@kensio/yulin 1.12.1 → 1.14.0

package/dist/service/route53/dnssec/sim-route53-zone-dnssec.d.ts

@@ -0,0 +1,75 @@
+import type { SimRoute53KeySigningKey } from "./sim-route53-key-signing-key.js";
+/**
+ * Whether a zone is being signed.
+ *
+ * Real Route53 also reports DELETING while signing is being taken off, and two
+ * statuses for a zone that needs attention. Nothing here leaves a zone in any
+ * of those, so a zone is signing or it is not.
+ */
+export declare const SimRoute53ServeSignature: {
+    readonly Signing: "SIGNING";
+    readonly NotSigning: "NOT_SIGNING";
+};
+export type SimRoute53ServeSignature = (typeof SimRoute53ServeSignature)[keyof typeof SimRoute53ServeSignature];
+/**
+ * The DNSSEC state of one hosted zone: its key-signing keys, and whether the
+ * zone is signed with them.
+ *
+ * The two are separate on real Route53 and stay separate here. Adding a
+ * key-signing key does not start signing, and stopping signing leaves the keys
+ * in place, which is what makes it possible to prepare a zone for DNSSEC
+ * before the DS record is published.
+ */
+export declare class SimRoute53ZoneDnssec {
+    #private;
+    private readonly keySigningKeys;
+    /**
+     * Whether the zone is being signed.
+     */
+    get serveSignature(): SimRoute53ServeSignature;
+    /**
+     * Every key-signing key on the zone, in the order they were added.
+     */
+    keys(): readonly SimRoute53KeySigningKey[];
+    /**
+     * Add a key-signing key to the zone.
+     *
+     * A name is unique within the zone, and so is the KMS key behind it: real
+     * Route53 refuses both, because two keys sharing either would be
+     * indistinguishable in the zone's DNSKEY set.
+     */
+    add(keySigningKey: SimRoute53KeySigningKey): void;
+    /**
+     * Find a key-signing key by name, or refuse an unknown one.
+     */
+    require(name: string): SimRoute53KeySigningKey;
+    /**
+     * Remove a key-signing key, refusing one that is still signing.
+     */
+    remove(name: string): void;
+    /**
+     * Start signing the zone.
+     *
+     * A zone with no active key-signing key has nothing to sign with, which real
+     * Route53 refuses rather than reporting a signed zone no resolver could
+     * validate.
+     */
+    enableSigning(): void;
+    /**
+     * Refuse deletion of the Hosted Zone while it is still being signed.
+     *
+     * Real Route53 will not delete a signed zone: DNSSEC has to be disabled
+     * first, so the DS record at the parent stops pointing at a zone that has
+     * gone.
+     *
+     * Which error it answers with is not documented among DeleteHostedZone's
+     * errors, so this reports the InvalidInput that operation does document
+     * rather than claiming a code that may not be the one AWS sends.
+     */
+    assertZoneDeletable(): void;
+    /**
+     * Stop signing the zone, leaving its key-signing keys in place.
+     */
+    disableSigning(): void;
+}
+//# sourceMappingURL=sim-route53-zone-dnssec.d.ts.map

package/dist/service/route53/dnssec/sim-route53-zone-dnssec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-zone-dnssec.d.ts","sourceRoot":"","sources":["../../../../src/service/route53/dnssec/sim-route53-zone-dnssec.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEhF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;aACnC,OAAO,EAAE,SAAS;aAClB,UAAU,EAAE,aAAa;CACjB,CAAC;AAEX,MAAM,MAAM,wBAAwB,GAClC,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,OAAO,wBAAwB,CAAC,CAAC;AAE3E;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8C;IAI7E;;OAEG;IACH,IAAI,cAAc,IAAI,wBAAwB,CAE7C;IAED;;OAEG;IACH,IAAI,IAAI,SAAS,uBAAuB,EAAE,CAEzC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,aAAa,EAAE,uBAAuB,GAAG,IAAI,CAchD;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAU7C;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGzB;IAED;;;;;;OAMG;IACH,aAAa,IAAI,IAAI,CAQpB;IAED;;;;;;;;;;OAUG;IACH,mBAAmB,IAAI,IAAI,CAM1B;IAED;;OAEG;IACH,cAAc,IAAI,IAAI,CAQrB;CACF"}

