kms

type Alias struct {
	// AliasName is the alias name (e.g., alias/my-key).
	AliasName string `json:"AliasName"`
	// AliasArn is the full ARN of the alias.
	AliasArn string `json:"AliasArn"`
	// TargetKeyId is the key ID that this alias points to.
	TargetKeyID string `json:"TargetKeyId,omitempty"`
	// CreationDate is the Unix timestamp when the alias was created.
	CreationDate float64 `json:"CreationDate,omitempty"`
	// LastUpdatedDate is the Unix timestamp when the alias was last updated.
	LastUpdatedDate float64 `json:"LastUpdatedDate,omitempty"`
}

type CancelKeyDeletionInput struct {
	KeyID string `json:"KeyId"`
}

type CancelKeyDeletionOutput struct {
	KeyID string `json:"KeyId"`
}

type ConfigProvider interface {
	GetKMSSettings() Settings
}

type ConnectCustomKeyStoreInput struct {
	// CustomKeyStoreId identifies the custom key store to connect.
	CustomKeyStoreID string `json:"CustomKeyStoreId"`
}

type CreateAliasInput struct {
	// AliasName is the name of the alias (must begin with alias/).
	AliasName string `json:"AliasName"`
	// TargetKeyId is the key ID the alias should point to.
	TargetKeyID string `json:"TargetKeyId"`
}

type CreateCustomKeyStoreInput struct {
	// CustomKeyStoreName is the name of the custom key store to create.
	CustomKeyStoreName string `json:"CustomKeyStoreName"`
	// CustomKeyStoreType is the type of custom key store (default AWS_CLOUDHSM).
	CustomKeyStoreType string `json:"CustomKeyStoreType,omitempty"`
	// CloudHsmClusterID and TrustAnchorCertificate are AWS_CLOUDHSM-only
	// inputs, echoed back verbatim by DescribeCustomKeyStores.
	CloudHsmClusterID      string `json:"CloudHsmClusterId,omitempty"`
	TrustAnchorCertificate string `json:"TrustAnchorCertificate,omitempty"`
	// EXTERNAL_KEY_STORE proxy settings.
	XksProxyAuthenticationCredential *XksProxyAuthenticationCredential `json:"XksProxyAuthenticationCredential,omitempty"`
	XksProxyConnectivity             string                            `json:"XksProxyConnectivity,omitempty"`
	XksProxyURIEndpoint              string                            `json:"XksProxyUriEndpoint,omitempty"`
	XksProxyURIPath                  string                            `json:"XksProxyUriPath,omitempty"`
	XksProxyVpcEndpointServiceName   string                            `json:"XksProxyVpcEndpointServiceName,omitempty"`
	XksProxyVpcEndpointServiceOwner  string                            `json:"XksProxyVpcEndpointServiceOwner,omitempty"`
}

type CreateCustomKeyStoreOutput struct {
	// CustomKeyStoreId is the ID of the newly created custom key store.
	CustomKeyStoreID string `json:"CustomKeyStoreId"`
}

type CreateGrantInput struct {
	Constraints              *GrantConstraints `json:"Constraints,omitempty"`
	KeyID                    string            `json:"KeyId"`
	GranteePrincipal         string            `json:"GranteePrincipal,omitempty"`
	GranteeServicePrincipal  string            `json:"GranteeServicePrincipal,omitempty"`
	RetiringPrincipal        string            `json:"RetiringPrincipal,omitempty"`
	RetiringServicePrincipal string            `json:"RetiringServicePrincipal,omitempty"`
	Name                     string            `json:"Name,omitempty"`
	Operations               []string          `json:"Operations"`
	// GrantTokens authorizes the CreateGrant call itself via an existing,
	// not-yet-eventually-consistent grant. There is no IAM/authorization
	// layer anywhere in this mock, so this field is accepted for wire parity
	// and otherwise a no-op -- the same documented scope boundary as
	// CreateKeyInput/ReplicateKeyInput's BypassPolicyLockoutSafetyCheck.
	GrantTokens []string `json:"GrantTokens,omitempty"`
	DryRun      bool     `json:"DryRun,omitempty"`
}

type CreateGrantOutput struct {
	GrantID    string `json:"GrantId"`
	GrantToken string `json:"GrantToken"`
}

type CreateKeyInput struct {
	Description string `json:"Description,omitempty"`
	KeyUsage    string `json:"KeyUsage,omitempty"`
	KeySpec     string `json:"KeySpec,omitempty"`
	// CustomerMasterKeySpec is KeySpec's deprecated predecessor (same enum, same
	// meaning); aws_kms_key's customer_master_key_spec argument still sends this
	// wire field, not KeySpec.
	CustomerMasterKeySpec          string `json:"CustomerMasterKeySpec,omitempty"`
	Origin                         string `json:"Origin,omitempty"`
	Policy                         string `json:"Policy,omitempty"`
	Region                         string `json:"-"`
	CustomKeyStoreID               string `json:"CustomKeyStoreId,omitempty"`
	Tags                           []Tag  `json:"Tags,omitempty"`
	MultiRegion                    bool   `json:"MultiRegion,omitempty"`
	BypassPolicyLockoutSafetyCheck bool   `json:"BypassPolicyLockoutSafetyCheck,omitempty"`
}

type CreateKeyOutput struct {
	// KeyMetadata contains the newly created key metadata.
	KeyMetadata KeyMetadata `json:"KeyMetadata"`
}

type CustomKeyStore struct {
	CustomKeyStoreID   string  `json:"CustomKeyStoreId"`
	CustomKeyStoreName string  `json:"CustomKeyStoreName"`
	ConnectionState    string  `json:"ConnectionState"`
	CustomKeyStoreType string  `json:"CustomKeyStoreType"`
	CreationDate       float64 `json:"CreationDate"`
	// CloudHsmClusterId and TrustAnchorCertificate are echoed back by
	// DescribeCustomKeyStores for AWS_CLOUDHSM stores (types.go:37-40,225);
	// KeyStorePassword is write-only and never echoed.
	CloudHsmClusterID      string `json:"CloudHsmClusterId,omitempty"`
	TrustAnchorCertificate string `json:"TrustAnchorCertificate,omitempty"`
	// XksProxyConfiguration is set for EXTERNAL_KEY_STORE stores only.
	XksProxyConfiguration *XksProxyConfiguration `json:"XksProxyConfiguration,omitempty"`
}

