@kensio/yulin 0.32.0 → 0.34.0

package/dist/dist-hidden/service/acm/cfn/property/sim-cfn-acm-cert-prop-reader.js

@@ -0,0 +1,105 @@
+import { isRecord } from "../../../../util/type-guard/record.js";
+/**
+ * Reads AWS::ACM::Certificate properties whose CloudFormation shape is an
+ * array.
+ *
+ * This class keeps array traversal and nested object validation out of
+ * SimCfnAcmCertificateProperties. The outer properties reader stays focused on
+ * top-level CloudFormation fields, while this reader owns the repeated rules
+ * for list properties:
+ *
+ * - the property must be an array when it is present;
+ * - each array item is validated with an index-aware error path;
+ * - nested optional string fields are checked before being returned to the
+ *   request-certificate command shape.
+ */
+export class SimCfnAcmCertificatePropertyListReader {
+    logicalId;
+    constructor(props) {
+        this.logicalId = props.logicalId;
+    }
+    /**
+     * Read Certificate SubjectAlternativeNames.
+     *
+     * CloudFormation accepts this property as a list of DNS names. The simulator
+     * stores the already-resolved template values, so each entry must be a plain
+     * string by this point.
+     */
+    subjectAlternativeNames(value) {
+        this.assertArray(value, "SubjectAlternativeNames");
+        for (const [index, item] of value.entries()) {
+            if (typeof item !== "string") {
+                throw this.propertyError(`SubjectAlternativeNames[${String(index)}]`, "must be a string");
+            }
+        }
+        return value;
+    }
+    /**
+     * Read Certificate DomainValidationOptions.
+     *
+     * Each option is a small object with optional string fields. The simulator
+     * returns the command input shape because the ACM resource factory can pass it
+     * directly into the request-certificate flow.
+     */
+    domainValidationOptions(value) {
+        this.assertArray(value, "DomainValidationOptions");
+        return value.map((item, index) => this.domainValidationOption(item, index));
+    }
+    /**
+     * Read Certificate Tags.
+     *
+     * Tags follow the AWS SDK command shape where Key and Value are optional
+     * strings. Invalid nested values are reported with the exact array index so a
+     * failing template is easy to locate.
+     */
+    tags(value) {
+        this.assertArray(value, "Tags");
+        return value.map((item, index) => this.tag(item, index));
+    }
+    assertArray(value, propertyName) {
+        if (!Array.isArray(value)) {
+            throw this.propertyError(propertyName, "must be an array");
+        }
+    }
+    domainValidationOption(value, index) {
+        const propertyPath = `DomainValidationOptions[${String(index)}]`;
+        if (!isRecord(value)) {
+            throw this.propertyError(propertyPath, "must be an object");
+        }
+        const domainName = value["DomainName"];
+        if (domainName !== undefined && typeof domainName !== "string") {
+            throw this.propertyError(`${propertyPath}.DomainName`, "must be a string");
+        }
+        const validationDomain = value["ValidationDomain"];
+        if (validationDomain !== undefined &&
+            typeof validationDomain !== "string") {
+            throw this.propertyError(`${propertyPath}.ValidationDomain`, "must be a string");
+        }
+        return {
+            DomainName: domainName,
+            ValidationDomain: validationDomain,
+        };
+    }
+    tag(value, index) {
+        const propertyPath = `Tags[${String(index)}]`;
+        if (!isRecord(value)) {
+            throw this.propertyError(propertyPath, "must be an object");
+        }
+        const key = value["Key"];
+        if (key !== undefined && typeof key !== "string") {
+            throw this.propertyError(`${propertyPath}.Key`, "must be a string");
+        }
+        const tagValue = value["Value"];
+        if (tagValue !== undefined && typeof tagValue !== "string") {
+            throw this.propertyError(`${propertyPath}.Value`, "must be a string");
+        }
+        return {
+            Key: key,
+            Value: tagValue,
+        };
+    }
+    propertyError(propertyPath, reason) {
+        return new Error(`Invalid AWS::ACM::Certificate Resource ${this.logicalId} property ${propertyPath}: ${reason}`);
+    }
+}
+//# sourceMappingURL=sim-cfn-acm-cert-prop-reader.js.map