package/dist/service/route53/dnssec/sim-route53-zone-dnssec.js

@@ -0,0 +1,109 @@
+import { SimRoute53DnssecNotFound, SimRoute53InvalidInput, SimRoute53KeySigningKeyAlreadyExists, SimRoute53NoActiveKeySigningKey, SimRoute53NoSuchKeySigningKey, } from "../error/sim-route53.error.js";
+/**
+ * Whether a zone is being signed.
+ *
+ * Real Route53 also reports DELETING while signing is being taken off, and two
+ * statuses for a zone that needs attention. Nothing here leaves a zone in any
+ * of those, so a zone is signing or it is not.
+ */
+export const SimRoute53ServeSignature = {
+    Signing: "SIGNING",
+    NotSigning: "NOT_SIGNING",
+};
+/**
+ * The DNSSEC state of one hosted zone: its key-signing keys, and whether the
+ * zone is signed with them.
+ *
+ * The two are separate on real Route53 and stay separate here. Adding a
+ * key-signing key does not start signing, and stopping signing leaves the keys
+ * in place, which is what makes it possible to prepare a zone for DNSSEC
+ * before the DS record is published.
+ */
+export class SimRoute53ZoneDnssec {
+    keySigningKeys = new Map();
+    #serveSignature = SimRoute53ServeSignature.NotSigning;
+    /**
+     * Whether the zone is being signed.
+     */
+    get serveSignature() {
+        return this.#serveSignature;
+    }
+    /**
+     * Every key-signing key on the zone, in the order they were added.
+     */
+    keys() {
+        return this.keySigningKeys.values().toArray();
+    }
+    /**
+     * Add a key-signing key to the zone.
+     *
+     * A name is unique within the zone, and so is the KMS key behind it: real
+     * Route53 refuses both, because two keys sharing either would be
+     * indistinguishable in the zone's DNSKEY set.
+     */
+    add(keySigningKey) {
+        if (this.keySigningKeys.has(keySigningKey.name)) {
+            throw new SimRoute53KeySigningKeyAlreadyExists(`Key signing key ${keySigningKey.name} already exists in this hosted zone`);
+        }
+        if (this.keys().some((key) => key.kmsArn === keySigningKey.kmsArn)) {
+            throw new SimRoute53KeySigningKeyAlreadyExists(`Key signing key ${keySigningKey.name} uses KMS key ${keySigningKey.kmsArn}, which another key signing key in this hosted zone already uses`);
+        }
+        this.keySigningKeys.set(keySigningKey.name, keySigningKey);
+    }
+    /**
+     * Find a key-signing key by name, or refuse an unknown one.
+     */
+    require(name) {
+        const keySigningKey = this.keySigningKeys.get(name);
+        if (keySigningKey === undefined) {
+            throw new SimRoute53NoSuchKeySigningKey(`No key signing key named ${name} in this hosted zone`);
+        }
+        return keySigningKey;
+    }
+    /**
+     * Remove a key-signing key, refusing one that is still signing.
+     */
+    remove(name) {
+        this.require(name).requireRemovable();
+        this.keySigningKeys.delete(name);
+    }
+    /**
+     * Start signing the zone.
+     *
+     * A zone with no active key-signing key has nothing to sign with, which real
+     * Route53 refuses rather than reporting a signed zone no resolver could
+     * validate.
+     */
+    enableSigning() {
+        if (this.keys().every((key) => !key.isActive)) {
+            throw new SimRoute53NoActiveKeySigningKey("This hosted zone has no ACTIVE key signing key to sign with");
+        }
+        this.#serveSignature = SimRoute53ServeSignature.Signing;
+    }
+    /**
+     * Refuse deletion of the Hosted Zone while it is still being signed.
+     *
+     * Real Route53 will not delete a signed zone: DNSSEC has to be disabled
+     * first, so the DS record at the parent stops pointing at a zone that has
+     * gone.
+     *
+     * Which error it answers with is not documented among DeleteHostedZone's
+     * errors, so this reports the InvalidInput that operation does document
+     * rather than claiming a code that may not be the one AWS sends.
+     */
+    assertZoneDeletable() {
+        if (this.#serveSignature === SimRoute53ServeSignature.Signing) {
+            throw new SimRoute53InvalidInput("This hosted zone is signed and cannot be deleted: disable DNSSEC first");
+        }
+    }
+    /**
+     * Stop signing the zone, leaving its key-signing keys in place.
+     */
+    disableSigning() {
+        if (this.#serveSignature === SimRoute53ServeSignature.NotSigning) {
+            throw new SimRoute53DnssecNotFound("This hosted zone is not signed, so signing cannot be disabled");
+        }
+        this.#serveSignature = SimRoute53ServeSignature.NotSigning;
+    }
+}
+//# sourceMappingURL=sim-route53-zone-dnssec.js.map

package/dist/service/route53/dnssec/sim-route53-zone-dnssec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-zone-dnssec.js","sourceRoot":"","sources":["../../../../src/service/route53/dnssec/sim-route53-zone-dnssec.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,oCAAoC,EACpC,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAGvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO,EAAE,SAAS;IAClB,UAAU,EAAE,aAAa;CACjB,CAAC;AAKX;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoB;IACd,cAAc,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC7E,eAAe,GACb,wBAAwB,CAAC,UAAU,CAAC;IAEtC;;OAEG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACH,GAAG,CAAC,aAAsC;QACxC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,oCAAoC,CAC5C,mBAAmB,aAAa,CAAC,IAAI,qCAAqC,CAC3E,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,oCAAoC,CAC5C,mBAAmB,aAAa,CAAC,IAAI,iBAAiB,aAAa,CAAC,MAAM,kEAAkE,CAC7I,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAY;QAClB,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEpD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,6BAA6B,CACrC,4BAA4B,IAAI,sBAAsB,CACvD,CAAC;QACJ,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAY;QACjB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACH,aAAa;QACX,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,+BAA+B,CACvC,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;OAUG;IACH,mBAAmB;QACjB,IAAI,IAAI,CAAC,eAAe,KAAK,wBAAwB,CAAC,OAAO,EAAE,CAAC;YAC9D,MAAM,IAAI,sBAAsB,CAC9B,wEAAwE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,eAAe,KAAK,wBAAwB,CAAC,UAAU,EAAE,CAAC;YACjE,MAAM,IAAI,wBAAwB,CAChC,+DAA+D,CAChE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,GAAG,wBAAwB,CAAC,UAAU,CAAC;IAC7D,CAAC;CACF"}