type DecryptInput struct {
	EncryptionContext map[string]string `json:"EncryptionContext,omitempty"`
	// GrantTokens is an optional list of grant tokens used to authorize the operation.
	GrantTokens         []string `json:"GrantTokens,omitempty"`
	KeyID               string   `json:"KeyId,omitempty"`
	CiphertextBlob      []byte   `json:"CiphertextBlob"`
	EncryptionAlgorithm string   `json:"EncryptionAlgorithm,omitempty"`
	DryRun              bool     `json:"DryRun,omitempty"`
}

type DecryptOutput struct {
	KeyID               string `json:"KeyId"`
	EncryptionAlgorithm string `json:"EncryptionAlgorithm,omitempty"`
	Plaintext           []byte `json:"Plaintext"`
}

type DeleteAliasInput struct {
	// AliasName is the name of the alias to delete.
	AliasName string `json:"AliasName"`
}

type DeleteCustomKeyStoreInput struct {
	// CustomKeyStoreId identifies the custom key store to delete.
	CustomKeyStoreID string `json:"CustomKeyStoreId"`
}

type DeleteImportedKeyMaterialInput struct {
	// KeyId identifies the EXTERNAL-origin key whose material should be deleted.
	KeyID string `json:"KeyId"`
}

type DeleteImportedKeyMaterialOutput struct {
	KeyID string `json:"KeyId"`
}

type DeriveSharedSecretInput struct {
	// KeyId is the ECC key (KEY_AGREEMENT usage) used to derive the shared secret.
	KeyID string `json:"KeyId"`
	// KeyAgreementAlgorithm is the key agreement algorithm (always ECDH).
	KeyAgreementAlgorithm string `json:"KeyAgreementAlgorithm"`
	// PublicKey is the DER-encoded public key of the other party.
	PublicKey []byte `json:"PublicKey"`
	// GrantTokens is an optional list of grant tokens used to authorize the operation.
	GrantTokens []string `json:"GrantTokens,omitempty"`
	DryRun      bool     `json:"DryRun,omitempty"`
}

type DeriveSharedSecretOutput struct {
	KeyID                 string `json:"KeyId"`
	KeyAgreementAlgorithm string `json:"KeyAgreementAlgorithm"`
	SharedSecret          []byte `json:"SharedSecret"`
}

type DescribeCustomKeyStoresInput struct {
	// CustomKeyStoreId filters results to a single custom key store by ID.
	CustomKeyStoreID string `json:"CustomKeyStoreId,omitempty"`
	// CustomKeyStoreName filters results to a single custom key store by name.
	CustomKeyStoreName string `json:"CustomKeyStoreName,omitempty"`
	// Limit caps the number of results returned.
	Limit *int32 `json:"Limit,omitempty"`
	// Marker is the pagination cursor from a previous call.
	Marker string `json:"Marker,omitempty"`
}

type DescribeCustomKeyStoresOutput struct {
	NextMarker      string           `json:"NextMarker,omitempty"`
	CustomKeyStores []CustomKeyStore `json:"CustomKeyStores"`
	Truncated       bool             `json:"Truncated"`
}

type DescribeKeyInput struct {
	// KeyId is the key ID or alias to describe.
	KeyID string `json:"KeyId"`
	// GrantTokens is an optional list of grant tokens used to make a just-created
	// grant that permits DescribeKey immediately effective. DescribeKey is a valid
	// grant operation (see isValidGrantOperation) and the real DescribeKey op
	// declares InvalidGrantTokenException in its error set, so a supplied token
	// must resolve to an existing, unexpired grant.
	GrantTokens []string `json:"GrantTokens,omitempty"`
}

type DescribeKeyOutput struct {
	// KeyMetadata contains the key metadata.
	KeyMetadata KeyMetadata `json:"KeyMetadata"`
}

type DisableKeyInput struct {
	KeyID string `json:"KeyId"`
}

type DisableKeyRotationInput struct {
	// KeyId is the key to disable rotation for.
	KeyID string `json:"KeyId"`
}

type DisconnectCustomKeyStoreInput struct {
	// CustomKeyStoreId identifies the custom key store to disconnect.
	CustomKeyStoreID string `json:"CustomKeyStoreId"`
}

type EnableKeyInput struct {
	KeyID string `json:"KeyId"`
}

type EnableKeyRotationInput struct {
	RotationPeriodInDays *int32 `json:"RotationPeriodInDays,omitempty"`
	KeyID                string `json:"KeyId"`
}

type EncryptInput struct {
	EncryptionContext map[string]string `json:"EncryptionContext,omitempty"`
	// GrantTokens is an optional list of grant tokens used to authorize the operation.
	GrantTokens []string `json:"GrantTokens,omitempty"`
	KeyID       string   `json:"KeyId"`
	Plaintext   []byte   `json:"Plaintext"`
	// EncryptionAlgorithm is required only for asymmetric keys; symmetric keys
	// default to SYMMETRIC_DEFAULT when omitted.
	EncryptionAlgorithm string `json:"EncryptionAlgorithm,omitempty"`
	DryRun              bool   `json:"DryRun,omitempty"`
}

type EncryptOutput struct {
	KeyID               string `json:"KeyId"`
	EncryptionAlgorithm string `json:"EncryptionAlgorithm,omitempty"`
	CiphertextBlob      []byte `json:"CiphertextBlob"`
}

type ErrorResponse struct {
	// Type is the error type string.
	Type string `json:"__type"`
	// Message is the human-readable error message.
	Message string `json:"message"`
}

type GenerateDataKeyInput struct {
	EncryptionContext map[string]string `json:"EncryptionContext,omitempty"`
	NumberOfBytes     *int32            `json:"NumberOfBytes,omitempty"`
	KeyID             string            `json:"KeyId"`
	KeySpec           string            `json:"KeySpec,omitempty"`
	GrantTokens       []string          `json:"GrantTokens,omitempty"`
	DryRun            bool              `json:"DryRun,omitempty"`
}