package/dist/dist-hidden/service/acm/cfn/property/sim-cfn-acm-cert-prop-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-acm-cert-prop-reader.js","sourceRoot":"","sources":["../../../../../src/service/acm/cfn/property/sim-cfn-acm-cert-prop-reader.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AAMjE;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,sCAAsC;IAChC,SAAS,CAAS;IAEnC,YAAY,KAAkD;QAC5D,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACH,uBAAuB,CAAC,KAAc;QACpC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;QAEnD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,aAAa,CACtB,2BAA2B,MAAM,CAAC,KAAK,CAAC,GAAG,EAC3C,kBAAkB,CACnB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,KAA0B,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IACH,uBAAuB,CACrB,KAAc;QAEd,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;QAEnD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,KAAc;QACjB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAEhC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,WAAW,CACjB,KAAc,EACd,YACgE;QAEhE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAEO,sBAAsB,CAC5B,KAAc,EACd,KAAa;QAEb,MAAM,YAAY,GAAG,2BAA2B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QAEjE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,aAAa,CACtB,GAAG,YAAY,aAAa,EAC5B,kBAAkB,CACnB,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACnD,IACE,gBAAgB,KAAK,SAAS;YAC9B,OAAO,gBAAgB,KAAK,QAAQ,EACpC,CAAC;YACD,MAAM,IAAI,CAAC,aAAa,CACtB,GAAG,YAAY,mBAAmB,EAClC,kBAAkB,CACnB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,UAAU,EAAE,UAAU;YACtB,gBAAgB,EAAE,gBAAgB;SACnC,CAAC;IACJ,CAAC;IAEO,GAAG,CAAC,KAAc,EAAE,KAAa;QACvC,MAAM,YAAY,GAAG,QAAQ,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QAE9C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,YAAY,MAAM,EAAE,kBAAkB,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,YAAY,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACxE,CAAC;QAED,OAAO;YACL,GAAG,EAAE,GAAG;YACR,KAAK,EAAE,QAAQ;SAChB,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,YAAoB,EAAE,MAAc;QACxD,OAAO,IAAI,KAAK,CACd,0CAA0C,IAAI,CAAC,SAAS,aAAa,YAAY,KAAK,MAAM,EAAE,CAC/F,CAAC;IACJ,CAAC;CACF"}

package/dist/dist-hidden/service/acm/cfn/property/sim-cfn-acm-cert-properties.d.ts

@@ -0,0 +1,40 @@
+import type { SimAcmValidationMethod } from "../../certificate/sim-acm-certificate.js";
+import type { SimRequestCertificateDomainValidationOption, SimRequestCertificateTag } from "../../command/request-certificate/request-certificate.cmd.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+interface SimCfnAcmCertificatePropertiesProps {
+    readonly logicalId: string;
+    readonly properties: SimCfnTemplateValueRecord;
+}
+/**
+ * Reads and validates CloudFormation AWS::ACM::Certificate properties for
+ * sim ACM certificate creation.
+ */
+export declare class SimCfnAcmCertificateProperties {
+    private readonly logicalId;
+    private readonly properties;
+    private readonly listReader;
+    constructor(props: SimCfnAcmCertificatePropertiesProps);
+    /**
+     * Get the Certificate DomainName property.
+     */
+    domainName(): string | undefined;
+    /**
+     * Get the Certificate SubjectAlternativeNames property.
+     */
+    subjectAlternativeNames(): readonly string[] | undefined;
+    /**
+     * Get the Certificate ValidationMethod property.
+     */
+    validationMethod(): SimAcmValidationMethod | undefined;
+    /**
+     * Get the Certificate DomainValidationOptions property.
+     */
+    domainValidationOptions(): readonly SimRequestCertificateDomainValidationOption[] | undefined;
+    /**
+     * Get the Certificate Tags property.
+     */
+    tags(): readonly SimRequestCertificateTag[] | undefined;
+    private propertyError;
+}
+export {};
+//# sourceMappingURL=sim-cfn-acm-cert-properties.d.ts.map

