@kensio/yulin 0.31.0 → 0.33.0

package/dist/service/acm/command/list-certificates/list-certificates-page-builder.d.ts

@@ -0,0 +1,82 @@
+import type { SimArn } from "../../../aws/arn.js";
+import type { SimAcmCertificate } from "../../certificate/sim-acm-certificate.js";
+import type { SimListCertificatesCommandInput, SimListCertificatesCommandOutput } from "./list-certificates.cmd.js";
+interface ListCertificatesPageBuilderProps {
+    readonly certificates: ReadonlyMap<SimArn, SimAcmCertificate>;
+}
+type ListCertificatesPage = Omit<SimListCertificatesCommandOutput, "$metadata">;
+/**
+ * Builds one page of an ACM ListCertificates response.
+ *
+ * IAM authorization remains in the command handler because it determines
+ * whether certificate state may be read at all. This class handles the data
+ * operations that happen after authorization: request validation, status
+ * filtering, continuation-token interpretation, page selection, and conversion
+ * of certificates into SDK response summaries.
+ *
+ * Certificates retain the insertion order of the service's Map. Requesting a
+ * certificate inserts it into that Map, so this preserves creation order across
+ * filtered and paginated responses.
+ *
+ * Continuation tokens are numeric offsets into the filtered certificate
+ * collection. The offset format matches the previous handler behavior and
+ * allows the next request to resume immediately after the preceding page.
+ */
+export declare class ListCertificatesPageBuilder {
+    private readonly certificates;
+    constructor(props: ListCertificatesPageBuilderProps);
+    /**
+     * Build the response fields for one ListCertificates page.
+     *
+     * Response metadata belongs to the command handler and is omitted here. This
+     * keeps transport-level response concerns separate from certificate filtering
+     * and pagination.
+     *
+     * MaxItems and NextToken are validated before certificate state is traversed.
+     * After validation, the complete status-matched collection is produced so the
+     * next token can be based on the same collection used to select the page.
+     */
+    build(input: SimListCertificatesCommandInput): ListCertificatesPage;
+    /**
+     * Validate and normalize the requested page size.
+     *
+     * ACM defaults MaxItems to 100. Values outside the supported range, including
+     * fractions and non-finite numbers, are rejected rather than being passed to
+     * Array.prototype.slice and normalized by JavaScript.
+     */
+    private maxItems;
+    /**
+     * Convert a continuation token into its filtered-collection offset.
+     *
+     * Tokens must use the canonical non-negative integer representation emitted
+     * by this class. The string round-trip rejects forms such as decimals,
+     * whitespace, signs, exponential notation, and leading zeroes.
+     */
+    private startIndex;
+    /**
+     * Return certificates whose status is included by the request.
+     *
+     * Omitting CertificateStatuses includes every certificate. Filtering an array
+     * copied from the Map leaves service state unchanged and preserves insertion
+     * order among the matching certificates.
+     */
+    private matchingCertificates;
+    /**
+     * Return the next filtered-collection offset when another item remains.
+     *
+     * The next offset advances by MaxItems rather than by the current page length.
+     * This retains the established token representation. No token is returned for
+     * the final page or for a request whose starting offset is past the end.
+     */
+    private nextToken;
+    /**
+     * Convert internal certificate state into the fields returned by ACM.
+     *
+     * ACM returns at most 100 subject alternative name summaries. The additional
+     * names flag tells the caller whether the source certificate contains entries
+     * beyond that response limit.
+     */
+    private certificateSummary;
+}
+export {};
+//# sourceMappingURL=list-certificates-page-builder.d.ts.map

package/dist/service/acm/command/list-certificates/list-certificates-page-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-certificates-page-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates-page-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAElF,OAAO,KAAK,EAEV,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,4BAA4B,CAAC;AAEpC,UAAU,gCAAgC;IACxC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC/D;AAED,KAAK,oBAAoB,GAAG,IAAI,CAAC,gCAAgC,EAAE,WAAW,CAAC,CAAC;AAKhF;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyC;IAEtE,YAAY,KAAK,EAAE,gCAAgC,EAElD;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,EAAE,+BAA+B,GAAG,oBAAoB,CAkBlE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;IAgBhB;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAoBlB;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAY5B;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;IAUjB;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;CAkB3B"}

package/dist/service/acm/command/list-certificates/list-certificates-page-builder.js

