@kensio/yulin 0.34.0 → 0.35.0

package/dist/service/acm/sim-acm.js

@@ -6,6 +6,8 @@ import { SimAcmCfnResourceFactory } from "./cfn/sim-cfn-acm-resource-factory.js"
 import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
 import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimAcmSdkCommandRouter } from "./sdk/sim-acm-sdk-command-router.js";
+import { SimAcmCertificateValidation } from "./validation/sim-acm-certificate-validation.js";
+import { SimAcmDnsValidationCompleter } from "./validation/sim-acm-dns-validation-completer.js";
 /**
  * Simulated ACM. Handles SDK commands. Emulates AWS behaviour and state.
  */
@@ -14,15 +16,62 @@ export class SimAcm {
     accountRegionScope;
     iam;
     background;
+    validation;
+    dnsValidationCompleter;
     cfnFactory = new SimAcmCfnResourceFactory({
         acm: this,
     });
     sdkRouter = new SimAcmSdkCommandRouter(this);
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), dnsRecords, } = properties;
         this.accountRegionScope = accountRegionScope;
         this.iam = iam;
         this.background = background;
+        this.validation = new SimAcmCertificateValidation({
+            background,
+            dnsRecords,
+        });
+        this.dnsValidationCompleter = new SimAcmDnsValidationCompleter({
+            certificates: this.certificates,
+            validation: this.validation,
+            dnsRecords,
+        });
+    }
+    /**
+     * Always require a DNS validation record before issuing a Certificate, even
+     * where no sim Route53 Hosted Zone covers the domain name.
+     */
+    requireDnsValidation() {
+        this.validation.alwaysRequireDnsValidation();
+        return this;
+    }
+    /**
+     * Never require a DNS validation record: issue every Certificate as soon as
+     * it is requested, whatever sim Route53 holds.
+     */
+    autoIssueCertificates() {
+        this.validation.neverRequireDnsValidation();
+        return this;
+    }
+    /**
+     * Create the DNS validation records a pending sim Certificate is waiting on.
+     *
+     * This is a simulator convenience for tests that want a realistic issuance
+     * flow without publishing each validation CNAME by hand. The Certificate is
+     * issued by the time this resolves.
+     */
+    async completeDnsValidation(certificateArn) {
+        await this.dnsValidationCompleter.complete(certificateArn);
+    }
+    /**
+     * Re-check a sim Certificate against DNS now, issuing it if it is validated.
+     *
+     * This publishes nothing. It is for callers that have already created the
+     * validation records themselves, such as CloudFormation.
+     * @internal
+     */
+    async settleCertificateValidation(certificate) {
+        await this.validation.settle(certificate);
     }
     /**
      * Handle a Describe Certificate Command from the SDK.
@@ -55,6 +104,7 @@ export class SimAcm {
             certificates: this.certificates,
             iam: this.iam,
             background: this.background,
+            validation: this.validation,
         });
         return await handler.handle(command, options);
     }

package/dist/service/acm/sim-acm.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-acm.js","sourceRoot":"","sources":["../../../src/service/acm/sim-acm.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAO7C,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAMhH,OAAO,EAAE,iCAAiC,EAAE,MAAM,gEAAgE,CAAC;AAKnH,OAAO,EAAE,8BAA8B,EAAE,MAAM,0DAA0D,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AAEjG,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAa7E;;GAEG;AACH,MAAM,OAAO,MAAM;IACD,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEnD,kBAAkB,CAA2B;IAC7C,GAAG,CAA0B;IAC7B,UAAU,CAAsB;IAChC,UAAU,GAAG,IAAI,wBAAwB,CAAC;QACzD,GAAG,EAAE,IAAI;KACV,CAAC,CAAC;IACc,SAAS,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE9D,YAAY,UAAU,GAAqB,EAAE;QAC3C,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAsC,EACtC,OAA8B;QAE9B,MAAM,OAAO,GAAG,IAAI,iCAAiC,CAAC;YACpD,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAmC,EACnC,OAA8B;QAE9B,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAAC;YACjD,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,OAAqC,EACrC,OAA8B;QAE9B,MAAM,OAAO,GAAG,IAAI,gCAAgC,CAAC;YACnD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"sim-acm.js","sourceRoot":"","sources":["../../../src/service/acm/sim-acm.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAO7C,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAMhH,OAAO,EAAE,iCAAiC,EAAE,MAAM,gEAAgE,CAAC;AAKnH,OAAO,EAAE,8BAA8B,EAAE,MAAM,0DAA0D,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AAEjG,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,kDAAkD,CAAC;AAchG;;GAEG;AACH,MAAM,OAAO,MAAM;IACD,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEnD,kBAAkB,CAA2B;IAC7C,GAAG,CAA0B;IAC7B,UAAU,CAAsB;IAChC,UAAU,CAA8B;IACxC,sBAAsB,CAA+B;IACrD,UAAU,GAAG,IAAI,wBAAwB,CAAC;QACzD,GAAG,EAAE,IAAI;KACV,CAAC,CAAC;IACc,SAAS,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE9D,YAAY,UAAU,GAAqB,EAAE;QAC3C,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,UAAU,GACX,GAAG,UAAU,CAAC;QAEf,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,IAAI,2BAA2B,CAAC;YAChD,UAAU;YACV,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,sBAAsB,GAAG,IAAI,4BAA4B,CAAC;YAC7D,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,oBAAoB;QAClB,IAAI,CAAC,UAAU,CAAC,0BAA0B,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,qBAAqB;QACnB,IAAI,CAAC,UAAU,CAAC,yBAAyB,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB,CACzB,cAAkC;QAElC,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,2BAA2B,CAC/B,WAA8B;QAE9B,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAsC,EACtC,OAA8B;QAE9B,MAAM,OAAO,GAAG,IAAI,iCAAiC,CAAC;YACpD,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAmC,EACnC,OAA8B;QAE9B,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAAC;YACjD,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,OAAqC,EACrC,OAA8B;QAE9B,MAAM,OAAO,GAAG,IAAI,gCAAgC,CAAC;YACnD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF"}

