,IAAI,CAAC,CAAC,GAAG,IAAI;QAC/B,iBAAiB,GAAG,IAAI;QACxB,wBAAwB;QACxB,8BAA8B;KAC/B,CAAC,CAAC;IAEH,OAAO,gBAAgB,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/service/route53/dnssec/sim-route53-dnskey-tag.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The key tag of a DNSKEY, by the RFC 4034 Appendix B algorithm.
+ *
+ * The RDATA is summed as a sequence of 16-bit words, the carry is folded back
+ * in, and what is left of the low 16 bits is the tag. It is not a hash and it
+ * is not unique; it is the hint a resolver uses to pick which key to try, and
+ * it is what a DS record leads with.
+ */
+export declare function simRoute53DnskeyKeyTag(rdata: Uint8Array): number;
+//# sourceMappingURL=sim-route53-dnskey-tag.d.ts.map

package/dist/service/route53/dnssec/sim-route53-dnskey-tag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-dnskey-tag.d.ts","sourceRoot":"","sources":["../../../../src/service/route53/dnssec/sim-route53-dnskey-tag.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAUhE"}

package/dist/service/route53/dnssec/sim-route53-dnskey-tag.js

@@ -0,0 +1,26 @@
+/**
+ * The key tag of a DNSKEY, by the RFC 4034 Appendix B algorithm.
+ *
+ * The RDATA is summed as a sequence of 16-bit words, the carry is folded back
+ * in, and what is left of the low 16 bits is the tag. It is not a hash and it
+ * is not unique; it is the hint a resolver uses to pick which key to try, and
+ * it is what a DS record leads with.
+ */
+export function simRoute53DnskeyKeyTag(rdata) {
+    let accumulator = 0;
+    for (const [index, byte] of rdata.entries()) {
+        accumulator += shiftedByte(index, byte);
+    }
+    accumulator += (accumulator >> 16) & 0xff_ff;
+    return accumulator & 0xff_ff;
+}
+/**
+ * A byte's contribution to the sum: the high half of a word, or the low half.
+ */
+function shiftedByte(index, byte) {
+    if (index % 2 === 0) {
+        return byte << 8;
+    }
+    return byte;
+}
+//# sourceMappingURL=sim-route53-dnskey-tag.js.map

package/dist/service/route53/dnssec/sim-route53-dnskey-tag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-dnskey-tag.js","sourceRoot":"","sources":["../../../../src/service/route53/dnssec/sim-route53-dnskey-tag.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAiB;IACtD,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,WAAW,IAAI,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,WAAW,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC;IAE7C,OAAO,WAAW,GAAG,OAAO,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAa,EAAE,IAAY;IAC9C,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/service/route53/dnssec/sim-route53-dnskey.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The DNSKEY a key-signing key publishes, derived from its KMS public key.
+ *
+ * Everything here is computed rather than invented, so the DS record a test
+ * reads is the DS record the zone's registrar would need. Two zones on two
+ * keys get two different ones, and a key tag that does not match its public
+ * key would be a bug rather than a detail nobody checks.
+ */
+export declare class SimRoute53Dnskey {
+    /**
+     * The public key, base64 encoded as RFC 4034 requires.
+     */
+    readonly publicKey: string;
+    /**
+     * The key tag, computed by the RFC 4034 Appendix B algorithm.
+     */
+    readonly keyTag: number;
+    private readonly rdata;
+    constructor(publicKeyDer: Uint8Array);
+    /**
+     * The delegation signer digest over a zone's owner name and this DNSKEY.
+     *
+     * Uppercase hex, which is the form Route53 returns and the form a registrar
+     * expects in a DS record.
+     */
+    digestValue(zoneName: string): string;
+    /**
+     * The DS record a registrar is given, as Route53 formats it.
+     */
+    dsRecord(zoneName: string): string;
+    /**
+     * The DNSKEY record this key publishes, as Route53 formats it.
+     */
+    dnskeyRecord(): string;
+}
+//# sourceMappingURL=sim-route53-dnskey.d.ts.map

