@kensio/yulin 0.31.0 → 0.33.0

package/dist/service/acm/command/request-certificate/request-certificate.handler.js

@@ -1,6 +1,8 @@
 import { BackgroundTasks, } from "../../../../util/background/background.js";
-import { SimAcmInvalidArgsException, SimAcmTooManyTagsException, } from "../../error/sim-acm.error.js";
+import { RequestCertificateAuthorizer } from "./request-certificate-authorizer.js";
 import { RequestCertificateFactory } from "./request-cert-factory.js";
+import { RequestCertificateValidator } from "./request-certificate-validator.js";
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
 /**
  * Simulated ACM RequestCertificateCommand handler.
  *
@@ -8,28 +10,35 @@ import { RequestCertificateFactory } from "./request-cert-factory.js";
  */
 export class RequestCertificateCommandHandler {
     certificates;
+    authorizer;
     background;
     certificateFactory;
+    validator = new RequestCertificateValidator();
     constructor(props) {
-        const { accountRegionScope, certificates, background = new BackgroundTasks(), } = props;
+        const { accountRegionScope, certificates, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = props;
         this.certificates = certificates;
+        this.authorizer = new RequestCertificateAuthorizer({
+            iam,
+            resource: `arn:aws:acm:${accountRegionScope.regionName}:${accountRegionScope.accountId}:certificate/*`,
+        });
         this.background = background;
         this.certificateFactory = new RequestCertificateFactory({
             accountRegionScope,
         });
     }
     /**
-     * Request a simulated ACM certificate.
+     * Validate, authorize, create, and schedule issuance of a certificate.
+     *
+     * Validation precedes authorization so malformed SDK requests retain ACM's
+     * client-error behavior. Authorization precedes factory use and Map mutation,
+     * preventing an unauthorized caller from allocating certificate state or
+     * scheduling a certificate issuance task.
      */
-    async handle(cmd) {
-        if (cmd.input.DomainName === undefined || cmd.input.DomainName === "") {
-            throw new SimAcmInvalidArgsException("RequestCertificateCommand.input.DomainName required");
-        }
-        if ((cmd.input.Tags?.length ?? 0) > 50) {
-            throw new SimAcmTooManyTagsException("RequestCertificateCommand.input.Tags cannot contain more than 50 tags");
-        }
+    async handle(cmd, opts) {
+        this.validator.validate(cmd);
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
+        this.authorizer.authorize(opts?.caller);
         const certificate = this.certificateFactory.makeCertificate(cmd, this.certificates.size);
         const { certificateArn } = certificate;
         this.certificates.set(certificateArn, certificate);

package/dist/service/acm/command/request-certificate/request-certificate.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-certificate.handler.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-certificate.handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAOnD,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAQtE;;;;GAIG;AACH,MAAM,OAAO,gCAAgC;IAI1B,YAAY,CAAiC;IAC7C,UAAU,CAAsB;IAChC,kBAAkB,CAA4B;IAE/D,YAAY,KAA4C;QACtD,MAAM,EACJ,kBAAkB,EAClB,YAAY,EACZ,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,KAAK,CAAC;QAEV,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,kBAAkB,GAAG,IAAI,yBAAyB,CAAC;YACtD,kBAAkB;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,GAAiC;QAEjC,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,0BAA0B,CAClC,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,0BAA0B,CAClC,uEAAuE,CACxE,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,eAAe,CACzD,GAAG,EACH,IAAI,CAAC,YAAY,CAAC,IAAI,CACvB,CAAC;QACF,MAAM,EAAE,cAAc,EAAE,GAAG,WAAW,CAAC;QAEvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAEnD,yDAAyD;QACzD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;QAEpD,OAAO;YACL,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,cAAc;SAC/B,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"request-certificate.handler.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-certificate.handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAOnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,EACL,kBAAkB,GAEnB,MAAM,wDAAwD,CAAC;AAchE;;;;GAIG;AACH,MAAM,OAAO,gCAAgC;IAI1B,YAAY,CAAiC;IAC7C,UAAU,CAA+B;IACzC,UAAU,CAAsB;IAChC,kBAAkB,CAA4B;IAC9C,SAAS,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAE/D,YAAY,KAA4C;QACtD,MAAM,EACJ,kBAAkB,EAClB,YAAY,EACZ,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,KAAK,CAAC;QAEV,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,IAAI,4BAA4B,CAAC;YACjD,GAAG;YACH,QAAQ,EAAE,eAAe,kBAAkB,CAAC,UAAU,IAAI,kBAAkB,CAAC,SAAS,gBAAgB;SACvG,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,kBAAkB,GAAG,IAAI,yBAAyB,CAAC;YACtD,kBAAkB;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,GAAiC,EACjC,IAA8C;QAE9C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE7B,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAExC,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,eAAe,CACzD,GAAG,EACH,IAAI,CAAC,YAAY,CAAC,IAAI,CACvB,CAAC;QACF,MAAM,EAAE,cAAc,EAAE,GAAG,WAAW,CAAC;QAEvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAEnD,yDAAyD;QACzD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;QAEpD,OAAO;YACL,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,cAAc;SAC/B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/acm/error/sim-acm.error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-acm.error.d.ts","sourceRoot":"","sources":["../../../../src/service/acm/error/sim-acm.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAGlB,SAAS,EAAE,mBAAmB;gBAD9C,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,mBAAwB;CAItD;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,WAAW;IACzD,SAAyB,IAAI,0BAA0B;gBAE3C,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,+BAAgC,SAAQ,WAAW;IAC9D,SAAyB,IAAI,+BAA+B;gBAEhD,OAAO,EAAE,MAAM;CAG5B;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,WAAW;IACzD,SAAyB,IAAI,0BAA0B;gBAE3C,OAAO,EAAE,MAAM;CAG5B"}
+{"version":3,"file":"sim-acm.error.d.ts","sourceRoot":"","sources":["../../../../src/service/acm/error/sim-acm.error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAGlB,SAAS,EAAE,mBAAmB;IAFhD,YACE,OAAO,EAAE,MAAM,EACC,SAAS,GAAE,mBAAwB,EAGpD;CACF;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,WAAW;IACzD,SAAyB,IAAI,0BAA0B;IAEvD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,+BAAgC,SAAQ,WAAW;IAC9D,SAAyB,IAAI,+BAA+B;IAE5D,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,WAAW;IACzD,SAAyB,IAAI,0BAA0B;IAEvD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}