package/dist/service/route53/error/sim-route53.error.d.ts

@@ -44,4 +44,59 @@ export declare class SimRoute53HostedZoneAlreadyExists extends SimRoute53Error {
     readonly name = "HostedZoneAlreadyExists";
     constructor(message: string);
 }
+/**
+ * Simulated Route53 InvalidKeySigningKeyStatus error.
+ *
+ * Real Route53 reports a key-signing key that is in the wrong state for what
+ * was asked of it this way, such as deleting one that is still active.
+ */
+export declare class SimRoute53InvalidKeySigningKeyStatus extends SimRoute53Error {
+    readonly name = "InvalidKeySigningKeyStatus";
+    constructor(message: string);
+}
+/**
+ * Simulated Route53 NoSuchKeySigningKey error.
+ */
+export declare class SimRoute53NoSuchKeySigningKey extends SimRoute53Error {
+    readonly name = "NoSuchKeySigningKey";
+    constructor(message: string);
+}
+/**
+ * Simulated Route53 KeySigningKeyAlreadyExists error.
+ */
+export declare class SimRoute53KeySigningKeyAlreadyExists extends SimRoute53Error {
+    readonly name = "KeySigningKeyAlreadyExists";
+    constructor(message: string);
+}
+/**
+ * Simulated Route53 InvalidKMSArn error.
+ *
+ * Route53 checks the customer managed key a key-signing key names before it
+ * creates one: the key has to exist, be enabled, and be an ECC_NIST_P256
+ * SIGN_VERIFY key. This is how it reports a key that is not.
+ */
+export declare class SimRoute53InvalidKmsArn extends SimRoute53Error {
+    readonly name = "InvalidKMSArn";
+    constructor(message: string);
+}
+/**
+ * Simulated Route53 DNSSECNotFound error.
+ *
+ * Real Route53 reports an attempt to stop signing a zone that is not signed
+ * this way.
+ */
+export declare class SimRoute53DnssecNotFound extends SimRoute53Error {
+    readonly name = "DNSSECNotFound";
+    constructor(message: string);
+}
+/**
+ * Simulated Route53 KeySigningKeyWithActiveStatusNotFound error.
+ *
+ * Enabling DNSSEC signing needs an active key-signing key to sign with, and
+ * this is what real Route53 answers when the zone has none.
+ */
+export declare class SimRoute53NoActiveKeySigningKey extends SimRoute53Error {
+    readonly name = "KeySigningKeyWithActiveStatusNotFound";
+    constructor(message: string);
+}
 //# sourceMappingURL=sim-route53.error.d.ts.map

package/dist/service/route53/error/sim-route53.error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-route53.error.d.ts","sourceRoot":"","sources":["../../../../src/service/route53/error/sim-route53.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,SAAS,EAAE,uBAAuB;IAFpD,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,uBAA4B,EAGxD;CACF;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,eAAe;IAC7D,SAAyB,IAAI,sBAAsB;IAEnD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,4BAA6B,SAAQ,eAAe;IAC/D,SAAyB,IAAI,wBAAwB;IAErD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;IACzD,SAAyB,IAAI,kBAAkB;IAE/C,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,iCAAkC,SAAQ,eAAe;IACpE,SAAyB,IAAI,6BAA6B;IAE1D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}
+{"version":3,"file":"sim-route53.error.d.ts","sourceRoot":"","sources":["../../../../src/service/route53/error/sim-route53.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;aAGtB,SAAS,EAAE,uBAAuB;IAFpD,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,uBAA4B,EAGxD;CACF;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,eAAe;IAC7D,SAAyB,IAAI,sBAAsB;IAEnD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,4BAA6B,SAAQ,eAAe;IAC/D,SAAyB,IAAI,wBAAwB;IAErD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;IACzD,SAAyB,IAAI,kBAAkB;IAE/C,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,iCAAkC,SAAQ,eAAe;IACpE,SAAyB,IAAI,6BAA6B;IAE1D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,oCAAqC,SAAQ,eAAe;IACvE,SAAyB,IAAI,gCAAgC;IAE7D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,6BAA8B,SAAQ,eAAe;IAChE,SAAyB,IAAI,yBAAyB;IAEtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,oCAAqC,SAAQ,eAAe;IACvE,SAAyB,IAAI,gCAAgC;IAE7D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,eAAe;IAC1D,SAAyB,IAAI,mBAAmB;IAEhD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,eAAe;IAC3D,SAAyB,IAAI,oBAAoB;IAEjD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,eAAe;IAClE,SAAyB,IAAI,2CAA2C;IAExE,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}

