@kensio/yulin 1.12.1 → 1.14.0

package/dist/service/route53/command/dnssec/dnssec.command.d.ts

@@ -0,0 +1,78 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimRoute53KeySigningKeyView } from "../../dnssec/sim-route53-key-signing-key.js";
+import type { SimRoute53ServeSignature } from "../../dnssec/sim-route53-zone-dnssec.js";
+import type { SimRoute53ChangeInfo } from "../create-hosted-zone/create-hosted-zone.command.js";
+/**
+ * Minimal structural sim Route53 CreateKeySigningKey command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/route-53/command/CreateKeySigningKeyCommand/
+ */
+export interface SimCreateKeySigningKeyCommand {
+    readonly input: SimCreateKeySigningKeyCommandInput;
+}
+export interface SimCreateKeySigningKeyCommandInput {
+    readonly CallerReference?: string | undefined;
+    readonly HostedZoneId?: string | undefined;
+    readonly KeyManagementServiceArn?: string | undefined;
+    readonly Name?: string | undefined;
+    readonly Status?: string | undefined;
+}
+export interface SimCreateKeySigningKeyCommandOutput {
+    readonly ChangeInfo?: SimRoute53ChangeInfo | undefined;
+    readonly KeySigningKey?: SimRoute53KeySigningKeyView | undefined;
+    readonly Location?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim Route53 key-signing key command input.
+ *
+ * ActivateKeySigningKey, DeactivateKeySigningKey and DeleteKeySigningKey all
+ * take the same two fields and answer with the same change info.
+ */
+export interface SimKeySigningKeyCommand {
+    readonly input: SimKeySigningKeyCommandInput;
+}
+export interface SimKeySigningKeyCommandInput {
+    readonly HostedZoneId?: string | undefined;
+    readonly Name?: string | undefined;
+}
+export interface SimKeySigningKeyCommandOutput {
+    readonly ChangeInfo?: SimRoute53ChangeInfo | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim Route53 zone signing command input.
+ *
+ * EnableHostedZoneDNSSEC and DisableHostedZoneDNSSEC share it.
+ */
+export interface SimHostedZoneDnssecCommand {
+    readonly input: SimHostedZoneDnssecCommandInput;
+}
+export interface SimHostedZoneDnssecCommandInput {
+    readonly HostedZoneId?: string | undefined;
+}
+export interface SimHostedZoneDnssecCommandOutput {
+    readonly ChangeInfo?: SimRoute53ChangeInfo | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Minimal structural sim Route53 GetDNSSEC command.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/route-53/command/GetDNSSECCommand/
+ */
+export interface SimGetDnssecCommand {
+    readonly input: SimGetDnssecCommandInput;
+}
+export interface SimGetDnssecCommandInput {
+    readonly HostedZoneId?: string | undefined;
+}
+export interface SimRoute53DnssecStatus {
+    readonly ServeSignature?: SimRoute53ServeSignature | undefined;
+    readonly StatusMessage?: string | undefined;
+}
+export interface SimGetDnssecCommandOutput {
+    readonly Status?: SimRoute53DnssecStatus | undefined;
+    readonly KeySigningKeys?: readonly SimRoute53KeySigningKeyView[] | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+//# sourceMappingURL=dnssec.command.d.ts.map

package/dist/service/route53/command/dnssec/dnssec.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dnssec.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/dnssec/dnssec.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAC/F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAEhG;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,kCAAkC,CAAC;CACpD;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,aAAa,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;CAC9C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;CACjD;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,2BAA2B,EAAE,GAAG,SAAS,CAAC;IAC7E,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/route53/command/dnssec/dnssec.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dnssec.command.js.map

package/dist/service/route53/command/dnssec/dnssec.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dnssec.command.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/dnssec/dnssec.command.ts"],"names":[],"mappings":""}

package/dist/service/route53/command/dnssec/sim-route53-dnssec-authorizer.d.ts

@@ -0,0 +1,24 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimRoute53HostedZoneId } from "../create-hosted-zone/sim-route53-zone-id.js";
+interface SimRoute53DnssecAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to a Route53 DNSSEC request.
+ *
+ * Every DNSSEC operation names a hosted zone and authorizes against that
+ * zone's ARN, so one authorizer takes the action rather than there being seven
+ * classes that differ by a string. Authorization runs before the zone is
+ * looked up, so an unauthorized caller cannot learn whether a zone ID exists.
+ */
+export declare class SimRoute53DnssecAuthorizer {
+    private readonly iam;
+    constructor(properties: SimRoute53DnssecAuthorizerProperties);
+    /**
+     * Ensure the caller may perform a DNSSEC action on a hosted zone.
+     */
+    authorize(action: string, hostedZoneId: SimRoute53HostedZoneId, caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=sim-route53-dnssec-authorizer.d.ts.map