package/dist/service/acm/error/sim-acm.error.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-acm.error.js","sourceRoot":"","sources":["../../../../src/service/acm/error/sim-acm.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB;IAFlB,YACE,OAAe,EACC,YAAiC,EAAE;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,cAAS,GAAT,SAAS,CAA0B;IAGrD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,0BAA2B,SAAQ,WAAW;IAChC,IAAI,GAAG,sBAAsB,CAAC;IAEvD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,+BAAgC,SAAQ,WAAW;IACrC,IAAI,GAAG,2BAA2B,CAAC;IAE5D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,0BAA2B,SAAQ,WAAW;IAChC,IAAI,GAAG,sBAAsB,CAAC;IAEvD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"sim-acm.error.js","sourceRoot":"","sources":["../../../../src/service/acm/error/sim-acm.error.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB,SAAS;IAF3B,YACE,OAAe,EACC,SAAS,GAAwB,EAAE;QAEnD,KAAK,CAAC,OAAO,CAAC,CAAC;yBAFC,SAAS;IAG3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,0BAA2B,SAAQ,WAAW;IAChC,IAAI,GAAG,sBAAsB,CAAC;IAEvD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,+BAAgC,SAAQ,WAAW;IACrC,IAAI,GAAG,2BAA2B,CAAC;IAE5D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,0BAA2B,SAAQ,WAAW;IAChC,IAAI,GAAG,sBAAsB,CAAC;IAEvD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/acm/sim-acm.d.ts

@@ -5,8 +5,14 @@ import type { SimAcmCertificate } from "./certificate/sim-acm-certificate.js";
 import type { SimDescribeCertificateCommand, SimDescribeCertificateCommandOutput } from "./command/describe-certificate/describe-certificate.cmd.js";
 import type { SimListCertificatesCommand, SimListCertificatesCommandOutput } from "./command/list-certificates/list-certificates.cmd.js";
 import { SimAcmCfnResourceFactory } from "./cfn/sim-cfn-acm-resource-factory.js";
+import type { SimAwsCaller } from "../aws/caller/sim-aws-caller.js";
+import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
+export interface SimAcmRequestOptions {
+    readonly caller?: SimAwsCaller;
+}
 interface SimAcmProps {
     readonly accountRegionScope?: SimAwsAccountRegionScope;
+    readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;
 }
 /**
@@ -15,21 +21,22 @@ interface SimAcmProps {
 export declare class SimAcm {
     readonly certificates: Map<`arn:aws:${string}:${string}:${string}:${string}/${string}`, SimAcmCertificate>;
     private readonly accountRegionScope;
+    private readonly iam;
     private readonly background;
     private readonly cfnFactory;
     constructor(props?: SimAcmProps);
     /**
      * Handle a Describe Certificate Command from the SDK.
      */
-    describeCertificate(cmd: SimDescribeCertificateCommand): Promise<SimDescribeCertificateCommandOutput>;
+    describeCertificate(cmd: SimDescribeCertificateCommand, opts?: SimAcmRequestOptions): Promise<SimDescribeCertificateCommandOutput>;
     /**
      * Handle a List Certificates Command from the SDK.
      */
-    listCertificates(cmd: SimListCertificatesCommand): Promise<SimListCertificatesCommandOutput>;
+    listCertificates(cmd: SimListCertificatesCommand, opts?: SimAcmRequestOptions): Promise<SimListCertificatesCommandOutput>;
     /**
      * Handle a Request Certificate Command from the SDK.
      */
-    requestCertificate(cmd: SimRequestCertificateCommand): Promise<SimRequestCertificateCommandOutput>;
+    requestCertificate(cmd: SimRequestCertificateCommand, opts?: SimAcmRequestOptions): Promise<SimRequestCertificateCommandOutput>;
     /**
      * Get this service's CloudFormation Resource factory.
      */