package/dist/dist-hidden/service/acm/cfn/property/sim-cfn-acm-cert-properties.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-acm-cert-properties.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/cfn/property/sim-cfn-acm-cert-properties.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,KAAK,EACV,2CAA2C,EAC3C,wBAAwB,EACzB,MAAM,8DAA8D,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAGlH,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;CAChD;AAED;;;GAGG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyC;IAEpE,YAAY,KAAK,EAAE,mCAAmC,EAMrD;IAED;;OAEG;IACH,UAAU,IAAI,MAAM,GAAG,SAAS,CAa/B;IAED;;OAEG;IACH,uBAAuB,IAAI,SAAS,MAAM,EAAE,GAAG,SAAS,CAQvD;IAED;;OAEG;IACH,gBAAgB,IAAI,sBAAsB,GAAG,SAAS,CAarD;IAED;;OAEG;IACH,uBAAuB,IACrB,SAAS,2CAA2C,EAAE,GAAG,SAAS,CAQnE;IAED;;OAEG;IACH,IAAI,IAAI,SAAS,wBAAwB,EAAE,GAAG,SAAS,CAQtD;IAED,OAAO,CAAC,aAAa;CAKtB"}

package/dist/dist-hidden/service/acm/cfn/property/sim-cfn-acm-cert-properties.js

@@ -0,0 +1,79 @@
+import { SimCfnAcmCertificatePropertyListReader } from "./sim-cfn-acm-cert-prop-reader.js";
+/**
+ * Reads and validates CloudFormation AWS::ACM::Certificate properties for
+ * sim ACM certificate creation.
+ */
+export class SimCfnAcmCertificateProperties {
+    logicalId;
+    properties;
+    listReader;
+    constructor(props) {
+        this.logicalId = props.logicalId;
+        this.properties = props.properties;
+        this.listReader = new SimCfnAcmCertificatePropertyListReader({
+            logicalId: this.logicalId,
+        });
+    }
+    /**
+     * Get the Certificate DomainName property.
+     */
+    domainName() {
+        const value = this.properties["DomainName"];
+        /* v8 ignore if */
+        if (value === undefined) {
+            return undefined;
+        }
+        if (typeof value !== "string") {
+            throw this.propertyError("DomainName", "must be a string");
+        }
+        return value;
+    }
+    /**
+     * Get the Certificate SubjectAlternativeNames property.
+     */
+    subjectAlternativeNames() {
+        const value = this.properties["SubjectAlternativeNames"];
+        if (value === undefined) {
+            return undefined;
+        }
+        return this.listReader.subjectAlternativeNames(value);
+    }
+    /**
+     * Get the Certificate ValidationMethod property.
+     */
+    validationMethod() {
+        const value = this.properties["ValidationMethod"];
+        /* v8 ignore if */
+        if (value === undefined) {
+            return undefined;
+        }
+        if (value !== "DNS" && value !== "EMAIL") {
+            throw this.propertyError("ValidationMethod", "must be DNS or EMAIL");
+        }
+        return value;
+    }
+    /**
+     * Get the Certificate DomainValidationOptions property.
+     */
+    domainValidationOptions() {
+        const value = this.properties["DomainValidationOptions"];
+        if (value === undefined) {
+            return undefined;
+        }
+        return this.listReader.domainValidationOptions(value);
+    }
+    /**
+     * Get the Certificate Tags property.
+     */
+    tags() {
+        const value = this.properties["Tags"];
+        if (value === undefined) {
+            return undefined;
+        }
+        return this.listReader.tags(value);
+    }
+    propertyError(propertyPath, reason) {
+        return new Error(`Invalid AWS::ACM::Certificate Resource ${this.logicalId} property ${propertyPath}: ${reason}`);
+    }
+}
+//# sourceMappingURL=sim-cfn-acm-cert-properties.js.map