package/dist/service/route53/error/sim-route53.error.js

@@ -49,4 +49,71 @@ export class SimRoute53HostedZoneAlreadyExists extends SimRoute53Error {
         super(message, { httpStatusCode: 409 });
     }
 }
+/**
+ * Simulated Route53 InvalidKeySigningKeyStatus error.
+ *
+ * Real Route53 reports a key-signing key that is in the wrong state for what
+ * was asked of it this way, such as deleting one that is still active.
+ */
+export class SimRoute53InvalidKeySigningKeyStatus extends SimRoute53Error {
+    name = "InvalidKeySigningKeyStatus";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated Route53 NoSuchKeySigningKey error.
+ */
+export class SimRoute53NoSuchKeySigningKey extends SimRoute53Error {
+    name = "NoSuchKeySigningKey";
+    constructor(message) {
+        super(message, { httpStatusCode: 404 });
+    }
+}
+/**
+ * Simulated Route53 KeySigningKeyAlreadyExists error.
+ */
+export class SimRoute53KeySigningKeyAlreadyExists extends SimRoute53Error {
+    name = "KeySigningKeyAlreadyExists";
+    constructor(message) {
+        super(message, { httpStatusCode: 409 });
+    }
+}
+/**
+ * Simulated Route53 InvalidKMSArn error.
+ *
+ * Route53 checks the customer managed key a key-signing key names before it
+ * creates one: the key has to exist, be enabled, and be an ECC_NIST_P256
+ * SIGN_VERIFY key. This is how it reports a key that is not.
+ */
+export class SimRoute53InvalidKmsArn extends SimRoute53Error {
+    name = "InvalidKMSArn";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated Route53 DNSSECNotFound error.
+ *
+ * Real Route53 reports an attempt to stop signing a zone that is not signed
+ * this way.
+ */
+export class SimRoute53DnssecNotFound extends SimRoute53Error {
+    name = "DNSSECNotFound";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
+/**
+ * Simulated Route53 KeySigningKeyWithActiveStatusNotFound error.
+ *
+ * Enabling DNSSEC signing needs an active key-signing key to sign with, and
+ * this is what real Route53 answers when the zone has none.
+ */
+export class SimRoute53NoActiveKeySigningKey extends SimRoute53Error {
+    name = "KeySigningKeyWithActiveStatusNotFound";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}
 //# sourceMappingURL=sim-route53.error.js.map

package/dist/service/route53/error/sim-route53.error.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-route53.error.js","sourceRoot":"","sources":["../../../../src/service/route53/error/sim-route53.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGtB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAA4B,EAAE;QAEvD,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,0BAA2B,SAAQ,eAAe;IACpC,IAAI,GAAG,kBAAkB,CAAC;IAEnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA6B,SAAQ,eAAe;IACtC,IAAI,GAAG,oBAAoB,CAAC;IAErD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,eAAe;IAChC,IAAI,GAAG,cAAc,CAAC;IAE/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iCAAkC,SAAQ,eAAe;IAC3C,IAAI,GAAG,yBAAyB,CAAC;IAE1D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"sim-route53.error.js","sourceRoot":"","sources":["../../../../src/service/route53/error/sim-route53.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGtB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAA4B,EAAE;QAEvD,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,0BAA2B,SAAQ,eAAe;IACpC,IAAI,GAAG,kBAAkB,CAAC;IAEnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA6B,SAAQ,eAAe;IACtC,IAAI,GAAG,oBAAoB,CAAC;IAErD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,eAAe;IAChC,IAAI,GAAG,cAAc,CAAC;IAE/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iCAAkC,SAAQ,eAAe;IAC3C,IAAI,GAAG,yBAAyB,CAAC;IAE1D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oCAAqC,SAAQ,eAAe;IAC9C,IAAI,GAAG,4BAA4B,CAAC;IAE7D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,6BAA8B,SAAQ,eAAe;IACvC,IAAI,GAAG,qBAAqB,CAAC;IAEtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,oCAAqC,SAAQ,eAAe;IAC9C,IAAI,GAAG,4BAA4B,CAAC;IAE7D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,uBAAwB,SAAQ,eAAe;IACjC,IAAI,GAAG,eAAe,CAAC;IAEhD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,eAAe;IAClC,IAAI,GAAG,gBAAgB,CAAC;IAEjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,+BAAgC,SAAQ,eAAe;IACzC,IAAI,GAAG,uCAAuC,CAAC;IAExE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/route53/hosted-zone/sim-route53-hosted-zone.d.ts