package/dist/service/route53/dnssec/sim-route53-dnskey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-dnskey.d.ts","sourceRoot":"","sources":["../../../../src/service/route53/dnssec/sim-route53-dnskey.ts"],"names":[],"mappings":"AAeA;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B;;OAEG;IACH,SAAgB,SAAS,EAAE,MAAM,CAAC;IAElC;;OAEG;IACH,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,YAAY,YAAY,EAAE,UAAU,EAMnC;IAED;;;;;OAKG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOpC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOjC;IAED;;OAEG;IACH,YAAY,IAAI,MAAM,CAOrB;CACF"}

package/dist/service/route53/dnssec/sim-route53-dnskey.js

@@ -0,0 +1,67 @@
+import { createHash } from "node:crypto";
+import { encodeDnsName } from "../dns/wire/dns-name.js";
+import { concatenateBytes } from "../dns/wire/dns-bytes.js";
+import { simRoute53DnskeyKeyTag } from "./sim-route53-dnskey-tag.js";
+import { simRoute53DnskeyRdata, simRoute53EcPoint, } from "./sim-route53-dnskey-rdata.js";
+import { simRoute53DigestAlgorithmType, simRoute53DnskeyProtocol, simRoute53KskFlag, simRoute53SigningAlgorithmType, } from "./sim-route53-dnssec-algorithm.js";
+/**
+ * The DNSKEY a key-signing key publishes, derived from its KMS public key.
+ *
+ * Everything here is computed rather than invented, so the DS record a test
+ * reads is the DS record the zone's registrar would need. Two zones on two
+ * keys get two different ones, and a key tag that does not match its public
+ * key would be a bug rather than a detail nobody checks.
+ */
+export class SimRoute53Dnskey {
+    /**
+     * The public key, base64 encoded as RFC 4034 requires.
+     */
+    publicKey;
+    /**
+     * The key tag, computed by the RFC 4034 Appendix B algorithm.
+     */
+    keyTag;
+    rdata;
+    constructor(publicKeyDer) {
+        const point = simRoute53EcPoint(publicKeyDer);
+        this.publicKey = Buffer.from(point).toString("base64");
+        this.rdata = simRoute53DnskeyRdata(point);
+        this.keyTag = simRoute53DnskeyKeyTag(this.rdata);
+    }
+    /**
+     * The delegation signer digest over a zone's owner name and this DNSKEY.
+     *
+     * Uppercase hex, which is the form Route53 returns and the form a registrar
+     * expects in a DS record.
+     */
+    digestValue(zoneName) {
+        const ownerName = encodeDnsName(zoneName.toLowerCase());
+        return createHash("sha256")
+            .update(concatenateBytes([ownerName, this.rdata]))
+            .digest("hex")
+            .toUpperCase();
+    }
+    /**
+     * The DS record a registrar is given, as Route53 formats it.
+     */
+    dsRecord(zoneName) {
+        return [
+            this.keyTag,
+            simRoute53SigningAlgorithmType,
+            simRoute53DigestAlgorithmType,
+            this.digestValue(zoneName),
+        ].join(" ");
+    }
+    /**
+     * The DNSKEY record this key publishes, as Route53 formats it.
+     */
+    dnskeyRecord() {
+        return [
+            simRoute53KskFlag,
+            simRoute53DnskeyProtocol,
+            simRoute53SigningAlgorithmType,
+            this.publicKey,
+        ].join(" ");
+    }
+}
+//# sourceMappingURL=sim-route53-dnskey.js.map