package/dist/service/route53/command/dnssec/sim-route53-dnssec-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-dnssec-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/dnssec/sim-route53-dnssec-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AAE3F,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;OAEG;IACH,SAAS,CACP,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,sBAAsB,EACpC,MAAM,CAAC,EAAE,YAAY,GACpB,IAAI,CAWN;CACF"}

package/dist/service/route53/command/dnssec/sim-route53-dnssec-authorizer.js

@@ -0,0 +1,31 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simRoute53HostedZoneArn } from "../../hosted-zone/sim-route53-hosted-zone-arn.js";
+/**
+ * Applies IAM authorization to a Route53 DNSSEC request.
+ *
+ * Every DNSSEC operation names a hosted zone and authorizes against that
+ * zone's ARN, so one authorizer takes the action rather than there being seven
+ * classes that differ by a string. Authorization runs before the zone is
+ * looked up, so an unauthorized caller cannot learn whether a zone ID exists.
+ */
+export class SimRoute53DnssecAuthorizer {
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may perform a DNSSEC action on a hosted zone.
+     */
+    authorize(action, hostedZoneId, caller) {
+        const resource = simRoute53HostedZoneArn(hostedZoneId);
+        const decision = this.iam.authorize({ action, resource, caller });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action,
+                resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=sim-route53-dnssec-authorizer.js.map

package/dist/service/route53/command/dnssec/sim-route53-dnssec-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-dnssec-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/dnssec/sim-route53-dnssec-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kDAAkD,CAAC;AAO3F;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACpB,GAAG,CAA0B;IAE9C,YAAY,UAAgD;QAC1D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,SAAS,CACP,MAAc,EACd,YAAoC,EACpC,MAAqB;QAErB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAElE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/route53/command/dnssec/sim-route53-dnssec-commands.d.ts

@@ -0,0 +1,28 @@
+import type { BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimKmsKeyResolver } from "../../../kms/registry/sim-kms-registry.js";
+import type { SimRoute53HostedZone } from "../../hosted-zone/sim-route53-hosted-zone.js";
+import type { SimRoute53HostedZoneId } from "../create-hosted-zone/sim-route53-zone-id.js";
+import { SimRoute53KskCommands } from "./sim-route53-ksk-commands.js";
+import { SimRoute53ZoneSigningCommands } from "./sim-route53-zone-signing-commands.js";
+interface SimRoute53DnssecCommandsProperties {
+    readonly hostedZones: Map<SimRoute53HostedZoneId, SimRoute53HostedZone>;
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly background: BackgroundScheduler;
+    readonly kmsKeys?: SimKmsKeyResolver | undefined;
+}
+/**
+ * The DNSSEC commands of one simulated Route53 scope, and the state they
+ * share.
+ *
+ * Grouped rather than wired one at a time on the service facade, because all
+ * seven start from the same hosted zone lookup and authorization, and four of
+ * them work on the same key-signing key list.
+ */
+export declare class SimRoute53DnssecCommands {
+    readonly keySigningKeys: SimRoute53KskCommands;
+    readonly zoneSigning: SimRoute53ZoneSigningCommands;
+    constructor(properties: SimRoute53DnssecCommandsProperties);
+}
+export {};
+//# sourceMappingURL=sim-route53-dnssec-commands.d.ts.map

package/dist/service/route53/command/dnssec/sim-route53-dnssec-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-dnssec-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/dnssec/sim-route53-dnssec-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AAE3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAEvF,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;IACxE,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,cAAc,EAAE,qBAAqB,CAAC;IACtD,SAAgB,WAAW,EAAE,6BAA6B,CAAC;IAE3D,YAAY,UAAU,EAAE,kCAAkC,EAazD;CACF"}

