@kensio/yulin 1.8.0 → 1.10.0

package/dist/service/sns/sdk/sim-sns-sdk-command-router.js

@@ -0,0 +1,76 @@
+import { simSdkCallerOptions, } from "../../../sdk/index.js";
+/**
+ * Routes intercepted SDK Commands to one scoped simulated SNS.
+ */
+export class SimSnsSdkCommandRouter {
+    routes;
+    constructor(simSns) {
+        this.routes = new Map([
+            [
+                "CreateTopicCommand",
+                async (command, context) => await simSns.createTopic(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "ListTopicsCommand",
+                async (command, context) => await simSns.listTopics(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DeleteTopicCommand",
+                async (command, context) => await simSns.deleteTopic(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetTopicAttributesCommand",
+                async (command, context) => await simSns.getTopicAttributes(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "SetTopicAttributesCommand",
+                async (command, context) => await simSns.setTopicAttributes(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "SubscribeCommand",
+                async (command, context) => await simSns.subscribe(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "UnsubscribeCommand",
+                async (command, context) => await simSns.unsubscribe(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "ListSubscriptionsCommand",
+                async (command, context) => await simSns.listSubscriptions(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "ListSubscriptionsByTopicCommand",
+                async (command, context) => await simSns.listSubscriptionsByTopic(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetSubscriptionAttributesCommand",
+                async (command, context) => await simSns.getSubscriptionAttributes(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "SetSubscriptionAttributesCommand",
+                async (command, context) => await simSns.setSubscriptionAttributes(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "PublishCommand",
+                async (command, context) => await simSns.publish(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "PublishBatchCommand",
+                async (command, context) => await simSns.publishBatch(command, simSdkCallerOptions(context)),
+            ],
+        ]);
+    }
+    /**
+     * The SDK Command names simulated SNS can handle.
+     */
+    supportedCommandNames() {
+        return this.routes.keys().toArray();
+    }
+    /**
+     * Get the route for an SDK Command name, if simulated SNS supports it.
+     */
+    route(commandName) {
+        return this.routes.get(commandName);
+    }
+}
+//# sourceMappingURL=sim-sns-sdk-command-router.js.map

package/dist/service/sns/sdk/sim-sns-sdk-command-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-sdk-command-router.js","sourceRoot":"","sources":["../../../../src/service/sns/sdk/sim-sns-sdk-command-router.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,uBAAuB,CAAC;AAsB/B;;GAEG;AACH,MAAM,OAAO,sBAAsB;IAChB,MAAM,CAA0C;IAEjE,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAA6B;YAChD;gBACE,oBAAoB;gBACpB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,WAAW,CACtB,OAAgC,EAChC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,mBAAmB;gBACnB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,UAAU,CACrB,OAA+B,EAC/B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,oBAAoB;gBACpB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,WAAW,CACtB,OAAgC,EAChC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,2BAA2B;gBAC3B,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,kBAAkB,CAC7B,OAAuC,EACvC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,2BAA2B;gBAC3B,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,kBAAkB,CAC7B,OAAuC,EACvC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,kBAAkB;gBAClB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,SAAS,CACpB,OAA8B,EAC9B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,oBAAoB;gBACpB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,WAAW,CACtB,OAAgC,EAChC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,0BAA0B;gBAC1B,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,iBAAiB,CAC5B,OAAsC,EACtC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,iCAAiC;gBACjC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,wBAAwB,CACnC,OAA6C,EAC7C,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,kCAAkC;gBAClC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,yBAAyB,CACpC,OAA8C,EAC9C,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,kCAAkC;gBAClC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,yBAAyB,CACpC,OAA8C,EAC9C,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,gBAAgB;gBAChB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,OAAO,CAClB,OAA4B,EAC5B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,qBAAqB;gBACrB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,MAAM,CAAC,YAAY,CACvB,OAAiC,EACjC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAmB;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;CACF"}