package/dist/service/route53/dnssec/sim-route53-dnskey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-dnskey.js","sourceRoot":"","sources":["../../../../src/service/route53/dnssec/sim-route53-dnskey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IAC3B;;OAEG;IACa,SAAS,CAAS;IAElC;;OAEG;IACa,MAAM,CAAS;IAEd,KAAK,CAAa;IAEnC,YAAY,YAAwB;QAClC,MAAM,KAAK,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAE9C,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,QAAgB;QAC1B,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAExD,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;aACjD,MAAM,CAAC,KAAK,CAAC;aACb,WAAW,EAAE,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB;QACvB,OAAO;YACL,IAAI,CAAC,MAAM;YACX,8BAA8B;YAC9B,6BAA6B;YAC7B,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;SAC3B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO;YACL,iBAAiB;YACjB,wBAAwB;YACxB,8BAA8B;YAC9B,IAAI,CAAC,SAAS;SACf,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;CACF"}

package/dist/service/route53/dnssec/sim-route53-dnssec-algorithm.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The DNSSEC parameters of a Route53 key-signing key.
+ *
+ * Route53 only accepts an ECC_NIST_P256 customer managed key, so there is one
+ * algorithm here rather than a table: ECDSA with SHA-256, algorithm 13, and
+ * the SHA-256 delegation signer digest, algorithm 2. A key-signing key always
+ * carries flag 257, the secure entry point.
+ */
+export declare const simRoute53KskFlag = 257;
+export declare const simRoute53SigningAlgorithmMnemonic = "ECDSAP256SHA256";
+export declare const simRoute53SigningAlgorithmType = 13;
+export declare const simRoute53DigestAlgorithmMnemonic = "SHA-256";
+export declare const simRoute53DigestAlgorithmType = 2;
+/**
+ * The DNSKEY protocol field, which RFC 4034 fixes at 3.
+ */
+export declare const simRoute53DnskeyProtocol = 3;
+//# sourceMappingURL=sim-route53-dnssec-algorithm.d.ts.map

package/dist/service/route53/dnssec/sim-route53-dnssec-algorithm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-dnssec-algorithm.d.ts","sourceRoot":"","sources":["../../../../src/service/route53/dnssec/sim-route53-dnssec-algorithm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,kCAAkC,oBAAoB,CAAC;AACpE,eAAO,MAAM,8BAA8B,KAAK,CAAC;AACjD,eAAO,MAAM,iCAAiC,YAAY,CAAC;AAC3D,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C;;GAEG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC"}

package/dist/service/route53/dnssec/sim-route53-dnssec-algorithm.js

@@ -0,0 +1,18 @@
+/**
+ * The DNSSEC parameters of a Route53 key-signing key.
+ *
+ * Route53 only accepts an ECC_NIST_P256 customer managed key, so there is one
+ * algorithm here rather than a table: ECDSA with SHA-256, algorithm 13, and
+ * the SHA-256 delegation signer digest, algorithm 2. A key-signing key always
+ * carries flag 257, the secure entry point.
+ */
+export const simRoute53KskFlag = 257;
+export const simRoute53SigningAlgorithmMnemonic = "ECDSAP256SHA256";
+export const simRoute53SigningAlgorithmType = 13;
+export const simRoute53DigestAlgorithmMnemonic = "SHA-256";
+export const simRoute53DigestAlgorithmType = 2;
+/**
+ * The DNSKEY protocol field, which RFC 4034 fixes at 3.
+ */
+export const simRoute53DnskeyProtocol = 3;
+//# sourceMappingURL=sim-route53-dnssec-algorithm.js.map

package/dist/service/route53/dnssec/sim-route53-dnssec-algorithm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-dnssec-algorithm.js","sourceRoot":"","sources":["../../../../src/service/route53/dnssec/sim-route53-dnssec-algorithm.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,kCAAkC,GAAG,iBAAiB,CAAC;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AACjD,MAAM,CAAC,MAAM,iCAAiC,GAAG,SAAS,CAAC;AAC3D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAE/C;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC"}

