@kensio/yulin 1.12.1 → 1.14.0

package/dist/service/eventbridge/target/sim-event-target.d.ts

@@ -1,4 +1,5 @@
 import { SimEventTargetArn } from "./sim-event-target-arn.js";
+import { SimEventTargetEcs, type SimEventTargetTaskProperties } from "./sim-event-target-ecs.js";
 /**
  * One place a rule sends the events it matches.
  *
@@ -20,14 +21,21 @@ export declare class SimEventTarget {
      * know that something happened.
      */
     readonly input: string | undefined;
+    /**
+     * What this target says about the ECS task it runs, where it runs one.
+     *
+     * An ECS target is the one target type here whose `Input` is not what the
+     * target receives: a task has nowhere to receive a payload, so the `Input`
+     * is what the task overrides instead.
+     */
+    readonly ecs: SimEventTargetEcs | undefined;
     private constructor();
     /**
      * Read a target from request input.
      */
-    static of(properties: {
+    static of(properties: SimEventTargetTaskProperties & {
         readonly Id?: string | undefined;
         readonly Arn?: string | undefined;
-        readonly Input?: string | undefined;
     }): SimEventTarget;
     /**
      * Read a target's fixed input, which has to be JSON.

package/dist/service/eventbridge/target/sim-event-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-event-target.d.ts","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAc9D;;;;;;;GAOG;AACH,qBAAa,cAAc;IACzB,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,GAAG,EAAE,iBAAiB,CAAC;IAEvC;;;;;;;;OAQG;IACH,SAAgB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C,OAAO,eAIN;IAED;;OAEG;IACH,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE;QACpB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACrC,GAAG,cAAc,CAMjB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,SAAS;IAgBxB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU;CAiB1B"}
+{"version":3,"file":"sim-event-target.d.ts","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,KAAK,4BAA4B,EAClC,MAAM,2BAA2B,CAAC;AAenC;;;;;;;GAOG;AACH,qBAAa,cAAc;IACzB,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,GAAG,EAAE,iBAAiB,CAAC;IAEvC;;;;;;;;OAQG;IACH,SAAgB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C;;;;;;OAMG;IACH,SAAgB,GAAG,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAEnD,OAAO,eAKN;IAED;;OAEG;IACH,MAAM,CAAC,EAAE,CACP,UAAU,EAAE,4BAA4B,GAAG;QACzC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACnC,GACA,cAAc,CAShB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,SAAS;IAgBxB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU;CAiB1B"}

package/dist/service/eventbridge/target/sim-event-target.js

@@ -1,5 +1,6 @@
 import { SimEventBridgeValidationException } from "../error/sim-event-bridge.error.js";
 import { SimEventTargetArn } from "./sim-event-target-arn.js";
+import { SimEventTargetEcs, } from "./sim-event-target-ecs.js";
 /**
  * Real EventBridge allows alphanumerics, full stops, hyphens and underscores,
  * up to 64 characters, for a target id.
@@ -26,19 +27,30 @@ export class SimEventTarget {
      * know that something happened.
      */
     input;
+    /**
+     * What this target says about the ECS task it runs, where it runs one.
+     *
+     * An ECS target is the one target type here whose `Input` is not what the
+     * target receives: a task has nowhere to receive a payload, so the `Input`
+     * is what the task overrides instead.
+     */
+    ecs;
     constructor(properties) {
         this.id = properties.id;
         this.arn = properties.arn;
         this.input = properties.input;
+        this.ecs = properties.ecs;
     }
     /**
      * Read a target from request input.
      */
     static of(properties) {
+        const arn = SimEventTargetArn.of(properties.Arn);
         return new this({
             id: this.requiredId(properties.Id),
-            arn: SimEventTargetArn.of(properties.Arn),
+            arn,
             input: this.readInput(properties.Input),
+            ecs: SimEventTargetEcs.of(arn, properties),
         });
     }
     /**