package/dist/service/sns/signature/sim-sns-certificate.d.ts

@@ -0,0 +1,30 @@
+import type { KeyObject } from "node:crypto";
+interface SimSnsCertificateInput {
+    readonly privateKey: KeyObject;
+    readonly publicKey: KeyObject;
+    readonly subjectName: string;
+    readonly serialNumber: Buffer;
+}
+/**
+ * Build a self-signed X.509 certificate for a key pair, as PEM.
+ *
+ * It is the smallest certificate that is still a certificate: a version, a
+ * serial number, one common name as both issuer and subject, a validity window,
+ * the public key, and an RSA signature over all of it. There are no extensions,
+ * because nothing verifying an SNS message looks at any.
+ */
+export declare function simSnsSelfSignedCertificatePem(input: SimSnsCertificateInput): string;
+/**
+ * Read a certificate serial number out of a digest of the public key.
+ *
+ * A real certificate authority allocates serial numbers. Nothing here has one
+ * to allocate, and a serial derived from the key is unique in the only way that
+ * matters: two simulated scopes with different keys have different serials.
+ *
+ * The top bit of the first byte is cleared, because a certificate serial number
+ * has to be positive and a DER integer is signed. Clearing it is one byte of
+ * uniqueness given up for a serial that never needs a leading zero.
+ */
+export declare function simSnsSerialNumber(digest: Buffer): Buffer;
+export {};
+//# sourceMappingURL=sim-sns-certificate.d.ts.map

package/dist/service/sns/signature/sim-sns-certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-certificate.d.ts","sourceRoot":"","sources":["../../../../src/service/sns/signature/sim-sns-certificate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AA6D7C,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAuED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,sBAAsB,GAC5B,MAAM,CAaR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAMzD"}