@@ -0,0 +1,128 @@
+import { SimAcmInvalidArgsException } from "../../error/sim-acm.error.js";
+const defaultMaxItems = 100;
+const maxMaxItems = 1000;
+/**
+ * Builds one page of an ACM ListCertificates response.
+ *
+ * IAM authorization remains in the command handler because it determines
+ * whether certificate state may be read at all. This class handles the data
+ * operations that happen after authorization: request validation, status
+ * filtering, continuation-token interpretation, page selection, and conversion
+ * of certificates into SDK response summaries.
+ *
+ * Certificates retain the insertion order of the service's Map. Requesting a
+ * certificate inserts it into that Map, so this preserves creation order across
+ * filtered and paginated responses.
+ *
+ * Continuation tokens are numeric offsets into the filtered certificate
+ * collection. The offset format matches the previous handler behavior and
+ * allows the next request to resume immediately after the preceding page.
+ */
+export class ListCertificatesPageBuilder {
+    certificates;
+    constructor(props) {
+        this.certificates = props.certificates;
+    }
+    /**
+     * Build the response fields for one ListCertificates page.
+     *
+     * Response metadata belongs to the command handler and is omitted here. This
+     * keeps transport-level response concerns separate from certificate filtering
+     * and pagination.
+     *
+     * MaxItems and NextToken are validated before certificate state is traversed.
+     * After validation, the complete status-matched collection is produced so the
+     * next token can be based on the same collection used to select the page.
+     */
+    build(input) {
+        const maxItems = this.maxItems(input.MaxItems);
+        const startIndex = this.startIndex(input.NextToken);
+        const matchingCertificates = this.matchingCertificates(input.CertificateStatuses);
+        const page = matchingCertificates.slice(startIndex, startIndex + maxItems);
+        return {
+            CertificateSummaryList: page.map((certificate) => this.certificateSummary(certificate)),
+            NextToken: this.nextToken(startIndex, maxItems, matchingCertificates.length),
+        };
+    }
+    /**
+     * Validate and normalize the requested page size.
+     *
+     * ACM defaults MaxItems to 100. Values outside the supported range, including
+     * fractions and non-finite numbers, are rejected rather than being passed to
+     * Array.prototype.slice and normalized by JavaScript.
+     */
+    maxItems(requestedMaxItems) {
+        const maxItems = requestedMaxItems ?? defaultMaxItems;
+        if (!Number.isSafeInteger(maxItems) ||
+            maxItems < 1 ||
+            maxItems > maxMaxItems) {
+            throw new SimAcmInvalidArgsException("ListCertificatesCommand.input.MaxItems must be an integer between 1 and 1000");
+        }
+        return maxItems;
+    }
+    /**
+     * Convert a continuation token into its filtered-collection offset.
+     *
+     * Tokens must use the canonical non-negative integer representation emitted
+     * by this class. The string round-trip rejects forms such as decimals,
+     * whitespace, signs, exponential notation, and leading zeroes.
+     */
+    startIndex(nextToken) {
+        if (nextToken === undefined) {
+            return 0;
+        }
+        const startIndex = Number(nextToken);
+        if (!Number.isSafeInteger(startIndex) ||
+            startIndex < 0 ||
+            String(startIndex) !== nextToken) {
+            throw new SimAcmInvalidArgsException("ListCertificatesCommand.input.NextToken is invalid");
+        }
+        return startIndex;
+    }
+    /**
+     * Return certificates whose status is included by the request.
+     *
+     * Omitting CertificateStatuses includes every certificate. Filtering an array
+     * copied from the Map leaves service state unchanged and preserves insertion
+     * order among the matching certificates.
+     */
+    matchingCertificates(statuses) {
+        const certificates = this.certificates.values().toArray();
+        return statuses === undefined
+            ? certificates
+            : certificates.filter((certificate) => statuses.includes(certificate.status));
+    }
+    /**
+     * Return the next filtered-collection offset when another item remains.
+     *
+     * The next offset advances by MaxItems rather than by the current page length.
+     * This retains the established token representation. No token is returned for
+     * the final page or for a request whose starting offset is past the end.
+     */
+    nextToken(startIndex, maxItems, matchingCertificateCount) {
+        const nextIndex = startIndex + maxItems;
+        return nextIndex < matchingCertificateCount ? String(nextIndex) : undefined;
+    }
+    /**
+     * Convert internal certificate state into the fields returned by ACM.
+     *
+     * ACM returns at most 100 subject alternative name summaries. The additional
+     * names flag tells the caller whether the source certificate contains entries
+     * beyond that response limit.
+     */
+    certificateSummary(certificate) {
+        return {
+            CertificateArn: certificate.certificateArn,
+            DomainName: certificate.domainName,
+            SubjectAlternativeNameSummaries: certificate.subjectAlternativeNames.slice(0, 100),
+            HasAdditionalSubjectAlternativeNames: certificate.subjectAlternativeNames.length > 100,
+            Status: certificate.status,
+            Type: "TEST_ISSUED",
+            KeyAlgorithm: "RSA-2048",
+            InUse: false,
+            CreatedAt: certificate.createdAt,
+            IssuedAt: certificate.issuedAt,
+        };
+    }
+}
+//# sourceMappingURL=list-certificates-page-builder.js.map