package/dist/service/eventbridge/target/sim-event-target.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-event-target.js","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;GAGG;AACH,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAQlD;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IACT,EAAE,CAAS;IACX,GAAG,CAAoB;IAEvC;;;;;;;;OAQG;IACa,KAAK,CAAqB;IAE1C,YAAoB,UAAoC;QACtD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,EAAE,CAAC,UAIT;QACC,OAAO,IAAI,IAAI,CAAC;YACd,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,GAAG,EAAE,iBAAiB,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YACzC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,SAAS,CAAC,KAAyB;QAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iCAAiC,CACzC,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,UAAU,CAAC,EAAsB;QAC9C,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,iCAAiC,CACzC,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,EAAE,0BAA0B;gBACnE,mEAAmE;gBACnE,oEAAoE,CACvE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}
+{"version":3,"file":"sim-event-target.js","sourceRoot":"","sources":["../../../../src/service/eventbridge/target/sim-event-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,iBAAiB,GAElB,MAAM,2BAA2B,CAAC;AAEnC;;;GAGG;AACH,MAAM,eAAe,GAAG,yBAAyB,CAAC;AASlD;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IACT,EAAE,CAAS;IACX,GAAG,CAAoB;IAEvC;;;;;;;;OAQG;IACa,KAAK,CAAqB;IAE1C;;;;;;OAMG;IACa,GAAG,CAAgC;IAEnD,YAAoB,UAAoC;QACtD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,EAAE,CACP,UAGC;QAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAEjD,OAAO,IAAI,IAAI,CAAC;YACd,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,GAAG;YACH,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;YACvC,GAAG,EAAE,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,CAAC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,SAAS,CAAC,KAAyB;QAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iCAAiC,CACzC,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,UAAU,CAAC,EAAsB;QAC9C,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,iCAAiC,CACzC,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,EAAE,0BAA0B;gBACnE,mEAAmE;gBACnE,oEAAoE,CACvE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/service/iam/index.d.ts

@@ -6,5 +6,6 @@ export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSign
 export type { SimIamSigV4ExpectedScope } from "./sigv4/sim-iam-sigv4-expected-scope.js";
 export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
 export { type SimAwsRequestAuthMethod, SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";
+export { SimAwsRequestSource, simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./request/sim-aws-request-source.js";
 export { isSimAwsRequestAuthFailure, SimAwsInvalidCallerHeader, type SimAwsRequestAuthFailure, } from "./request/error/sim-aws-request-auth.error.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/service/iam/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,YAAY,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,KAAK,uBAAuB,EAC5B,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,YAAY,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,KAAK,oBAAoB,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,KAAK,uBAAuB,EAC5B,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC"}

package/dist/service/iam/index.js

@@ -3,5 +3,6 @@ export { SimIamAccessDenied, SimIamError } from "./error/sim-iam.error.js";
 export { SimIamCredentialScopeMismatch, SimIamExpiredToken, SimIamIncompleteSignature, SimIamInvalidClientTokenId, SimIamSignatureDoesNotMatch, SimIamSigV4Error, } from "./sigv4/error/sim-iam-sigv4.error.js";
 export { simAwsCallerHeaderName, simAwsCallerHeaderPrincipal, simAwsCallerHeaderValue, } from "./request/sim-aws-caller-header.js";
 export { SimAwsRequestCaller, } from "./request/sim-aws-request-caller.js";
+export { SimAwsRequestSource, simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./request/sim-aws-request-source.js";
 export { isSimAwsRequestAuthFailure, SimAwsInvalidCallerHeader, } from "./request/error/sim-aws-request-auth.error.js";
 //# sourceMappingURL=index.js.map

package/dist/service/iam/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG3E,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,GAEjB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,+CAA+C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/iam/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG3E,OAAO,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,GAEjB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,+CAA+C,CAAC"}

package/dist/service/iam/request/sim-aws-control-headers.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Header names that are instructions to the simulator rather than part of the
+ * request being simulated.
+ *
+ * They state who a request is from and what it is for, so anything passing a
+ * request on to a simulated service has to decide what to do with them rather
+ * than forward them by accident: the HTTP boundary strips them once the
+ * request has been attributed, and sim CloudFront strips a viewer's before
+ * deciding for itself what an Origin request says.
+ */
+export declare const simAwsControlHeaderNames: readonly string[];
+/**
+ * Remove the simulator's control headers from a set of request headers.
+ */
+export declare function stripSimAwsControlHeaders(headers: Headers): void;
+//# sourceMappingURL=sim-aws-control-headers.d.ts.map