@@ -2,6 +2,7 @@ import type { SimRoute53HostedZoneConfig } from "../command/create-hosted-zone/c
 import { SimRoute53HostedZoneRecords } from "./sim-route53-hosted-zone-records.js";
 import { type SimRoute53HostedZoneId } from "../command/create-hosted-zone/sim-route53-zone-id.js";
 import type { BackgroundScheduler } from "../../../util/background/background.js";
+import { SimRoute53ZoneDnssec } from "../dnssec/sim-route53-zone-dnssec.js";
 export type SimRoute53HostedZoneStatus = "PENDING" | "INSYNC";
 interface SimRoute53HostedZoneProperties {
     readonly id: SimRoute53HostedZoneId | string;
@@ -23,6 +24,15 @@ interface SimRoute53HostedZoneProperties {
 export declare class SimRoute53HostedZone {
     #private;
     readonly records: SimRoute53HostedZoneRecords;
+    /**
+     * This zone's key-signing keys and whether it is being signed.
+     *
+     * DNSSEC state belongs to the zone rather than to the account-scoped
+     * service, in the same way its records do, so a zone reached through the
+     * shared registry carries it too.
+     * @internal
+     */
+    readonly dnssec: SimRoute53ZoneDnssec;
     /**
      * AWS Route53 Hosted Zone ID.
      */
@@ -60,7 +70,7 @@ export declare class SimRoute53HostedZone {
     /**
      * Move the sim Hosted Zone into PENDING status.
      */
-    beginSynchronization(): Promise<void>;
+    beginSynchronization(): void;
     /**
      * Schedule Hosted Zone synchronization work and remember its completion.
      */
@@ -78,14 +88,12 @@ export declare class SimRoute53HostedZone {
      */
     assertDeletable(): void;
     /**
-     * Move the sim Hosted Zone into INSYNC status.
-     */
-    completeSynchronization(): Promise<void>;
-    /**
-     * Put the sim Hosted Zone into INSYNC status without awaiting anything.
+     * Put the sim Hosted Zone into INSYNC status.
      *
-     * A zone registered as already existing has no synchronization to wait for,
-     * and setup methods are not asynchronous.
+     * Neither this nor `beginSynchronization` awaits anything. Both used to
+     * answer with a resolved promise, which said the status change was
+     * asynchronous when it never was: the waiting is what
+     * `scheduleSynchronization` arranges, and it is separate.
      */
     markSynchronized(): void;
 }

package/dist/service/route53/hosted-zone/sim-route53-hosted-zone.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-route53-hosted-zone.d.ts","sourceRoot":"","sources":["../../../../src/service/route53/hosted-zone/sim-route53-hosted-zone.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,sDAAsD,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAKlF,MAAM,MAAM,0BAA0B,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE9D,UAAU,8BAA8B;IACtC,QAAQ,CAAC,EAAE,EAAE,sBAAsB,GAAG,MAAM,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7C;AAED;;;;GAIG;AACH,qBAAa,oBAAoB;;IAE/B,SAAgB,OAAO,8BAAqC;IAC5D;;OAEG;IACH,SAAgB,EAAE,EAAE,sBAAsB,CAAC;IAC3C;;;OAGG;IACH,SAAgB,eAAe,EAAE,MAAM,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAyC;IAG1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuC;IAEvE,YAAY,UAAU,EAAE,8BAA8B,EAQrD;IAED;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;;;;;;OAOG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAM1C;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,0BAA0B,GAAG,SAAS,CAInD;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,0BAA0B,CAEvC;IAED;;OAEG;IACH,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGpC;IAED;;OAEG;IACH,uBAAuB,CACrB,UAAU,EAAE,mBAAmB,EAC/B,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAC/B,IAAI,CAEN;IAED;;OAEG;IACG,8BAA8B,IAAI,OAAO,CAAC,IAAI,CAAC,CAEpD;IAED;;;;;;OAMG;IACH,eAAe,IAAI,IAAI,CAOtB;IAED;;OAEG;IACH,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAGvC;IAED;;;;;OAKG;IACH,gBAAgB,IAAI,IAAI,CAEvB;CACF"}
+{"version":3,"file":"sim-route53-hosted-zone.d.ts","sourceRoot":"","sources":["../../../../src/service/route53/hosted-zone/sim-route53-hosted-zone.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,sDAAsD,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAIlF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,MAAM,MAAM,0BAA0B,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE9D,UAAU,8BAA8B;IACtC,QAAQ,CAAC,EAAE,EAAE,sBAAsB,GAAG,MAAM,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7C;AAED;;;;GAIG;AACH,qBAAa,oBAAoB;;IAE/B,SAAgB,OAAO,8BAAqC;IAC5D;;;;;;;OAOG;IACH,SAAgB,MAAM,uBAA8B;IACpD;;OAEG;IACH,SAAgB,EAAE,EAAE,sBAAsB,CAAC;IAC3C;;;OAGG;IACH,SAAgB,eAAe,EAAE,MAAM,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAyC;IAG1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuC;IAEvE,YAAY,UAAU,EAAE,8BAA8B,EAQrD;IAED;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;;;;;;OAOG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAM1C;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,0BAA0B,GAAG,SAAS,CAInD;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,0BAA0B,CAEvC;IAED;;OAEG;IACH,oBAAoB,IAAI,IAAI,CAE3B;IAED;;OAEG;IACH,uBAAuB,CACrB,UAAU,EAAE,mBAAmB,EAC/B,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAC/B,IAAI,CAEN;IAED;;OAEG;IACG,8BAA8B,IAAI,OAAO,CAAC,IAAI,CAAC,CAEpD;IAED;;;;;;OAMG;IACH,eAAe,IAAI,IAAI,CAOtB;IAED;;;;;;;OAOG;IACH,gBAAgB,IAAI,IAAI,CAEvB;CACF"}