package/dist/service/acm/command/list-certificates/list-certificates-page-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-certificates-page-builder.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates-page-builder.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAa1E,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,2BAA2B;IACrB,YAAY,CAAyC;IAEtE,YAAY,KAAuC;QACjD,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACzC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAsC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CACpD,KAAK,CAAC,mBAAmB,CAC1B,CAAC;QACF,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,QAAQ,CAAC,CAAC;QAE3E,OAAO;YACL,sBAAsB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAC/C,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CACrC;YACD,SAAS,EAAE,IAAI,CAAC,SAAS,CACvB,UAAU,EACV,QAAQ,EACR,oBAAoB,CAAC,MAAM,CAC5B;SACF,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,QAAQ,CAAC,iBAA0B;QACzC,MAAM,QAAQ,GAAG,iBAAiB,IAAI,eAAe,CAAC;QAEtD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;YAC/B,QAAQ,GAAG,CAAC;YACZ,QAAQ,GAAG,WAAW,EACtB,CAAC;YACD,MAAM,IAAI,0BAA0B,CAClC,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACK,UAAU,CAAC,SAAkB;QACnC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAErC,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YACjC,UAAU,GAAG,CAAC;YACd,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS,EAChC,CAAC;YACD,MAAM,IAAI,0BAA0B,CAClC,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAC1B,QAAgE;QAEhE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QAE1D,OAAO,QAAQ,KAAK,SAAS;YAC3B,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAClC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CACtC,CAAC;IACR,CAAC;IAED;;;;;;OAMG;IACK,SAAS,CACf,UAAkB,EAClB,QAAgB,EAChB,wBAAgC;QAEhC,MAAM,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;QAExC,OAAO,SAAS,GAAG,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CACxB,WAA8B;QAE9B,OAAO;YACL,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,+BAA+B,EAC7B,WAAW,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACnD,oCAAoC,EAClC,WAAW,CAAC,uBAAuB,CAAC,MAAM,GAAG,GAAG;YAClD,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,IAAI,EAAE,aAAa;YACnB,YAAY,EAAE,UAAU;YACxB,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/acm/command/list-certificates/list-certificates.handler.d.ts