package/dist/service/acm/sim-acm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-acm.d.ts","sourceRoot":"","sources":["../../../src/service/acm/sim-acm.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,KAAK,EACV,4BAA4B,EAC5B,kCAAkC,EACnC,MAAM,0DAA0D,CAAC;AAElE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EACV,6BAA6B,EAC7B,mCAAmC,EACpC,MAAM,4DAA4D,CAAC;AAEpE,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,sDAAsD,CAAC;AAE9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAGjF,UAAU,WAAW;IACnB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;GAEG;AACH,qBAAa,MAAM;IACjB,SAAgB,YAAY,sFAAwC;IAEpE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAExB;gBAES,KAAK,GAAE,WAAgB;IAUnC;;OAEG;IACG,mBAAmB,CACvB,GAAG,EAAE,6BAA6B,GACjC,OAAO,CAAC,mCAAmC,CAAC;IAQ/C;;OAEG;IACG,gBAAgB,CACpB,GAAG,EAAE,0BAA0B,GAC9B,OAAO,CAAC,gCAAgC,CAAC;IAQ5C;;OAEG;IACG,kBAAkB,CACtB,GAAG,EAAE,4BAA4B,GAChC,OAAO,CAAC,kCAAkC,CAAC;IAS9C;;OAEG;IACH,kBAAkB,IAAI,wBAAwB;CAG/C"}
+{"version":3,"file":"sim-acm.d.ts","sourceRoot":"","sources":["../../../src/service/acm/sim-acm.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,KAAK,EACV,4BAA4B,EAC5B,kCAAkC,EACnC,MAAM,0DAA0D,CAAC;AAElE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EACV,6BAA6B,EAC7B,mCAAmC,EACpC,MAAM,4DAA4D,CAAC;AAEpE,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,sDAAsD,CAAC;AAE9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAEjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kDAAkD,CAAC;AAE1D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;GAEG;AACH,qBAAa,MAAM;IACjB,SAAgB,YAAY,sFAAwC;IAEpE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAExB;IAEH,YAAY,KAAK,GAAE,WAAgB,EAUlC;IAED;;OAEG;IACG,mBAAmB,CACvB,GAAG,EAAE,6BAA6B,EAClC,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,mCAAmC,CAAC,CAO9C;IAED;;OAEG;IACG,gBAAgB,CACpB,GAAG,EAAE,0BAA0B,EAC/B,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,gCAAgC,CAAC,CAO3C;IAED;;OAEG;IACG,kBAAkB,CACtB,GAAG,EAAE,4BAA4B,EACjC,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,kCAAkC,CAAC,CAQ7C;IAED;;OAEG;IACH,kBAAkB,IAAI,wBAAwB,CAE7C;CACF"}

package/dist/service/acm/sim-acm.js

@@ -4,51 +4,57 @@ import { DescribeCertificateCommandHandler } from "./command/describe-certificat
 import { ListCertificatesCommandHandler } from "./command/list-certificates/list-certificates.handler.js";
 import { SimAcmCfnResourceFactory } from "./cfn/sim-cfn-acm-resource-factory.js";
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
+import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 /**
  * Simulated ACM. Handles SDK commands. Emulates AWS behaviour and state.
  */
 export class SimAcm {
     certificates = new Map();
     accountRegionScope;
+    iam;
     background;
     cfnFactory = new SimAcmCfnResourceFactory({
         acm: this,
     });
     constructor(props = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), background = new BackgroundTasks(), } = props;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = props;
         this.accountRegionScope = accountRegionScope;
+        this.iam = iam;
         this.background = background;
     }
     /**
      * Handle a Describe Certificate Command from the SDK.
      */
-    async describeCertificate(cmd) {
+    async describeCertificate(cmd, opts) {
         const handler = new DescribeCertificateCommandHandler({
             certificates: this.certificates,
+            iam: this.iam,
             background: this.background,
         });
-        return await handler.handle(cmd);
+        return await handler.handle(cmd, opts);
     }
     /**
      * Handle a List Certificates Command from the SDK.
      */
-    async listCertificates(cmd) {
+    async listCertificates(cmd, opts) {
         const handler = new ListCertificatesCommandHandler({
             certificates: this.certificates,
+            iam: this.iam,
             background: this.background,
         });
-        return await handler.handle(cmd);
+        return await handler.handle(cmd, opts);
     }
     /**
      * Handle a Request Certificate Command from the SDK.
      */
-    async requestCertificate(cmd) {
+    async requestCertificate(cmd, opts) {
         const handler = new RequestCertificateCommandHandler({
             accountRegionScope: this.accountRegionScope,
             certificates: this.certificates,
+            iam: this.iam,
             background: this.background,
         });
-        return await handler.handle(cmd);
+        return await handler.handle(cmd, opts);
     }
     /**
      * Get this service's CloudFormation Resource factory.