package/dist/service/route53/hosted-zone/sim-route53-hosted-zone.js

@@ -4,6 +4,7 @@ import { assertIsSimRoute53HostedZoneId, } from "../command/create-hosted-zone/s
 import { SimRoute53ZoneSynchronization } from "./sim-route53-zone-synchronization.js";
 import { SimRoute53HostedZoneNotEmpty } from "../error/sim-route53.error.js";
 import { widenSimRoute53ZoneName } from "./sim-route53-zone-name-widening.js";
+import { SimRoute53ZoneDnssec } from "../dnssec/sim-route53-zone-dnssec.js";
 /**
  * Simulated Route53 Hosted Zone.
  *
@@ -12,6 +13,15 @@ import { widenSimRoute53ZoneName } from "./sim-route53-zone-name-widening.js";
 export class SimRoute53HostedZone {
     /* @internal */
     records = new SimRoute53HostedZoneRecords();
+    /**
+     * This zone's key-signing keys and whether it is being signed.
+     *
+     * DNSSEC state belongs to the zone rather than to the account-scoped
+     * service, in the same way its records do, so a zone reached through the
+     * shared registry carries it too.
+     * @internal
+     */
+    dnssec = new SimRoute53ZoneDnssec();
     /**
      * AWS Route53 Hosted Zone ID.
      */
@@ -74,7 +84,6 @@ export class SimRoute53HostedZone {
      */
     beginSynchronization() {
         this.#status = "PENDING";
-        return Promise.resolve();
     }
     /**
      * Schedule Hosted Zone synchronization work and remember its completion.
@@ -102,17 +111,12 @@ export class SimRoute53HostedZone {
         }
     }
     /**
-     * Move the sim Hosted Zone into INSYNC status.
-     */
-    completeSynchronization() {
-        this.markSynchronized();
-        return Promise.resolve();
-    }
-    /**
-     * Put the sim Hosted Zone into INSYNC status without awaiting anything.
+     * Put the sim Hosted Zone into INSYNC status.
      *
-     * A zone registered as already existing has no synchronization to wait for,
-     * and setup methods are not asynchronous.
+     * Neither this nor `beginSynchronization` awaits anything. Both used to
+     * answer with a resolved promise, which said the status change was
+     * asynchronous when it never was: the waiting is what
+     * `scheduleSynchronization` arranges, and it is separate.
      */
     markSynchronized() {
         this.#status = "INSYNC";

package/dist/service/route53/hosted-zone/sim-route53-hosted-zone.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-route53-hosted-zone.js","sourceRoot":"","sources":["../../../../src/service/route53/hosted-zone/sim-route53-hosted-zone.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAElF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,8BAA8B,GAE/B,MAAM,sDAAsD,CAAC;AAE9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAkB9E;;;;GAIG;AACH,MAAM,OAAO,oBAAoB;IAC/B,eAAe;IACC,OAAO,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAC5D;;OAEG;IACa,EAAE,CAAyB;IAC3C;;;OAGG;IACa,eAAe,CAAS;IACvB,YAAY,CAAU;IACtB,gBAAgB,CAAyC;IAC1E,KAAK,CAAS;IACd,OAAO,GAA+B,SAAS,CAAC;IAC/B,eAAe,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAEvE,YAAY,UAA0C;QACpD,8BAA8B,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,GAAG,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,KAAK,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,gBAAgB;YACnB,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;;OAOG;IACH,iBAAiB,CAAC,UAAkB;QAClC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,gBAAgB,KAAK,SAAS;YACxC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,uBAAuB,CACrB,UAA+B,EAC/B,WAAgC;QAEhC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,8BAA8B;QAClC,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;OAMG;IACH,eAAe;QACb,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAA4B,CACpC,2BAA2B,IAAI,CAAC,EAAE,eAAe;gBAC/C,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,uBAAuB;QACrB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,gBAAgB;QACd,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC1B,CAAC;CACF"}
+{"version":3,"file":"sim-route53-hosted-zone.js","sourceRoot":"","sources":["../../../../src/service/route53/hosted-zone/sim-route53-hosted-zone.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAElF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,8BAA8B,GAE/B,MAAM,sDAAsD,CAAC;AAE9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAkB5E;;;;GAIG;AACH,MAAM,OAAO,oBAAoB;IAC/B,eAAe;IACC,OAAO,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAC5D;;;;;;;OAOG;IACa,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACpD;;OAEG;IACa,EAAE,CAAyB;IAC3C;;;OAGG;IACa,eAAe,CAAS;IACvB,YAAY,CAAU;IACtB,gBAAgB,CAAyC;IAC1E,KAAK,CAAS;IACd,OAAO,GAA+B,SAAS,CAAC;IAC/B,eAAe,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAEvE,YAAY,UAA0C;QACpD,8BAA8B,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,GAAG,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,KAAK,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,gBAAgB;YACnB,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;;OAOG;IACH,iBAAiB,CAAC,UAAkB;QAClC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,gBAAgB,KAAK,SAAS;YACxC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,uBAAuB,CACrB,UAA+B,EAC/B,WAAgC;QAEhC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,8BAA8B;QAClC,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;OAMG;IACH,eAAe;QACb,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAA4B,CACpC,2BAA2B,IAAI,CAAC,EAAE,eAAe;gBAC/C,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,gBAAgB;QACd,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC1B,CAAC;CACF"}

