@kensio/yulin 0.32.0 → 0.34.0

package/dist/service/acm/command/list-certificates/list-certificates-authorizer.d.ts

@@ -0,0 +1,31 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+interface ListCertificatesAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to an ACM ListCertificates request.
+ *
+ * AWS maps the ListCertificates API operation to the acm:ListCertificates IAM
+ * action. This is a list operation whose authorization resource is "*", rather
+ * than an individual Certificate ARN.
+ *
+ * Authorization applies to the complete operation. A denied caller receives
+ * AccessDenied rather than an empty or filtered certificate listing.
+ */
+export declare class ListCertificatesAuthorizer {
+    private static readonly action;
+    private static readonly resource;
+    private readonly iam;
+    constructor(properties: ListCertificatesAuthorizerProperties);
+    /**
+     * Ensure the caller may list the simulated Account and Region's certificates.
+     *
+     * The caller is passed through unchanged so sim IAM can distinguish an
+     * omitted caller, which defaults to Account root, from an explicit anonymous
+     * caller.
+     */
+    authorize(caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=list-certificates-authorizer.d.ts.map

package/dist/service/acm/command/list-certificates/list-certificates-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-certificates-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACxD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAO;IAEvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAcrC;CACF"}

package/dist/service/acm/command/list-certificates/list-certificates-authorizer.js

@@ -0,0 +1,41 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies IAM authorization to an ACM ListCertificates request.
+ *
+ * AWS maps the ListCertificates API operation to the acm:ListCertificates IAM
+ * action. This is a list operation whose authorization resource is "*", rather
+ * than an individual Certificate ARN.
+ *
+ * Authorization applies to the complete operation. A denied caller receives
+ * AccessDenied rather than an empty or filtered certificate listing.
+ */
+export class ListCertificatesAuthorizer {
+    static action = "acm:ListCertificates";
+    static resource = "*";
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may list the simulated Account and Region's certificates.
+     *
+     * The caller is passed through unchanged so sim IAM can distinguish an
+     * omitted caller, which defaults to Account root, from an explicit anonymous
+     * caller.
+     */
+    authorize(caller) {
+        const decision = this.iam.authorize({
+            action: ListCertificatesAuthorizer.action,
+            resource: ListCertificatesAuthorizer.resource,
+            caller,
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action: ListCertificatesAuthorizer.action,
+                resource: ListCertificatesAuthorizer.resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=list-certificates-authorizer.js.map

package/dist/service/acm/command/list-certificates/list-certificates-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-certificates-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAMzE;;;;;;;;;GASG;AACH,MAAM,OAAO,0BAA0B;IAC7B,MAAM,CAAU,MAAM,GAAG,sBAAsB,CAAC;IAChD,MAAM,CAAU,QAAQ,GAAG,GAAG,CAAC;IAEtB,GAAG,CAA0B;IAE9C,YAAY,UAAgD;QAC1D,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAqB;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,EAAE,0BAA0B,CAAC,MAAM;YACzC,QAAQ,EAAE,0BAA0B,CAAC,QAAQ;YAC7C,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;gBACpC,MAAM,EAAE,0BAA0B,CAAC,MAAM;gBACzC,QAAQ,EAAE,0BAA0B,CAAC,QAAQ;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/acm/command/list-certificates/list-certificates-page-builder.d.ts