package/dist/service/acm/validation/sim-acm-certificate-validation.d.ts

@@ -0,0 +1,66 @@
+import type { BackgroundScheduler } from "../../../util/background/background.js";
+import type { SimAcmCertificate } from "../certificate/sim-acm-certificate.js";
+import type { SimAcmDnsRecords } from "./sim-acm-dns-records.js";
+interface SimAcmCertificateValidationProperties {
+    readonly background: BackgroundScheduler;
+    readonly dnsRecords?: SimAcmDnsRecords | undefined;
+}
+/**
+ * Drives sim ACM Certificate issuance through domain validation.
+ *
+ * A requested Certificate is evaluated once as background work, and then again
+ * whenever DNS records change, until every domain name on it is validated. The
+ * re-evaluation is driven by DNS record changes rather than by polling, so
+ * draining simulator background tasks always terminates: a Certificate whose
+ * validation record never appears simply stays pending.
+ */
+export declare class SimAcmCertificateValidation {
+    private readonly background;
+    private readonly dnsRecords;
+    private readonly pendingCertificates;
+    private mode;
+    private listeningForRecordChanges;
+    constructor(properties: SimAcmCertificateValidationProperties);
+    /**
+     * Always require a DNS validation record before issuing a Certificate.
+     *
+     * With no sim Route53 to validate against there is no way to satisfy this,
+     * so it is rejected rather than silently issuing certificates anyway.
+     */
+    alwaysRequireDnsValidation(): void;
+    /**
+     * Never require a DNS validation record before issuing a Certificate.
+     */
+    neverRequireDnsValidation(): void;
+    /**
+     * Begin validating a newly requested Certificate.
+     */
+    begin(certificate: SimAcmCertificate): void;
+    /**
+     * Validate whatever can be validated now, issuing the Certificate once every
+     * domain name on it has succeeded.
+     */
+    settle(certificate: SimAcmCertificate): Promise<void>;
+    /**
+     * Validate one domain name, if it is waiting and its record now exists.
+     */
+    private validateDomain;
+    /**
+     * The DNS record a domain name must publish before it can be validated.
+     *
+     * Undefined means this domain name does not need to prove anything through
+     * DNS: it is not using DNS validation, or nothing in the simulation is
+     * authoritative for it.
+     */
+    private requiredDnsRecord;
+    /**
+     * Subscribe to DNS record changes the first time a Certificate needs them.
+     */
+    private listenForRecordChanges;
+    /**
+     * Schedule another look at every Certificate still waiting to be issued.
+     */
+    private revalidatePendingCertificates;
+}
+export {};
+//# sourceMappingURL=sim-acm-certificate-validation.d.ts.map