package/dist/dist-hidden/service/acm/cfn/property/sim-cfn-acm-cert-properties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-acm-cert-properties.js","sourceRoot":"","sources":["../../../../../src/service/acm/cfn/property/sim-cfn-acm-cert-properties.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,sCAAsC,EAAE,MAAM,mCAAmC,CAAC;AAO3F;;;GAGG;AACH,MAAM,OAAO,8BAA8B;IACxB,SAAS,CAAS;IAClB,UAAU,CAA4B;IACtC,UAAU,CAAyC;IAEpE,YAAY,KAA0C;QACpD,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,IAAI,sCAAsC,CAAC;YAC3D,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,UAAU;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAE5C,kBAAkB;QAClB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,uBAAuB;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;QAEzD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;QAElD,kBAAkB;QAClB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,uBAAuB;QAErB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;QAEzD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAEO,aAAa,CAAC,YAAoB,EAAE,MAAc;QACxD,OAAO,IAAI,KAAK,CACd,0CAA0C,IAAI,CAAC,SAAS,aAAa,YAAY,KAAK,MAAM,EAAE,CAC/F,CAAC;IACJ,CAAC;CACF"}

package/dist/dist-hidden/service/acm/cfn/sim-cfn-acm-resource-factory.d.ts

@@ -0,0 +1,20 @@
+import type { SimCfnResource, SimCloudFormationResourceCreateContext } from "../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnServiceResourceFactory } from "../../cloudformation/resource/factory/sim-cfn-resource-factory.type.js";
+import { SimAcm } from "../sim-acm.js";
+interface SimAcmCfnResourceFactoryProps {
+    readonly acm?: SimAcm | undefined;
+}
+/**
+ * CloudFormation Resource factory for simulated ACM resources.
+ */
+export declare class SimAcmCfnResourceFactory implements SimCfnServiceResourceFactory {
+    private readonly acm;
+    constructor(props?: SimAcmCfnResourceFactoryProps);
+    /**
+     * Create a simulated ACM resource from a CloudFormation Resource.
+     */
+    create(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceCreateContext): Promise<object | undefined>;
+    private createCertificate;
+}
+export {};
+//# sourceMappingURL=sim-cfn-acm-resource-factory.d.ts.map

package/dist/dist-hidden/service/acm/cfn/sim-cfn-acm-resource-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-acm-resource-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/acm/cfn/sim-cfn-acm-resource-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,sCAAsC,EACvC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AAC3H,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAKvC,UAAU,6BAA6B;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;GAEG;AACH,qBAAa,wBAAyB,YAAW,4BAA4B;IAC3E,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,KAAK,GAAE,6BAAkC,EAIpD;IAED;;OAEG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW7B;YAEa,iBAAiB;CAiChC"}