@@ -0,0 +1,82 @@
+import type { SimArn } from "../../../aws/arn.js";
+import type { SimAcmCertificate } from "../../certificate/sim-acm-certificate.js";
+import type { SimListCertificatesCommandInput, SimListCertificatesCommandOutput } from "./list-certificates.cmd.js";
+interface ListCertificatesPageBuilderProperties {
+    readonly certificates: ReadonlyMap<SimArn, SimAcmCertificate>;
+}
+type ListCertificatesPage = Omit<SimListCertificatesCommandOutput, "$metadata">;
+/**
+ * Builds one page of an ACM ListCertificates response.
+ *
+ * IAM authorization remains in the command handler because it determines
+ * whether certificate state may be read at all. This class handles the data
+ * operations that happen after authorization: request validation, status
+ * filtering, continuation-token interpretation, page selection, and conversion
+ * of certificates into SDK response summaries.
+ *
+ * Certificates retain the insertion order of the service's Map. Requesting a
+ * certificate inserts it into that Map, so this preserves creation order across
+ * filtered and paginated responses.
+ *
+ * Continuation tokens are numeric offsets into the filtered certificate
+ * collection. The offset format matches the previous handler behavior and
+ * allows the next request to resume immediately after the preceding page.
+ */
+export declare class ListCertificatesPageBuilder {
+    private readonly certificates;
+    constructor(properties: ListCertificatesPageBuilderProperties);
+    /**
+     * Build the response fields for one ListCertificates page.
+     *
+     * Response metadata belongs to the command handler and is omitted here. This
+     * keeps transport-level response concerns separate from certificate filtering
+     * and pagination.
+     *
+     * MaxItems and NextToken are validated before certificate state is traversed.
+     * After validation, the complete status-matched collection is produced so the
+     * next token can be based on the same collection used to select the page.
+     */
+    build(input: SimListCertificatesCommandInput): ListCertificatesPage;
+    /**
+     * Validate and normalize the requested page size.
+     *
+     * ACM defaults MaxItems to 100. Values outside the supported range, including
+     * fractions and non-finite numbers, are rejected rather than being passed to
+     * Array.prototype.slice and normalized by JavaScript.
+     */
+    private maxItems;
+    /**
+     * Convert a continuation token into its filtered-collection offset.
+     *
+     * Tokens must use the canonical non-negative integer representation emitted
+     * by this class. The string round-trip rejects forms such as decimals,
+     * whitespace, signs, exponential notation, and leading zeroes.
+     */
+    private startIndex;
+    /**
+     * Return certificates whose status is included by the request.
+     *
+     * Omitting CertificateStatuses includes every certificate. Filtering an array
+     * copied from the Map leaves service state unchanged and preserves insertion
+     * order among the matching certificates.
+     */
+    private matchingCertificates;
+    /**
+     * Return the next filtered-collection offset when another item remains.
+     *
+     * The next offset advances by MaxItems rather than by the current page length.
+     * This retains the established token representation. No token is returned for
+     * the final page or for a request whose starting offset is past the end.
+     */
+    private nextToken;
+    /**
+     * Convert internal certificate state into the fields returned by ACM.
+     *
+     * ACM returns at most 100 subject alternative name summaries. The additional
+     * names flag tells the caller whether the source certificate contains entries
+     * beyond that response limit.
+     */
+    private certificateSummary;
+}
+export {};
+//# sourceMappingURL=list-certificates-page-builder.d.ts.map

package/dist/service/acm/command/list-certificates/list-certificates-page-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-certificates-page-builder.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates-page-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAElF,OAAO,KAAK,EAEV,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,4BAA4B,CAAC;AAEpC,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC/D;AAED,KAAK,oBAAoB,GAAG,IAAI,CAAC,gCAAgC,EAAE,WAAW,CAAC,CAAC;AAKhF;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyC;IAEtE,YAAY,UAAU,EAAE,qCAAqC,EAE5D;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAK,EAAE,+BAA+B,GAAG,oBAAoB,CAkBlE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ;IAgBhB;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAoBlB;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAY5B;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;IAUjB;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;CAkB3B"}

package/dist/service/acm/command/list-certificates/list-certificates-page-builder.js