@@ -1,28 +1,42 @@
-import type { SimArn } from "../../../aws/arn.js";
 import { type BackgroundScheduler } from "../../../../util/background/background.js";
 import type { CommandHandler } from "../../../../command/command-handler.js";
+import type { SimArn } from "../../../aws/arn.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type { SimAcmCertificate } from "../../certificate/sim-acm-certificate.js";
 import type { SimListCertificatesCommand, SimListCertificatesCommandOutput } from "./list-certificates.cmd.js";
 interface ListCertificatesCommandHandlerProps {
     readonly certificates: Map<SimArn, SimAcmCertificate>;
+    readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;
 }
+interface ListCertificatesCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
 /**
  * Simulated ACM ListCertificatesCommand handler.
  *
  * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/acm/command/ListCertificatesCommand/
  */
 export declare class ListCertificatesCommandHandler implements CommandHandler<SimListCertificatesCommand, SimListCertificatesCommandOutput> {
-    private readonly certificates;
+    private readonly authorizer;
+    private readonly pageBuilder;
     private readonly background;
     constructor(props: ListCertificatesCommandHandlerProps);
     /**
-     * List simulated ACM certificates.
+     * Simulate listing ACM certificates.
+     *
+     * Background sequencing completes before authorization so command execution
+     * retains the ordering used by other simulated service handlers.
+     *
+     * Authorization occurs before the page builder reads certificate state. ACM
+     * treats ListCertificates as one operation and does not return a partial list
+     * based on individual Certificate ARN permissions.
+     *
+     * Once authorization succeeds, page construction is delegated so this handler
+     * remains responsible for request-level coordination and response metadata.
      */
-    handle(cmd: SimListCertificatesCommand): Promise<SimListCertificatesCommandOutput>;
-    private getMaxItems;
-    private getStartIndex;
-    private makeCertificateSummary;
+    handle(cmd: SimListCertificatesCommand, opts?: ListCertificatesCommandHandlerOptions): Promise<SimListCertificatesCommandOutput>;
 }
 export {};
 //# sourceMappingURL=list-certificates.handler.d.ts.map

package/dist/service/acm/command/list-certificates/list-certificates.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-certificates.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAElF,OAAO,KAAK,EAEV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,4BAA4B,CAAC;AAEpC,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACtD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAKD;;;;GAIG;AACH,qBAAa,8BAA+B,YAAW,cAAc,CACnE,0BAA0B,EAC1B,gCAAgC,CACjC;IACC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;gBAErC,KAAK,EAAE,mCAAmC;IAOtD;;OAEG;IACG,MAAM,CACV,GAAG,EAAE,0BAA0B,GAC9B,OAAO,CAAC,gCAAgC,CAAC;IA0B5C,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,aAAa;IAoBrB,OAAO,CAAC,sBAAsB;CAkB/B"}
+{"version":3,"file":"list-certificates.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,wDAAwD,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAElF,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,4BAA4B,CAAC;AAGpC,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACtD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,8BAA+B,YAAW,cAAc,CACnE,0BAA0B,EAC1B,gCAAgC,CACjC;IACC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8B;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,KAAK,EAAE,mCAAmC,EAUrD;IAED;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,GAAG,EAAE,0BAA0B,EAC/B,IAAI,CAAC,EAAE,qCAAqC,GAC3C,OAAO,CAAC,gCAAgC,CAAC,CAU3C;CACF"}