package/dist/service/iam/request/sim-aws-control-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-control-headers.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-control-headers.ts"],"names":[],"mappings":"AAMA;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAIrD,CAAC;AAEF;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAIhE"}

package/dist/service/iam/request/sim-aws-control-headers.js

@@ -0,0 +1,26 @@
+import { simAwsCallerHeaderName } from "./sim-aws-caller-header.js";
+import { simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "./sim-aws-request-source.js";
+/**
+ * Header names that are instructions to the simulator rather than part of the
+ * request being simulated.
+ *
+ * They state who a request is from and what it is for, so anything passing a
+ * request on to a simulated service has to decide what to do with them rather
+ * than forward them by accident: the HTTP boundary strips them once the
+ * request has been attributed, and sim CloudFront strips a viewer's before
+ * deciding for itself what an Origin request says.
+ */
+export const simAwsControlHeaderNames = [
+    simAwsCallerHeaderName,
+    simAwsSourceArnHeaderName,
+    simAwsSourceAccountHeaderName,
+];
+/**
+ * Remove the simulator's control headers from a set of request headers.
+ */
+export function stripSimAwsControlHeaders(headers) {
+    for (const name of simAwsControlHeaderNames) {
+        headers.delete(name);
+    }
+}
+//# sourceMappingURL=sim-aws-control-headers.js.map

package/dist/service/iam/request/sim-aws-control-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-control-headers.js","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-control-headers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,sBAAsB;IACtB,yBAAyB;IACzB,6BAA6B;CAC9B,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,KAAK,MAAM,IAAI,IAAI,wBAAwB,EAAE,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/service/iam/request/sim-aws-request-source.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The header naming the AWS resource a request is being made on behalf of.
+ *
+ * When one AWS service calls another it says what it is calling for, and IAM
+ * supplies that as `aws:SourceArn`. A resource policy granting a service
+ * principal is normally conditioned on it, so that a Distribution or a Bucket
+ * can be granted rather than the whole service. Nothing about an HTTP request
+ * arriving in process says any of that, so the caller states it the same way it
+ * states who it is.
+ */
+export declare const simAwsSourceArnHeaderName = "x-sim-aws-source-arn";
+/**
+ * The header naming the Account owning the resource the request is made on
+ * behalf of, supplied by IAM as `aws:SourceAccount`.
+ */
+export declare const simAwsSourceAccountHeaderName = "x-sim-aws-source-account";
+interface SimAwsRequestSourceProperties {
+    readonly arn?: string | undefined;
+    readonly accountId?: string | undefined;
+}
+/**
+ * What a request says it is being made on behalf of.
+ *
+ * This is separate from the caller: the caller is who is asking, and this is
+ * which of their resources they are asking for. Only a service principal has
+ * one in practice, since that is the case AWS supplies the condition keys for.
+ */
+export declare class SimAwsRequestSource {
+    readonly arn: string | undefined;
+    readonly accountId: string | undefined;
+    constructor(properties: SimAwsRequestSourceProperties);
+    /**
+     * Read the source a request states, or nothing when it states none.
+     *
+     * A request carrying neither header has no source rather than an empty one,
+     * so a policy conditioned on either fails to match instead of matching an
+     * empty string. A header present but empty is the same thing said a
+     * different way, and is read the same, since no AWS service names a resource
+     * by sending nothing.
+     */
+    static fromHeaders(headers: Headers): SimAwsRequestSource | undefined;
+}
+export {};
+//# sourceMappingURL=sim-aws-request-source.d.ts.map

package/dist/service/iam/request/sim-aws-request-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-source.d.ts","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE,UAAU,6BAA6B;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAED;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,SAAgB,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,SAAgB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAE9C,YAAY,UAAU,EAAE,6BAA6B,EAGpD;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CASpE;CACF"}