package/dist/service/route53/dnssec/sim-route53-key-signing-key.d.ts

@@ -0,0 +1,95 @@
+/**
+ * The statuses a key-signing key can hold here.
+ *
+ * Real Route53 also has DELETING and the two failure statuses, which describe
+ * a key mid-operation or a zone that needs attention. Nothing in this
+ * simulation produces either, so a key is one of these two.
+ */
+export declare const SimRoute53KeySigningKeyStatus: {
+    readonly Active: "ACTIVE";
+    readonly Inactive: "INACTIVE";
+};
+export type SimRoute53KeySigningKeyStatus = (typeof SimRoute53KeySigningKeyStatus)[keyof typeof SimRoute53KeySigningKeyStatus];
+interface SimRoute53KeySigningKeyProperties {
+    readonly name: string;
+    readonly kmsArn: string;
+    readonly hostedZoneId: string;
+    readonly zoneName: string;
+    readonly publicKeyDer: Uint8Array;
+    readonly status: SimRoute53KeySigningKeyStatus;
+    readonly createdDate: Date;
+}
+/**
+ * The AWS-shaped view of a key-signing key, as GetDNSSEC returns it.
+ */
+export interface SimRoute53KeySigningKeyView {
+    readonly Name: string;
+    readonly KmsArn: string;
+    readonly Flag: number;
+    readonly SigningAlgorithmMnemonic: string;
+    readonly SigningAlgorithmType: number;
+    readonly DigestAlgorithmMnemonic: string;
+    readonly DigestAlgorithmType: number;
+    readonly KeyTag: number;
+    readonly DigestValue: string;
+    readonly PublicKey: string;
+    readonly DSRecord: string;
+    readonly DNSKEYRecord: string;
+    readonly Status: SimRoute53KeySigningKeyStatus;
+    readonly CreatedDate: Date;
+    readonly LastModifiedDate: Date;
+}
+/**
+ * A simulated Route53 key-signing key.
+ *
+ * The key itself lives in KMS. What is held here is what Route53 adds: a name
+ * within the zone, a status, and the DNSSEC parameters derived from the KMS
+ * key's public key at the moment the key-signing key was created. Real Route53
+ * derives them once in the same way, which is why rotating the KMS key is not
+ * a thing you can do to an existing key-signing key.
+ */
+export declare class SimRoute53KeySigningKey {
+    #private;
+    readonly name: string;
+    readonly kmsArn: string;
+    /**
+     * The Hosted Zone this key belongs to. A key-signing key is only ever
+     * identified alongside its zone, which is why its CloudFormation Ref is the
+     * two joined together.
+     */
+    readonly hostedZoneId: string;
+    private readonly zoneName;
+    private readonly dnskey;
+    private readonly createdDate;
+    constructor(properties: SimRoute53KeySigningKeyProperties);
+    /**
+     * Whether this key is being used to sign the zone.
+     */
+    get isActive(): boolean;
+    /**
+     * The DS record this key's registrar is given.
+     */
+    get dsRecord(): string;
+    /**
+     * Start signing with this key.
+     */
+    activate(modifiedDate: Date): void;
+    /**
+     * Stop signing with this key, leaving it on the zone.
+     */
+    deactivate(modifiedDate: Date): void;
+    /**
+     * Refuse removal of a key that is still signing.
+     *
+     * Real Route53 will not delete an active key-signing key, because doing so
+     * would leave the zone signed with a key resolvers can no longer find.
+     */
+    requireRemovable(): void;
+    /**
+     * Describe this key the way GetDNSSEC reports it.
+     */
+    describe(): SimRoute53KeySigningKeyView;
+    private setStatus;
+}
+export {};
+//# sourceMappingURL=sim-route53-key-signing-key.d.ts.map