package/dist/service/acm/command/list-certificates/list-certificates.handler.js

@@ -1,70 +1,42 @@
 import { BackgroundTasks, } from "../../../../util/background/background.js";
-import { SimAcmInvalidArgsException } from "../../error/sim-acm.error.js";
-const defaultMaxItems = 100;
-const maxMaxItems = 1000;
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { ListCertificatesAuthorizer } from "./list-certificates-authorizer.js";
+import { ListCertificatesPageBuilder } from "./list-certificates-page-builder.js";
 /**
  * Simulated ACM ListCertificatesCommand handler.
  *
  * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/acm/command/ListCertificatesCommand/
  */
 export class ListCertificatesCommandHandler {
-    certificates;
+    authorizer;
+    pageBuilder;
     background;
     constructor(props) {
-        const { certificates, background = new BackgroundTasks() } = props;
-        this.certificates = certificates;
+        const { certificates, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = props;
+        this.authorizer = new ListCertificatesAuthorizer({ iam });
+        this.pageBuilder = new ListCertificatesPageBuilder({ certificates });
         this.background = background;
     }
     /**
-     * List simulated ACM certificates.
+     * Simulate listing ACM certificates.
+     *
+     * Background sequencing completes before authorization so command execution
+     * retains the ordering used by other simulated service handlers.
+     *
+     * Authorization occurs before the page builder reads certificate state. ACM
+     * treats ListCertificates as one operation and does not return a partial list
+     * based on individual Certificate ARN permissions.
+     *
+     * Once authorization succeeds, page construction is delegated so this handler
+     * remains responsible for request-level coordination and response metadata.
      */
-    async handle(cmd) {
+    async handle(cmd, opts) {
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
-        const maxItems = this.getMaxItems(cmd);
-        const startIndex = this.getStartIndex(cmd);
-        const certificates = [...this.certificates.values()].filter((certificate) => cmd.input.CertificateStatuses === undefined
-            ? true
-            : cmd.input.CertificateStatuses.includes(certificate.status));
-        const page = certificates.slice(startIndex, startIndex + maxItems);
-        const nextIndex = startIndex + maxItems;
+        this.authorizer.authorize(opts?.caller);
         return {
+            ...this.pageBuilder.build(cmd.input),
             $metadata: {},
-            CertificateSummaryList: page.map((certificate) => this.makeCertificateSummary(certificate)),
-            NextToken: nextIndex < certificates.length ? String(nextIndex) : undefined,
-        };
-    }
-    getMaxItems(cmd) {
-        const maxItems = cmd.input.MaxItems ?? defaultMaxItems;
-        if (!Number.isInteger(maxItems) || maxItems < 1 || maxItems > maxMaxItems) {
-            throw new SimAcmInvalidArgsException("ListCertificatesCommand.input.MaxItems must be an integer between 1 and 1000");
-        }
-        return maxItems;
-    }
-    getStartIndex(cmd) {
-        if (cmd.input.NextToken === undefined) {
-            return 0;
-        }
-        const startIndex = Number(cmd.input.NextToken);
-        if (!Number.isInteger(startIndex) ||
-            startIndex < 0 ||
-            String(startIndex) !== cmd.input.NextToken) {
-            throw new SimAcmInvalidArgsException("ListCertificatesCommand.input.NextToken is invalid");
-        }
-        return startIndex;
-    }
-    makeCertificateSummary(certificate) {
-        return {
-            CertificateArn: certificate.certificateArn,
-            DomainName: certificate.domainName,
-            SubjectAlternativeNameSummaries: certificate.subjectAlternativeNames.slice(0, 100),
-            HasAdditionalSubjectAlternativeNames: certificate.subjectAlternativeNames.length > 100,
-            Status: certificate.status,
-            Type: "TEST_ISSUED",
-            KeyAlgorithm: "RSA-2048",
-            InUse: false,
-            CreatedAt: certificate.createdAt,
-            IssuedAt: certificate.issuedAt,
         };
     }
 }