package/dist/service/route53/command/dnssec/sim-route53-dnssec-commands.js

@@ -0,0 +1,30 @@
+import { SimRoute53DnssecScope } from "./sim-route53-dnssec-scope.js";
+import { SimRoute53KskCommands } from "./sim-route53-ksk-commands.js";
+import { SimRoute53KskKmsKey } from "./sim-route53-ksk-kms-key.js";
+import { SimRoute53ZoneSigningCommands } from "./sim-route53-zone-signing-commands.js";
+/**
+ * The DNSSEC commands of one simulated Route53 scope, and the state they
+ * share.
+ *
+ * Grouped rather than wired one at a time on the service facade, because all
+ * seven start from the same hosted zone lookup and authorization, and four of
+ * them work on the same key-signing key list.
+ */
+export class SimRoute53DnssecCommands {
+    keySigningKeys;
+    zoneSigning;
+    constructor(properties) {
+        const scope = new SimRoute53DnssecScope({
+            hostedZones: properties.hostedZones,
+            iam: properties.iam,
+            background: properties.background,
+        });
+        this.keySigningKeys = new SimRoute53KskCommands({
+            scope,
+            kmsKey: new SimRoute53KskKmsKey({ kmsKeys: properties.kmsKeys }),
+            clock: properties.background,
+        });
+        this.zoneSigning = new SimRoute53ZoneSigningCommands({ scope });
+    }
+}
+//# sourceMappingURL=sim-route53-dnssec-commands.js.map

package/dist/service/route53/command/dnssec/sim-route53-dnssec-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-dnssec-commands.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/dnssec/sim-route53-dnssec-commands.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AASvF;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnB,cAAc,CAAwB;IACtC,WAAW,CAAgC;IAE3D,YAAY,UAA8C;QACxD,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC;YACtC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,UAAU,EAAE,UAAU,CAAC,UAAU;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,GAAG,IAAI,qBAAqB,CAAC;YAC9C,KAAK;YACL,MAAM,EAAE,IAAI,mBAAmB,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;YAChE,KAAK,EAAE,UAAU,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,6BAA6B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;CACF"}

package/dist/service/route53/command/dnssec/sim-route53-dnssec-scope.d.ts

@@ -0,0 +1,38 @@
+import type { BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimRoute53HostedZone } from "../../hosted-zone/sim-route53-hosted-zone.js";
+import type { SimRoute53RequestOptions } from "../../sim-route53-request-options.js";
+import { type SimRoute53HostedZoneId } from "../create-hosted-zone/sim-route53-zone-id.js";
+import type { SimRoute53ChangeInfo } from "../create-hosted-zone/create-hosted-zone.command.js";
+interface SimRoute53DnssecScopeProperties {
+    readonly hostedZones: Map<SimRoute53HostedZoneId, SimRoute53HostedZone>;
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly background: BackgroundScheduler;
+}
+/**
+ * What every DNSSEC command does before and after its own work.
+ *
+ * All seven start the same way: normalise the hosted zone ID, sequence through
+ * the background scheduler, authorize against the zone ARN, then find the
+ * zone. Doing that once here keeps each command to the part that differs.
+ */
+export declare class SimRoute53DnssecScope {
+    private readonly hostedZones;
+    private readonly authorizer;
+    private readonly background;
+    constructor(properties: SimRoute53DnssecScopeProperties);
+    /**
+     * The hosted zone a DNSSEC request names, once the caller may reach it.
+     */
+    zoneFor(action: string, hostedZoneId: string | undefined, options?: SimRoute53RequestOptions): Promise<SimRoute53HostedZone>;
+    /**
+     * The change info a DNSSEC change answers with.
+     *
+     * Route53 applies a DNSSEC change to the zone rather than to a record set,
+     * and nothing here defers the work, so the change is reported against the
+     * zone's own synchronization status.
+     */
+    changeInfo(hostedZone: SimRoute53HostedZone): SimRoute53ChangeInfo;
+}
+export {};
+//# sourceMappingURL=sim-route53-dnssec-scope.d.ts.map

package/dist/service/route53/command/dnssec/sim-route53-dnssec-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-dnssec-scope.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/dnssec/sim-route53-dnssec-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEtG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAC;AAGhG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;IACxE,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAG1B;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,UAAU,EAAE,+BAA+B,EAItD;IAED;;OAEG;IACG,OAAO,CACX,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,oBAAoB,CAAC,CAiB/B;IAED;;;;;;OAMG;IACH,UAAU,CAAC,UAAU,EAAE,oBAAoB,GAAG,oBAAoB,CAMjE;CACF"}