package/dist/service/route53/dnssec/sim-route53-key-signing-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-key-signing-key.d.ts","sourceRoot":"","sources":["../../../../src/service/route53/dnssec/sim-route53-key-signing-key.ts"],"names":[],"mappings":"AAUA;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B;aACxC,MAAM,EAAE,QAAQ;aAChB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,MAAM,6BAA6B,GACvC,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,OAAO,6BAA6B,CAAC,CAAC;AAErF,UAAU,iCAAiC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC;IAC/C,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC;IAC/C,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC;CACjC;AAED;;;;;;;;GAQG;AACH,qBAAa,uBAAuB;;IAClC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B;;;;OAIG;IACH,SAAgB,YAAY,EAAE,MAAM,CAAC;IAErC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAO;IAInC,YAAY,UAAU,EAAE,iCAAiC,EASxD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAEjC;IAED;;OAEG;IACH,UAAU,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAEnC;IAED;;;;;OAKG;IACH,gBAAgB,IAAI,IAAI,CAMvB;IAED;;OAEG;IACH,QAAQ,IAAI,2BAA2B,CAkBtC;IAED,OAAO,CAAC,SAAS;CAOlB"}

package/dist/service/route53/dnssec/sim-route53-key-signing-key.js

@@ -0,0 +1,110 @@
+import { SimRoute53InvalidKeySigningKeyStatus } from "../error/sim-route53.error.js";
+import { SimRoute53Dnskey } from "./sim-route53-dnskey.js";
+import { simRoute53DigestAlgorithmMnemonic, simRoute53DigestAlgorithmType, simRoute53KskFlag, simRoute53SigningAlgorithmMnemonic, simRoute53SigningAlgorithmType, } from "./sim-route53-dnssec-algorithm.js";
+/**
+ * The statuses a key-signing key can hold here.
+ *
+ * Real Route53 also has DELETING and the two failure statuses, which describe
+ * a key mid-operation or a zone that needs attention. Nothing in this
+ * simulation produces either, so a key is one of these two.
+ */
+export const SimRoute53KeySigningKeyStatus = {
+    Active: "ACTIVE",
+    Inactive: "INACTIVE",
+};
+/**
+ * A simulated Route53 key-signing key.
+ *
+ * The key itself lives in KMS. What is held here is what Route53 adds: a name
+ * within the zone, a status, and the DNSSEC parameters derived from the KMS
+ * key's public key at the moment the key-signing key was created. Real Route53
+ * derives them once in the same way, which is why rotating the KMS key is not
+ * a thing you can do to an existing key-signing key.
+ */
+export class SimRoute53KeySigningKey {
+    name;
+    kmsArn;
+    /**
+     * The Hosted Zone this key belongs to. A key-signing key is only ever
+     * identified alongside its zone, which is why its CloudFormation Ref is the
+     * two joined together.
+     */
+    hostedZoneId;
+    zoneName;
+    dnskey;
+    createdDate;
+    #status;
+    #lastModifiedDate;
+    constructor(properties) {
+        this.name = properties.name;
+        this.kmsArn = properties.kmsArn;
+        this.hostedZoneId = properties.hostedZoneId;
+        this.zoneName = properties.zoneName;
+        this.dnskey = new SimRoute53Dnskey(properties.publicKeyDer);
+        this.createdDate = properties.createdDate;
+        this.#status = properties.status;
+        this.#lastModifiedDate = properties.createdDate;
+    }
+    /**
+     * Whether this key is being used to sign the zone.
+     */
+    get isActive() {
+        return this.#status === SimRoute53KeySigningKeyStatus.Active;
+    }
+    /**
+     * The DS record this key's registrar is given.
+     */
+    get dsRecord() {
+        return this.dnskey.dsRecord(this.zoneName);
+    }
+    /**
+     * Start signing with this key.
+     */
+    activate(modifiedDate) {
+        this.setStatus(SimRoute53KeySigningKeyStatus.Active, modifiedDate);
+    }
+    /**
+     * Stop signing with this key, leaving it on the zone.
+     */
+    deactivate(modifiedDate) {
+        this.setStatus(SimRoute53KeySigningKeyStatus.Inactive, modifiedDate);
+    }
+    /**
+     * Refuse removal of a key that is still signing.
+     *
+     * Real Route53 will not delete an active key-signing key, because doing so
+     * would leave the zone signed with a key resolvers can no longer find.
+     */
+    requireRemovable() {
+        if (this.isActive) {
+            throw new SimRoute53InvalidKeySigningKeyStatus(`Key signing key ${this.name} is ACTIVE and cannot be deleted: deactivate it first`);
+        }
+    }
+    /**
+     * Describe this key the way GetDNSSEC reports it.
+     */
+    describe() {
+        return {
+            Name: this.name,
+            KmsArn: this.kmsArn,
+            Flag: simRoute53KskFlag,
+            SigningAlgorithmMnemonic: simRoute53SigningAlgorithmMnemonic,
+            SigningAlgorithmType: simRoute53SigningAlgorithmType,
+            DigestAlgorithmMnemonic: simRoute53DigestAlgorithmMnemonic,
+            DigestAlgorithmType: simRoute53DigestAlgorithmType,
+            KeyTag: this.dnskey.keyTag,
+            DigestValue: this.dnskey.digestValue(this.zoneName),
+            PublicKey: this.dnskey.publicKey,
+            DSRecord: this.dsRecord,
+            DNSKEYRecord: this.dnskey.dnskeyRecord(),
+            Status: this.#status,
+            CreatedDate: new Date(this.createdDate),
+            LastModifiedDate: new Date(this.#lastModifiedDate),
+        };
+    }
+    setStatus(status, modifiedDate) {
+        this.#status = status;
+        this.#lastModifiedDate = modifiedDate;
+    }
+}
+//# sourceMappingURL=sim-route53-key-signing-key.js.map