package/dist/service/iam/request/sim-aws-request-source.js

@@ -0,0 +1,58 @@
+/**
+ * The header naming the AWS resource a request is being made on behalf of.
+ *
+ * When one AWS service calls another it says what it is calling for, and IAM
+ * supplies that as `aws:SourceArn`. A resource policy granting a service
+ * principal is normally conditioned on it, so that a Distribution or a Bucket
+ * can be granted rather than the whole service. Nothing about an HTTP request
+ * arriving in process says any of that, so the caller states it the same way it
+ * states who it is.
+ */
+export const simAwsSourceArnHeaderName = "x-sim-aws-source-arn";
+/**
+ * The header naming the Account owning the resource the request is made on
+ * behalf of, supplied by IAM as `aws:SourceAccount`.
+ */
+export const simAwsSourceAccountHeaderName = "x-sim-aws-source-account";
+/**
+ * What a request says it is being made on behalf of.
+ *
+ * This is separate from the caller: the caller is who is asking, and this is
+ * which of their resources they are asking for. Only a service principal has
+ * one in practice, since that is the case AWS supplies the condition keys for.
+ */
+export class SimAwsRequestSource {
+    arn;
+    accountId;
+    constructor(properties) {
+        this.arn = properties.arn;
+        this.accountId = properties.accountId;
+    }
+    /**
+     * Read the source a request states, or nothing when it states none.
+     *
+     * A request carrying neither header has no source rather than an empty one,
+     * so a policy conditioned on either fails to match instead of matching an
+     * empty string. A header present but empty is the same thing said a
+     * different way, and is read the same, since no AWS service names a resource
+     * by sending nothing.
+     */
+    static fromHeaders(headers) {
+        const arn = stated(headers.get(simAwsSourceArnHeaderName));
+        const accountId = stated(headers.get(simAwsSourceAccountHeaderName));
+        if (arn === undefined && accountId === undefined) {
+            return undefined;
+        }
+        return new SimAwsRequestSource({ arn, accountId });
+    }
+}
+/**
+ * One header value, or nothing when the request did not really state it.
+ */
+function stated(value) {
+    if (value === null || value.trim().length === 0) {
+        return undefined;
+    }
+    return value;
+}
+//# sourceMappingURL=sim-aws-request-source.js.map

package/dist/service/iam/request/sim-aws-request-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-source.js","sourceRoot":"","sources":["../../../../src/service/iam/request/sim-aws-request-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AAOxE;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACd,GAAG,CAAqB;IACxB,SAAS,CAAqB;IAE9C,YAAY,UAAyC;QACnD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,WAAW,CAAC,OAAgB;QACjC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC;QAErE,IAAI,GAAG,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,mBAAmB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACrD,CAAC;CACF;AAED;;GAEG;AACH,SAAS,MAAM,CAAC,KAAoB;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/service/kms/command/key/sim-kms-key-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAGzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,UAAU,2BAA2B;IACnC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;CAC1C;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D,YAAY,UAAU,EAAE,2BAA2B,EAKlD;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,yBAAyB,CAgB3B;IAED;;OAEG;IACH,QAAQ,CACN,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,2BAA2B,CAK7B;CACF"}
+{"version":3,"file":"sim-kms-key-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAGzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,UAAU,2BAA2B;IACnC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;CAC1C;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D,YAAY,UAAU,EAAE,2BAA2B,EAKlD;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,yBAAyB,CAiB3B;IAED;;OAEG;IACH,QAAQ,CACN,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,2BAA2B,CAK7B;CACF"}

package/dist/service/kms/command/key/sim-kms-key-commands.js

@@ -24,11 +24,12 @@ export class SimKmsKeyCommands {
      * resource-level permissions for the same reason.
      */
     create(command, options) {
-        this.keyType.require(command.input.KeyUsage, command.input.KeySpec, command.input.Origin);
+        const keySpec = this.keyType.require(command.input.KeyUsage, command.input.KeySpec, command.input.Origin);
         this.authorizer.authorizeAccount("kms:CreateKey", options);
         const key = this.keyFactory.make({
             description: command.input.Description,
             policy: this.policyDocument.parseOptional(command.input.Policy),
+            keySpec,
         });
         this.keys.add(key);
         return { $metadata: {}, KeyMetadata: this.metadata.describe(key) };