package/dist/service/route53/command/dnssec/sim-route53-dnssec-scope.js

@@ -0,0 +1,49 @@
+import { SimRoute53NoSuchHostedZone } from "../../error/sim-route53.error.js";
+import { normalizeSimRoute53HostedZoneId, } from "../create-hosted-zone/sim-route53-zone-id.js";
+import { SimRoute53DnssecAuthorizer } from "./sim-route53-dnssec-authorizer.js";
+/**
+ * What every DNSSEC command does before and after its own work.
+ *
+ * All seven start the same way: normalise the hosted zone ID, sequence through
+ * the background scheduler, authorize against the zone ARN, then find the
+ * zone. Doing that once here keeps each command to the part that differs.
+ */
+export class SimRoute53DnssecScope {
+    hostedZones;
+    authorizer;
+    background;
+    constructor(properties) {
+        this.hostedZones = properties.hostedZones;
+        this.authorizer = new SimRoute53DnssecAuthorizer({ iam: properties.iam });
+        this.background = properties.background;
+    }
+    /**
+     * The hosted zone a DNSSEC request names, once the caller may reach it.
+     */
+    async zoneFor(action, hostedZoneId, options) {
+        const zoneId = normalizeSimRoute53HostedZoneId(hostedZoneId);
+        // Allow for potential non-deterministic sequencing of async events.
+        await this.background.sequence();
+        this.authorizer.authorize(action, zoneId, options?.caller);
+        const hostedZone = this.hostedZones.get(zoneId);
+        if (hostedZone === undefined) {
+            throw new SimRoute53NoSuchHostedZone(`No sim Route53 Hosted Zone with ID ${zoneId}`);
+        }
+        return hostedZone;
+    }
+    /**
+     * The change info a DNSSEC change answers with.
+     *
+     * Route53 applies a DNSSEC change to the zone rather than to a record set,
+     * and nothing here defers the work, so the change is reported against the
+     * zone's own synchronization status.
+     */
+    changeInfo(hostedZone) {
+        return {
+            Id: `/change/${hostedZone.id}`,
+            Status: hostedZone.status,
+            SubmittedAt: this.background.now(),
+        };
+    }
+}
+//# sourceMappingURL=sim-route53-dnssec-scope.js.map

package/dist/service/route53/command/dnssec/sim-route53-dnssec-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-dnssec-scope.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/dnssec/sim-route53-dnssec-scope.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAG9E,OAAO,EACL,+BAA+B,GAEhC,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAQhF;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACf,WAAW,CAG1B;IACe,UAAU,CAA6B;IACvC,UAAU,CAAsB;IAEjD,YAAY,UAA2C;QACrD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,IAAI,0BAA0B,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,YAAgC,EAChC,OAAkC;QAElC,MAAM,MAAM,GAAG,+BAA+B,CAAC,YAAY,CAAC,CAAC;QAE7D,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAE3D,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEhD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,0BAA0B,CAClC,sCAAsC,MAAM,EAAE,CAC/C,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,UAAgC;QACzC,OAAO;YACL,EAAE,EAAE,WAAW,UAAU,CAAC,EAAE,EAAE;YAC9B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE;SACnC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/route53/command/dnssec/sim-route53-ksk-commands.d.ts

@@ -0,0 +1,46 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimRoute53DnssecScope } from "./sim-route53-dnssec-scope.js";
+import type { SimRoute53KskKmsKey } from "./sim-route53-ksk-kms-key.js";
+import type { SimCreateKeySigningKeyCommand, SimCreateKeySigningKeyCommandOutput, SimKeySigningKeyCommand, SimKeySigningKeyCommandOutput } from "./dnssec.command.js";
+import type { SimRoute53RequestOptions } from "../../sim-route53-request-options.js";
+interface SimRoute53KskCommandsProperties {
+    readonly scope: SimRoute53DnssecScope;
+    readonly kmsKey: SimRoute53KskKmsKey;
+    readonly clock: SimClock;
+}
+/**
+ * The key-signing key commands of one simulated Route53 scope.
+ *
+ * The four operate on the same key-signing key list on the same hosted zone,
+ * so they are grouped rather than wired separately on the service facade.
+ */
+export declare class SimRoute53KskCommands {
+    private readonly scope;
+    private readonly kmsKey;
+    private readonly clock;
+    private readonly input;
+    constructor(properties: SimRoute53KskCommandsProperties);
+    /**
+     * Create a key-signing key for a hosted zone.
+     *
+     * The DNSSEC parameters are derived here, from the KMS key's real public
+     * key, so a test reading the DS record gets the one that key would produce.
+     */
+    create(command: SimCreateKeySigningKeyCommand, options?: SimRoute53RequestOptions): Promise<SimCreateKeySigningKeyCommandOutput>;
+    /**
+     * Start signing with a key-signing key.
+     */
+    activate(command: SimKeySigningKeyCommand, options?: SimRoute53RequestOptions): Promise<SimKeySigningKeyCommandOutput>;
+    /**
+     * Stop signing with a key-signing key.
+     */
+    deactivate(command: SimKeySigningKeyCommand, options?: SimRoute53RequestOptions): Promise<SimKeySigningKeyCommandOutput>;
+    /**
+     * Remove a key-signing key from a hosted zone.
+     */
+    delete(command: SimKeySigningKeyCommand, options?: SimRoute53RequestOptions): Promise<SimKeySigningKeyCommandOutput>;
+    private changeStatus;
+    private applyStatus;
+}
+export {};
+//# sourceMappingURL=sim-route53-ksk-commands.d.ts.map