package/dist/service/acm/sim-acm.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-acm.js","sourceRoot":"","sources":["../../../src/service/acm/sim-acm.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAO7C,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAMhH,OAAO,EAAE,iCAAiC,EAAE,MAAM,gEAAgE,CAAC;AAKnH,OAAO,EAAE,8BAA8B,EAAE,MAAM,0DAA0D,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AAOjG;;GAEG;AACH,MAAM,OAAO,MAAM;IACD,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEnD,kBAAkB,CAA2B;IAC7C,UAAU,CAAsB;IAChC,UAAU,GAAG,IAAI,wBAAwB,CAAC;QACzD,GAAG,EAAE,IAAI;KACV,CAAC,CAAC;IAEH,YAAY,QAAqB,EAAE;QACjC,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,KAAK,CAAC;QAEV,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CACvB,GAAkC;QAElC,MAAM,OAAO,GAAG,IAAI,iCAAiC,CAAC;YACpD,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,GAA+B;QAE/B,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAAC;YACjD,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,GAAiC;QAEjC,MAAM,OAAO,GAAG,IAAI,gCAAgC,CAAC;YACnD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF"}
+{"version":3,"file":"sim-acm.js","sourceRoot":"","sources":["../../../src/service/acm/sim-acm.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAO7C,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAMhH,OAAO,EAAE,iCAAiC,EAAE,MAAM,gEAAgE,CAAC;AAKnH,OAAO,EAAE,8BAA8B,EAAE,MAAM,0DAA0D,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AAEjG,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAY1D;;GAEG;AACH,MAAM,OAAO,MAAM;IACD,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEnD,kBAAkB,CAA2B;IAC7C,GAAG,CAA0B;IAC7B,UAAU,CAAsB;IAChC,UAAU,GAAG,IAAI,wBAAwB,CAAC;QACzD,GAAG,EAAE,IAAI;KACV,CAAC,CAAC;IAEH,YAAY,KAAK,GAAgB,EAAE;QACjC,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,KAAK,CAAC;QAEV,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CACvB,GAAkC,EAClC,IAA2B;QAE3B,MAAM,OAAO,GAAG,IAAI,iCAAiC,CAAC;YACpD,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,GAA+B,EAC/B,IAA2B;QAE3B,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAAC;YACjD,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,GAAiC,EACjC,IAA2B;QAE3B,MAAM,OAAO,GAAG,IAAI,gCAAgC,CAAC;YACnD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF"}

package/dist/service/aws/caller/sim-aws-account-root-principal.d.ts

@@ -0,0 +1,7 @@
+import type { SimAwsAccountId } from "../sim-aws-account.js";
+import type { SimAwsPrincipal } from "./sim-aws-caller.js";
+/**
+ * Make the intrinsic root principal for a simulated AWS Account.
+ */
+export declare function makeSimAwsAccountRootPrincipal(accountId: SimAwsAccountId): SimAwsPrincipal;
+//# sourceMappingURL=sim-aws-account-root-principal.d.ts.map

package/dist/service/aws/caller/sim-aws-account-root-principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-account-root-principal.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/caller/sim-aws-account-root-principal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,eAAe,GACzB,eAAe,CAKjB"}

package/dist/service/aws/caller/sim-aws-account-root-principal.js

@@ -0,0 +1,10 @@
+/**
+ * Make the intrinsic root principal for a simulated AWS Account.
+ */
+export function makeSimAwsAccountRootPrincipal(accountId) {
+    return {
+        kind: "arn",
+        arn: `arn:aws:iam::${accountId}:root`,
+    };
+}
+//# sourceMappingURL=sim-aws-account-root-principal.js.map

package/dist/service/aws/caller/sim-aws-account-root-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-account-root-principal.js","sourceRoot":"","sources":["../../../../src/service/aws/caller/sim-aws-account-root-principal.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAA0B;IAE1B,OAAO;QACL,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,gBAAgB,SAAS,OAAO;KACtC,CAAC;AACJ,CAAC"}