package/dist/dist-hidden/service/acm/cfn/sim-cfn-acm-resource-factory.js

@@ -0,0 +1,47 @@
+import { SimAcm } from "../sim-acm.js";
+import { assertDefined } from "../../../util/type-guard/defined.js";
+import { SimCfnAcmCertificateProperties } from "./property/sim-cfn-acm-cert-properties.js";
+/**
+ * CloudFormation Resource factory for simulated ACM resources.
+ */
+export class SimAcmCfnResourceFactory {
+    acm;
+    constructor(props = {}) {
+        const { acm = new SimAcm() } = props;
+        this.acm = acm;
+    }
+    /**
+     * Create a simulated ACM resource from a CloudFormation Resource.
+     */
+    async create(resourceTypeName, resource, context) {
+        switch (resourceTypeName) {
+            case "Certificate": {
+                return await this.createCertificate(resource, context);
+            }
+            default: {
+                throw new Error(`Unsupported sim ACM CloudFormation Resource ${resourceTypeName}`);
+            }
+        }
+    }
+    async createCertificate(resource, context) {
+        const properties = new SimCfnAcmCertificateProperties({
+            logicalId: resource.logicalId,
+            properties: context.resolvedProperties ?? resource.properties,
+        });
+        const requestCertificateOutput = await this.acm.requestCertificate({
+            input: {
+                DomainName: properties.domainName(),
+                SubjectAlternativeNames: properties.subjectAlternativeNames(),
+                ValidationMethod: properties.validationMethod(),
+                DomainValidationOptions: properties.domainValidationOptions(),
+                Tags: properties.tags(),
+            },
+        });
+        const certificateArn = requestCertificateOutput.CertificateArn;
+        assertDefined(certificateArn, `sim ACM Certificate ARN after CloudFormation creation for ${resource.logicalId}`);
+        const certificate = this.acm.certificates.get(certificateArn);
+        assertDefined(certificate, `sim ACM Certificate ${certificateArn} after CloudFormation creation`);
+        return certificate;
+    }
+}
+//# sourceMappingURL=sim-cfn-acm-resource-factory.js.map

package/dist/dist-hidden/service/acm/cfn/sim-cfn-acm-resource-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-acm-resource-factory.js","sourceRoot":"","sources":["../../../../src/service/acm/cfn/sim-cfn-acm-resource-factory.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAM3F;;GAEG;AACH,MAAM,OAAO,wBAAwB;IAClB,GAAG,CAAS;IAE7B,YAAY,KAAK,GAAkC,EAAE;QACnD,MAAM,EAAE,GAAG,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC;QAErC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,gBAAwB,EACxB,QAAwB,EACxB,OAA+C;QAE/C,QAAQ,gBAAgB,EAAE,CAAC;YACzB,KAAK,aAAa,EAAE,CAAC;gBACnB,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACzD,CAAC;YACD,SAAS,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,+CAA+C,gBAAgB,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,QAAwB,EACxB,OAA+C;QAE/C,MAAM,UAAU,GAAG,IAAI,8BAA8B,CAAC;YACpD,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,UAAU,EAAE,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU;SAC9D,CAAC,CAAC;QAEH,MAAM,wBAAwB,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACjE,KAAK,EAAE;gBACL,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE;gBACnC,uBAAuB,EAAE,UAAU,CAAC,uBAAuB,EAAE;gBAC7D,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,EAAE;gBAC/C,uBAAuB,EAAE,UAAU,CAAC,uBAAuB,EAAE;gBAC7D,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE;aACxB;SACF,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,wBAAwB,CAAC,cAAc,CAAC;QAC/D,aAAa,CACX,cAAc,EACd,6DAA6D,QAAQ,CAAC,SAAS,EAAE,CAClF,CAAC;QAEF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9D,aAAa,CACX,WAAW,EACX,uBAAuB,cAAc,gCAAgC,CACtE,CAAC;QAEF,OAAO,WAAW,CAAC;IACrB,CAAC;CACF"}

package/dist/dist-hidden/service/acm/command/describe-certificate/describe-certificate-authorizer.d.ts

@@ -0,0 +1,31 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+interface DescribeCertificateAuthorizerProps {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to an ACM DescribeCertificate request.
+ *
+ * DescribeCertificate authorizes against the requested Certificate ARN. This
+ * differs from ListCertificates, which is an account and Region-level operation
+ * using "*". A policy can therefore grant access to one certificate without
+ * granting access to every certificate in the Account and Region.
+ *
+ * Authorization occurs before ACM looks up the Certificate. An unauthorized
+ * caller receives AccessDenied whether the requested ARN exists or not, which
+ * prevents the operation from exposing certificate existence.
+ */
+export declare class DescribeCertificateAuthorizer {
+    private static readonly action;
+    private readonly iam;
+    constructor(props: DescribeCertificateAuthorizerProps);
+    /**
+     * Ensure the caller may describe the certificate identified by the ARN.
+     *
+     * The caller is passed through unchanged so sim IAM can apply the account-root
+     * fallback only for an omitted caller and preserve explicit anonymous callers.
+     */
+    authorize(certificateArn: string, caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=describe-certificate-authorizer.d.ts.map