package/dist/service/sns/signature/sim-sns-certificate.js

@@ -0,0 +1,110 @@
+import { createSign } from "node:crypto";
+import { derBitStringTag, derBytes, derExplicitZeroTag, derIntegerTag, derNullTag, derObjectIdentifierTag, derPrintableStringTag, derSequenceTag, derSetTag, derText, derUtcTimeTag, derValue, } from "./sim-sns-der.js";
+/**
+ * The body bytes of the sha1WithRSAEncryption object identifier,
+ * 1.2.840.113549.1.1.5.
+ *
+ * This is the algorithm signature version 1 names, which is the version real
+ * SNS signs with unless a topic opts into version 2.
+ */
+const sha1WithRsaEncryption = [
+    0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05,
+];
+/**
+ * The body bytes of the commonName object identifier, 2.5.4.3.
+ */
+const commonName = [0x55, 0x04, 0x03];
+/**
+ * The version number of an X.509 v3 certificate, which counts from zero.
+ */
+const version3 = 2;
+/**
+ * When the certificate becomes valid, and when it stops being valid.
+ *
+ * Both are fixed rather than taken from the clock, so the same key always
+ * produces the same certificate and nothing in a test suite depends on when it
+ * ran. The end is before 2050 because a certificate valid past then cannot use
+ * the UTCTime encoding, and nothing here is a real trust anchor that ought to
+ * expire.
+ */
+const notBefore = new Date("2000-01-01T00:00:00.000Z");
+const notAfter = new Date("2049-12-31T23:59:59.000Z");
+/**
+ * How many bytes of the public key digest become the serial number.
+ */
+const serialNumberBytes = 8;
+/**
+ * How many base64 characters a PEM document puts on one line.
+ */
+const pemLineLength = 64;
+/**
+ * A UTCTime, which is the two digit year form certificates date things with.
+ *
+ * Two digits means the year has to be before 2050, which is what X.509 says: a
+ * certificate valid past then carries a GeneralizedTime instead.
+ */
+function utcTime(instant) {
+    const digits = instant.toISOString().replaceAll(/\D/gu, "");
+    return derText(derUtcTimeTag, `${digits.slice(2, 14)}Z`);
+}
+/**
+ * Wrap DER bytes as the PEM document a verifier reads.
+ */
+function toPem(der) {
+    const base64 = der.toString("base64");
+    const lines = Array.from({ length: Math.ceil(base64.length / pemLineLength) }, (_unused, index) => base64.slice(index * pemLineLength, (index + 1) * pemLineLength));
+    return `-----BEGIN CERTIFICATE-----\n${lines.join("\n")}\n-----END CERTIFICATE-----\n`;
+}
+/**
+ * The algorithm identifier both the certificate body and its signature carry.
+ */
+function signatureAlgorithm() {
+    return derValue(derSequenceTag, derBytes(derObjectIdentifierTag, ...sha1WithRsaEncryption), derValue(derNullTag));
+}
+/**
+ * An X.509 Name carrying one common name, which is all this certificate needs.
+ */
+function distinguishedName(name) {
+    const attribute = derValue(derSequenceTag, derBytes(derObjectIdentifierTag, ...commonName), derText(derPrintableStringTag, name));
+    return derValue(derSequenceTag, derValue(derSetTag, attribute));
+}
+/**
+ * The part of a certificate that is signed.
+ */
+function certificateBody(input) {
+    const name = distinguishedName(input.subjectName);
+    return derValue(derSequenceTag, derValue(derExplicitZeroTag, derBytes(derIntegerTag, version3)), derValue(derIntegerTag, input.serialNumber), signatureAlgorithm(), name, derValue(derSequenceTag, utcTime(notBefore), utcTime(notAfter)), 
+    // Self-signed, so the issuer and the subject are the same Name.
+    name, input.publicKey.export({ type: "spki", format: "der" }));
+}
+/**
+ * Build a self-signed X.509 certificate for a key pair, as PEM.
+ *
+ * It is the smallest certificate that is still a certificate: a version, a
+ * serial number, one common name as both issuer and subject, a validity window,
+ * the public key, and an RSA signature over all of it. There are no extensions,
+ * because nothing verifying an SNS message looks at any.
+ */
+export function simSnsSelfSignedCertificatePem(input) {
+    const body = certificateBody(input);
+    const signature = createSign("RSA-SHA1").update(body).sign(input.privateKey);
+    const unusedBits = Buffer.from([0]);
+    return toPem(derValue(derSequenceTag, body, signatureAlgorithm(), derValue(derBitStringTag, unusedBits, signature)));
+}
+/**
+ * Read a certificate serial number out of a digest of the public key.
+ *
+ * A real certificate authority allocates serial numbers. Nothing here has one
+ * to allocate, and a serial derived from the key is unique in the only way that
+ * matters: two simulated scopes with different keys have different serials.
+ *
+ * The top bit of the first byte is cleared, because a certificate serial number
+ * has to be positive and a DER integer is signed. Clearing it is one byte of
+ * uniqueness given up for a serial that never needs a leading zero.
+ */
+export function simSnsSerialNumber(digest) {
+    const serial = Buffer.from(digest.subarray(0, serialNumberBytes));
+    serial.writeUInt8(serial.readUInt8(0) & 0x7f, 0);
+    return serial;
+}
+//# sourceMappingURL=sim-sns-certificate.js.map