@@ -0,0 +1,128 @@
+import { SimAcmInvalidArgsException as SimAcmInvalidArgumentsException } from "../../error/sim-acm.error.js";
+const defaultMaxItems = 100;
+const maxMaxItems = 1000;
+/**
+ * Builds one page of an ACM ListCertificates response.
+ *
+ * IAM authorization remains in the command handler because it determines
+ * whether certificate state may be read at all. This class handles the data
+ * operations that happen after authorization: request validation, status
+ * filtering, continuation-token interpretation, page selection, and conversion
+ * of certificates into SDK response summaries.
+ *
+ * Certificates retain the insertion order of the service's Map. Requesting a
+ * certificate inserts it into that Map, so this preserves creation order across
+ * filtered and paginated responses.
+ *
+ * Continuation tokens are numeric offsets into the filtered certificate
+ * collection. The offset format matches the previous handler behavior and
+ * allows the next request to resume immediately after the preceding page.
+ */
+export class ListCertificatesPageBuilder {
+    certificates;
+    constructor(properties) {
+        this.certificates = properties.certificates;
+    }
+    /**
+     * Build the response fields for one ListCertificates page.
+     *
+     * Response metadata belongs to the command handler and is omitted here. This
+     * keeps transport-level response concerns separate from certificate filtering
+     * and pagination.
+     *
+     * MaxItems and NextToken are validated before certificate state is traversed.
+     * After validation, the complete status-matched collection is produced so the
+     * next token can be based on the same collection used to select the page.
+     */
+    build(input) {
+        const maxItems = this.maxItems(input.MaxItems);
+        const startIndex = this.startIndex(input.NextToken);
+        const matchingCertificates = this.matchingCertificates(input.CertificateStatuses);
+        const page = matchingCertificates.slice(startIndex, startIndex + maxItems);
+        return {
+            CertificateSummaryList: page.map((certificate) => this.certificateSummary(certificate)),
+            NextToken: this.nextToken(startIndex, maxItems, matchingCertificates.length),
+        };
+    }
+    /**
+     * Validate and normalize the requested page size.
+     *
+     * ACM defaults MaxItems to 100. Values outside the supported range, including
+     * fractions and non-finite numbers, are rejected rather than being passed to
+     * Array.prototype.slice and normalized by JavaScript.
+     */
+    maxItems(requestedMaxItems) {
+        const maxItems = requestedMaxItems ?? defaultMaxItems;
+        if (!Number.isSafeInteger(maxItems) ||
+            maxItems < 1 ||
+            maxItems > maxMaxItems) {
+            throw new SimAcmInvalidArgumentsException("ListCertificatesCommand.input.MaxItems must be an integer between 1 and 1000");
+        }
+        return maxItems;
+    }
+    /**
+     * Convert a continuation token into its filtered-collection offset.
+     *
+     * Tokens must use the canonical non-negative integer representation emitted
+     * by this class. The string round-trip rejects forms such as decimals,
+     * whitespace, signs, exponential notation, and leading zeroes.
+     */
+    startIndex(nextToken) {
+        if (nextToken === undefined) {
+            return 0;
+        }
+        const startIndex = Number(nextToken);
+        if (!Number.isSafeInteger(startIndex) ||
+            startIndex < 0 ||
+            String(startIndex) !== nextToken) {
+            throw new SimAcmInvalidArgumentsException("ListCertificatesCommand.input.NextToken is invalid");
+        }
+        return startIndex;
+    }
+    /**
+     * Return certificates whose status is included by the request.
+     *
+     * Omitting CertificateStatuses includes every certificate. Filtering an array
+     * copied from the Map leaves service state unchanged and preserves insertion
+     * order among the matching certificates.
+     */
+    matchingCertificates(statuses) {
+        const certificates = this.certificates.values().toArray();
+        return statuses === undefined
+            ? certificates
+            : certificates.filter((certificate) => statuses.includes(certificate.status));
+    }
+    /**
+     * Return the next filtered-collection offset when another item remains.
+     *
+     * The next offset advances by MaxItems rather than by the current page length.
+     * This retains the established token representation. No token is returned for
+     * the final page or for a request whose starting offset is past the end.
+     */
+    nextToken(startIndex, maxItems, matchingCertificateCount) {
+        const nextIndex = startIndex + maxItems;
+        return nextIndex < matchingCertificateCount ? String(nextIndex) : undefined;
+    }
+    /**
+     * Convert internal certificate state into the fields returned by ACM.
+     *
+     * ACM returns at most 100 subject alternative name summaries. The additional
+     * names flag tells the caller whether the source certificate contains entries
+     * beyond that response limit.
+     */
+    certificateSummary(certificate) {
+        return {
+            CertificateArn: certificate.certificateArn,
+            DomainName: certificate.domainName,
+            SubjectAlternativeNameSummaries: certificate.subjectAlternativeNames.slice(0, 100),
+            HasAdditionalSubjectAlternativeNames: certificate.subjectAlternativeNames.length > 100,
+            Status: certificate.status,
+            Type: "TEST_ISSUED",
+            KeyAlgorithm: "RSA-2048",
+            InUse: false,
+            CreatedAt: certificate.createdAt,
+            IssuedAt: certificate.issuedAt,
+        };
+    }
+}
+//# sourceMappingURL=list-certificates-page-builder.js.map