package/dist/service/acm/validation/sim-acm-certificate-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-certificate-validation.d.ts","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-certificate-validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAK/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgC;IACpE,OAAO,CAAC,IAAI,CAAkC;IAC9C,OAAO,CAAC,yBAAyB,CAAS;IAE1C,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;;;;OAKG;IACH,0BAA0B,IAAI,IAAI,CASjC;IAED;;OAEG;IACH,yBAAyB,IAAI,IAAI,CAEhC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAI1C;IAED;;;OAGG;IACG,MAAM,CAAC,WAAW,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAW1D;IAED;;OAEG;IACH,OAAO,CAAC,cAAc;IAsBtB;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAwBzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAa9B;;OAEG;IACH,OAAO,CAAC,6BAA6B;CAKtC"}

package/dist/service/acm/validation/sim-acm-certificate-validation.js

@@ -0,0 +1,124 @@
+import { SimAcmDnsValidationMode } from "./sim-acm-dns-validation-mode.js";
+/**
+ * Drives sim ACM Certificate issuance through domain validation.
+ *
+ * A requested Certificate is evaluated once as background work, and then again
+ * whenever DNS records change, until every domain name on it is validated. The
+ * re-evaluation is driven by DNS record changes rather than by polling, so
+ * draining simulator background tasks always terminates: a Certificate whose
+ * validation record never appears simply stays pending.
+ */
+export class SimAcmCertificateValidation {
+    background;
+    dnsRecords;
+    pendingCertificates = new Set();
+    mode = SimAcmDnsValidationMode.auto();
+    listeningForRecordChanges = false;
+    constructor(properties) {
+        this.background = properties.background;
+        this.dnsRecords = properties.dnsRecords;
+    }
+    /**
+     * Always require a DNS validation record before issuing a Certificate.
+     *
+     * With no sim Route53 to validate against there is no way to satisfy this,
+     * so it is rejected rather than silently issuing certificates anyway.
+     */
+    alwaysRequireDnsValidation() {
+        if (this.dnsRecords === undefined) {
+            throw new Error("Sim ACM cannot require DNS validation with no sim Route53 to validate against. " +
+                "Use SimAws, so ACM can see Hosted Zones, rather than a standalone SimAcm.");
+        }
+        this.mode = SimAcmDnsValidationMode.always();
+    }
+    /**
+     * Never require a DNS validation record before issuing a Certificate.
+     */
+    neverRequireDnsValidation() {
+        this.mode = SimAcmDnsValidationMode.never();
+    }
+    /**
+     * Begin validating a newly requested Certificate.
+     */
+    begin(certificate) {
+        this.pendingCertificates.add(certificate);
+        this.listenForRecordChanges();
+        this.background.schedule(() => this.settle(certificate));
+    }
+    /**
+     * Validate whatever can be validated now, issuing the Certificate once every
+     * domain name on it has succeeded.
+     */
+    async settle(certificate) {
+        for (const domainValidation of certificate.domainValidationOptions) {
+            this.validateDomain(domainValidation);
+        }
+        if (!certificate.isValidated) {
+            return;
+        }
+        await certificate.issue();
+        this.pendingCertificates.delete(certificate);
+    }
+    /**
+     * Validate one domain name, if it is waiting and its record now exists.
+     */
+    validateDomain(domainValidation) {
+        if (!domainValidation.isPending) {
+            return;
+        }
+        const dnsRecords = this.dnsRecords;
+        if (dnsRecords === undefined) {
+            domainValidation.succeed();
+            return;
+        }
+        const requiredRecord = this.requiredDnsRecord(domainValidation, dnsRecords);
+        if (requiredRecord === undefined) {
+            domainValidation.succeed();
+            return;
+        }
+        if (dnsRecords.hasCname(requiredRecord.name, requiredRecord.value)) {
+            domainValidation.succeed();
+        }
+    }
+    /**
+     * The DNS record a domain name must publish before it can be validated.
+     *
+     * Undefined means this domain name does not need to prove anything through
+     * DNS: it is not using DNS validation, or nothing in the simulation is
+     * authoritative for it.
+     */
+    requiredDnsRecord(domainValidation, dnsRecords) {
+        const resourceRecord = domainValidation.resourceRecord;
+        if (resourceRecord === undefined ||
+            domainValidation.validationMethod !== "DNS") {
+            return undefined;
+        }
+        const requiresValidation = this.mode.requiresValidation(dnsRecords.hasAuthorityFor(domainValidation.domainName));
+        if (!requiresValidation) {
+            return undefined;
+        }
+        return resourceRecord;
+    }
+    /**
+     * Subscribe to DNS record changes the first time a Certificate needs them.
+     */
+    listenForRecordChanges() {
+        const dnsRecords = this.dnsRecords;
+        if (this.listeningForRecordChanges || dnsRecords === undefined) {
+            return;
+        }
+        this.listeningForRecordChanges = true;
+        dnsRecords.onRecordChange(() => {
+            this.revalidatePendingCertificates();
+        });
+    }
+    /**
+     * Schedule another look at every Certificate still waiting to be issued.
+     */
+    revalidatePendingCertificates() {
+        for (const certificate of this.pendingCertificates) {
+            this.background.schedule(() => this.settle(certificate));
+        }
+    }
+}
+//# sourceMappingURL=sim-acm-certificate-validation.js.map