package/dist/service/route53/command/dnssec/sim-route53-ksk-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-ksk-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/dnssec/sim-route53-ksk-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAKpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAExE,OAAO,KAAK,EACV,6BAA6B,EAC7B,mCAAmC,EACnC,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAErF,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;GAKG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAElD,YAAY,UAAU,EAAE,+BAA+B,EAItD;IAED;;;;;OAKG;IACG,MAAM,CACV,OAAO,EAAE,6BAA6B,EACtC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,mCAAmC,CAAC,CA2B9C;IAED;;OAEG;IACG,QAAQ,CACZ,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,6BAA6B,CAAC,CAOxC;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,6BAA6B,CAAC,CAOxC;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,6BAA6B,CAAC,CAUxC;YAEa,YAAY;IAoB1B,OAAO,CAAC,WAAW;CAYpB"}

package/dist/service/route53/command/dnssec/sim-route53-ksk-commands.js

@@ -0,0 +1,80 @@
+import { SimRoute53KeySigningKey, SimRoute53KeySigningKeyStatus, } from "../../dnssec/sim-route53-key-signing-key.js";
+import { SimRoute53KskInput } from "./sim-route53-ksk-input.js";
+/**
+ * The key-signing key commands of one simulated Route53 scope.
+ *
+ * The four operate on the same key-signing key list on the same hosted zone,
+ * so they are grouped rather than wired separately on the service facade.
+ */
+export class SimRoute53KskCommands {
+    scope;
+    kmsKey;
+    clock;
+    input = new SimRoute53KskInput();
+    constructor(properties) {
+        this.scope = properties.scope;
+        this.kmsKey = properties.kmsKey;
+        this.clock = properties.clock;
+    }
+    /**
+     * Create a key-signing key for a hosted zone.
+     *
+     * The DNSSEC parameters are derived here, from the KMS key's real public
+     * key, so a test reading the DS record gets the one that key would produce.
+     */
+    async create(command, options) {
+        const zone = await this.scope.zoneFor("route53:CreateKeySigningKey", command.input.HostedZoneId, options);
+        const name = this.input.requireName(command.input.Name);
+        const key = this.kmsKey.require(command.input.KeyManagementServiceArn);
+        const keySigningKey = new SimRoute53KeySigningKey({
+            name,
+            kmsArn: key.arn,
+            hostedZoneId: zone.id,
+            zoneName: zone.name,
+            publicKeyDer: key.publicKeyDer(),
+            status: this.input.requireStatus(command.input.Status),
+            createdDate: this.clock.now(),
+        });
+        zone.dnssec.add(keySigningKey);
+        return {
+            $metadata: {},
+            ChangeInfo: this.scope.changeInfo(zone),
+            KeySigningKey: keySigningKey.describe(),
+            Location: `/2013-04-01/keysigningkey/${zone.id}/${name}`,
+        };
+    }
+    /**
+     * Start signing with a key-signing key.
+     */
+    async activate(command, options) {
+        return await this.changeStatus("route53:ActivateKeySigningKey", command, options, SimRoute53KeySigningKeyStatus.Active);
+    }
+    /**
+     * Stop signing with a key-signing key.
+     */
+    async deactivate(command, options) {
+        return await this.changeStatus("route53:DeactivateKeySigningKey", command, options, SimRoute53KeySigningKeyStatus.Inactive);
+    }
+    /**
+     * Remove a key-signing key from a hosted zone.
+     */
+    async delete(command, options) {
+        const zone = await this.scope.zoneFor("route53:DeleteKeySigningKey", command.input.HostedZoneId, options);
+        zone.dnssec.remove(this.input.requireName(command.input.Name));
+        return { $metadata: {}, ChangeInfo: this.scope.changeInfo(zone) };
+    }
+    async changeStatus(action, command, options, status) {
+        const zone = await this.scope.zoneFor(action, command.input.HostedZoneId, options);
+        const keySigningKey = zone.dnssec.require(this.input.requireName(command.input.Name));
+        this.applyStatus(keySigningKey, status);
+        return { $metadata: {}, ChangeInfo: this.scope.changeInfo(zone) };
+    }
+    applyStatus(keySigningKey, status) {
+        if (status === SimRoute53KeySigningKeyStatus.Active) {
+            keySigningKey.activate(this.clock.now());
+            return;
+        }
+        keySigningKey.deactivate(this.clock.now());
+    }
+}
+//# sourceMappingURL=sim-route53-ksk-commands.js.map