package/dist/service/route53/index.d.ts

@@ -1,3 +1,6 @@
 export { SimRoute53 } from "./sim-route53.js";
 export { type SimRoute53HostedZoneRegistration } from "./hosted-zone/register-sim-route53-hosted-zone.js";
+export { SimRoute53KeySigningKey, SimRoute53KeySigningKeyStatus, type SimRoute53KeySigningKeyView, } from "./dnssec/sim-route53-key-signing-key.js";
+export { SimRoute53ServeSignature, SimRoute53ZoneDnssec, } from "./dnssec/sim-route53-zone-dnssec.js";
+export { SimRoute53DnssecNotFound, SimRoute53InvalidKeySigningKeyStatus, SimRoute53InvalidKmsArn, SimRoute53KeySigningKeyAlreadyExists, SimRoute53NoActiveKeySigningKey, SimRoute53NoSuchKeySigningKey, } from "./error/sim-route53.error.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/service/route53/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/route53/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,KAAK,gCAAgC,EAAE,MAAM,mDAAmD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/service/route53/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,KAAK,gCAAgC,EAAE,MAAM,mDAAmD,CAAC;AAC1G,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,2BAA2B,GACjC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,uBAAuB,EACvB,oCAAoC,EACpC,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC"}

package/dist/service/route53/index.js

@@ -1,3 +1,6 @@
 export { SimRoute53 } from "./sim-route53.js";
 export {} from "./hosted-zone/register-sim-route53-hosted-zone.js";
+export { SimRoute53KeySigningKey, SimRoute53KeySigningKeyStatus, } from "./dnssec/sim-route53-key-signing-key.js";
+export { SimRoute53ServeSignature, SimRoute53ZoneDnssec, } from "./dnssec/sim-route53-zone-dnssec.js";
+export { SimRoute53DnssecNotFound, SimRoute53InvalidKeySigningKeyStatus, SimRoute53InvalidKmsArn, SimRoute53KeySigningKeyAlreadyExists, SimRoute53NoActiveKeySigningKey, SimRoute53NoSuchKeySigningKey, } from "./error/sim-route53.error.js";
 //# sourceMappingURL=index.js.map

package/dist/service/route53/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/route53/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAyC,MAAM,mDAAmD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/service/route53/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAyC,MAAM,mDAAmD,CAAC;AAC1G,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAE9B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,uBAAuB,EACvB,oCAAoC,EACpC,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC"}

package/dist/service/route53/resolve/sim-r53-regional-service-target.d.ts

@@ -0,0 +1,46 @@
+import type { SimAwsServiceTarget } from "../../../serve/controller/sim-service-controller.js";
+/**
+ * Maps the Yulin-local hostnames whose last label is a Region to simulated
+ * service targets.
+ *
+ * These are the endpoints the AWS SDK talks to, and the local URL rewriting
+ * drops the AWS domain from each of them, which is what leaves the Region as
+ * the last label. Grouping them here keeps that one rule in one place, and
+ * leaves the resolver with the hostnames that keep their own domain.
+ */
+export declare class SimRoute53RegionalServiceTargets {
+    /**
+     * Convert a logical hostname ending in a Region into a service target.
+     */
+    resolve(logicalName: string): SimAwsServiceTarget | undefined;
+    /**
+     * Resolve Cognito user pool endpoint hostnames.
+     *
+     * Simulated Cognito hostnames use:
+     *
+     *   cognito-idp.<region>
+     *
+     * The hostname names the regional Cognito endpoint rather than one pool, as
+     * the real `cognito-idp.<region>.amazonaws.com` does, and the pool id is the
+     * first path segment. The resource name is therefore empty, in the same way
+     * it is for the path-style S3 endpoint.
+     */
+    private cognitoIdpTarget;
+    /**
+     * Resolve the endpoints one resource is issued, which name that resource in
+     * their first label:
+     *
+     *   <url-id>.lambda-url.<region>    a Lambda Function URL
+     *   <api-id>.execute-api.<region>   an API Gateway HTTP API
+     *
+     * The real AWS endpoints end `.on.aws` and `.amazonaws.com`, which the local
+     * URL rewriting drops in the same way it drops `.amazonaws.com` from S3
+     * endpoints. Both ids are one DNS label, so the label count here is exact.
+     */
+    private resourceEndpointTarget;
+    /**
+     * Which service issues an endpoint hostname carrying a service label.
+     */
+    private endpointService;
+}
+//# sourceMappingURL=sim-r53-regional-service-target.d.ts.map