package/dist/service/aws/caller/sim-aws-caller-resolver.d.ts

@@ -0,0 +1,40 @@
+import type { SimAwsCaller, SimAwsPrincipal, SimCredentialCaller } from "./sim-aws-caller.js";
+import type { SimIamCredentialIdentity } from "../../iam/credential/sim-aws-credentials.js";
+export interface SimAwsCredentialIdentityResolver {
+    resolveCredentials(credentials: SimCredentialCaller["credentials"], now?: Date): SimIamCredentialIdentity;
+}
+/**
+ * Caller information normalized for simulated AWS service operations.
+ *
+ * The effective principal is used for request context and diagnostics. The
+ * identity-policy principal identifies the IAM entity whose policies apply.
+ */
+export interface SimAwsResolvedCaller {
+    readonly principal: SimAwsPrincipal;
+    readonly identityPolicyPrincipal: SimAwsPrincipal;
+    readonly arn?: string | undefined;
+    readonly identityPolicyArn?: string | undefined;
+    readonly accountId?: string | undefined;
+    readonly service?: string | undefined;
+}
+/**
+ * Resolves caller input at a simulated AWS operation boundary.
+ *
+ * An omitted caller resolves to the supplied operation default. Explicit
+ * anonymity is preserved. Credential callers are authenticated before a
+ * resolved caller is returned.
+ */
+export declare class SimAwsCallerResolver {
+    private readonly credentialIdentityResolver?;
+    constructor(credentialIdentityResolver?: SimAwsCredentialIdentityResolver);
+    /**
+     * Resolve and normalize a simulated AWS caller.
+     */
+    resolve(caller: SimAwsCaller | undefined, defaultPrincipal: SimAwsPrincipal): SimAwsResolvedCaller;
+    private normalized;
+    /**
+     * Extract the account component of an ARN when it contains one.
+     */
+    private accountId;
+}
+//# sourceMappingURL=sim-aws-caller-resolver.d.ts.map

package/dist/service/aws/caller/sim-aws-caller-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-caller-resolver.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/caller/sim-aws-caller-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAE5F,MAAM,WAAW,gCAAgC;IAC/C,kBAAkB,CAChB,WAAW,EAAE,mBAAmB,CAAC,aAAa,CAAC,EAC/C,GAAG,CAAC,EAAE,IAAI,GACT,wBAAwB,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,uBAAuB,EAAE,eAAe,CAAC;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CACG;IAE/C,YAAY,0BAA0B,CAAC,EAAE,gCAAgC,EAExE;IAED;;OAEG;IACH,OAAO,CACL,MAAM,EAAE,YAAY,GAAG,SAAS,EAChC,gBAAgB,EAAE,eAAe,GAChC,oBAAoB,CAoBtB;IAED,OAAO,CAAC,UAAU;IAiClB;;OAEG;IACH,OAAO,CAAC,SAAS;CAMlB"}

package/dist/service/aws/caller/sim-aws-caller-resolver.js

@@ -0,0 +1,62 @@
+/**
+ * Resolves caller input at a simulated AWS operation boundary.
+ *
+ * An omitted caller resolves to the supplied operation default. Explicit
+ * anonymity is preserved. Credential callers are authenticated before a
+ * resolved caller is returned.
+ */
+export class SimAwsCallerResolver {
+    credentialIdentityResolver;
+    constructor(credentialIdentityResolver) {
+        this.credentialIdentityResolver = credentialIdentityResolver;
+    }
+    /**
+     * Resolve and normalize a simulated AWS caller.
+     */
+    resolve(caller, defaultPrincipal) {
+        if (caller?.kind === "credentials") {
+            if (this.credentialIdentityResolver === undefined) {
+                throw new Error("Simulated credential callers require an IAM credential resolver");
+            }
+            const identity = this.credentialIdentityResolver.resolveCredentials(caller.credentials);
+            return this.normalized(identity.principal, identity.identityPolicyPrincipal);
+        }
+        const principal = caller ?? defaultPrincipal;
+        return this.normalized(principal, principal);
+    }
+    normalized(principal, identityPolicyPrincipal) {
+        if (principal.kind === "arn") {
+            const identityPolicyArn = identityPolicyPrincipal.kind === "arn"
+                ? identityPolicyPrincipal.arn
+                : undefined;
+            return {
+                principal,
+                identityPolicyPrincipal,
+                arn: principal.arn,
+                identityPolicyArn,
+                accountId: this.accountId(principal.arn),
+            };
+        }
+        if (principal.kind === "service") {
+            return {
+                principal,
+                identityPolicyPrincipal,
+                service: principal.service,
+            };
+        }
+        return {
+            principal,
+            identityPolicyPrincipal,
+        };
+    }
+    /**
+     * Extract the account component of an ARN when it contains one.
+     */
+    accountId(arn) {
+        const accountId = arn.split(":", 6)[4];
+        return accountId === undefined || accountId.length === 0
+            ? undefined
+            : accountId;
+    }
+}
+//# sourceMappingURL=sim-aws-caller-resolver.js.map