package/dist/dist-hidden/service/acm/command/describe-certificate/describe-certificate-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-certificate-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/describe-certificate/describe-certificate-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAA6B;IAE3D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,KAAK,EAAE,kCAAkC,EAEpD;IAED;;;;;OAKG;IACH,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAc7D;CACF"}

package/dist/dist-hidden/service/acm/command/describe-certificate/describe-certificate-authorizer.js

@@ -0,0 +1,41 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies IAM authorization to an ACM DescribeCertificate request.
+ *
+ * DescribeCertificate authorizes against the requested Certificate ARN. This
+ * differs from ListCertificates, which is an account and Region-level operation
+ * using "*". A policy can therefore grant access to one certificate without
+ * granting access to every certificate in the Account and Region.
+ *
+ * Authorization occurs before ACM looks up the Certificate. An unauthorized
+ * caller receives AccessDenied whether the requested ARN exists or not, which
+ * prevents the operation from exposing certificate existence.
+ */
+export class DescribeCertificateAuthorizer {
+    static action = "acm:DescribeCertificate";
+    iam;
+    constructor(props) {
+        this.iam = props.iam;
+    }
+    /**
+     * Ensure the caller may describe the certificate identified by the ARN.
+     *
+     * The caller is passed through unchanged so sim IAM can apply the account-root
+     * fallback only for an omitted caller and preserve explicit anonymous callers.
+     */
+    authorize(certificateArn, caller) {
+        const decision = this.iam.authorize({
+            action: DescribeCertificateAuthorizer.action,
+            resource: certificateArn,
+            caller,
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action: DescribeCertificateAuthorizer.action,
+                resource: certificateArn,
+            });
+        }
+    }
+}
+//# sourceMappingURL=describe-certificate-authorizer.js.map

package/dist/dist-hidden/service/acm/command/describe-certificate/describe-certificate-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-certificate-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/describe-certificate/describe-certificate-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAMzE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,6BAA6B;IAChC,MAAM,CAAU,MAAM,GAAG,yBAAyB,CAAC;IAE1C,GAAG,CAA0B;IAE9C,YAAY,KAAyC;QACnD,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,cAAsB,EAAE,MAAqB;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,6BAA6B,CAAC,MAAM;YAC5C,QAAQ,EAAE,cAAc;YACxB,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM,EAAE,6BAA6B,CAAC,MAAM;gBAC5C,QAAQ,EAAE,cAAc;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/dist-hidden/service/acm/command/describe-certificate/describe-certificate.handler.d.ts

@@ -0,0 +1,38 @@
+import type { SimArn } from "../../../aws/arn.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import type { SimAcmCertificate } from "../../certificate/sim-acm-certificate.js";
+import type { SimDescribeCertificateCommand, SimDescribeCertificateCommandOutput } from "./describe-certificate.cmd.js";
+interface DescribeCertificateCommandHandlerProps {
+    readonly certificates: Map<SimArn, SimAcmCertificate>;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+interface DescribeCertificateCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * Simulated ACM DescribeCertificateCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/acm/command/DescribeCertificateCommand/
+ */
+export declare class DescribeCertificateCommandHandler implements CommandHandler<SimDescribeCertificateCommand, SimDescribeCertificateCommandOutput> {
+    private readonly certificates;
+    private readonly authorizer;
+    private readonly background;
+    private readonly certificateDetailFactory;
+    constructor(props: DescribeCertificateCommandHandlerProps);
+    /**
+     * Describe a simulated ACM certificate.
+     *
+     * CertificateArn is validated before authorization because it is the resource
+     * identifier used in the IAM decision. After sequencing, authorization happens
+     * before the certificate store is read so unauthorized callers cannot learn
+     * whether the requested ARN exists.
+     */
+    handle(cmd: SimDescribeCertificateCommand, opts?: DescribeCertificateCommandHandlerOptions): Promise<SimDescribeCertificateCommandOutput>;
+}
+export {};
+//# sourceMappingURL=describe-certificate.handler.d.ts.map