package/dist/service/acm/command/list-certificates/list-certificates-page-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-certificates-page-builder.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates-page-builder.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,IAAI,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AAa7G,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,2BAA2B;IACrB,YAAY,CAAyC;IAEtE,YAAY,UAAiD;QAC3D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,KAAsC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CACpD,KAAK,CAAC,mBAAmB,CAC1B,CAAC;QACF,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,QAAQ,CAAC,CAAC;QAE3E,OAAO;YACL,sBAAsB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAC/C,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CACrC;YACD,SAAS,EAAE,IAAI,CAAC,SAAS,CACvB,UAAU,EACV,QAAQ,EACR,oBAAoB,CAAC,MAAM,CAC5B;SACF,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,QAAQ,CAAC,iBAA0B;QACzC,MAAM,QAAQ,GAAG,iBAAiB,IAAI,eAAe,CAAC;QAEtD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;YAC/B,QAAQ,GAAG,CAAC;YACZ,QAAQ,GAAG,WAAW,EACtB,CAAC;YACD,MAAM,IAAI,+BAA+B,CACvC,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACK,UAAU,CAAC,SAAkB;QACnC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAErC,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YACjC,UAAU,GAAG,CAAC;YACd,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS,EAChC,CAAC;YACD,MAAM,IAAI,+BAA+B,CACvC,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAC1B,QAAgE;QAEhE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;QAE1D,OAAO,QAAQ,KAAK,SAAS;YAC3B,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAClC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CACtC,CAAC;IACR,CAAC;IAED;;;;;;OAMG;IACK,SAAS,CACf,UAAkB,EAClB,QAAgB,EAChB,wBAAgC;QAEhC,MAAM,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;QAExC,OAAO,SAAS,GAAG,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CACxB,WAA8B;QAE9B,OAAO;YACL,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,+BAA+B,EAC7B,WAAW,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACnD,oCAAoC,EAClC,WAAW,CAAC,uBAAuB,CAAC,MAAM,GAAG,GAAG;YAClD,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,IAAI,EAAE,aAAa;YACnB,YAAY,EAAE,UAAU;YACxB,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/acm/command/list-certificates/list-certificates.handler.d.ts

@@ -1,28 +1,42 @@
-import type { SimArn } from "../../../aws/arn.js";
 import { type BackgroundScheduler } from "../../../../util/background/background.js";
 import type { CommandHandler } from "../../../../command/command-handler.js";
+import type { SimArn } from "../../../aws/arn.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type { SimAcmCertificate } from "../../certificate/sim-acm-certificate.js";
 import type { SimListCertificatesCommand, SimListCertificatesCommandOutput } from "./list-certificates.cmd.js";
-interface ListCertificatesCommandHandlerProps {
+interface ListCertificatesCommandHandlerProperties {
     readonly certificates: Map<SimArn, SimAcmCertificate>;
+    readonly iam?: SimIamInterServiceAuthZ;
     readonly background?: BackgroundScheduler;
 }
+interface ListCertificatesCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
 /**
  * Simulated ACM ListCertificatesCommand handler.
  *
  * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/acm/command/ListCertificatesCommand/
  */
 export declare class ListCertificatesCommandHandler implements CommandHandler<SimListCertificatesCommand, SimListCertificatesCommandOutput> {
-    private readonly certificates;
+    private readonly authorizer;
+    private readonly pageBuilder;
     private readonly background;
-    constructor(props: ListCertificatesCommandHandlerProps);
+    constructor(properties: ListCertificatesCommandHandlerProperties);
     /**
-     * List simulated ACM certificates.
+     * Simulate listing ACM certificates.
+     *
+     * Background sequencing completes before authorization so command execution
+     * retains the ordering used by other simulated service handlers.
+     *
+     * Authorization occurs before the page builder reads certificate state. ACM
+     * treats ListCertificates as one operation and does not return a partial list
+     * based on individual Certificate ARN permissions.
+     *
+     * Once authorization succeeds, page construction is delegated so this handler
+     * remains responsible for request-level coordination and response metadata.
      */
-    handle(cmd: SimListCertificatesCommand): Promise<SimListCertificatesCommandOutput>;
-    private getMaxItems;
-    private getStartIndex;
-    private makeCertificateSummary;
+    handle(command: SimListCertificatesCommand, options?: ListCertificatesCommandHandlerOptions): Promise<SimListCertificatesCommandOutput>;
 }
 export {};
 //# sourceMappingURL=list-certificates.handler.d.ts.map

package/dist/service/acm/command/list-certificates/list-certificates.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-certificates.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAElF,OAAO,KAAK,EAEV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,4BAA4B,CAAC;AAEpC,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACtD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAKD;;;;GAIG;AACH,qBAAa,8BAA+B,YAAW,cAAc,CACnE,0BAA0B,EAC1B,gCAAgC,CACjC;IACC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,KAAK,EAAE,mCAAmC,EAKrD;IAED;;OAEG;IACG,MAAM,CACV,GAAG,EAAE,0BAA0B,GAC9B,OAAO,CAAC,gCAAgC,CAAC,CAwB3C;IAED,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,aAAa;IAoBrB,OAAO,CAAC,sBAAsB;CAkB/B"}
+{"version":3,"file":"list-certificates.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,wDAAwD,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAElF,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,4BAA4B,CAAC;AAGpC,UAAU,wCAAwC;IAChD,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACtD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,8BAA+B,YAAW,cAAc,CACnE,0BAA0B,EAC1B,gCAAgC,CACjC;IACC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8B;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,UAAU,EAAE,wCAAwC,EAU/D;IAED;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,OAAO,EAAE,0BAA0B,EACnC,OAAO,CAAC,EAAE,qCAAqC,GAC9C,OAAO,CAAC,gCAAgC,CAAC,CAU3C;CACF"}