package/dist/service/kms/command/key/sim-kms-key-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-commands.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAkBtD;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACX,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,UAAU,CAAmB;IAC7B,QAAQ,CAAwB;IAChC,OAAO,GAAG,IAAI,aAAa,EAAE,CAAC;IAC9B,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7D,YAAY,UAAuC;QACjD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAA4B,EAC5B,OAA8B;QAE9B,IAAI,CAAC,OAAO,CAAC,OAAO,CAClB,OAAO,CAAC,KAAK,CAAC,QAAQ,EACtB,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,OAAO,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3D,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAC/B,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;YACtC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;SAChE,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEnB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,QAAQ,CACN,OAA8B,EAC9B,OAA8B;QAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAE9D,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC;CACF"}
+{"version":3,"file":"sim-kms-key-commands.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-commands.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAkBtD;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACX,IAAI,CAAiB;IACrB,UAAU,CAAmB;IAC7B,UAAU,CAAmB;IAC7B,QAAQ,CAAwB;IAChC,OAAO,GAAG,IAAI,aAAa,EAAE,CAAC;IAC9B,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAE7D,YAAY,UAAuC;QACjD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,OAA4B,EAC5B,OAA8B;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAClC,OAAO,CAAC,KAAK,CAAC,QAAQ,EACtB,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,OAAO,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE3D,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAC/B,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;YACtC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAC/D,OAAO;SACR,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEnB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,QAAQ,CACN,OAA8B,EAC9B,OAA8B;QAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,iBAAiB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAE9D,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC;CACF"}

package/dist/service/kms/command/key/sim-kms-key-type.d.ts

@@ -1,14 +1,52 @@
+import { type SimKmsKeySpec } from "../../key/spec/sim-kms-key-spec.js";
 /**
- * Checks a requested key type against what this simulation models.
+ * Resolves the key spec a CreateKey request asks for.
  *
- * Asymmetric keys, HMAC keys and imported material all behave differently
- * enough that pretending a symmetric key is one of them would make a passing
- * test meaningless, so an unmodelled type is refused rather than substituted.
+ * A key spec and key usage pair says what the key is, so a pair this
+ * simulation does not model is refused rather than substituted: asymmetric
+ * encryption, HMAC and key agreement keys all behave differently enough that a
+ * signing key or a symmetric one standing in for them would make a passing
+ * test meaningless. Imported key material is refused for the same reason.
  */
 export declare class SimKmsKeyType {
     /**
-     * Refuse a key type this simulation does not model.
+     * Resolve a requested key type, or refuse one this simulation does not
+     * model.
      */
-    require(keyUsage: string | undefined, keySpec: string | undefined, origin: string | undefined): void;
+    require(keyUsage: string | undefined, keySpec: string | undefined, origin: string | undefined): SimKmsKeySpec;
+    /**
+     * Refuse a key usage no simulated key spec has.
+     *
+     * HMAC and key agreement keys are the two this rules out. Neither has a spec
+     * here at all, so saying the usage is unsimulated is more use than sending
+     * the caller looking for a spec that would allow it.
+     */
+    private requireSimulatedKeyUsage;
+    /**
+     * Refuse key material this simulation does not generate itself.
+     */
+    private requireSimulatedOrigin;
+    /**
+     * Resolve a key spec name, or refuse one this simulation does not create.
+     */
+    private requireSimulatedSpec;
+    /**
+     * Refuse a key usage the resolved spec does not have here.
+     *
+     * Real KMS offers the RSA specs for encryption as well as signing, and
+     * offers no spec at all for a `SIGN_VERIFY` key that names none. Both of
+     * those come out here, and the two need different explanations, so the
+     * refusal says which case it is rather than repeating the pair back.
+     */
+    private requireSpecAllowsUsage;
+    /**
+     * Refuse a spec that cannot take the default key usage.
+     *
+     * `KeyUsage` is optional only for a symmetric encryption key. Every other
+     * spec requires it, so leaving it out is a request AWS refuses rather than
+     * one it fills in, and filling it in here would create a key real KMS would
+     * not have made.
+     */
+    private requireDefaultableSpec;
 }
 //# sourceMappingURL=sim-kms-key-type.d.ts.map