package/dist/service/sns/signature/sim-sns-certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-certificate.js","sourceRoot":"","sources":["../../../../src/service/sns/signature/sim-sns-certificate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,eAAe,EACf,QAAQ,EACR,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,EACd,SAAS,EACT,OAAO,EACP,aAAa,EACb,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAE1B;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG;IAC5B,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACrD,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEtC;;GAEG;AACH,MAAM,QAAQ,GAAG,CAAC,CAAC;AAEnB;;;;;;;;GAQG;AACH,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;AAEvD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;AAEtD;;GAEG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;GAEG;AACH,MAAM,aAAa,GAAG,EAAE,CAAC;AASzB;;;;;GAKG;AACH,SAAS,OAAO,CAAC,OAAa;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE5D,OAAO,OAAO,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAS,KAAK,CAAC,GAAW;IACxB,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CACtB,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,aAAa,CAAC,EAAE,EACpD,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACjB,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,aAAa,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CACnE,CAAC;IAEF,OAAO,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC;AACzF,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB;IACzB,OAAO,QAAQ,CACb,cAAc,EACd,QAAQ,CAAC,sBAAsB,EAAE,GAAG,qBAAqB,CAAC,EAC1D,QAAQ,CAAC,UAAU,CAAC,CACrB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,SAAS,GAAG,QAAQ,CACxB,cAAc,EACd,QAAQ,CAAC,sBAAsB,EAAE,GAAG,UAAU,CAAC,EAC/C,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,CACrC,CAAC;IAEF,OAAO,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,KAA6B;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAElD,OAAO,QAAQ,CACb,cAAc,EACd,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,EAC/D,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,EAC3C,kBAAkB,EAAE,EACpB,IAAI,EACJ,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,gEAAgE;IAChE,IAAI,EACJ,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CACxD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAA6B;IAE7B,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpC,OAAO,KAAK,CACV,QAAQ,CACN,cAAc,EACd,IAAI,EACJ,kBAAkB,EAAE,EACpB,QAAQ,CAAC,eAAe,EAAE,UAAU,EAAE,SAAS,CAAC,CACjD,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAElE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IAEjD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/service/sns/signature/sim-sns-der.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The little bit of DER writing a self-signed certificate needs.
+ *
+ * Node's `crypto` reads an X.509 certificate but does not write one, and the
+ * signature a simulated SNS message carries is only useful if a verifier can
+ * check it against a certificate. So the certificate is assembled by hand, and
+ * this is the encoding it is assembled with: every ASN.1 value is a tag, a
+ * length and a body, and that is the whole of what is here.
+ *
+ * The tags are exported alongside it because the shapes X.509 uses are the
+ * caller's business rather than this module's. It is not a general ASN.1
+ * encoder and does not try to be one.
+ */
+export declare const derSequenceTag = 48;
+export declare const derSetTag = 49;
+export declare const derIntegerTag = 2;
+export declare const derBitStringTag = 3;
+export declare const derNullTag = 5;
+export declare const derObjectIdentifierTag = 6;
+export declare const derPrintableStringTag = 19;
+export declare const derUtcTimeTag = 23;
+/**
+ * The tag of an explicitly tagged context specific zero, which is how a
+ * certificate carries its version.
+ */
+export declare const derExplicitZeroTag = 160;
+/**
+ * One ASN.1 value: a tag, the length of what follows, and what follows.
+ */
+export declare function derValue(tag: number, ...contents: Buffer[]): Buffer;
+/**
+ * A DER value holding ASCII text, which is what a common name and a UTCTime
+ * both are.
+ */
+export declare function derText(tag: number, value: string): Buffer;
+/**
+ * A DER value holding bytes given one at a time.
+ */
+export declare function derBytes(tag: number, ...bytes: number[]): Buffer;
+//# sourceMappingURL=sim-sns-der.d.ts.map

package/dist/service/sns/signature/sim-sns-der.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-der.d.ts","sourceRoot":"","sources":["../../../../src/service/sns/signature/sim-sns-der.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,cAAc,KAAO,CAAC;AAEnC,eAAO,MAAM,SAAS,KAAO,CAAC;AAE9B,eAAO,MAAM,aAAa,IAAO,CAAC;AAElC,eAAO,MAAM,eAAe,IAAO,CAAC;AAEpC,eAAO,MAAM,UAAU,IAAO,CAAC;AAE/B,eAAO,MAAM,sBAAsB,IAAO,CAAC;AAE3C,eAAO,MAAM,qBAAqB,KAAO,CAAC;AAE1C,eAAO,MAAM,aAAa,KAAO,CAAC;AAElC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,MAAO,CAAC;AAwBvC;;GAEG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAInE;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAEhE"}