package/dist/service/acm/command/list-certificates/list-certificates.handler.js

@@ -1,70 +1,42 @@
 import { BackgroundTasks, } from "../../../../util/background/background.js";
-import { SimAcmInvalidArgsException } from "../../error/sim-acm.error.js";
-const defaultMaxItems = 100;
-const maxMaxItems = 1000;
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { ListCertificatesAuthorizer } from "./list-certificates-authorizer.js";
+import { ListCertificatesPageBuilder } from "./list-certificates-page-builder.js";
 /**
  * Simulated ACM ListCertificatesCommand handler.
  *
  * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/acm/command/ListCertificatesCommand/
  */
 export class ListCertificatesCommandHandler {
-    certificates;
+    authorizer;
+    pageBuilder;
     background;
-    constructor(props) {
-        const { certificates, background = new BackgroundTasks() } = props;
-        this.certificates = certificates;
+    constructor(properties) {
+        const { certificates, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        this.authorizer = new ListCertificatesAuthorizer({ iam });
+        this.pageBuilder = new ListCertificatesPageBuilder({ certificates });
         this.background = background;
     }
     /**
-     * List simulated ACM certificates.
+     * Simulate listing ACM certificates.
+     *
+     * Background sequencing completes before authorization so command execution
+     * retains the ordering used by other simulated service handlers.
+     *
+     * Authorization occurs before the page builder reads certificate state. ACM
+     * treats ListCertificates as one operation and does not return a partial list
+     * based on individual Certificate ARN permissions.
+     *
+     * Once authorization succeeds, page construction is delegated so this handler
+     * remains responsible for request-level coordination and response metadata.
      */
-    async handle(cmd) {
+    async handle(command, options) {
         // Allow for potential non-deterministic sequencing of async events.
         await this.background.sequence();
-        const maxItems = this.getMaxItems(cmd);
-        const startIndex = this.getStartIndex(cmd);
-        const certificates = [...this.certificates.values()].filter((certificate) => cmd.input.CertificateStatuses === undefined
-            ? true
-            : cmd.input.CertificateStatuses.includes(certificate.status));
-        const page = certificates.slice(startIndex, startIndex + maxItems);
-        const nextIndex = startIndex + maxItems;
+        this.authorizer.authorize(options?.caller);
         return {
+            ...this.pageBuilder.build(command.input),
             $metadata: {},
-            CertificateSummaryList: page.map((certificate) => this.makeCertificateSummary(certificate)),
-            NextToken: nextIndex < certificates.length ? String(nextIndex) : undefined,
-        };
-    }
-    getMaxItems(cmd) {
-        const maxItems = cmd.input.MaxItems ?? defaultMaxItems;
-        if (!Number.isInteger(maxItems) || maxItems < 1 || maxItems > maxMaxItems) {
-            throw new SimAcmInvalidArgsException("ListCertificatesCommand.input.MaxItems must be an integer between 1 and 1000");
-        }
-        return maxItems;
-    }
-    getStartIndex(cmd) {
-        if (cmd.input.NextToken === undefined) {
-            return 0;
-        }
-        const startIndex = Number(cmd.input.NextToken);
-        if (!Number.isInteger(startIndex) ||
-            startIndex < 0 ||
-            String(startIndex) !== cmd.input.NextToken) {
-            throw new SimAcmInvalidArgsException("ListCertificatesCommand.input.NextToken is invalid");
-        }
-        return startIndex;
-    }
-    makeCertificateSummary(certificate) {
-        return {
-            CertificateArn: certificate.certificateArn,
-            DomainName: certificate.domainName,
-            SubjectAlternativeNameSummaries: certificate.subjectAlternativeNames.slice(0, 100),
-            HasAdditionalSubjectAlternativeNames: certificate.subjectAlternativeNames.length > 100,
-            Status: certificate.status,
-            Type: "TEST_ISSUED",
-            KeyAlgorithm: "RSA-2048",
-            InUse: false,
-            CreatedAt: certificate.createdAt,
-            IssuedAt: certificate.issuedAt,
         };
     }
 }