type GenerateDataKeyOutput struct {
	KeyID          string `json:"KeyId"`
	CiphertextBlob []byte `json:"CiphertextBlob"`
	Plaintext      []byte `json:"Plaintext"`
}

type GenerateDataKeyPairInput struct {
	// EncryptionContext is the optional encryption context for the wrapping key.
	EncryptionContext map[string]string `json:"EncryptionContext,omitempty"`
	// KeyId is the KMS symmetric key used to encrypt the private key.
	KeyID string `json:"KeyId"`
	// KeyPairSpec specifies the asymmetric key spec (e.g. RSA_2048, ECC_NIST_P256).
	KeyPairSpec string `json:"KeyPairSpec"`
	// GrantTokens is an optional list of grant tokens used to authorize the operation.
	GrantTokens []string `json:"GrantTokens,omitempty"`
	DryRun      bool     `json:"DryRun,omitempty"`
}

type GenerateDataKeyPairOutput struct {
	// KeyId is the ARN of the wrapping KMS key.
	KeyID string `json:"KeyId"`
	// KeyPairSpec is the key pair spec used.
	KeyPairSpec string `json:"KeyPairSpec"`
	// PrivateKeyCiphertextBlob is the DER-encoded private key encrypted under KeyId.
	PrivateKeyCiphertextBlob []byte `json:"PrivateKeyCiphertextBlob"`
	// PrivateKeyPlaintext is the DER-encoded PKCS#8 private key.
	PrivateKeyPlaintext []byte `json:"PrivateKeyPlaintext"`
	// PublicKey is the DER-encoded SubjectPublicKeyInfo public key.
	PublicKey []byte `json:"PublicKey"`
}

type GenerateDataKeyPairWithoutPlaintextInput struct {
	// EncryptionContext is the optional encryption context for the wrapping key.
	EncryptionContext map[string]string `json:"EncryptionContext,omitempty"`
	// KeyId is the KMS symmetric key used to encrypt the private key.
	KeyID string `json:"KeyId"`
	// KeyPairSpec specifies the asymmetric key spec (e.g. RSA_2048, ECC_NIST_P256).
	KeyPairSpec string `json:"KeyPairSpec"`
	// GrantTokens is an optional list of grant tokens used to authorize the operation.
	GrantTokens []string `json:"GrantTokens,omitempty"`
	DryRun      bool     `json:"DryRun,omitempty"`
}

type GenerateDataKeyPairWithoutPlaintextOutput struct {
	// KeyId is the ARN of the wrapping KMS key.
	KeyID string `json:"KeyId"`
	// KeyPairSpec is the key pair spec used.
	KeyPairSpec string `json:"KeyPairSpec"`
	// PrivateKeyCiphertextBlob is the DER-encoded private key encrypted under KeyId.
	PrivateKeyCiphertextBlob []byte `json:"PrivateKeyCiphertextBlob"`
	// PublicKey is the DER-encoded SubjectPublicKeyInfo public key.
	PublicKey []byte `json:"PublicKey"`
}

type GenerateDataKeyWithoutPlaintextInput struct {
	EncryptionContext map[string]string `json:"EncryptionContext,omitempty"`
	NumberOfBytes     *int32            `json:"NumberOfBytes,omitempty"`
	KeyID             string            `json:"KeyId"`
	KeySpec           string            `json:"KeySpec,omitempty"`
	GrantTokens       []string          `json:"GrantTokens,omitempty"`
	DryRun            bool              `json:"DryRun,omitempty"`
}

type GenerateDataKeyWithoutPlaintextOutput struct {
	KeyID          string `json:"KeyId"`
	CiphertextBlob []byte `json:"CiphertextBlob"`
}

type GenerateMacInput struct {
	// KeyId is the HMAC KMS key used to generate the MAC.
	KeyID string `json:"KeyId"`
	// MacAlgorithm specifies the MAC algorithm (e.g. HMAC_SHA_256).
	MacAlgorithm string `json:"MacAlgorithm"`
	// Message is the data over which to compute the MAC.
	Message []byte `json:"Message"`
	// GrantTokens is an optional list of grant tokens used to authorize the operation.
	GrantTokens []string `json:"GrantTokens,omitempty"`
	DryRun      bool     `json:"DryRun,omitempty"`
}

type GenerateMacOutput struct {
	KeyID        string `json:"KeyId"`
	MacAlgorithm string `json:"MacAlgorithm"`
	Mac          []byte `json:"Mac"`
}

type GenerateRandomInput struct {
	// NumberOfBytes specifies how many random bytes to generate (default 32, max 1024).
	NumberOfBytes *int32 `json:"NumberOfBytes,omitempty"`
}

type GenerateRandomOutput struct {
	// Plaintext contains the generated random bytes.
	Plaintext []byte `json:"Plaintext"`
}

type GetKeyLastUsageInput struct {
	KeyID string `json:"KeyId"` //nolint:tagliatelle // AWS API uses KeyId
}

type GetKeyLastUsageOutput struct {
	KeyLastUsage      *KeyLastUsageData `json:"KeyLastUsage,omitempty"`
	KeyID             string            `json:"KeyId,omitempty"`
	KeyCreationDate   float64           `json:"KeyCreationDate,omitempty"`
	TrackingStartDate float64           `json:"TrackingStartDate,omitempty"`
}

type GetKeyPolicyInput struct {
	KeyID      string `json:"KeyId"`
	PolicyName string `json:"PolicyName"`
}

type GetKeyPolicyOutput struct {
	Policy     string `json:"Policy"`
	PolicyName string `json:"PolicyName"`
}

type GetKeyRotationStatusInput struct {
	// KeyId is the key to query rotation status for.
	KeyID string `json:"KeyId"`
}

type GetKeyRotationStatusOutput struct {
	KeyID                     string  `json:"KeyId"`
	NextRotationDate          float64 `json:"NextRotationDate,omitempty"`
	OnDemandRotationStartDate float64 `json:"OnDemandRotationStartDate,omitempty"`
	RotationPeriodInDays      int32   `json:"RotationPeriodInDays,omitempty"`
	KeyRotationEnabled        bool    `json:"KeyRotationEnabled"`
}