package/dist/service/sns/signature/sim-sns-der.js

@@ -0,0 +1,64 @@
+/**
+ * The little bit of DER writing a self-signed certificate needs.
+ *
+ * Node's `crypto` reads an X.509 certificate but does not write one, and the
+ * signature a simulated SNS message carries is only useful if a verifier can
+ * check it against a certificate. So the certificate is assembled by hand, and
+ * this is the encoding it is assembled with: every ASN.1 value is a tag, a
+ * length and a body, and that is the whole of what is here.
+ *
+ * The tags are exported alongside it because the shapes X.509 uses are the
+ * caller's business rather than this module's. It is not a general ASN.1
+ * encoder and does not try to be one.
+ */
+export const derSequenceTag = 0x30;
+export const derSetTag = 0x31;
+export const derIntegerTag = 0x02;
+export const derBitStringTag = 0x03;
+export const derNullTag = 0x05;
+export const derObjectIdentifierTag = 0x06;
+export const derPrintableStringTag = 0x13;
+export const derUtcTimeTag = 0x17;
+/**
+ * The tag of an explicitly tagged context specific zero, which is how a
+ * certificate carries its version.
+ */
+export const derExplicitZeroTag = 0xa0;
+/**
+ * The largest length DER writes in the length byte itself.
+ */
+const shortFormLimit = 0x80;
+/**
+ * Encode a length in DER's short or long form.
+ */
+function derLength(length) {
+    if (length < shortFormLimit) {
+        return Buffer.from([length]);
+    }
+    const bytes = [];
+    for (let rest = length; rest > 0; rest = Math.floor(rest / 256)) {
+        bytes.unshift(rest % 256);
+    }
+    return Buffer.from([shortFormLimit | bytes.length, ...bytes]);
+}
+/**
+ * One ASN.1 value: a tag, the length of what follows, and what follows.
+ */
+export function derValue(tag, ...contents) {
+    const body = Buffer.concat(contents);
+    return Buffer.concat([Buffer.from([tag]), derLength(body.length), body]);
+}
+/**
+ * A DER value holding ASCII text, which is what a common name and a UTCTime
+ * both are.
+ */
+export function derText(tag, value) {
+    return derValue(tag, Buffer.from(value, "ascii"));
+}
+/**
+ * A DER value holding bytes given one at a time.
+ */
+export function derBytes(tag, ...bytes) {
+    return derValue(tag, Buffer.from(bytes));
+}
+//# sourceMappingURL=sim-sns-der.js.map

package/dist/service/sns/signature/sim-sns-der.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-der.js","sourceRoot":"","sources":["../../../../src/service/sns/signature/sim-sns-der.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC;AAE9B,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC;AAElC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AAE/B,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAE3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC;;GAEG;AACH,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B;;GAEG;AACH,SAAS,SAAS,CAAC,MAAc;IAC/B,IAAI,MAAM,GAAG,cAAc,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,IAAI,IAAI,GAAG,MAAM,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAChE,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,GAAG,QAAkB;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAErC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,KAAa;IAChD,OAAO,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,GAAG,KAAe;IACtD,OAAO,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/service/sns/signature/sim-sns-host.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The hostname the URLs in a delivered message name.
+ *
+ * Real SNS puts `sns.<region>.amazonaws.com` in the `SigningCertURL` and the
+ * `UnsubscribeURL` of every message it delivers. A simulated message names
+ * `sns.<region>.yulin.invalid` instead, because neither URL can be fetched:
+ * simulated SNS is not served over HTTP, and the certificate is handed out
+ * in process by `SimSns.signingCertificate`.
+ *
+ * `.invalid` is the reserved top level domain for exactly this. A consumer that
+ * does try to fetch one of these URLs fails to resolve it, rather than reaching
+ * real AWS and being answered by a certificate that signed nothing here.
+ *
+ * This is a divergence a real signature verifier notices. `sns-validator`
+ * hard-codes an `amazonaws.com` certificate host and fetches the URL itself, so
+ * it cannot verify a simulated message as it stands. Verifying one means
+ * checking the signature against the certificate `SimSns.signingCertificate`
+ * hands over, which is what the docs show.
+ */
+export declare function simSnsHost(regionName: string): string;
+/**
+ * The URL a delivered message names to say how to stop receiving them.
+ *
+ * Real SNS carries this in every envelope, and it is the same shape here with
+ * the simulated host in front of it.
+ */
+export declare function simSnsUnsubscribeUrl(regionName: string, subscriptionArn: string): string;
+//# sourceMappingURL=sim-sns-host.d.ts.map

package/dist/service/sns/signature/sim-sns-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-host.d.ts","sourceRoot":"","sources":["../../../../src/service/sns/signature/sim-sns-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,GACtB,MAAM,CAKR"}