package/dist/service/kms/command/key/sim-kms-key-type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-type.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-type.ts"],"names":[],"mappings":"AAYA;;;;;;GAMG;AACH,qBAAa,aAAa;IACxB;;OAEG;IACH,OAAO,CACL,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,IAAI,CAkBN;CACF"}
+{"version":3,"file":"sim-kms-key-type.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-type.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,oCAAoC,CAAC;AAiB5C;;;;;;;;GAQG;AACH,qBAAa,aAAa;IACxB;;;OAGG;IACH,OAAO,CACL,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,aAAa,CAWf;IAED;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IAUhC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAQ9B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAY5B;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IA0B9B;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;CAS/B"}

package/dist/service/kms/command/key/sim-kms-key-type.js

@@ -1,31 +1,100 @@
 import { SimKmsInvalidKeyUsageException, SimKmsValidationException, } from "../../error/sim-kms.error.js";
+import { SimKmsKeyUsage, } from "../../key/spec/sim-kms-key-spec.js";
+import { simKmsKeySpecNames, simKmsKeySpecs, simKmsSymmetricKeySpecName, } from "../../key/spec/sim-kms-key-specs.js";
+const kmsOrigin = "AWS_KMS";
 /**
- * The only key type this simulation models.
+ * The key usages this simulation has key specs for.
  */
-const symmetricKeySpec = "SYMMETRIC_DEFAULT";
-const encryptDecryptUsage = "ENCRYPT_DECRYPT";
-const kmsOrigin = "AWS_KMS";
+const simKmsKeyUsages = new Set([
+    SimKmsKeyUsage.EncryptDecrypt,
+    SimKmsKeyUsage.SignVerify,
+]);
 /**
- * Checks a requested key type against what this simulation models.
+ * Resolves the key spec a CreateKey request asks for.
  *
- * Asymmetric keys, HMAC keys and imported material all behave differently
- * enough that pretending a symmetric key is one of them would make a passing
- * test meaningless, so an unmodelled type is refused rather than substituted.
+ * A key spec and key usage pair says what the key is, so a pair this
+ * simulation does not model is refused rather than substituted: asymmetric
+ * encryption, HMAC and key agreement keys all behave differently enough that a
+ * signing key or a symmetric one standing in for them would make a passing
+ * test meaningless. Imported key material is refused for the same reason.
  */
 export class SimKmsKeyType {
     /**
-     * Refuse a key type this simulation does not model.
+     * Resolve a requested key type, or refuse one this simulation does not
+     * model.
      */
     require(keyUsage, keySpec, origin) {
-        if (keyUsage !== undefined && keyUsage !== encryptDecryptUsage) {
-            throw new SimKmsInvalidKeyUsageException(`KeyUsage '${keyUsage}' is not simulated: simulated KMS creates ${encryptDecryptUsage} keys`);
-        }
-        if (keySpec !== undefined && keySpec !== symmetricKeySpec) {
-            throw new SimKmsInvalidKeyUsageException(`KeySpec '${keySpec}' is not simulated: simulated KMS creates ${symmetricKeySpec} keys`);
+        this.requireSimulatedOrigin(origin);
+        this.requireSimulatedKeyUsage(keyUsage);
+        const spec = this.requireSimulatedSpec(keySpec ?? simKmsSymmetricKeySpecName);
+        this.requireSpecAllowsUsage(spec, keyUsage, keySpec);
+        return spec;
+    }
+    /**
+     * Refuse a key usage no simulated key spec has.
+     *
+     * HMAC and key agreement keys are the two this rules out. Neither has a spec
+     * here at all, so saying the usage is unsimulated is more use than sending
+     * the caller looking for a spec that would allow it.
+     */
+    requireSimulatedKeyUsage(keyUsage) {
+        if (keyUsage === undefined || simKmsKeyUsages.has(keyUsage)) {
+            return;
         }
+        throw new SimKmsInvalidKeyUsageException(`KeyUsage '${keyUsage}' is not simulated: simulated KMS creates ${[...simKmsKeyUsages].join(" and ")} keys`);
+    }
+    /**
+     * Refuse key material this simulation does not generate itself.
+     */
+    requireSimulatedOrigin(origin) {
         if (origin !== undefined && origin !== kmsOrigin) {
             throw new SimKmsValidationException(`Origin '${origin}' is not simulated: simulated KMS generates its own key material`);
         }
     }
+    /**
+     * Resolve a key spec name, or refuse one this simulation does not create.
+     */
+    requireSimulatedSpec(keySpecName) {
+        const spec = simKmsKeySpecs.get(keySpecName);
+        if (spec === undefined) {
+            throw new SimKmsInvalidKeyUsageException(`KeySpec '${keySpecName}' is not simulated: simulated KMS creates ${simKmsKeySpecNames().join(", ")} keys`);
+        }
+        return spec;
+    }
+    /**
+     * Refuse a key usage the resolved spec does not have here.
+     *
+     * Real KMS offers the RSA specs for encryption as well as signing, and
+     * offers no spec at all for a `SIGN_VERIFY` key that names none. Both of
+     * those come out here, and the two need different explanations, so the
+     * refusal says which case it is rather than repeating the pair back.
+     */
+    requireSpecAllowsUsage(spec, keyUsage, requestedKeySpec) {
+        if (keyUsage === undefined) {
+            this.requireDefaultableSpec(spec);
+            return;
+        }
+        if (keyUsage === spec.keyUsage) {
+            return;
+        }
+        if (requestedKeySpec === undefined) {
+            throw new SimKmsInvalidKeyUsageException(`KeyUsage '${keyUsage}' needs a KeySpec: the default ${simKmsSymmetricKeySpecName} spec is ${spec.keyUsage} only`);
+        }
+        throw new SimKmsInvalidKeyUsageException(`KeyUsage '${keyUsage}' with KeySpec '${spec.name}' is not simulated: simulated KMS creates ${spec.name} keys for ${spec.keyUsage}`);
+    }
+    /**
+     * Refuse a spec that cannot take the default key usage.
+     *
+     * `KeyUsage` is optional only for a symmetric encryption key. Every other
+     * spec requires it, so leaving it out is a request AWS refuses rather than
+     * one it fills in, and filling it in here would create a key real KMS would
+     * not have made.
+     */
+    requireDefaultableSpec(spec) {
+        if (!spec.isAsymmetric) {
+            return;
+        }
+        throw new SimKmsInvalidKeyUsageException(`KeySpec '${spec.name}' needs a KeyUsage: it is only optional for a ${simKmsSymmetricKeySpecName} key`);
+    }
 }
 //# sourceMappingURL=sim-kms-key-type.js.map