package/dist/service/aws/caller/sim-aws-caller-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-caller-resolver.js","sourceRoot":"","sources":["../../../../src/service/aws/caller/sim-aws-caller-resolver.ts"],"names":[],"mappings":"AA6BA;;;;;;GAMG;AACH,MAAM,OAAO,oBAAoB;IACd,0BAA0B,CACI;IAE/C,YAAY,0BAA6D;QACvE,IAAI,CAAC,0BAA0B,GAAG,0BAA0B,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,OAAO,CACL,MAAgC,EAChC,gBAAiC;QAEjC,IAAI,MAAM,EAAE,IAAI,KAAK,aAAa,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,0BAA0B,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,0BAA0B,CAAC,kBAAkB,CACjE,MAAM,CAAC,WAAW,CACnB,CAAC;YAEF,OAAO,IAAI,CAAC,UAAU,CACpB,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,uBAAuB,CACjC,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,gBAAgB,CAAC;QAC7C,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IAEO,UAAU,CAChB,SAA0B,EAC1B,uBAAwC;QAExC,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,MAAM,iBAAiB,GACrB,uBAAuB,CAAC,IAAI,KAAK,KAAK;gBACpC,CAAC,CAAC,uBAAuB,CAAC,GAAG;gBAC7B,CAAC,CAAC,SAAS,CAAC;YAEhB,OAAO;gBACL,SAAS;gBACT,uBAAuB;gBACvB,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,iBAAiB;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC;aACzC,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO;gBACL,SAAS;gBACT,uBAAuB;gBACvB,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS;YACT,uBAAuB;SACxB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,GAAW;QAC3B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YACtD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;CACF"}

package/dist/service/aws/caller/sim-aws-caller.d.ts

@@ -0,0 +1,40 @@
+import type { SimAwsCredentials } from "../../iam/credential/sim-aws-credentials.js";
+/**
+ * Resolved sim principal with an ARN, such as an IAM user or role.
+ */
+export interface SimArnPrincipal {
+    readonly kind: "arn";
+    readonly arn: string;
+}
+/**
+ * Resolved sim principal with a service name, such as lambda.amazonaws.com.
+ */
+export interface SimServicePrincipal {
+    readonly kind: "service";
+    readonly service: string;
+}
+/**
+ * Resolved sim principal with an anonymous identity.
+ */
+export interface SimAnonymousPrincipal {
+    readonly kind: "anonymous";
+}
+/**
+ * Simulated credentials supplied at an AWS operation boundary.
+ *
+ * Credentials are authentication material rather than a resolved principal.
+ * They must be authenticated before authorization.
+ */
+export interface SimCredentialCaller {
+    readonly kind: "credentials";
+    readonly credentials: SimAwsCredentials;
+}
+/**
+ * Resolved simulated AWS identity.
+ */
+export type SimAwsPrincipal = SimArnPrincipal | SimServicePrincipal | SimAnonymousPrincipal;
+/**
+ * Caller accepted by simulated AWS service operations.
+ */
+export type SimAwsCaller = SimAwsPrincipal | SimCredentialCaller;
+//# sourceMappingURL=sim-aws-caller.d.ts.map

package/dist/service/aws/caller/sim-aws-caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-caller.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/caller/sim-aws-caller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAErF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GACzB,eAAe,GAAG,mBAAmB,GAAG,qBAAqB,CAAC;AAEhE;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG,mBAAmB,CAAC"}

package/dist/service/aws/caller/sim-aws-caller.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-aws-caller.js.map

package/dist/service/aws/caller/sim-aws-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-caller.js","sourceRoot":"","sources":["../../../../src/service/aws/caller/sim-aws-caller.ts"],"names":[],"mappings":""}

package/dist/service/aws/factory/account-service-cache-key.d.ts

@@ -0,0 +1,17 @@
+import type { SimAwsAccountId } from "../sim-aws-account.js";
+export type SimAwsAccountServiceCacheServiceName = "cloudFront" | "iam" | "route53";
+/**
+ * Build a stable memo key for an account-scoped simulated service instance.
+ *
+ * Account-scoped services share one instance across all regions in an account,
+ * but different services in the same account must not share the same memo
+ * entry.
+ * The key includes both the simulated AWS service name and the account ID that
+ * owns the service state.
+ *
+ * Keep new account-scoped services in SimAwsAccountServiceCache on this key
+ * format instead of adding separate Maps. That keeps cache behavior consistent
+ * as more global/account-level simulated AWS services are added.
+ */
+export declare function accountServiceCacheKey(serviceName: SimAwsAccountServiceCacheServiceName, accountId: SimAwsAccountId): string;
+//# sourceMappingURL=account-service-cache-key.d.ts.map

package/dist/service/aws/factory/account-service-cache-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-service-cache-key.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/factory/account-service-cache-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,MAAM,oCAAoC,GAC9C,YAAY,GAAG,KAAK,GAAG,SAAS,CAAC;AAEnC;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,oCAAoC,EACjD,SAAS,EAAE,eAAe,GACzB,MAAM,CAER"}