package/dist/service/route53/resolve/sim-r53-regional-service-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-r53-regional-service-target.d.ts","sourceRoot":"","sources":["../../../../src/service/route53/resolve/sim-r53-regional-service-target.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAO/F;;;;;;;;GAQG;AACH,qBAAa,gCAAgC;IAC3C;;OAEG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAI5D;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,sBAAsB;IA2B9B;;OAEG;IACH,OAAO,CAAC,eAAe;CAaxB"}

package/dist/service/route53/resolve/sim-r53-regional-service-target.js

@@ -0,0 +1,90 @@
+import { executeApiHostLabel } from "../../apigatewayv2/api/sim-http-api-host.js";
+import { lambdaFunctionUrlHostLabel } from "../../lambda/function/url/sim-lambda-function-url-host.js";
+const cognitoIdpServiceLabel = "cognito-idp";
+/**
+ * Maps the Yulin-local hostnames whose last label is a Region to simulated
+ * service targets.
+ *
+ * These are the endpoints the AWS SDK talks to, and the local URL rewriting
+ * drops the AWS domain from each of them, which is what leaves the Region as
+ * the last label. Grouping them here keeps that one rule in one place, and
+ * leaves the resolver with the hostnames that keep their own domain.
+ */
+export class SimRoute53RegionalServiceTargets {
+    /**
+     * Convert a logical hostname ending in a Region into a service target.
+     */
+    resolve(logicalName) {
+        const labels = logicalName.split(".");
+        return this.cognitoIdpTarget(labels) ?? this.resourceEndpointTarget(labels);
+    }
+    /**
+     * Resolve Cognito user pool endpoint hostnames.
+     *
+     * Simulated Cognito hostnames use:
+     *
+     *   cognito-idp.<region>
+     *
+     * The hostname names the regional Cognito endpoint rather than one pool, as
+     * the real `cognito-idp.<region>.amazonaws.com` does, and the pool id is the
+     * first path segment. The resource name is therefore empty, in the same way
+     * it is for the path-style S3 endpoint.
+     */
+    cognitoIdpTarget(labels) {
+        if (labels.length !== 2) {
+            return undefined;
+        }
+        const [service, regionName] = labels;
+        if (service !== cognitoIdpServiceLabel || regionName === undefined) {
+            return undefined;
+        }
+        return {
+            service: "cognitoIdentityProvider",
+            resourceName: "",
+            regionName: regionName,
+        };
+    }
+    /**
+     * Resolve the endpoints one resource is issued, which name that resource in
+     * their first label:
+     *
+     *   <url-id>.lambda-url.<region>    a Lambda Function URL
+     *   <api-id>.execute-api.<region>   an API Gateway HTTP API
+     *
+     * The real AWS endpoints end `.on.aws` and `.amazonaws.com`, which the local
+     * URL rewriting drops in the same way it drops `.amazonaws.com` from S3
+     * endpoints. Both ids are one DNS label, so the label count here is exact.
+     */
+    resourceEndpointTarget(labels) {
+        if (labels.length !== 3) {
+            return undefined;
+        }
+        const [resourceName, service, regionName] = labels;
+        /* v8 ignore if -- empty labels are rejected before resolution */
+        if (resourceName === undefined || regionName === undefined) {
+            return undefined;
+        }
+        const endpointService = this.endpointService(service);
+        if (endpointService === undefined) {
+            return undefined;
+        }
+        return {
+            service: endpointService,
+            resourceName,
+            regionName: regionName,
+        };
+    }
+    /**
+     * Which service issues an endpoint hostname carrying a service label.
+     */
+    endpointService(service) {
+        if (service === lambdaFunctionUrlHostLabel) {
+            return "lambda";
+        }
+        if (service === executeApiHostLabel) {
+            return "apiGatewayV2";
+        }
+        return undefined;
+    }
+}
+//# sourceMappingURL=sim-r53-regional-service-target.js.map

package/dist/service/route53/resolve/sim-r53-regional-service-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-r53-regional-service-target.js","sourceRoot":"","sources":["../../../../src/service/route53/resolve/sim-r53-regional-service-target.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAElF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAEvG,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,OAAO,gCAAgC;IAC3C;;OAEG;IACH,OAAO,CAAC,WAAmB;QACzB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;;;;;OAWG;IACK,gBAAgB,CACtB,MAAyB;QAEzB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC;QAErC,IAAI,OAAO,KAAK,sBAAsB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,yBAAyB;YAClC,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,UAA2B;SACxC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,sBAAsB,CAC5B,MAAyB;QAEzB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC;QAEnD,iEAAiE;QACjE,IAAI,YAAY,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,eAAe;YACxB,YAAY;YACZ,UAAU,EAAE,UAA2B;SACxC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,OAA2B;QAE3B,IAAI,OAAO,KAAK,0BAA0B,EAAE,CAAC;YAC3C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;YACpC,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}