package/dist/service/route53/dnssec/sim-route53-key-signing-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-key-signing-key.js","sourceRoot":"","sources":["../../../../src/service/route53/dnssec/sim-route53-key-signing-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,iBAAiB,EACjB,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,mCAAmC,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAoCX;;;;;;;;GAQG;AACH,MAAM,OAAO,uBAAuB;IAClB,IAAI,CAAS;IACb,MAAM,CAAS;IAE/B;;;;OAIG;IACa,YAAY,CAAS;IAEpB,QAAQ,CAAS;IACjB,MAAM,CAAmB;IACzB,WAAW,CAAO;IACnC,OAAO,CAAgC;IACvC,iBAAiB,CAAO;IAExB,YAAY,UAA6C;QACvD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,gBAAgB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,WAAW,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,OAAO,KAAK,6BAA6B,CAAC,MAAM,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,YAAkB;QACzB,IAAI,CAAC,SAAS,CAAC,6BAA6B,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,YAAkB;QAC3B,IAAI,CAAC,SAAS,CAAC,6BAA6B,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,gBAAgB;QACd,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,oCAAoC,CAC5C,mBAAmB,IAAI,CAAC,IAAI,uDAAuD,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,iBAAiB;YACvB,wBAAwB,EAAE,kCAAkC;YAC5D,oBAAoB,EAAE,8BAA8B;YACpD,uBAAuB,EAAE,iCAAiC;YAC1D,mBAAmB,EAAE,6BAA6B;YAClD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE;YACxC,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;YACvC,gBAAgB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;SACnD,CAAC;IACJ,CAAC;IAEO,SAAS,CACf,MAAqC,EACrC,YAAkB;QAElB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,iBAAiB,GAAG,YAAY,CAAC;IACxC,CAAC;CACF"}