package/dist/service/aws/factory/account-service-cache-key.js

@@ -0,0 +1,17 @@
+/**
+ * Build a stable memo key for an account-scoped simulated service instance.
+ *
+ * Account-scoped services share one instance across all regions in an account,
+ * but different services in the same account must not share the same memo
+ * entry.
+ * The key includes both the simulated AWS service name and the account ID that
+ * owns the service state.
+ *
+ * Keep new account-scoped services in SimAwsAccountServiceCache on this key
+ * format instead of adding separate Maps. That keeps cache behavior consistent
+ * as more global/account-level simulated AWS services are added.
+ */
+export function accountServiceCacheKey(serviceName, accountId) {
+    return `${serviceName}:${accountId}`;
+}
+//# sourceMappingURL=account-service-cache-key.js.map

package/dist/service/aws/factory/account-service-cache-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-service-cache-key.js","sourceRoot":"","sources":["../../../../src/service/aws/factory/account-service-cache-key.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAiD,EACjD,SAA0B;IAE1B,OAAO,GAAG,WAAW,IAAI,SAAS,EAAE,CAAC;AACvC,CAAC"}

package/dist/service/aws/factory/sim-aws-account-service-cache.d.ts

@@ -5,27 +5,58 @@ import type { SimCloudFrontRegistry } from "../../cloudfront/registry/sim-cloud-
 import { SimCloudFront } from "../../cloudfront/sim-cloudfront.js";
 import { SimRoute53 } from "../../route53/index.js";
 import type { SimRoute53Registry } from "../../route53/registry/sim-route53-registry.js";
+import { SimIam } from "../../iam/index.js";
+import type { SimIamRegistry } from "../../iam/registry/sim-iam-registry.js";
 interface SimAwsAccountServiceCacheProps {
     readonly simAws: SimAws;
     readonly background: BackgroundScheduler & BackgroundCompleter;
     readonly cloudFrontRegistry: SimCloudFrontRegistry;
     readonly route53Registry: SimRoute53Registry;
+    readonly iamRegistry: SimIamRegistry;
 }
 /**
- * Cache for simulated AWS services scoped by account.
+ * Account-level cache for simulated AWS service instances.
+ *
+ * SimAwsServiceFactory owns the top-level service construction policy and the
+ * shared registries for one SimAws instance. This class is the narrower cache
+ * it delegates to for services whose AWS state is scoped to an account rather
+ * than to an account/region pair.
+ *
+ * This class is the account-scoped service catalog: it records which simulated
+ * AWS services share one instance across all regions in an account. A single
+ * Memo stores those instances by service/account keys, so adding another
+ * account-scoped service does not require a new Map or another repeated
+ * get/create/store block.
+ *
+ * Each create method returns the same simulated service instance for repeated
+ * requests in the same account, regardless of the requested region. This
+ * matches global/account-scoped AWS services such as IAM, Route53, and
+ * CloudFront while keeping those lifetime rules out of the top-level
+ * SimAwsServiceFactory.
  */
 export declare class SimAwsAccountServiceCache {
     private readonly simAws;
     private readonly background;
     private readonly cloudFrontRegistry;
+    private readonly iamRegistry;
     private readonly route53Registry;
-    private readonly cloudFrontServices;
-    private readonly route53Services;
+    /**
+     * Shared memo for account-scoped service instances.
+     *
+     * The cache key includes both service name and account ID. The account ID gives
+     * account-scoped lifetime, while the service name prevents different services
+     * in the same account from colliding in this single memo.
+     */
+    private readonly services;
     constructor(props: SimAwsAccountServiceCacheProps);
     /**
      * Create or get simulated CloudFront for an Account scope.
      */
     createCloudFront(scope: SimAwsAccountRegionContainer): SimCloudFront;
+    /**
+     * Create or get simulated IAM for an Account scope.
+     */
+    createIam(scope: SimAwsAccountRegionContainer): SimIam;
     /**
      * Create or get simulated Route53 for an Account scope.
      */

package/dist/service/aws/factory/sim-aws-account-service-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-account-service-cache.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-service-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uDAAuD,CAAC;AAEnG,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEzF,UAAU,8BAA8B;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,mBAAmB,GAAG,mBAAmB,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,kBAAkB,CAAC;CAC9C;AAED;;GAEG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4C;IACvE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwB;IAC3D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IAErD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAG/B;IACJ,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;gBAE9D,KAAK,EAAE,8BAA8B;IAOjD;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,aAAa;IAkBpE;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,4BAA4B,GAAG,UAAU;CAe/D"}
+{"version":3,"file":"sim-aws-account-service-cache.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-service-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uDAAuD,CAAC;AAEnG,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAI7E,UAAU,8BAA8B;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,mBAAmB,GAAG,mBAAmB,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,kBAAkB,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4C;IACvE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwB;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IAErD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmD;IAE5E,YAAY,KAAK,EAAE,8BAA8B,EAMhD;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,aAAa,CAcnE;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAcrD;IAED;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,4BAA4B,GAAG,UAAU,CAS7D;CACF"}