package/dist/service/acm/command/list-certificates/list-certificates.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-certificates.handler.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAY1E,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB;;;;GAIG;AACH,MAAM,OAAO,8BAA8B;IAIxB,YAAY,CAAiC;IAC7C,UAAU,CAAsB;IAEjD,YAAY,KAA0C;QACpD,MAAM,EAAE,YAAY,EAAE,UAAU,GAAG,IAAI,eAAe,EAAE,EAAE,GAAG,KAAK,CAAC;QAEnE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,GAA+B;QAE/B,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CACzD,CAAC,WAAW,EAAE,EAAE,CACd,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;YACzC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CACjE,CAAC;QAEF,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,QAAQ,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;QAExC,OAAO;YACL,SAAS,EAAE,EAAE;YACb,sBAAsB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAC/C,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CACzC;YACD,SAAS,EACP,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;SAClE,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,GAA+B;QACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,eAAe,CAAC;QAEvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,WAAW,EAAE,CAAC;YAC1E,MAAM,IAAI,0BAA0B,CAClC,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,aAAa,CAAC,GAA+B;QACnD,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAE/C,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;YAC7B,UAAU,GAAG,CAAC;YACd,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,SAAS,EAC1C,CAAC;YACD,MAAM,IAAI,0BAA0B,CAClC,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,sBAAsB,CAC5B,WAA8B;QAE9B,OAAO;YACL,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,+BAA+B,EAC7B,WAAW,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACnD,oCAAoC,EAClC,WAAW,CAAC,uBAAuB,CAAC,MAAM,GAAG,GAAG;YAClD,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,IAAI,EAAE,aAAa;YACnB,YAAY,EAAE,UAAU;YACxB,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"list-certificates.handler.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAInD,OAAO,EACL,kBAAkB,GAEnB,MAAM,wDAAwD,CAAC;AAEhE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAK/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAYlF;;;;GAIG;AACH,MAAM,OAAO,8BAA8B;IAIxB,UAAU,CAA6B;IACvC,WAAW,CAA8B;IACzC,UAAU,CAAsB;IAEjD,YAAY,KAA0C;QACpD,MAAM,EACJ,YAAY,EACZ,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,KAAK,CAAC;QAEV,IAAI,CAAC,UAAU,GAAG,IAAI,0BAA0B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,GAAG,IAAI,2BAA2B,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,MAAM,CACV,GAA+B,EAC/B,IAA4C;QAE5C,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAExC,OAAO;YACL,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;YACpC,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/acm/command/request-certificate/request-cert-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-cert-factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-cert-factory.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EACL,iBAAiB,EAKlB,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAGjF,UAAU,8BAA8B;IACtC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;gBAElD,KAAK,EAAE,8BAA8B;IAIjD;;;;;;;OAOG;IACH,eAAe,CACb,GAAG,EAAE,4BAA4B,EACjC,gBAAgB,EAAE,MAAM,GACvB,iBAAiB;IAiCpB;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAM1B;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAclC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;CAkB7B"}
+{"version":3,"file":"request-cert-factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-cert-factory.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EACL,iBAAiB,EAKlB,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAGjF,UAAU,8BAA8B;IACtC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAE9D,YAAY,KAAK,EAAE,8BAA8B,EAEhD;IAED;;;;;;;OAOG;IACH,eAAe,CACb,GAAG,EAAE,4BAA4B,EACjC,gBAAgB,EAAE,MAAM,GACvB,iBAAiB,CA+BnB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAM1B;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAclC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;CAkB7B"}

package/dist/service/acm/command/request-certificate/request-certificate-authorizer.d.ts

@@ -0,0 +1,28 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+interface RequestCertificateAuthorizerProps {
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly resource: string;
+}
+/**
+ * Applies IAM authorization to an ACM RequestCertificate request.
+ *
+ * ACM authorizes this operation against the wildcard certificate resource for
+ * the current Account and Region because the certificate does not exist until
+ * the request succeeds.
+ */
+export declare class RequestCertificateAuthorizer {
+    private static readonly action;
+    private readonly iam;
+    private readonly resource;
+    constructor(props: RequestCertificateAuthorizerProps);
+    /**
+     * Ensure the caller may request a certificate in this Account and Region.
+     *
+     * The caller is passed through unchanged so IAM can distinguish an omitted
+     * caller, which defaults to Account root, from an explicit anonymous caller.
+     */
+    authorize(caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=request-certificate-authorizer.d.ts.map

package/dist/service/acm/command/request-certificate/request-certificate-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-certificate-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-certificate-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,UAAU,iCAAiC;IACzC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAA4B;IAE1D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC,YAAY,KAAK,EAAE,iCAAiC,EAGnD;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAcrC;CACF"}

package/dist/service/acm/command/request-certificate/request-certificate-authorizer.js