package/dist/service/kms/command/key/sim-kms-key-type.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-kms-key-type.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-type.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AAEtC;;GAEG;AACH,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,SAAS,GAAG,SAAS,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IACxB;;OAEG;IACH,OAAO,CACL,QAA4B,EAC5B,OAA2B,EAC3B,MAA0B;QAE1B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAC/D,MAAM,IAAI,8BAA8B,CACtC,aAAa,QAAQ,6CAA6C,mBAAmB,OAAO,CAC7F,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YAC1D,MAAM,IAAI,8BAA8B,CACtC,YAAY,OAAO,6CAA6C,gBAAgB,OAAO,CACxF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,yBAAyB,CACjC,WAAW,MAAM,kEAAkE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-kms-key-type.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/key/sim-kms-key-type.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,cAAc,GAEf,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,0BAA0B,GAC3B,MAAM,qCAAqC,CAAC;AAE7C,MAAM,SAAS,GAAG,SAAS,CAAC;AAE5B;;GAEG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,cAAc,CAAC,cAAc;IAC7B,cAAc,CAAC,UAAU;CAC1B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,OAAO,aAAa;IACxB;;;OAGG;IACH,OAAO,CACL,QAA4B,EAC5B,OAA2B,EAC3B,MAA0B;QAE1B,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAExC,MAAM,IAAI,GAAG,IAAI,CAAC,oBAAoB,CACpC,OAAO,IAAI,0BAA0B,CACtC,CAAC;QAEF,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAErD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,wBAAwB,CAAC,QAA4B;QAC3D,IAAI,QAAQ,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,8BAA8B,CACtC,aAAa,QAAQ,6CAA6C,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAC5G,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,MAA0B;QACvD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,IAAI,yBAAyB,CACjC,WAAW,MAAM,kEAAkE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,WAAmB;QAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAE7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,8BAA8B,CACtC,YAAY,WAAW,6CAA6C,kBAAkB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAC3G,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACK,sBAAsB,CAC5B,IAAmB,EACnB,QAA4B,EAC5B,gBAAoC;QAEpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAElC,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,8BAA8B,CACtC,aAAa,QAAQ,kCAAkC,0BAA0B,YAAY,IAAI,CAAC,QAAQ,OAAO,CAClH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,8BAA8B,CACtC,aAAa,QAAQ,mBAAmB,IAAI,CAAC,IAAI,6CAA6C,IAAI,CAAC,IAAI,aAAa,IAAI,CAAC,QAAQ,EAAE,CACpI,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,sBAAsB,CAAC,IAAmB;QAChD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,8BAA8B,CACtC,YAAY,IAAI,CAAC,IAAI,iDAAiD,0BAA0B,MAAM,CACvG,CAAC;IACJ,CAAC;CACF"}