package/dist/service/acm/validation/sim-acm-certificate-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-certificate-validation.js","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-certificate-validation.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAO3E;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,UAAU,CAAsB;IAChC,UAAU,CAA+B;IACzC,mBAAmB,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5D,IAAI,GAAG,uBAAuB,CAAC,IAAI,EAAE,CAAC;IACtC,yBAAyB,GAAG,KAAK,CAAC;IAE1C,YAAY,UAAiD;QAC3D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,0BAA0B;QACxB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,iFAAiF;gBAC/E,2EAA2E,CAC9E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC,MAAM,EAAE,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,yBAAyB;QACvB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAA8B;QAClC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,KAAK,MAAM,gBAAgB,IAAI,WAAW,CAAC,uBAAuB,EAAE,CAAC;YACnE,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,gBAAwC;QAC7D,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAC5E,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CACvB,gBAAwC,EACxC,UAA4B;QAE5B,MAAM,cAAc,GAAG,gBAAgB,CAAC,cAAc,CAAC;QAEvD,IACE,cAAc,KAAK,SAAS;YAC5B,gBAAgB,CAAC,gBAAgB,KAAK,KAAK,EAC3C,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CACrD,UAAU,CAAC,eAAe,CAAC,gBAAgB,CAAC,UAAU,CAAC,CACxD,CAAC;QAEF,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAED;;OAEG;IACK,sBAAsB;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAEnC,IAAI,IAAI,CAAC,yBAAyB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC;QACtC,UAAU,CAAC,cAAc,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,6BAA6B;QACnC,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACnD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF"}

package/dist/service/acm/validation/sim-acm-dns-records.d.ts

@@ -0,0 +1,36 @@
+export type SimAcmDnsRecordChangeListener = () => void;
+/**
+ * DNS records visible to simulated ACM when validating domain ownership.
+ *
+ * Real ACM proves domain ownership by looking for a CNAME in public DNS. This
+ * port is how sim ACM does the same against sim Route53 without depending on
+ * Route53's own types or name normalisation rules. A standalone SimAcm has no
+ * implementation of this at all, which is what makes it issue certificates
+ * without validating them.
+ */
+export interface SimAcmDnsRecords {
+    /**
+     * Whether the simulation holds DNS authority for a domain name.
+     *
+     * This is the signal sim ACM uses to decide whether a certificate should
+     * wait for validation: with no Hosted Zone covering the domain name there is
+     * nothing in the simulation that could answer for it.
+     */
+    hasAuthorityFor(domainName: string): boolean;
+    /**
+     * Whether a CNAME record with this name and value exists.
+     */
+    hasCname(name: string, value: string): boolean;
+    /**
+     * Create a CNAME record in the Hosted Zone covering its name.
+     *
+     * Returns false when no Hosted Zone covers the name, so the caller can
+     * report which records it could not create.
+     */
+    createCname(name: string, value: string): boolean;
+    /**
+     * Register a listener called whenever any DNS record changes.
+     */
+    onRecordChange(listener: SimAcmDnsRecordChangeListener): void;
+}
+//# sourceMappingURL=sim-acm-dns-records.d.ts.map

package/dist/service/acm/validation/sim-acm-dns-records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-records.d.ts","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-records.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,6BAA6B,GAAG,MAAM,IAAI,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAE7C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAE/C;;;;;OAKG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAElD;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,6BAA6B,GAAG,IAAI,CAAC;CAC/D"}

package/dist/service/acm/validation/sim-acm-dns-records.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-acm-dns-records.js.map

package/dist/service/acm/validation/sim-acm-dns-records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-records.js","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-records.ts"],"names":[],"mappings":""}