package/dist/service/sns/signature/sim-sns-host.js

@@ -0,0 +1,33 @@
+/**
+ * The hostname the URLs in a delivered message name.
+ *
+ * Real SNS puts `sns.<region>.amazonaws.com` in the `SigningCertURL` and the
+ * `UnsubscribeURL` of every message it delivers. A simulated message names
+ * `sns.<region>.yulin.invalid` instead, because neither URL can be fetched:
+ * simulated SNS is not served over HTTP, and the certificate is handed out
+ * in process by `SimSns.signingCertificate`.
+ *
+ * `.invalid` is the reserved top level domain for exactly this. A consumer that
+ * does try to fetch one of these URLs fails to resolve it, rather than reaching
+ * real AWS and being answered by a certificate that signed nothing here.
+ *
+ * This is a divergence a real signature verifier notices. `sns-validator`
+ * hard-codes an `amazonaws.com` certificate host and fetches the URL itself, so
+ * it cannot verify a simulated message as it stands. Verifying one means
+ * checking the signature against the certificate `SimSns.signingCertificate`
+ * hands over, which is what the docs show.
+ */
+export function simSnsHost(regionName) {
+    return `sns.${regionName}.yulin.invalid`;
+}
+/**
+ * The URL a delivered message names to say how to stop receiving them.
+ *
+ * Real SNS carries this in every envelope, and it is the same shape here with
+ * the simulated host in front of it.
+ */
+export function simSnsUnsubscribeUrl(regionName, subscriptionArn) {
+    return (`https://${simSnsHost(regionName)}/?Action=Unsubscribe` +
+        `&SubscriptionArn=${encodeURIComponent(subscriptionArn)}`);
+}
+//# sourceMappingURL=sim-sns-host.js.map

package/dist/service/sns/signature/sim-sns-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-host.js","sourceRoot":"","sources":["../../../../src/service/sns/signature/sim-sns-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,UAAU,CAAC,UAAkB;IAC3C,OAAO,OAAO,UAAU,gBAAgB,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,eAAuB;IAEvB,OAAO,CACL,WAAW,UAAU,CAAC,UAAU,CAAC,sBAAsB;QACvD,oBAAoB,kBAAkB,CAAC,eAAe,CAAC,EAAE,CAC1D,CAAC;AACJ,CAAC"}

package/dist/service/sns/signature/sim-sns-message-signer.d.ts

@@ -0,0 +1,51 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+/**
+ * The signature version real SNS signs with unless a topic opts into version 2.
+ *
+ * Version 1 is SHA1withRSA. The `SignatureVersion` topic attribute, which is
+ * how a real topic asks for version 2, is refused here, so every message
+ * carries this.
+ */
+export declare const simSnsSignatureVersion = "1";
+/**
+ * What a signature adds to a delivered message.
+ */
+export interface SimSnsSignatureFields {
+    readonly SignatureVersion: string;
+    readonly Signature: string;
+    readonly SigningCertURL: string;
+}
+interface SimSnsMessageSignerProperties {
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * Signs the messages one simulated SNS scope delivers.
+ *
+ * The key belongs to the scope rather than to a topic, which is how real SNS
+ * works: one certificate per Region signs every message that Region sends. It
+ * is generated on first use, because generating RSA takes long enough to
+ * notice and a scope that never delivers anything never needs one.
+ */
+export declare class SimSnsMessageSigner {
+    private readonly host;
+    private held;
+    constructor(properties: SimSnsMessageSignerProperties);
+    /**
+     * Sign the canonical form of one message.
+     */
+    sign(canonicalMessage: string): SimSnsSignatureFields;
+    /**
+     * The certificate a `SigningCertURL` names, or nothing when it names another.
+     *
+     * This is how a verifier gets at the certificate, because the URL cannot be
+     * fetched: simulated SNS is not served over HTTP. A URL this scope did not
+     * issue answers with nothing rather than with the certificate it has, so a
+     * message signed by another scope is not accidentally verified against the
+     * wrong key.
+     */
+    certificateFor(signingCertUrl: string): string | undefined;
+    private certificateUrl;
+    private key;
+}
+export {};
+//# sourceMappingURL=sim-sns-message-signer.d.ts.map