package/dist/service/kms/command/sign/sign.command.d.ts

@@ -0,0 +1,69 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimKmsKeyUsage } from "../../key/spec/sim-kms-key-spec.js";
+/**
+ * Minimal structural sim KMS Sign command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/SignCommand/
+ */
+export interface SimSignCommand {
+    readonly input: SimSignCommandInput;
+}
+export interface SimSignCommandInput {
+    readonly KeyId?: string | undefined;
+    readonly Message?: Uint8Array | undefined;
+    /**
+     * `RAW` only. A `DIGEST` message is refused, because Node cannot sign a
+     * digest that has already been computed.
+     */
+    readonly MessageType?: string | undefined;
+    readonly SigningAlgorithm?: string | undefined;
+}
+export interface SimSignCommandOutput {
+    readonly KeyId?: string | undefined;
+    readonly Signature?: Uint8Array | undefined;
+    readonly SigningAlgorithm?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS Verify command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/VerifyCommand/
+ */
+export interface SimVerifyCommand {
+    readonly input: SimVerifyCommandInput;
+}
+export interface SimVerifyCommandInput {
+    readonly KeyId?: string | undefined;
+    readonly Message?: Uint8Array | undefined;
+    readonly MessageType?: string | undefined;
+    readonly Signature?: Uint8Array | undefined;
+    readonly SigningAlgorithm?: string | undefined;
+}
+export interface SimVerifyCommandOutput {
+    readonly KeyId?: string | undefined;
+    readonly SignatureValid?: boolean | undefined;
+    readonly SigningAlgorithm?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim KMS GetPublicKey command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/kms/command/GetPublicKeyCommand/
+ */
+export interface SimGetPublicKeyCommand {
+    readonly input: SimGetPublicKeyCommandInput;
+}
+export interface SimGetPublicKeyCommandInput {
+    readonly KeyId?: string | undefined;
+}
+export interface SimGetPublicKeyCommandOutput {
+    readonly KeyId?: string | undefined;
+    readonly PublicKey?: Uint8Array | undefined;
+    readonly KeySpec?: string | undefined;
+    readonly CustomerMasterKeySpec?: string | undefined;
+    readonly KeyUsage?: SimKmsKeyUsage | undefined;
+    readonly EncryptionAlgorithms?: readonly string[] | undefined;
+    readonly SigningAlgorithms?: readonly string[] | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=sign.command.d.ts.map

package/dist/service/kms/command/sign/sign.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/kms/command/sign/sign.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAE1C;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAC;CAC7C;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/kms/command/sign/sign.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sign.command.js.map

package/dist/service/kms/command/sign/sign.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.command.js","sourceRoot":"","sources":["../../../../../src/service/kms/command/sign/sign.command.ts"],"names":[],"mappings":""}