package/dist/service/route53/command/dnssec/sim-route53-ksk-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-ksk-commands.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/dnssec/sim-route53-ksk-commands.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,6CAA6C,CAAC;AAGrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAehE;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAwB;IAC7B,MAAM,CAAsB;IAC5B,KAAK,CAAW;IAChB,KAAK,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAElD,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CACV,OAAsC,EACtC,OAAkC;QAElC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CACnC,6BAA6B,EAC7B,OAAO,CAAC,KAAK,CAAC,YAAY,EAC1B,OAAO,CACR,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAEvE,MAAM,aAAa,GAAG,IAAI,uBAAuB,CAAC;YAChD,IAAI;YACJ,MAAM,EAAE,GAAG,CAAC,GAAG;YACf,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE;YAChC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YACtD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAE/B,OAAO;YACL,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YACvC,aAAa,EAAE,aAAa,CAAC,QAAQ,EAAE;YACvC,QAAQ,EAAE,6BAA6B,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE;SACzD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAgC,EAChC,OAAkC;QAElC,OAAO,MAAM,IAAI,CAAC,YAAY,CAC5B,+BAA+B,EAC/B,OAAO,EACP,OAAO,EACP,6BAA6B,CAAC,MAAM,CACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,OAAgC,EAChC,OAAkC;QAElC,OAAO,MAAM,IAAI,CAAC,YAAY,CAC5B,iCAAiC,EACjC,OAAO,EACP,OAAO,EACP,6BAA6B,CAAC,QAAQ,CACvC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAgC,EAChC,OAAkC;QAElC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CACnC,6BAA6B,EAC7B,OAAO,CAAC,KAAK,CAAC,YAAY,EAC1B,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/D,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IACpE,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,MAAc,EACd,OAAgC,EAChC,OAA6C,EAC7C,MAAqC;QAErC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CACnC,MAAM,EACN,OAAO,CAAC,KAAK,CAAC,YAAY,EAC1B,OAAO,CACR,CAAC;QACF,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CACvC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAC3C,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAExC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IACpE,CAAC;IAEO,WAAW,CACjB,aAAsC,EACtC,MAAqC;QAErC,IAAI,MAAM,KAAK,6BAA6B,CAAC,MAAM,EAAE,CAAC;YACpD,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAEzC,OAAO;QACT,CAAC;QAED,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/service/route53/command/dnssec/sim-route53-ksk-input.d.ts

@@ -0,0 +1,20 @@
+import { SimRoute53KeySigningKeyStatus } from "../../dnssec/sim-route53-key-signing-key.js";
+/**
+ * The two fields a key-signing key request carries beyond its hosted zone.
+ *
+ * Route53 requires both rather than defaulting either: a name is what
+ * identifies the key within its zone, and a key created active starts being
+ * published straight away, so neither is a choice to make on the caller's
+ * behalf.
+ */
+export declare class SimRoute53KskInput {
+    /**
+     * The name identifying a key-signing key within its hosted zone.
+     */
+    requireName(name: string | undefined): string;
+    /**
+     * The status a new key-signing key starts in.
+     */
+    requireStatus(status: string | undefined): SimRoute53KeySigningKeyStatus;
+}
+//# sourceMappingURL=sim-route53-ksk-input.d.ts.map

package/dist/service/route53/command/dnssec/sim-route53-ksk-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-ksk-input.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/dnssec/sim-route53-ksk-input.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,6CAA6C,CAAC;AAE5F;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAQ5C;IAED;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,6BAA6B,CAYvE;CACF"}