package/dist/service/route53/dnssec/sim-route53-zone-dnssec.d.ts

@@ -0,0 +1,75 @@
+import type { SimRoute53KeySigningKey } from "./sim-route53-key-signing-key.js";
+/**
+ * Whether a zone is being signed.
+ *
+ * Real Route53 also reports DELETING while signing is being taken off, and two
+ * statuses for a zone that needs attention. Nothing here leaves a zone in any
+ * of those, so a zone is signing or it is not.
+ */
+export declare const SimRoute53ServeSignature: {
+    readonly Signing: "SIGNING";
+    readonly NotSigning: "NOT_SIGNING";
+};
+export type SimRoute53ServeSignature = (typeof SimRoute53ServeSignature)[keyof typeof SimRoute53ServeSignature];
+/**
+ * The DNSSEC state of one hosted zone: its key-signing keys, and whether the
+ * zone is signed with them.
+ *
+ * The two are separate on real Route53 and stay separate here. Adding a
+ * key-signing key does not start signing, and stopping signing leaves the keys
+ * in place, which is what makes it possible to prepare a zone for DNSSEC
+ * before the DS record is published.
+ */
+export declare class SimRoute53ZoneDnssec {
+    #private;
+    private readonly keySigningKeys;
+    /**
+     * Whether the zone is being signed.
+     */
+    get serveSignature(): SimRoute53ServeSignature;
+    /**
+     * Every key-signing key on the zone, in the order they were added.
+     */
+    keys(): readonly SimRoute53KeySigningKey[];
+    /**
+     * Add a key-signing key to the zone.
+     *
+     * A name is unique within the zone, and so is the KMS key behind it: real
+     * Route53 refuses both, because two keys sharing either would be
+     * indistinguishable in the zone's DNSKEY set.
+     */
+    add(keySigningKey: SimRoute53KeySigningKey): void;
+    /**
+     * Find a key-signing key by name, or refuse an unknown one.
+     */
+    require(name: string): SimRoute53KeySigningKey;
+    /**
+     * Remove a key-signing key, refusing one that is still signing.
+     */
+    remove(name: string): void;
+    /**
+     * Start signing the zone.
+     *
+     * A zone with no active key-signing key has nothing to sign with, which real
+     * Route53 refuses rather than reporting a signed zone no resolver could
+     * validate.
+     */
+    enableSigning(): void;
+    /**
+     * Refuse deletion of the Hosted Zone while it is still being signed.
+     *
+     * Real Route53 will not delete a signed zone: DNSSEC has to be disabled
+     * first, so the DS record at the parent stops pointing at a zone that has
+     * gone.
+     *
+     * Which error it answers with is not documented among DeleteHostedZone's
+     * errors, so this reports the InvalidInput that operation does document
+     * rather than claiming a code that may not be the one AWS sends.
+     */
+    assertZoneDeletable(): void;
+    /**
+     * Stop signing the zone, leaving its key-signing keys in place.
+     */
+    disableSigning(): void;
+}
+//# sourceMappingURL=sim-route53-zone-dnssec.d.ts.map

package/dist/service/route53/dnssec/sim-route53-zone-dnssec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-zone-dnssec.d.ts","sourceRoot":"","sources":["../../../../src/service/route53/dnssec/sim-route53-zone-dnssec.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEhF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;aACnC,OAAO,EAAE,SAAS;aAClB,UAAU,EAAE,aAAa;CACjB,CAAC;AAEX,MAAM,MAAM,wBAAwB,GAClC,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,OAAO,wBAAwB,CAAC,CAAC;AAE3E;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8C;IAI7E;;OAEG;IACH,IAAI,cAAc,IAAI,wBAAwB,CAE7C;IAED;;OAEG;IACH,IAAI,IAAI,SAAS,uBAAuB,EAAE,CAEzC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,aAAa,EAAE,uBAAuB,GAAG,IAAI,CAchD;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAU7C;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGzB;IAED;;;;;;OAMG;IACH,aAAa,IAAI,IAAI,CAQpB;IAED;;;;;;;;;;OAUG;IACH,mBAAmB,IAAI,IAAI,CAM1B;IAED;;OAEG;IACH,cAAc,IAAI,IAAI,CAQrB;CACF"}