@@ -0,0 +1,38 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies IAM authorization to an ACM RequestCertificate request.
+ *
+ * ACM authorizes this operation against the wildcard certificate resource for
+ * the current Account and Region because the certificate does not exist until
+ * the request succeeds.
+ */
+export class RequestCertificateAuthorizer {
+    static action = "acm:RequestCertificate";
+    iam;
+    resource;
+    constructor(props) {
+        this.iam = props.iam;
+        this.resource = props.resource;
+    }
+    /**
+     * Ensure the caller may request a certificate in this Account and Region.
+     *
+     * The caller is passed through unchanged so IAM can distinguish an omitted
+     * caller, which defaults to Account root, from an explicit anonymous caller.
+     */
+    authorize(caller) {
+        const decision = this.iam.authorize({
+            action: RequestCertificateAuthorizer.action,
+            resource: this.resource,
+            caller,
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action: RequestCertificateAuthorizer.action,
+                resource: this.resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=request-certificate-authorizer.js.map

package/dist/service/acm/command/request-certificate/request-certificate-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-certificate-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-certificate-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAOzE;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IAC/B,MAAM,CAAU,MAAM,GAAG,wBAAwB,CAAC;IAEzC,GAAG,CAA0B;IAC7B,QAAQ,CAAS;IAElC,YAAY,KAAwC;QAClD,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAqB;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,4BAA4B,CAAC,MAAM;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM,EAAE,4BAA4B,CAAC,MAAM;gBAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/acm/command/request-certificate/request-certificate-validator.d.ts

@@ -0,0 +1,25 @@
+import type { SimRequestCertificateCommand } from "./request-certificate.cmd.js";
+/**
+ * Validates request-level invariants for ACM RequestCertificate.
+ *
+ * These checks occur before background sequencing and IAM authorization. This
+ * preserves ACM's input-error behavior: malformed requests fail as client
+ * errors rather than producing an authorization result, and no certificate
+ * state or background work can be created for an invalid request.
+ *
+ * Certificate construction is not performed here. RequestCertificateFactory
+ * remains responsible for translating a validated SDK command into a simulated
+ * certificate entity.
+ */
+export declare class RequestCertificateValidator {
+    /**
+     * Ensure the command has the required domain name and an allowed tag count.
+     *
+     * DomainName is the primary name represented by the resulting certificate.
+     * ACM rejects both an omitted value and an empty string. Tags are validated
+     * before certificate creation because the request limit applies to the whole
+     * request, not to an already-created certificate.
+     */
+    validate(cmd: SimRequestCertificateCommand): void;
+}
+//# sourceMappingURL=request-certificate-validator.d.ts.map

package/dist/service/acm/command/request-certificate/request-certificate-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-certificate-validator.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-certificate-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAMjF;;;;;;;;;;;GAWG;AACH,qBAAa,2BAA2B;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,EAAE,4BAA4B,GAAG,IAAI,CAYhD;CACF"}

package/dist/service/acm/command/request-certificate/request-certificate-validator.js

@@ -0,0 +1,32 @@
+import { SimAcmInvalidArgsException, SimAcmTooManyTagsException, } from "../../error/sim-acm.error.js";
+/**
+ * Validates request-level invariants for ACM RequestCertificate.
+ *
+ * These checks occur before background sequencing and IAM authorization. This
+ * preserves ACM's input-error behavior: malformed requests fail as client
+ * errors rather than producing an authorization result, and no certificate
+ * state or background work can be created for an invalid request.
+ *
+ * Certificate construction is not performed here. RequestCertificateFactory
+ * remains responsible for translating a validated SDK command into a simulated
+ * certificate entity.
+ */
+export class RequestCertificateValidator {
+    /**
+     * Ensure the command has the required domain name and an allowed tag count.
+     *
+     * DomainName is the primary name represented by the resulting certificate.
+     * ACM rejects both an omitted value and an empty string. Tags are validated
+     * before certificate creation because the request limit applies to the whole
+     * request, not to an already-created certificate.
+     */
+    validate(cmd) {
+        if (cmd.input.DomainName === undefined || cmd.input.DomainName === "") {
+            throw new SimAcmInvalidArgsException("RequestCertificateCommand.input.DomainName required");
+        }
+        if ((cmd.input.Tags?.length ?? 0) > 50) {
+            throw new SimAcmTooManyTagsException("RequestCertificateCommand.input.Tags cannot contain more than 50 tags");
+        }
+    }
+}
+//# sourceMappingURL=request-certificate-validator.js.map