package/dist/service/route53/command/dnssec/sim-route53-ksk-input.js

@@ -0,0 +1,34 @@
+import { SimRoute53InvalidInput } from "../../error/sim-route53.error.js";
+import { SimRoute53KeySigningKeyStatus } from "../../dnssec/sim-route53-key-signing-key.js";
+/**
+ * The two fields a key-signing key request carries beyond its hosted zone.
+ *
+ * Route53 requires both rather than defaulting either: a name is what
+ * identifies the key within its zone, and a key created active starts being
+ * published straight away, so neither is a choice to make on the caller's
+ * behalf.
+ */
+export class SimRoute53KskInput {
+    /**
+     * The name identifying a key-signing key within its hosted zone.
+     */
+    requireName(name) {
+        if (name === undefined || name.length === 0) {
+            throw new SimRoute53InvalidInput("A key signing key Name is required, and identifies the key within its hosted zone");
+        }
+        return name;
+    }
+    /**
+     * The status a new key-signing key starts in.
+     */
+    requireStatus(status) {
+        if (status === SimRoute53KeySigningKeyStatus.Active) {
+            return SimRoute53KeySigningKeyStatus.Active;
+        }
+        if (status === SimRoute53KeySigningKeyStatus.Inactive) {
+            return SimRoute53KeySigningKeyStatus.Inactive;
+        }
+        throw new SimRoute53InvalidInput(`A key signing key Status of '${String(status)}' is not valid: use ${SimRoute53KeySigningKeyStatus.Active} or ${SimRoute53KeySigningKeyStatus.Inactive}`);
+    }
+}
+//# sourceMappingURL=sim-route53-ksk-input.js.map

package/dist/service/route53/command/dnssec/sim-route53-ksk-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-ksk-input.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/dnssec/sim-route53-ksk-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,6BAA6B,EAAE,MAAM,6CAA6C,CAAC;AAE5F;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;OAEG;IACH,WAAW,CAAC,IAAwB;QAClC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,sBAAsB,CAC9B,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAA0B;QACtC,IAAI,MAAM,KAAK,6BAA6B,CAAC,MAAM,EAAE,CAAC;YACpD,OAAO,6BAA6B,CAAC,MAAM,CAAC;QAC9C,CAAC;QAED,IAAI,MAAM,KAAK,6BAA6B,CAAC,QAAQ,EAAE,CAAC;YACtD,OAAO,6BAA6B,CAAC,QAAQ,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,sBAAsB,CAC9B,gCAAgC,MAAM,CAAC,MAAM,CAAC,uBAAuB,6BAA6B,CAAC,MAAM,OAAO,6BAA6B,CAAC,QAAQ,EAAE,CACzJ,CAAC;IACJ,CAAC;CACF"}

package/dist/service/route53/command/dnssec/sim-route53-ksk-kms-key.d.ts

@@ -0,0 +1,32 @@
+import type { SimKmsKey } from "../../../kms/key/sim-kms-key.js";
+import type { SimKmsKeyResolver } from "../../../kms/registry/sim-kms-registry.js";
+interface SimRoute53KskKmsKeyProperties {
+    readonly kmsKeys?: SimKmsKeyResolver | undefined;
+}
+/**
+ * Finds and checks the customer managed key behind a key-signing key.
+ *
+ * Real Route53 is specific about this key: it has to be an enabled
+ * ECC_NIST_P256 key whose usage is sign and verify. Checking it here is what
+ * makes a stack that names the wrong key fail in this simulation rather than
+ * on the deployment, which is the whole point of deploying it here first.
+ */
+export declare class SimRoute53KskKmsKey {
+    private readonly kmsKeys;
+    constructor(properties: SimRoute53KskKmsKeyProperties);
+    /**
+     * Resolve the KMS key an ARN names, or refuse it.
+     */
+    require(keyManagementServiceArn: string | undefined): SimKmsKey;
+    private resolve;
+    /**
+     * Check the key is one Route53 would build a key-signing key on.
+     *
+     * Real Route53 checks the key usage as well as the spec. Here the spec
+     * decides the usage, so an ECC_NIST_P256 key is a SIGN_VERIFY key and there
+     * is nothing left for a separate usage check to catch.
+     */
+    private requireUsable;
+}
+export {};
+//# sourceMappingURL=sim-route53-ksk-kms-key.d.ts.map