type GetParametersForImportInput struct {
	KeyID             string `json:"KeyId"`
	WrappingAlgorithm string `json:"WrappingAlgorithm,omitempty"`
	WrappingKeySpec   string `json:"WrappingKeySpec,omitempty"`
}

type GetParametersForImportOutput struct {
	KeyID             string  `json:"KeyId"`
	ImportToken       []byte  `json:"ImportToken"`
	PublicKey         []byte  `json:"PublicKey"`
	ParametersValidTo float64 `json:"ParametersValidTo"`
}

type GetPublicKeyInput struct {
	// KeyId identifies the asymmetric KMS key whose public key to retrieve.
	KeyID string `json:"KeyId"`
	// GrantTokens is an optional list of grant tokens used to authorize the operation.
	GrantTokens []string `json:"GrantTokens,omitempty"`
}

type GetPublicKeyOutput struct {
	// KeyId is the ID of the asymmetric KMS key.
	KeyID string `json:"KeyId"`
	// PublicKey is the DER-encoded public key.
	PublicKey []byte `json:"PublicKey"`
	// KeySpec is the key spec of the key.
	KeySpec string `json:"KeySpec"`
	// KeyUsage is the intended use of the key.
	KeyUsage string `json:"KeyUsage"`
	// SigningAlgorithms lists the signing algorithms supported by this key.
	SigningAlgorithms []string `json:"SigningAlgorithms,omitempty"`
	// EncryptionAlgorithms lists the encryption algorithms (empty for sign keys).
	EncryptionAlgorithms []string `json:"EncryptionAlgorithms,omitempty"`
	// KeyAgreementAlgorithms lists the key agreement algorithms (e.g. ECDH).
	KeyAgreementAlgorithms []string `json:"KeyAgreementAlgorithms,omitempty"`
}

type Grant struct {
	// Constraints holds optional constraints for the grant.
	Constraints *GrantConstraints `json:"Constraints,omitempty"`
	// GrantID is the unique identifier for the grant.
	GrantID string `json:"GrantId"`
	// KeyID is the ID of the KMS key.
	KeyID string `json:"KeyId"`
	// GranteePrincipal is the principal that receives the grant. Mutually
	// exclusive with GranteeServicePrincipal; exactly one must be set.
	GranteePrincipal string `json:"GranteePrincipal,omitempty"`
	// GranteeServicePrincipal is the AWS service principal that receives the
	// grant. Mutually exclusive with GranteePrincipal; exactly one must be
	// set. No AWS-service-principal simulation exists in this mock (no
	// IAM/authorization layer at all -- see CreateGrantInput.GrantTokens), so
	// this is stored/round-tripped for wire parity, matching real AWS's
	// GrantListEntry shape, without any behavioral effect.
	GranteeServicePrincipal string `json:"GranteeServicePrincipal,omitempty"`
	// RetiringPrincipal is the principal that can retire the grant. Mutually
	// exclusive with RetiringServicePrincipal.
	RetiringPrincipal string `json:"RetiringPrincipal,omitempty"`
	// RetiringServicePrincipal is the AWS service principal that can retire
	// the grant. Mutually exclusive with RetiringPrincipal. Same no-IAM-layer
	// scope boundary as GranteeServicePrincipal.
	RetiringServicePrincipal string `json:"RetiringServicePrincipal,omitempty"`
	// GrantToken is a token that can be used to identify this grant.
	GrantToken string `json:"GrantToken"`
	// TokenIssuedAt records when the grant token was issued, enabling expiry checks.
	TokenIssuedAt time.Time `json:"TokenIssuedAt"`
	// Name is an optional name for the grant.
	Name string `json:"Name,omitempty"`
	// Operations is the list of cryptographic operations the grantee can perform.
	Operations []string `json:"Operations"`
	// CreationDate is the Unix timestamp when the grant was created.
	CreationDate float64 `json:"CreationDate"`
	// IssuingAccount is the AWS account ID under which the grant was issued.
	IssuingAccount string `json:"IssuingAccount,omitempty"`
}

type GrantConstraints struct {
	// EncryptionContextEquals requires the caller's encryption context to be
	// an exact match of this map (same keys and values).
	EncryptionContextEquals map[string]string `json:"EncryptionContextEquals,omitempty"`
	// EncryptionContextSubset requires the caller's encryption context to
	// contain at least all key-value pairs present in this map.
	EncryptionContextSubset map[string]string `json:"EncryptionContextSubset,omitempty"`
	// SourceArn restricts grant use to requests made on behalf of the named
	// AWS resource (effectively the aws:SourceArn condition key). This mock
	// has no cross-service request-context plumbing to carry a "made on
	// behalf of" resource ARN through crypto calls, so the constraint is
	// stored and round-tripped (CreateGrant -> ListGrants/ListRetirableGrants)
	// for wire parity but is NOT enforced -- consistent with the scope
	// boundary already documented for grant-token authorization elsewhere in
	// this package (see isValidGrantOperation's doc and CreateGrantInput.
	// GrantTokens below).
	SourceArn string `json:"SourceArn,omitempty"`
}

type GrantListEntry struct {
	Constraints              *GrantConstraints `json:"Constraints,omitempty"`
	GrantID                  string            `json:"GrantId"`
	KeyID                    string            `json:"KeyId"`
	GranteePrincipal         string            `json:"GranteePrincipal,omitempty"`
	GranteeServicePrincipal  string            `json:"GranteeServicePrincipal,omitempty"`
	RetiringPrincipal        string            `json:"RetiringPrincipal,omitempty"`
	RetiringServicePrincipal string            `json:"RetiringServicePrincipal,omitempty"`
	Name                     string            `json:"Name,omitempty"`
	Operations               []string          `json:"Operations"`
	CreationDate             float64           `json:"CreationDate"`
	IssuingAccount           string            `json:"IssuingAccount,omitempty"`
}

type Handler struct {
	Backend StorageBackend

	DefaultRegion string
	// contains filtered or unexported fields
}

type ImportKeyMaterialInput struct {
	KeyID           string  `json:"KeyId"`
	ExpirationModel string  `json:"ExpirationModel,omitempty"`
	KeyMaterial     []byte  `json:"EncryptedKeyMaterial"`
	ValidTo         float64 `json:"ValidTo,omitempty"`
}