package/dist/service/sns/signature/sim-sns-message-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-message-signer.d.ts","sourceRoot":"","sources":["../../../../src/service/sns/signature/sim-sns-message-signer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAI1F;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,IAAI,CAA+B;IAE3C,YAAY,UAAU,EAAE,6BAA6B,EAEpD;IAED;;OAEG;IACH,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,qBAAqB,CAQpD;IAED;;;;;;;;OAQG;IACH,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQzD;IAED,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,GAAG;CAKZ"}

package/dist/service/sns/signature/sim-sns-message-signer.js

@@ -0,0 +1,60 @@
+import { simSnsHost } from "./sim-sns-host.js";
+import { SimSnsSigningKey } from "./sim-sns-signing-key.js";
+/**
+ * The signature version real SNS signs with unless a topic opts into version 2.
+ *
+ * Version 1 is SHA1withRSA. The `SignatureVersion` topic attribute, which is
+ * how a real topic asks for version 2, is refused here, so every message
+ * carries this.
+ */
+export const simSnsSignatureVersion = "1";
+/**
+ * Signs the messages one simulated SNS scope delivers.
+ *
+ * The key belongs to the scope rather than to a topic, which is how real SNS
+ * works: one certificate per Region signs every message that Region sends. It
+ * is generated on first use, because generating RSA takes long enough to
+ * notice and a scope that never delivers anything never needs one.
+ */
+export class SimSnsMessageSigner {
+    host;
+    held;
+    constructor(properties) {
+        this.host = simSnsHost(properties.accountRegionScope.regionName);
+    }
+    /**
+     * Sign the canonical form of one message.
+     */
+    sign(canonicalMessage) {
+        const key = this.key();
+        return {
+            SignatureVersion: simSnsSignatureVersion,
+            Signature: key.sign(canonicalMessage),
+            SigningCertURL: this.certificateUrl(key),
+        };
+    }
+    /**
+     * The certificate a `SigningCertURL` names, or nothing when it names another.
+     *
+     * This is how a verifier gets at the certificate, because the URL cannot be
+     * fetched: simulated SNS is not served over HTTP. A URL this scope did not
+     * issue answers with nothing rather than with the certificate it has, so a
+     * message signed by another scope is not accidentally verified against the
+     * wrong key.
+     */
+    certificateFor(signingCertUrl) {
+        const key = this.held;
+        if (key === undefined || this.certificateUrl(key) !== signingCertUrl) {
+            return undefined;
+        }
+        return key.certificatePem;
+    }
+    certificateUrl(key) {
+        return `https://${this.host}/SimulatedNotificationService-${key.fingerprint}.pem`;
+    }
+    key() {
+        this.held ??= SimSnsSigningKey.generate(this.host);
+        return this.held;
+    }
+}
+//# sourceMappingURL=sim-sns-message-signer.js.map

package/dist/service/sns/signature/sim-sns-message-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-message-signer.js","sourceRoot":"","sources":["../../../../src/service/sns/signature/sim-sns-message-signer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAe1C;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACb,IAAI,CAAS;IACtB,IAAI,CAA+B;IAE3C,YAAY,UAAyC;QACnD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,gBAAwB;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,OAAO;YACL,gBAAgB,EAAE,sBAAsB;YACxC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACrC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;SACzC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,cAAc,CAAC,cAAsB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;QAEtB,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC;YACrE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,GAAG,CAAC,cAAc,CAAC;IAC5B,CAAC;IAEO,cAAc,CAAC,GAAqB;QAC1C,OAAO,WAAW,IAAI,CAAC,IAAI,iCAAiC,GAAG,CAAC,WAAW,MAAM,CAAC;IACpF,CAAC;IAEO,GAAG;QACT,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEnD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/service/sns/signature/sim-sns-signing-key.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The key one simulated SNS scope signs its messages with.
+ *
+ * The key material is real, generated with `node:crypto`, and the signature is
+ * a real SHA1withRSA signature over the string real SNS signs. A verifier can
+ * therefore check a delivered message against the certificate, rather than
+ * being handed a `Signature` field it has no way to use.
+ */
+export declare class SimSnsSigningKey {
+    readonly fingerprint: string;
+    readonly certificatePem: string;
+    private readonly privateKey;
+    private constructor();
+    /**
+     * Generate a key pair for a simulated SNS scope.
+     *
+     * A scope generates its own on first use rather than at construction,
+     * because generating 2048-bit RSA takes long enough to notice and most
+     * simulated SNS scopes in a test suite never deliver anything. Nothing is
+     * written to disk, and no key material is committed: a private key in the
+     * repository would set off secret scanners for no gain.
+     */
+    static generate(subjectName: string): SimSnsSigningKey;
+    /**
+     * Sign the canonical form of a message, as real SNS signs it.
+     *
+     * Signature version 1 is SHA1withRSA, and the signature travels base64
+     * encoded in the envelope. SHA-1 is weak, and it is what real SNS uses for
+     * version 1: a simulation signing with something else would produce a
+     * signature a real verifier could not check.
+     */
+    sign(canonicalMessage: string): string;
+}
+//# sourceMappingURL=sim-sns-signing-key.d.ts.map