package/dist/dist-hidden/service/acm/command/describe-certificate/describe-certificate.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-certificate.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/describe-certificate/describe-certificate.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,wDAAwD,CAAC;AAChE,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAE7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAGlF,OAAO,KAAK,EACV,6BAA6B,EAC7B,mCAAmC,EACpC,MAAM,+BAA+B,CAAC;AAGvC,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACtD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,wCAAwC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,iCAAkC,YAAW,cAAc,CACtE,6BAA6B,EAC7B,mCAAmC,CACpC;IACC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgC;IAC3D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CACF;IAEvC,YAAY,KAAK,EAAE,sCAAsC,EAUxD;IAED;;;;;;;OAOG;IACG,MAAM,CACV,GAAG,EAAE,6BAA6B,EAClC,IAAI,CAAC,EAAE,wCAAwC,GAC9C,OAAO,CAAC,mCAAmC,CAAC,CAwB9C;CACF"}

package/dist/dist-hidden/service/acm/command/describe-certificate/describe-certificate.handler.js

@@ -0,0 +1,46 @@
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimAcmResourceNotFoundException } from "../../error/sim-acm.error.js";
+import { DescribeCertificateAuthorizer } from "./describe-certificate-authorizer.js";
+import { SimAcmCertificateDetailFactory } from "./sim-acm-cert-detail-factory.js";
+/**
+ * Simulated ACM DescribeCertificateCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/acm/command/DescribeCertificateCommand/
+ */
+export class DescribeCertificateCommandHandler {
+    certificates;
+    authorizer;
+    background;
+    certificateDetailFactory = new SimAcmCertificateDetailFactory();
+    constructor(props) {
+        const { certificates, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = props;
+        this.certificates = certificates;
+        this.authorizer = new DescribeCertificateAuthorizer({ iam });
+        this.background = background;
+    }
+    /**
+     * Describe a simulated ACM certificate.
+     *
+     * CertificateArn is validated before authorization because it is the resource
+     * identifier used in the IAM decision. After sequencing, authorization happens
+     * before the certificate store is read so unauthorized callers cannot learn
+     * whether the requested ARN exists.
+     */
+    async handle(cmd, opts) {
+        assertDefined(cmd.input.CertificateArn, "DescribeCertificateCommand.input.CertificateArn required");
+        // Allow for potential non-deterministic sequencing of async events.
+        await this.background.sequence();
+        this.authorizer.authorize(cmd.input.CertificateArn, opts?.caller);
+        const certificate = this.certificates.get(cmd.input.CertificateArn);
+        if (certificate === undefined) {
+            throw new SimAcmResourceNotFoundException(`No sim ACM Certificate with ARN ${cmd.input.CertificateArn}`);
+        }
+        return {
+            $metadata: {},
+            Certificate: this.certificateDetailFactory.make(certificate),
+        };
+    }
+}
+//# sourceMappingURL=describe-certificate.handler.js.map

package/dist/dist-hidden/service/acm/command/describe-certificate/describe-certificate.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-certificate.handler.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/describe-certificate/describe-certificate.handler.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,kBAAkB,GAEnB,MAAM,wDAAwD,CAAC;AAChE,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAEvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAKrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAYlF;;;;GAIG;AACH,MAAM,OAAO,iCAAiC;IAI3B,YAAY,CAAiC;IAC7C,UAAU,CAAgC;IAC1C,UAAU,CAAsB;IAChC,wBAAwB,GACvC,IAAI,8BAA8B,EAAE,CAAC;IAEvC,YAAY,KAA6C;QACvD,MAAM,EACJ,YAAY,EACZ,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,KAAK,CAAC;QAEV,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,IAAI,6BAA6B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CACV,GAAkC,EAClC,IAA+C;QAE/C,aAAa,CACX,GAAG,CAAC,KAAK,CAAC,cAAc,EACxB,0DAA0D,CAC3D,CAAC;QAEF,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAElE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CACvC,GAAG,CAAC,KAAK,CAAC,cAAwB,CACnC,CAAC;QACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,+BAA+B,CACvC,mCAAmC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,CAC9D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC;SAC7D,CAAC;IACJ,CAAC;CACF"}