package/dist/service/acm/command/list-certificates/list-certificates.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-certificates.handler.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates.handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAY1E,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB;;;;GAIG;AACH,MAAM,OAAO,8BAA8B;IAIxB,YAAY,CAAiC;IAC7C,UAAU,CAAsB;IAEjD,YAAY,KAA0C;QACpD,MAAM,EAAE,YAAY,EAAE,UAAU,GAAG,IAAI,eAAe,EAAE,EAAE,GAAG,KAAK,CAAC;QAEnE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,GAA+B;QAE/B,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CACzD,CAAC,WAAW,EAAE,EAAE,CACd,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;YACzC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CACjE,CAAC;QAEF,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,QAAQ,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;QAExC,OAAO;YACL,SAAS,EAAE,EAAE;YACb,sBAAsB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAC/C,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CACzC;YACD,SAAS,EACP,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;SAClE,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,GAA+B;QACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,eAAe,CAAC;QAEvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,WAAW,EAAE,CAAC;YAC1E,MAAM,IAAI,0BAA0B,CAClC,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,aAAa,CAAC,GAA+B;QACnD,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAE/C,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;YAC7B,UAAU,GAAG,CAAC;YACd,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,SAAS,EAC1C,CAAC;YACD,MAAM,IAAI,0BAA0B,CAClC,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,sBAAsB,CAC5B,WAA8B;QAE9B,OAAO;YACL,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,+BAA+B,EAC7B,WAAW,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACnD,oCAAoC,EAClC,WAAW,CAAC,uBAAuB,CAAC,MAAM,GAAG,GAAG;YAClD,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,IAAI,EAAE,aAAa;YACnB,YAAY,EAAE,UAAU;YACxB,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"list-certificates.handler.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/list-certificates/list-certificates.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAInD,OAAO,EACL,kBAAkB,GAEnB,MAAM,wDAAwD,CAAC;AAEhE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAK/E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAYlF;;;;GAIG;AACH,MAAM,OAAO,8BAA8B;IAIxB,UAAU,CAA6B;IACvC,WAAW,CAA8B;IACzC,UAAU,CAAsB;IAEjD,YAAY,UAAoD;QAC9D,MAAM,EACJ,YAAY,EACZ,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,UAAU,GAAG,IAAI,0BAA0B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,GAAG,IAAI,2BAA2B,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,MAAM,CACV,OAAmC,EACnC,OAA+C;QAE/C,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE3C,OAAO;YACL,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACxC,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;CACF"}

package/dist/service/acm/command/request-certificate/request-cert-factory.d.ts

@@ -1,7 +1,7 @@
 import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
 import { SimAcmCertificate } from "../../certificate/sim-acm-certificate.js";
 import type { SimRequestCertificateCommand } from "./request-certificate.cmd.js";
-interface RequestCertificateFactoryProps {
+interface RequestCertificateFactoryProperties {
     readonly accountRegionScope: SimAwsAccountRegionScope;
 }
 /**
@@ -14,7 +14,7 @@ interface RequestCertificateFactoryProps {
  */
 export declare class RequestCertificateFactory {
     private readonly accountRegionScope;
-    constructor(props: RequestCertificateFactoryProps);
+    constructor(properties: RequestCertificateFactoryProperties);
     /**
      * Create the certificate entity that will be stored by the handler.
      *
@@ -23,7 +23,7 @@ export declare class RequestCertificateFactory {
      * class write access to the certificate store while still producing stable
      * ARNs that match the existing simulator behavior.
      */
-    makeCertificate(cmd: SimRequestCertificateCommand, certificateCount: number): SimAcmCertificate;
+    makeCertificate(command: SimRequestCertificateCommand, certificateCount: number): SimAcmCertificate;
     /**
      * Generate the next simulator ARN in the current account and Region.
      *

package/dist/service/acm/command/request-certificate/request-cert-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-cert-factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-cert-factory.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EACL,iBAAiB,EAKlB,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAGjF,UAAU,8BAA8B;IACtC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAE9D,YAAY,KAAK,EAAE,8BAA8B,EAEhD;IAED;;;;;;;OAOG;IACH,eAAe,CACb,GAAG,EAAE,4BAA4B,EACjC,gBAAgB,EAAE,MAAM,GACvB,iBAAiB,CA+BnB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAM1B;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAclC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;CAkB7B"}
+{"version":3,"file":"request-cert-factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-cert-factory.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EACL,iBAAiB,EAKlB,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAGjF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAE9D,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;;;;;;OAOG;IACH,eAAe,CACb,OAAO,EAAE,4BAA4B,EACrC,gBAAgB,EAAE,MAAM,GACvB,iBAAiB,CA+BnB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAM1B;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAclC;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;CAkB7B"}