package/dist/service/sns/signature/sim-sns-signing-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sns-signing-key.d.ts","sourceRoot":"","sources":["../../../../src/service/sns/signature/sim-sns-signing-key.ts"],"names":[],"mappings":"AAwBA;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,cAAc,EAAE,MAAM,CAAC;IAEvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IAEvC,OAAO,eAgBN;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,gBAAgB,CAErD;IAED;;;;;;;OAOG;IACH,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAKrC;CACF"}

package/dist/service/sns/signature/sim-sns-signing-key.js

@@ -0,0 +1,69 @@
+import { createHash, createSign, generateKeyPairSync, } from "node:crypto";
+import { simSnsSelfSignedCertificatePem, simSnsSerialNumber, } from "./sim-sns-certificate.js";
+/**
+ * The RSA modulus size real SNS signs with.
+ */
+const modulusLength = 2048;
+/**
+ * How many characters of the key's digest name the certificate.
+ *
+ * Real SNS puts an opaque hash in the certificate's file name. This is the
+ * same idea, and it means the URL names the key it actually belongs to.
+ */
+const fingerprintLength = 32;
+/**
+ * The key one simulated SNS scope signs its messages with.
+ *
+ * The key material is real, generated with `node:crypto`, and the signature is
+ * a real SHA1withRSA signature over the string real SNS signs. A verifier can
+ * therefore check a delivered message against the certificate, rather than
+ * being handed a `Signature` field it has no way to use.
+ */
+export class SimSnsSigningKey {
+    fingerprint;
+    certificatePem;
+    privateKey;
+    constructor(subjectName) {
+        const { privateKey, publicKey } = generateKeyPairSync("rsa", {
+            modulusLength,
+        });
+        const digest = createHash("sha256")
+            .update(publicKey.export({ type: "spki", format: "der" }))
+            .digest();
+        this.privateKey = privateKey;
+        this.fingerprint = digest.toString("hex").slice(0, fingerprintLength);
+        this.certificatePem = simSnsSelfSignedCertificatePem({
+            privateKey,
+            publicKey,
+            subjectName,
+            serialNumber: simSnsSerialNumber(digest),
+        });
+    }
+    /**
+     * Generate a key pair for a simulated SNS scope.
+     *
+     * A scope generates its own on first use rather than at construction,
+     * because generating 2048-bit RSA takes long enough to notice and most
+     * simulated SNS scopes in a test suite never deliver anything. Nothing is
+     * written to disk, and no key material is committed: a private key in the
+     * repository would set off secret scanners for no gain.
+     */
+    static generate(subjectName) {
+        return new SimSnsSigningKey(subjectName);
+    }
+    /**
+     * Sign the canonical form of a message, as real SNS signs it.
+     *
+     * Signature version 1 is SHA1withRSA, and the signature travels base64
+     * encoded in the envelope. SHA-1 is weak, and it is what real SNS uses for
+     * version 1: a simulation signing with something else would produce a
+     * signature a real verifier could not check.
+     */
+    sign(canonicalMessage) {
+        return createSign("RSA-SHA1")
+            .update(canonicalMessage, "utf8")
+            .sign(this.privateKey)
+            .toString("base64");
+    }
+}
+//# sourceMappingURL=sim-sns-signing-key.js.map