type ImportKeyMaterialOutput struct {
	KeyID string `json:"KeyId"`
}

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

type Janitor struct {
	Backend *InMemoryBackend
	// OnKeyPurged, if set, is invoked synchronously at the end of purgeKey after
	// the key's backend-owned state has been removed. It lets a caller (see
	// Handler.WithJanitor) cascade-clean side state that lives outside
	// InMemoryBackend entirely -- specifically Handler.tags, a side map keyed
	// by KeyID that the janitor has no access to itself. Without this hook, a
	// permanently-deleted key's tag collection (and the lockmetrics/Prometheus
	// registration it owns) would never be released, since KMS key IDs are
	// UUIDs that are never reused and Handler.tags has no other cleanup path.
	// Called with the backend write lock held: implementations must not call
	// back into any InMemoryBackend method.
	OnKeyPurged func(region, keyID string)

	// Interval is the time between janitor sweeps.
	Interval time.Duration
	// TaskTimeout bounds each individual janitor task. When non-zero, each task
	// runs with a child context that expires after this duration, preventing a
	// stalled operation from blocking the janitor loop indefinitely.
	TaskTimeout time.Duration
	// contains filtered or unexported fields
}

type Key struct {
	Origin           string `json:"Origin,omitempty"`
	PrimaryRegion    string `json:"PrimaryRegion,omitempty"`
	Description      string `json:"Description,omitempty"`
	KeyState         string `json:"KeyState"`
	KeyUsage         string `json:"KeyUsage"`
	KeySpec          string `json:"KeySpec,omitempty"`
	KeyID            string `json:"KeyId"`
	Arn              string `json:"Arn"`
	ExpirationModel  string `json:"ExpirationModel,omitempty"`
	CustomKeyStoreID string `json:"CustomKeyStoreId,omitempty"`
	// KeyManager is CUSTOMER or AWS (gopherstack-6u8p4); a zero value means
	// CUSTOMER (see KeyManagerCustomer).
	KeyManager string `json:"KeyManager,omitempty"`
	// Rotations stores all rotation events with their types. The separate
	// RotationDates and OnDemandRotationDates slices are kept for JSON
	// backwards-compatibility with existing snapshots.
	Rotations             []RotationRecord `json:"Rotations,omitempty"`
	RotationDates         []float64        `json:"RotationDates,omitempty"`
	OnDemandRotationDates []float64        `json:"OnDemandRotationDates,omitempty"`
	// ReplicaKeyIDs stores the key IDs of replica keys created from this primary.
	ReplicaKeyIDs        []string `json:"ReplicaKeyIds,omitempty"`
	CreationDate         float64  `json:"CreationDate"`
	DeletionDate         float64  `json:"DeletionDate,omitempty"`
	ValidTo              float64  `json:"ValidTo,omitempty"`
	PendingWindowInDays  int      `json:"PendingWindowInDays,omitempty"`
	RotationPeriodInDays int32    `json:"RotationPeriodInDays,omitempty"`
	Enabled              bool     `json:"Enabled"`
	MultiRegion          bool     `json:"MultiRegion,omitempty"`
	RotationEnabled      bool     `json:"RotationEnabled"`
}

type KeyLastUsageData struct {
	CloudTrailEventID string  `json:"CloudTrailEventId,omitempty"`
	KmsRequestID      string  `json:"KmsRequestId,omitempty"`
	Operation         string  `json:"Operation,omitempty"`
	Timestamp         float64 `json:"Timestamp,omitempty"`
}

type KeyListEntry struct {
	// KeyId is the UUID of the key.
	KeyID string `json:"KeyId"`
	// KeyArn is the full ARN of the key.
	KeyArn string `json:"KeyArn"`
}

type KeyMetadata struct {
	MultiRegionConfiguration    *MultiRegionConfiguration `json:"MultiRegionConfiguration,omitempty"`
	Arn                         string                    `json:"Arn"`
	Description                 string                    `json:"Description,omitempty"`
	KeyState                    string                    `json:"KeyState"`
	KeyUsage                    string                    `json:"KeyUsage"`
	KeyManager                  string                    `json:"KeyManager,omitempty"`
	Origin                      string                    `json:"Origin,omitempty"`
	KeySpec                     string                    `json:"KeySpec,omitempty"`
	KeyID                       string                    `json:"KeyId"`
	AWSAccountID                string                    `json:"AWSAccountId,omitempty"`
	CustomKeyStoreID            string                    `json:"CustomKeyStoreId,omitempty"`
	CustomerMasterKeySpec       string                    `json:"CustomerMasterKeySpec,omitempty"`
	ExpirationModel             string                    `json:"ExpirationModel,omitempty"`
	MacAlgorithms               []string                  `json:"MacAlgorithms,omitempty"`
	SigningAlgorithms           []string                  `json:"SigningAlgorithms,omitempty"`
	KeyAgreementAlgorithms      []string                  `json:"KeyAgreementAlgorithms,omitempty"`
	EncryptionAlgorithms        []string                  `json:"EncryptionAlgorithms,omitempty"`
	CreationDate                float64                   `json:"CreationDate"`
	DeletionDate                float64                   `json:"DeletionDate,omitempty"`
	ValidTo                     float64                   `json:"ValidTo,omitempty"`
	PendingDeletionWindowInDays int                       `json:"PendingDeletionWindowInDays,omitempty"`
	MultiRegion                 bool                      `json:"MultiRegion"`
	Enabled                     bool                      `json:"Enabled"`
}

type KeyRotationEntry struct {
	KeyID            string  `json:"KeyId,omitempty"`
	KeyMaterialID    string  `json:"KeyMaterialId,omitempty"`
	KeyMaterialState string  `json:"KeyMaterialState,omitempty"`
	RotationType     string  `json:"RotationType,omitempty"`
	RotationDate     float64 `json:"RotationDate,omitempty"`
}

type ListAliasesInput struct {
	// KeyId optionally filters aliases to those pointing to this key.
	KeyID string `json:"KeyId,omitempty"`
	// Limit caps the number of results returned.
	Limit *int32 `json:"Limit,omitempty"`
	// Marker is the pagination cursor from a previous call.
	Marker string `json:"Marker,omitempty"`
}