package/dist/service/acm/command/request-certificate/request-cert-factory.js

@@ -11,8 +11,8 @@ import { assertDefined } from "../../../../util/type-guard/defined.js";
  */
 export class RequestCertificateFactory {
     accountRegionScope;
-    constructor(props) {
-        this.accountRegionScope = props.accountRegionScope;
+    constructor(properties) {
+        this.accountRegionScope = properties.accountRegionScope;
     }
     /**
      * Create the certificate entity that will be stored by the handler.
@@ -22,18 +22,18 @@ export class RequestCertificateFactory {
      * class write access to the certificate store while still producing stable
      * ARNs that match the existing simulator behavior.
      */
-    makeCertificate(cmd, certificateCount) {
+    makeCertificate(command, certificateCount) {
         const certificateArn = this.makeCertificateArn(certificateCount);
-        const validationMethod = cmd.input.ValidationMethod ?? "DNS";
+        const validationMethod = command.input.ValidationMethod ?? "DNS";
         const domainNames = [
-            cmd.input.DomainName,
-            ...(cmd.input.SubjectAlternativeNames ?? []),
+            command.input.DomainName,
+            ...(command.input.SubjectAlternativeNames ?? []),
         ];
-        assertDefined(cmd.input.DomainName, "SimRequestCertificateCommand.input.DomainName required");
+        assertDefined(command.input.DomainName, "SimRequestCertificateCommand.input.DomainName required");
         return new SimAcmCertificate({
             certificateArn,
-            domainName: cmd.input.DomainName,
-            subjectAlternativeNames: cmd.input.SubjectAlternativeNames ?? [],
+            domainName: command.input.DomainName,
+            subjectAlternativeNames: command.input.SubjectAlternativeNames ?? [],
             status: "PENDING_VALIDATION",
             validationMethod,
             domainValidationOptions: domainNames.map((domainName) => {
@@ -41,7 +41,7 @@ export class RequestCertificateFactory {
                 return this.makeDomainValidationOption(domainName, validationMethod);
             }),
             createdAt: new Date(),
-            tags: cmd.input.Tags?.map((tag) => ({
+            tags: command.input.Tags?.map((tag) => ({
                 Key: tag.Key,
                 Value: tag.Value,
             })),

package/dist/service/acm/command/request-certificate/request-cert-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-cert-factory.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-cert-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,iBAAiB,GAKlB,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAMvE;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,kBAAkB,CAA2B;IAE9D,YAAY,KAAqC;QAC/C,IAAI,CAAC,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,CAAC;IACrD,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CACb,GAAiC,EACjC,gBAAwB;QAExB,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACjE,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC;QAC7D,MAAM,WAAW,GAAG;YAClB,GAAG,CAAC,KAAK,CAAC,UAAU;YACpB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC;SAC7C,CAAC;QACF,aAAa,CACX,GAAG,CAAC,KAAK,CAAC,UAAU,EACpB,wDAAwD,CACzD,CAAC;QAEF,OAAO,IAAI,iBAAiB,CAAC;YAC3B,cAAc;YACd,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU;YAChC,uBAAuB,EAAE,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE;YAChE,MAAM,EAAE,oBAAoB;YAC5B,gBAAgB;YAChB,uBAAuB,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;gBACtD,aAAa,CACX,UAAU,EACV,kFAAkF,CACnF,CAAC;gBACF,OAAO,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;YACvE,CAAC,CAAC;YACF,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,EAAa,EAAE,CAAC,CAAC;gBAC7C,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,KAAK,EAAE,GAAG,CAAC,KAAK;aACjB,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CAAC,gBAAwB;QACjD,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAEpE,OAAO,eAAe,IAAI,CAAC,kBAAkB,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,gBAAgB,aAAa,EAAE,CAAC;IAC/H,CAAC;IAED;;;;;;OAMG;IACK,0BAA0B,CAChC,UAAkB,EAClB,gBAAwC;QAExC,OAAO;YACL,UAAU;YACV,gBAAgB;YAChB,cAAc,EACZ,gBAAgB,KAAK,KAAK;gBACxB,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC;gBACvC,CAAC,CAAC,SAAS;SAChB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,oBAAoB,CAAC,UAAkB;QAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC9B,MAAM,CACL;YACE,IAAI,CAAC,kBAAkB,CAAC,SAAS;YACjC,IAAI,CAAC,kBAAkB,CAAC,UAAU;YAClC,UAAU;SACX,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ;aACA,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhB,OAAO;YACL,IAAI,EAAE,cAAc,IAAI,IAAI,UAAU,GAAG;YACzC,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,cAAc,IAAI,uBAAuB;SACjD,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"request-cert-factory.js","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-cert-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,iBAAiB,GAKlB,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAMvE;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,kBAAkB,CAA2B;IAE9D,YAAY,UAA+C;QACzD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC1D,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CACb,OAAqC,EACrC,gBAAwB;QAExB,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACjE,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC;QACjE,MAAM,WAAW,GAAG;YAClB,OAAO,CAAC,KAAK,CAAC,UAAU;YACxB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC;SACjD,CAAC;QACF,aAAa,CACX,OAAO,CAAC,KAAK,CAAC,UAAU,EACxB,wDAAwD,CACzD,CAAC;QAEF,OAAO,IAAI,iBAAiB,CAAC;YAC3B,cAAc;YACd,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU;YACpC,uBAAuB,EAAE,OAAO,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE;YACpE,MAAM,EAAE,oBAAoB;YAC5B,gBAAgB;YAChB,uBAAuB,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;gBACtD,aAAa,CACX,UAAU,EACV,kFAAkF,CACnF,CAAC;gBACF,OAAO,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;YACvE,CAAC,CAAC;YACF,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,EAAa,EAAE,CAAC,CAAC;gBACjD,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,KAAK,EAAE,GAAG,CAAC,KAAK;aACjB,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CAAC,gBAAwB;QACjD,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAEpE,OAAO,eAAe,IAAI,CAAC,kBAAkB,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,CAAC,SAAS,gBAAgB,aAAa,EAAE,CAAC;IAC/H,CAAC;IAED;;;;;;OAMG;IACK,0BAA0B,CAChC,UAAkB,EAClB,gBAAwC;QAExC,OAAO;YACL,UAAU;YACV,gBAAgB;YAChB,cAAc,EACZ,gBAAgB,KAAK,KAAK;gBACxB,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC;gBACvC,CAAC,CAAC,SAAS;SAChB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,oBAAoB,CAAC,UAAkB;QAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC9B,MAAM,CACL;YACE,IAAI,CAAC,kBAAkB,CAAC,SAAS;YACjC,IAAI,CAAC,kBAAkB,CAAC,UAAU;YAClC,UAAU;SACX,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ;aACA,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhB,OAAO;YACL,IAAI,EAAE,cAAc,IAAI,IAAI,UAAU,GAAG;YACzC,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,cAAc,IAAI,uBAAuB;SACjD,CAAC;IACJ,CAAC;CACF"}