package/dist/service/aws/factory/sim-aws-account-service-cache.js

@@ -1,53 +1,84 @@
 import { makeSimCfS3OriginResolver } from "../../cloudfront/origin/s3/sim-cf-s3-origin-resolver-factory.js";
 import { SimCloudFront } from "../../cloudfront/sim-cloudfront.js";
 import { SimRoute53 } from "../../route53/index.js";
+import { SimIam } from "../../iam/index.js";
+import { Memo } from "../../../util/memo/memo.js";
+import { accountServiceCacheKey } from "./account-service-cache-key.js";
 /**
- * Cache for simulated AWS services scoped by account.
+ * Account-level cache for simulated AWS service instances.
+ *
+ * SimAwsServiceFactory owns the top-level service construction policy and the
+ * shared registries for one SimAws instance. This class is the narrower cache
+ * it delegates to for services whose AWS state is scoped to an account rather
+ * than to an account/region pair.
+ *
+ * This class is the account-scoped service catalog: it records which simulated
+ * AWS services share one instance across all regions in an account. A single
+ * Memo stores those instances by service/account keys, so adding another
+ * account-scoped service does not require a new Map or another repeated
+ * get/create/store block.
+ *
+ * Each create method returns the same simulated service instance for repeated
+ * requests in the same account, regardless of the requested region. This
+ * matches global/account-scoped AWS services such as IAM, Route53, and
+ * CloudFront while keeping those lifetime rules out of the top-level
+ * SimAwsServiceFactory.
  */
 export class SimAwsAccountServiceCache {
     simAws;
     background;
     cloudFrontRegistry;
+    iamRegistry;
     route53Registry;
-    cloudFrontServices = new Map();
-    route53Services = new Map();
+    /**
+     * Shared memo for account-scoped service instances.
+     *
+     * The cache key includes both service name and account ID. The account ID gives
+     * account-scoped lifetime, while the service name prevents different services
+     * in the same account from colliding in this single memo.
+     */
+    services = new Memo();
     constructor(props) {
         this.simAws = props.simAws;
         this.background = props.background;
         this.cloudFrontRegistry = props.cloudFrontRegistry;
+        this.iamRegistry = props.iamRegistry;
         this.route53Registry = props.route53Registry;
     }
     /**
      * Create or get simulated CloudFront for an Account scope.
      */
     createCloudFront(scope) {
-        const { accountId } = scope.accountRegionScope;
-        let cloudFront = this.cloudFrontServices.get(accountId);
-        if (cloudFront === undefined) {
-            cloudFront = new SimCloudFront({
+        const iam = this.createIam(scope);
+        return this.services.getOrCreate(accountServiceCacheKey("cloudFront", scope.accountRegionScope.accountId), () => new SimCloudFront({
+            accountRegionScope: scope.accountRegionScope,
+            cloudFrontRegistry: this.cloudFrontRegistry,
+            s3OriginResolver: makeSimCfS3OriginResolver(this.simAws, scope),
+            iam,
+            background: this.background,
+        }));
+    }
+    /**
+     * Create or get simulated IAM for an Account scope.
+     */
+    createIam(scope) {
+        return this.services.getOrCreate(accountServiceCacheKey("iam", scope.accountRegionScope.accountId), () => {
+            const iam = new SimIam({
                 accountRegionScope: scope.accountRegionScope,
-                cloudFrontRegistry: this.cloudFrontRegistry,
-                s3OriginResolver: makeSimCfS3OriginResolver(this.simAws, scope),
                 background: this.background,
             });
-            this.cloudFrontServices.set(accountId, cloudFront);
-        }
-        return cloudFront;
+            this.iamRegistry.register(scope.accountRegionScope.accountId, iam);
+            return iam;
+        });
     }
     /**
      * Create or get simulated Route53 for an Account scope.
      */
     createRoute53(scope) {
-        const { accountId } = scope.accountRegionScope;
-        let route53 = this.route53Services.get(accountId);
-        if (route53 === undefined) {
-            route53 = new SimRoute53({
-                background: this.background,
-                route53Registry: this.route53Registry,
-            });
-            this.route53Services.set(accountId, route53);
-        }
-        return route53;
+        return this.services.getOrCreate(accountServiceCacheKey("route53", scope.accountRegionScope.accountId), () => new SimRoute53({
+            background: this.background,
+            route53Registry: this.route53Registry,
+        }));
     }
 }
 //# sourceMappingURL=sim-aws-account-service-cache.js.map