type ListAliasesOutput struct {
	NextMarker string  `json:"NextMarker,omitempty"`
	Aliases    []Alias `json:"Aliases"`
	Truncated  bool    `json:"Truncated"`
}

type ListGrantsInput struct {
	Limit   *int32 `json:"Limit,omitempty"`
	KeyID   string `json:"KeyId"`
	GrantID string `json:"GrantId,omitempty"`
	Marker  string `json:"Marker,omitempty"`
}

type ListGrantsOutput struct {
	NextMarker string           `json:"NextMarker,omitempty"`
	Grants     []GrantListEntry `json:"Grants"`
	Truncated  bool             `json:"Truncated"`
}

type ListKeyPoliciesInput struct {
	Limit  *int32 `json:"Limit,omitempty"`
	KeyID  string `json:"KeyId"`
	Marker string `json:"Marker,omitempty"`
}

type ListKeyPoliciesOutput struct {
	NextMarker  string   `json:"NextMarker,omitempty"`
	PolicyNames []string `json:"PolicyNames"`
	Truncated   bool     `json:"Truncated"`
}

type ListKeyRotationsInput struct {
	Limit  *int32 `json:"Limit,omitempty"`
	KeyID  string `json:"KeyId"`
	Marker string `json:"Marker,omitempty"`
	// IncludeKeyMaterial is ROTATIONS_ONLY (default) or ALL_KEY_MATERIAL.
	IncludeKeyMaterial string `json:"IncludeKeyMaterial,omitempty"`
}

type ListKeyRotationsOutput struct {
	NextMarker string             `json:"NextMarker,omitempty"`
	Rotations  []KeyRotationEntry `json:"Rotations"`
	Truncated  bool               `json:"Truncated"`
}

type ListKeysInput struct {
	// Limit caps the number of results returned.
	Limit *int32 `json:"Limit,omitempty"`
	// Marker is the pagination cursor from a previous call.
	Marker string `json:"Marker,omitempty"`
}

type ListKeysOutput struct {
	NextMarker string         `json:"NextMarker,omitempty"`
	Keys       []KeyListEntry `json:"Keys"`
	Truncated  bool           `json:"Truncated"`
}

type ListRetirableGrantsInput struct {
	Limit                    *int32 `json:"Limit,omitempty"`
	RetiringPrincipal        string `json:"RetiringPrincipal,omitempty"`
	RetiringServicePrincipal string `json:"RetiringServicePrincipal,omitempty"`
	Marker                   string `json:"Marker,omitempty"`
}

type MultiRegionConfiguration struct {
	// MultiRegionKeyType is either PRIMARY or REPLICA.
	MultiRegionKeyType string `json:"MultiRegionKeyType,omitempty"`
	// PrimaryKey references the primary key in the multi-region set.
	PrimaryKey *MultiRegionKeyRef `json:"PrimaryKey,omitempty"`
	// ReplicaKeys lists the replica keys associated with the primary.
	ReplicaKeys []MultiRegionKeyRef `json:"ReplicaKeys,omitempty"`
}

type MultiRegionKeyRef struct {
	// Arn is the ARN of the multi-region key.
	Arn string `json:"Arn"`
	// Region is the AWS region of the multi-region key.
	Region string `json:"Region"`
}

type Provider struct{}

type PutKeyPolicyInput struct {
	KeyID      string `json:"KeyId"`
	PolicyName string `json:"PolicyName"`
	Policy     string `json:"Policy"`
	// BypassPolicyLockoutSafetyCheck is accepted as a no-op -- same precedent
	// as CreateKeyInput/ReplicateKeyInput's field of the same name (models.go),
	// no IAM layer exists in this mock to enforce the lockout check it waives.
	BypassPolicyLockoutSafetyCheck bool `json:"BypassPolicyLockoutSafetyCheck,omitempty"`
}

type ReEncryptInput struct {
	SourceEncryptionContext        map[string]string `json:"SourceEncryptionContext,omitempty"`
	DestinationEncryptionContext   map[string]string `json:"DestinationEncryptionContext,omitempty"`
	DestinationKeyID               string            `json:"DestinationKeyId"`
	SourceKeyID                    string            `json:"SourceKeyId,omitempty"`
	CiphertextBlob                 []byte            `json:"CiphertextBlob"`
	SourceEncryptionAlgorithm      string            `json:"SourceEncryptionAlgorithm,omitempty"`
	DestinationEncryptionAlgorithm string            `json:"DestinationEncryptionAlgorithm,omitempty"`
	DryRun                         bool              `json:"DryRun,omitempty"`
}

type ReEncryptOutput struct {
	KeyID                          string `json:"KeyId"`
	SourceKeyID                    string `json:"SourceKeyId"`
	SourceEncryptionAlgorithm      string `json:"SourceEncryptionAlgorithm,omitempty"`
	DestinationEncryptionAlgorithm string `json:"DestinationEncryptionAlgorithm,omitempty"`
	CiphertextBlob                 []byte `json:"CiphertextBlob"`
}

type ReplicateKeyInput struct {
	KeyID         string `json:"KeyId"`
	ReplicaRegion string `json:"ReplicaRegion"`
	Description   string `json:"Description,omitempty"`
	// Policy is the key policy to attach to the replica. If omitted, KMS
	// attaches the default key policy (matches CreateKey's Policy field).
	// The key policy is NOT a shared property of multi-region keys: the
	// replica gets its own independent policy rather than inheriting the
	// primary's.
	Policy string `json:"Policy,omitempty"`
	// Tags are optional tags to apply to the replica key.
	Tags                           []Tag `json:"Tags,omitempty"`
	BypassPolicyLockoutSafetyCheck bool  `json:"BypassPolicyLockoutSafetyCheck,omitempty"`
}

type ReplicateKeyOutput struct {
	ReplicaKeyMetadata KeyMetadata `json:"ReplicaKeyMetadata"`
	ReplicaPolicy      string      `json:"ReplicaPolicy,omitempty"`
	ReplicaTags        []Tag       `json:"ReplicaTags,omitempty"`
}