package/dist/service/acm/command/request-certificate/request-certificate-authorizer.d.ts

@@ -0,0 +1,28 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+interface RequestCertificateAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly resource: string;
+}
+/**
+ * Applies IAM authorization to an ACM RequestCertificate request.
+ *
+ * ACM authorizes this operation against the wildcard certificate resource for
+ * the current Account and Region because the certificate does not exist until
+ * the request succeeds.
+ */
+export declare class RequestCertificateAuthorizer {
+    private static readonly action;
+    private readonly iam;
+    private readonly resource;
+    constructor(properties: RequestCertificateAuthorizerProperties);
+    /**
+     * Ensure the caller may request a certificate in this Account and Region.
+     *
+     * The caller is passed through unchanged so IAM can distinguish an omitted
+     * caller, which defaults to Account root, from an explicit anonymous caller.
+     */
+    authorize(caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=request-certificate-authorizer.d.ts.map

package/dist/service/acm/command/request-certificate/request-certificate-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-certificate-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/acm/command/request-certificate/request-certificate-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAA4B;IAE1D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC,YAAY,UAAU,EAAE,sCAAsC,EAG7D;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAcrC;CACF"}

package/dist/service/acm/command/request-certificate/request-certificate-authorizer.js

@@ -0,0 +1,38 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+/**
+ * Applies IAM authorization to an ACM RequestCertificate request.
+ *
+ * ACM authorizes this operation against the wildcard certificate resource for
+ * the current Account and Region because the certificate does not exist until
+ * the request succeeds.
+ */
+export class RequestCertificateAuthorizer {
+    static action = "acm:RequestCertificate";
+    iam;
+    resource;
+    constructor(properties) {
+        this.iam = properties.iam;
+        this.resource = properties.resource;
+    }
+    /**
+     * Ensure the caller may request a certificate in this Account and Region.
+     *
+     * The caller is passed through unchanged so IAM can distinguish an omitted
+     * caller, which defaults to Account root, from an explicit anonymous caller.
+     */
+    authorize(caller) {
+        const decision = this.iam.authorize({
+            action: RequestCertificateAuthorizer.action,
+            resource: this.resource,
+            caller,
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                action: RequestCertificateAuthorizer.action,
+                resource: this.resource,
+            });
+        }
+    }
+}
+//# sourceMappingURL=request-certificate-authorizer.js.map