package/dist/service/route53/command/dnssec/sim-route53-ksk-kms-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-ksk-kms-key.d.ts","sourceRoot":"","sources":["../../../../../src/service/route53/command/dnssec/sim-route53-ksk-kms-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AASnF,UAAU,6BAA6B;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;IAExD,YAAY,UAAU,EAAE,6BAA6B,EAEpD;IAED;;OAEG;IACH,OAAO,CAAC,uBAAuB,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAqB9D;IAED,OAAO,CAAC,OAAO;IAUf;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;CAatB"}

package/dist/service/route53/command/dnssec/sim-route53-ksk-kms-key.js

@@ -0,0 +1,57 @@
+import { SimKmsKeyUsage } from "../../../kms/key/spec/sim-kms-key-spec.js";
+import { SimRoute53InvalidKmsArn } from "../../error/sim-route53.error.js";
+/**
+ * The one key spec Route53 will build a key-signing key on.
+ */
+const requiredKeySpec = "ECC_NIST_P256";
+/**
+ * Finds and checks the customer managed key behind a key-signing key.
+ *
+ * Real Route53 is specific about this key: it has to be an enabled
+ * ECC_NIST_P256 key whose usage is sign and verify. Checking it here is what
+ * makes a stack that names the wrong key fail in this simulation rather than
+ * on the deployment, which is the whole point of deploying it here first.
+ */
+export class SimRoute53KskKmsKey {
+    kmsKeys;
+    constructor(properties) {
+        this.kmsKeys = properties.kmsKeys;
+    }
+    /**
+     * Resolve the KMS key an ARN names, or refuse it.
+     */
+    require(keyManagementServiceArn) {
+        if (keyManagementServiceArn === undefined ||
+            keyManagementServiceArn.length === 0) {
+            throw new SimRoute53InvalidKmsArn("KeyManagementServiceArn is required to create a key signing key");
+        }
+        const key = this.resolve(keyManagementServiceArn);
+        if (key === undefined) {
+            throw new SimRoute53InvalidKmsArn(`No simulated KMS key at ${keyManagementServiceArn}: a key signing key needs a customer managed key that exists`);
+        }
+        this.requireUsable(key);
+        return key;
+    }
+    resolve(keyManagementServiceArn) {
+        if (this.kmsKeys === undefined) {
+            throw new SimRoute53InvalidKmsArn("This simulated Route53 has no simulated KMS to resolve a key signing key's KMS ARN against: reach Route53 through SimAws so the two are wired together");
+        }
+        return this.kmsKeys.key(keyManagementServiceArn);
+    }
+    /**
+     * Check the key is one Route53 would build a key-signing key on.
+     *
+     * Real Route53 checks the key usage as well as the spec. Here the spec
+     * decides the usage, so an ECC_NIST_P256 key is a SIGN_VERIFY key and there
+     * is nothing left for a separate usage check to catch.
+     */
+    requireUsable(key) {
+        if (key.keySpec.name !== requiredKeySpec) {
+            throw new SimRoute53InvalidKmsArn(`KMS key ${key.arn} is ${key.keySpec.name}: a key signing key needs a ${requiredKeySpec} ${SimKmsKeyUsage.SignVerify} key`);
+        }
+        if (!key.isEnabled) {
+            throw new SimRoute53InvalidKmsArn(`KMS key ${key.arn} is not enabled: a key signing key needs an enabled key`);
+        }
+    }
+}
+//# sourceMappingURL=sim-route53-ksk-kms-key.js.map

package/dist/service/route53/command/dnssec/sim-route53-ksk-kms-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-ksk-kms-key.js","sourceRoot":"","sources":["../../../../../src/service/route53/command/dnssec/sim-route53-ksk-kms-key.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAE3E;;GAEG;AACH,MAAM,eAAe,GAAG,eAAe,CAAC;AAMxC;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACb,OAAO,CAAgC;IAExD,YAAY,UAAyC;QACnD,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,uBAA2C;QACjD,IACE,uBAAuB,KAAK,SAAS;YACrC,uBAAuB,CAAC,MAAM,KAAK,CAAC,EACpC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAElD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,uBAAuB,8DAA8D,CACjH,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAExB,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,OAAO,CAAC,uBAA+B;QAC7C,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,uBAAuB,CAC/B,wJAAwJ,CACzJ,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,GAAc;QAClC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACzC,MAAM,IAAI,uBAAuB,CAC/B,WAAW,GAAG,CAAC,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,+BAA+B,eAAe,IAAI,cAAc,CAAC,UAAU,MAAM,CAC3H,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,uBAAuB,CAC/B,WAAW,GAAG,CAAC,GAAG,yDAAyD,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}