type RetireGrantInput struct {
	GrantToken string `json:"GrantToken,omitempty"`
	GrantID    string `json:"GrantId,omitempty"`
	KeyID      string `json:"KeyId,omitempty"`
	DryRun     bool   `json:"DryRun,omitempty"`
}

type RevokeGrantInput struct {
	KeyID   string `json:"KeyId"`
	GrantID string `json:"GrantId"`
	DryRun  bool   `json:"DryRun,omitempty"`
}

type RotateKeyOnDemandInput struct {
	KeyID string `json:"KeyId"`
}

type RotateKeyOnDemandOutput struct {
	KeyID string `json:"KeyId"`
}

type RotationRecord struct {
	RotationType string  `json:"RotationType"`
	Date         float64 `json:"Date"`
}

type ScheduleKeyDeletionInput struct {
	KeyID               string `json:"KeyId"`
	PendingWindowInDays int    `json:"PendingWindowInDays,omitempty"`
}

type ScheduleKeyDeletionOutput struct {
	KeyID    string `json:"KeyId"`
	KeyState string `json:"KeyState"`
	// DeletionDate is absent for a multi-Region primary key with replicas:
	// real AWS doesn't know the deletion date until the last replica is
	// deleted, so the key is in KeyStatePendingReplicaDeletion instead.
	DeletionDate        float64 `json:"DeletionDate,omitempty"`
	PendingWindowInDays int     `json:"PendingWindowInDays,omitempty"`
}

type Settings struct {
	JanitorInterval time.Duration `json:"janitor_interval" env:"KMS_JANITOR_INTERVAL" default:"1m" help:"Janitor tick interval."` //nolint:lll // Kong struct tag makes this line long
}

type SignInput struct {
	KeyID            string   `json:"KeyId"`
	MessageType      string   `json:"MessageType,omitempty"`
	SigningAlgorithm string   `json:"SigningAlgorithm"`
	Message          []byte   `json:"Message"`
	GrantTokens      []string `json:"GrantTokens,omitempty"`
	DryRun           bool     `json:"DryRun,omitempty"`
}

type SignOutput struct {
	KeyID            string `json:"KeyId"`
	SigningAlgorithm string `json:"SigningAlgorithm"`
	Signature        []byte `json:"Signature"`
}

type StorageBackend interface {
	CreateKey(ctx context.Context, input *CreateKeyInput) (*CreateKeyOutput, error)
	DescribeKey(ctx context.Context, input *DescribeKeyInput) (*DescribeKeyOutput, error)
	ListKeys(ctx context.Context, input *ListKeysInput) (*ListKeysOutput, error)
	Encrypt(ctx context.Context, input *EncryptInput) (*EncryptOutput, error)
	Decrypt(ctx context.Context, input *DecryptInput) (*DecryptOutput, error)
	GenerateDataKey(
		ctx context.Context,
		input *GenerateDataKeyInput,
	) (*GenerateDataKeyOutput, error)
	GenerateDataKeyWithoutPlaintext(
		ctx context.Context, input *GenerateDataKeyWithoutPlaintextInput,
	) (*GenerateDataKeyWithoutPlaintextOutput, error)
	ReEncrypt(ctx context.Context, input *ReEncryptInput) (*ReEncryptOutput, error)
	Sign(ctx context.Context, input *SignInput) (*SignOutput, error)
	Verify(ctx context.Context, input *VerifyInput) (*VerifyOutput, error)
	GetPublicKey(ctx context.Context, input *GetPublicKeyInput) (*GetPublicKeyOutput, error)
	CreateAlias(ctx context.Context, input *CreateAliasInput) error
	UpdateAlias(ctx context.Context, input *UpdateAliasInput) error
	DeleteAlias(ctx context.Context, input *DeleteAliasInput) error
	ListAliases(ctx context.Context, input *ListAliasesInput) (*ListAliasesOutput, error)
	EnableKeyRotation(ctx context.Context, input *EnableKeyRotationInput) error
	DisableKeyRotation(ctx context.Context, input *DisableKeyRotationInput) error
	GetKeyRotationStatus(
		ctx context.Context,
		input *GetKeyRotationStatusInput,
	) (*GetKeyRotationStatusOutput, error)
	DisableKey(ctx context.Context, input *DisableKeyInput) error
	EnableKey(ctx context.Context, input *EnableKeyInput) error
	ScheduleKeyDeletion(
		ctx context.Context,
		input *ScheduleKeyDeletionInput,
	) (*ScheduleKeyDeletionOutput, error)
	CancelKeyDeletion(
		ctx context.Context,
		input *CancelKeyDeletionInput,
	) (*CancelKeyDeletionOutput, error)
	CreateGrant(ctx context.Context, input *CreateGrantInput) (*CreateGrantOutput, error)
	ListGrants(ctx context.Context, input *ListGrantsInput) (*ListGrantsOutput, error)
	RevokeGrant(ctx context.Context, input *RevokeGrantInput) error
	RetireGrant(ctx context.Context, input *RetireGrantInput) error
	ListRetirableGrants(
		ctx context.Context,
		input *ListRetirableGrantsInput,
	) (*ListGrantsOutput, error)
	PutKeyPolicy(ctx context.Context, input *PutKeyPolicyInput) error
	GetKeyPolicy(ctx context.Context, input *GetKeyPolicyInput) (*GetKeyPolicyOutput, error)
	GetParametersForImport(
		ctx context.Context,
		input *GetParametersForImportInput,
	) (*GetParametersForImportOutput, error)
	ListKeyPolicies(
		ctx context.Context,
		input *ListKeyPoliciesInput,
	) (*ListKeyPoliciesOutput, error)
	ListKeyRotations(
		ctx context.Context,
		input *ListKeyRotationsInput,
	) (*ListKeyRotationsOutput, error)
	ImportKeyMaterial(ctx context.Context, input *ImportKeyMaterialInput) error
	DeleteImportedKeyMaterial(ctx context.Context, input *DeleteImportedKeyMaterialInput) error
	ReplicateKey(ctx context.Context, input *ReplicateKeyInput) (*ReplicateKeyOutput, error)
	RotateKeyOnDemand(
		ctx context.Context,
		input *RotateKeyOnDemandInput,
	) (*RotateKeyOnDemandOutput, error)
	ConnectCustomKeyStore(ctx context.Context, input *ConnectCustomKeyStoreInput) error
	CreateCustomKeyStore(
		ctx context.Context,
		input *CreateCustomKeyStoreInput,
	) (*CreateCustomKeyStoreOutput, error)
	DeleteCustomKeyStore(ctx context.Context, input *DeleteCustomKeyStoreInput) error
	DeriveSharedSecret(
		ctx context.Context,
		input *DeriveSharedSecretInput,
	) (*DeriveSharedSecretOutput, error)
	DescribeCustomKeyStores(
		ctx context.Context,
		input *DescribeCustomKeyStoresInput,
	) (*DescribeCustomKeyStoresOutput, error)
	DisconnectCustomKeyStore(ctx context.Context, input *DisconnectCustomKeyStoreInput) error
	UpdateCustomKeyStore(ctx context.Context, input *UpdateCustomKeyStoreInput) error
	UpdateKeyDescription(ctx context.Context, input *UpdateKeyDescriptionInput) error
	UpdatePrimaryRegion(ctx context.Context, input *UpdatePrimaryRegionInput) error
	GenerateDataKeyPair(
		ctx context.Context,
		input *GenerateDataKeyPairInput,
	) (*GenerateDataKeyPairOutput, error)
	GenerateDataKeyPairWithoutPlaintext(
		ctx context.Context, input *GenerateDataKeyPairWithoutPlaintextInput,
	) (*GenerateDataKeyPairWithoutPlaintextOutput, error)
	GenerateMac(ctx context.Context, input *GenerateMacInput) (*GenerateMacOutput, error)
	GenerateRandom(ctx context.Context, input *GenerateRandomInput) (*GenerateRandomOutput, error)
	VerifyMac(ctx context.Context, input *VerifyMacInput) (*VerifyMacOutput, error)
	GetKeyLastUsage(
		ctx context.Context,
		input *GetKeyLastUsageInput,
	) (*GetKeyLastUsageOutput, error)
}