package/dist/service/acm/command/request-certificate/request-certificate-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-certificate-validator.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-certificate-validator.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,2BAA2B;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAiC;QACxC,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,0BAA0B,CAClC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,0BAA0B,CAClC,uEAAuE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/acm/command/request-certificate/request-certificate.handler.d.ts

@@ -4,11 +4,17 @@ import { type BackgroundScheduler } from "../../../../util/background/background
 import type { CommandHandler } from "../../../../command/command-handler.js";
 import type { SimRequestCertificateCommand, SimRequestCertificateCommandOutput } from "./request-certificate.cmd.js";
 import type { SimAcmCertificate } from "../../certificate/sim-acm-certificate.js";
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 interface RequestCertificateCommandHandlerProps {
     readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly certificates: Map<SimArn, SimAcmCertificate>;
+    readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;
 }
+interface RequestCertificateCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
 /**
  * Simulated ACM RequestCertificateCommand handler.
  *
@@ -16,13 +22,20 @@ interface RequestCertificateCommandHandlerProps {
  */
 export declare class RequestCertificateCommandHandler implements CommandHandler<SimRequestCertificateCommand, SimRequestCertificateCommandOutput> {
     private readonly certificates;
+    private readonly authorizer;
     private readonly background;
     private readonly certificateFactory;
+    private readonly validator;
     constructor(props: RequestCertificateCommandHandlerProps);
     /**
-     * Request a simulated ACM certificate.
+     * Validate, authorize, create, and schedule issuance of a certificate.
+     *
+     * Validation precedes authorization so malformed SDK requests retain ACM's
+     * client-error behavior. Authorization precedes factory use and Map mutation,
+     * preventing an unauthorized caller from allocating certificate state or
+     * scheduling a certificate issuance task.
      */
-    handle(cmd: SimRequestCertificateCommand): Promise<SimRequestCertificateCommandOutput>;
+    handle(cmd: SimRequestCertificateCommand, opts?: RequestCertificateCommandHandlerOptions): Promise<SimRequestCertificateCommandOutput>;
 }
 export {};
 //# sourceMappingURL=request-certificate.handler.d.ts.map

package/dist/service/acm/command/request-certificate/request-certificate.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-certificate.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-certificate.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EACV,4BAA4B,EAC5B,kCAAkC,EACnC,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAOlF,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACtD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;GAIG;AACH,qBAAa,gCAAiC,YAAW,cAAc,CACrE,4BAA4B,EAC5B,kCAAkC,CACnC;IACC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA4B;gBAEnD,KAAK,EAAE,qCAAqC;IAcxD;;OAEG;IACG,MAAM,CACV,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,kCAAkC,CAAC;CAgC/C"}
+{"version":3,"file":"request-certificate.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-certificate.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EACV,4BAA4B,EAC5B,kCAAkC,EACnC,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAIlF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,wDAAwD,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAE1E,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACtD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,gCAAiC,YAAW,cAAc,CACrE,4BAA4B,EAC5B,kCAAkC,CACnC;IACC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA4B;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAE/D,YAAY,KAAK,EAAE,qCAAqC,EAiBvD;IAED;;;;;;;OAOG;IACG,MAAM,CACV,GAAG,EAAE,4BAA4B,EACjC,IAAI,CAAC,EAAE,uCAAuC,GAC7C,OAAO,CAAC,kCAAkC,CAAC,CAuB7C;CACF"}