package/dist/dist-hidden/service/acm/command/list-certificates/list-certificates-authorizer.d.ts

@@ -0,0 +1,31 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+interface ListCertificatesAuthorizerProps {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to an ACM ListCertificates request.
+ *
+ * AWS maps the ListCertificates API operation to the acm:ListCertificates IAM
+ * action. This is a list operation whose authorization resource is "*", rather
+ * than an individual Certificate ARN.
+ *
+ * Authorization applies to the complete operation. A denied caller receives
+ * AccessDenied rather than an empty or filtered certificate listing.
+ */
+export declare class ListCertificatesAuthorizer {
+    private static readonly action;
+    private static readonly resource;
+    private readonly iam;
+    constructor(props: ListCertificatesAuthorizerProps);
+    /**
+     * Ensure the caller may list the simulated Account and Region's certificates.
+     *
+     * The caller is passed through unchanged so sim IAM can distinguish an
+     * omitted caller, which defaults to Account root, from an explicit anonymous
+     * caller.
+     */
+    authorize(caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=list-certificates-authorizer.d.ts.map

package/dist/dist-hidden/service/acm/command/list-certificates/list-certificates-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-certificates-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACxD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAO;IAEvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,KAAK,EAAE,+BAA+B,EAEjD;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAcrC;CACF"}

package/dist/dist-hidden/service/acm/command/list-certificates/list-certificates-authorizer.js

@@ -0,0 +1,41 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies IAM authorization to an ACM ListCertificates request.
+ *
+ * AWS maps the ListCertificates API operation to the acm:ListCertificates IAM
+ * action. This is a list operation whose authorization resource is "*", rather
+ * than an individual Certificate ARN.
+ *
+ * Authorization applies to the complete operation. A denied caller receives
+ * AccessDenied rather than an empty or filtered certificate listing.
+ */
+export class ListCertificatesAuthorizer {
+    static action = "acm:ListCertificates";
+    static resource = "*";
+    iam;
+    constructor(props) {
+        this.iam = props.iam;
+    }
+    /**
+     * Ensure the caller may list the simulated Account and Region's certificates.
+     *
+     * The caller is passed through unchanged so sim IAM can distinguish an
+     * omitted caller, which defaults to Account root, from an explicit anonymous
+     * caller.
+     */
+    authorize(caller) {
+        const decision = this.iam.authorize({
+            action: ListCertificatesAuthorizer.action,
+            resource: ListCertificatesAuthorizer.resource,
+            caller,
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action: ListCertificatesAuthorizer.action,
+                resource: ListCertificatesAuthorizer.resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=list-certificates-authorizer.js.map

package/dist/dist-hidden/service/acm/command/list-certificates/list-certificates-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-certificates-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAMzE;;;;;;;;;GASG;AACH,MAAM,OAAO,0BAA0B;IAC7B,MAAM,CAAU,MAAM,GAAG,sBAAsB,CAAC;IAChD,MAAM,CAAU,QAAQ,GAAG,GAAG,CAAC;IAEtB,GAAG,CAA0B;IAE9C,YAAY,KAAsC;QAChD,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAqB;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,0BAA0B,CAAC,MAAM;YACzC,QAAQ,EAAE,0BAA0B,CAAC,QAAQ;YAC7C,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM,EAAE,0BAA0B,CAAC,MAAM;gBACzC,QAAQ,EAAE,0BAA0B,CAAC,QAAQ;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}