type Tag struct {
	// TagKey is the tag key.
	TagKey string `json:"TagKey"`
	// TagValue is the tag value.
	TagValue string `json:"TagValue"`
}

type TaggedKeyInfo struct {
	Tags map[string]string
	ARN  string
}

type UpdateAliasInput struct {
	// AliasName is the existing alias to redirect.
	AliasName string `json:"AliasName"`
	// TargetKeyId is the new key ID the alias should point to.
	TargetKeyID string `json:"TargetKeyId"`
}

type UpdateCustomKeyStoreInput struct {
	NewCustomKeyStoreName            *string                           `json:"NewCustomKeyStoreName,omitempty"`
	CloudHsmClusterID                *string                           `json:"CloudHsmClusterId,omitempty"`
	KeyStorePassword                 *string                           `json:"KeyStorePassword,omitempty"`
	XksProxyAuthenticationCredential *XksProxyAuthenticationCredential `json:"XksProxyAuthenticationCredential,omitempty"`
	XksProxyConnectivity             *string                           `json:"XksProxyConnectivity,omitempty"`
	XksProxyURIEndpoint              *string                           `json:"XksProxyUriEndpoint,omitempty"`
	XksProxyURIPath                  *string                           `json:"XksProxyUriPath,omitempty"`
	XksProxyVpcEndpointServiceName   *string                           `json:"XksProxyVpcEndpointServiceName,omitempty"`
	XksProxyVpcEndpointServiceOwner  *string                           `json:"XksProxyVpcEndpointServiceOwner,omitempty"`
	CustomKeyStoreID                 string                            `json:"CustomKeyStoreId"`
}

type UpdateKeyDescriptionInput struct {
	KeyID       string `json:"KeyId"`
	Description string `json:"Description"`
}

type UpdatePrimaryRegionInput struct {
	KeyID         string `json:"KeyId"`
	PrimaryRegion string `json:"PrimaryRegion"`
}

type VerifyInput struct {
	KeyID            string   `json:"KeyId"`
	MessageType      string   `json:"MessageType,omitempty"`
	SigningAlgorithm string   `json:"SigningAlgorithm"`
	Message          []byte   `json:"Message"`
	Signature        []byte   `json:"Signature"`
	GrantTokens      []string `json:"GrantTokens,omitempty"`
	DryRun           bool     `json:"DryRun,omitempty"`
}

type VerifyMacInput struct {
	// KeyId is the HMAC KMS key used to verify the MAC.
	KeyID string `json:"KeyId"`
	// MacAlgorithm specifies the MAC algorithm (e.g. HMAC_SHA_256).
	MacAlgorithm string `json:"MacAlgorithm"`
	// Message is the data over which to verify the MAC.
	Message []byte `json:"Message"`
	// Mac is the MAC tag to verify.
	Mac []byte `json:"Mac"`
	// GrantTokens is an optional list of grant tokens used to authorize the operation.
	GrantTokens []string `json:"GrantTokens,omitempty"`
	DryRun      bool     `json:"DryRun,omitempty"`
}

type VerifyMacOutput struct {
	KeyID        string `json:"KeyId"`
	MacAlgorithm string `json:"MacAlgorithm"`
	MacValid     bool   `json:"MacValid"`
}

type VerifyOutput struct {
	KeyID            string `json:"KeyId"`
	SigningAlgorithm string `json:"SigningAlgorithm"`
	SignatureValid   bool   `json:"SignatureValid"`
}

type XksProxyAuthenticationCredential struct {
	AccessKeyID        string `json:"AccessKeyId"`
	RawSecretAccessKey string `json:"RawSecretAccessKey"`
}

type XksProxyConfiguration struct {
	AccessKeyID             string `json:"AccessKeyId,omitempty"`
	Connectivity            string `json:"Connectivity,omitempty"`
	URIEndpoint             string `json:"UriEndpoint,omitempty"`
	URIPath                 string `json:"UriPath,omitempty"`
	VpcEndpointServiceName  string `json:"VpcEndpointServiceName,omitempty"`
	VpcEndpointServiceOwner string `json:"VpcEndpointServiceOwner,omitempty"`
}