package/dist/service/acm/validation/sim-acm-dns-validation-completer.d.ts

@@ -0,0 +1,37 @@
+import type { SimArn } from "../../aws/arn.js";
+import type { SimAcmCertificate } from "../certificate/sim-acm-certificate.js";
+import type { SimAcmCertificateValidation } from "./sim-acm-certificate-validation.js";
+import type { SimAcmDnsRecords } from "./sim-acm-dns-records.js";
+interface SimAcmDnsValidationCompleterProperties {
+    readonly certificates: ReadonlyMap<SimArn, SimAcmCertificate>;
+    readonly validation: SimAcmCertificateValidation;
+    readonly dnsRecords?: SimAcmDnsRecords | undefined;
+}
+/**
+ * Creates the DNS validation records a pending sim Certificate is waiting for.
+ *
+ * This is the shortcut for users who want realistic DNS routing but not the
+ * certificate ceremony: it writes each validation CNAME into the Hosted Zone
+ * covering it, then settles the Certificate, so the Certificate is issued by
+ * the time the call returns.
+ */
+export declare class SimAcmDnsValidationCompleter {
+    private readonly certificates;
+    private readonly validation;
+    private readonly dnsRecords;
+    constructor(properties: SimAcmDnsValidationCompleterProperties);
+    /**
+     * Publish the validation records for a Certificate and wait for issuance.
+     */
+    complete(certificateArn: string | undefined): Promise<void>;
+    /**
+     * Resolve the Certificate this ARN refers to.
+     */
+    private findCertificate;
+    /**
+     * Create each validation record, reporting the names that had nowhere to go.
+     */
+    private createValidationRecords;
+}
+export {};
+//# sourceMappingURL=sim-acm-dns-validation-completer.d.ts.map

package/dist/service/acm/validation/sim-acm-dns-validation-completer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-validation-completer.d.ts","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-validation-completer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAM/E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC9D,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyC;IACtE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAE1D,YAAY,UAAU,EAAE,sCAAsC,EAI7D;IAED;;OAEG;IACG,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAchE;IAED;;OAEG;IACH,OAAO,CAAC,eAAe;IAoBvB;;OAEG;IACH,OAAO,CAAC,uBAAuB;CAyBhC"}

package/dist/service/acm/validation/sim-acm-dns-validation-completer.js

@@ -0,0 +1,66 @@
+import { SimAcmDnsValidationFailed, SimAcmInvalidArgumentsException, SimAcmResourceNotFoundException, } from "../error/sim-acm.error.js";
+/**
+ * Creates the DNS validation records a pending sim Certificate is waiting for.
+ *
+ * This is the shortcut for users who want realistic DNS routing but not the
+ * certificate ceremony: it writes each validation CNAME into the Hosted Zone
+ * covering it, then settles the Certificate, so the Certificate is issued by
+ * the time the call returns.
+ */
+export class SimAcmDnsValidationCompleter {
+    certificates;
+    validation;
+    dnsRecords;
+    constructor(properties) {
+        this.certificates = properties.certificates;
+        this.validation = properties.validation;
+        this.dnsRecords = properties.dnsRecords;
+    }
+    /**
+     * Publish the validation records for a Certificate and wait for issuance.
+     */
+    async complete(certificateArn) {
+        const certificate = this.findCertificate(certificateArn);
+        const uncreatedRecordNames = this.createValidationRecords(certificate);
+        await this.validation.settle(certificate);
+        if (certificate.status === "ISSUED") {
+            return;
+        }
+        throw new SimAcmDnsValidationFailed(`Cannot complete DNS validation of sim ACM Certificate ${certificate.certificateArn}: ` +
+            `no sim Route53 Hosted Zone covers ${uncreatedRecordNames.join(", ")}`);
+    }
+    /**
+     * Resolve the Certificate this ARN refers to.
+     */
+    findCertificate(certificateArn) {
+        if (certificateArn === undefined) {
+            throw new SimAcmInvalidArgumentsException("SimAcm.completeDnsValidation requires a CertificateArn");
+        }
+        const certificate = this.certificates.get(certificateArn);
+        if (certificate === undefined) {
+            throw new SimAcmResourceNotFoundException(`No sim ACM Certificate found with ARN ${certificateArn}`);
+        }
+        return certificate;
+    }
+    /**
+     * Create each validation record, reporting the names that had nowhere to go.
+     */
+    createValidationRecords(certificate) {
+        const dnsRecords = this.dnsRecords;
+        if (dnsRecords === undefined) {
+            return [];
+        }
+        const uncreatedRecordNames = [];
+        for (const domainValidation of certificate.domainValidationOptions) {
+            const resourceRecord = domainValidation.resourceRecord;
+            if (resourceRecord === undefined) {
+                continue;
+            }
+            if (!dnsRecords.createCname(resourceRecord.name, resourceRecord.value)) {
+                uncreatedRecordNames.push(resourceRecord.name);
+            }
+        }
+        return uncreatedRecordNames;
+    }
+}
+//# sourceMappingURL=sim-acm-dns-validation-completer.js.map

package/dist/service/acm/validation/sim-acm-dns-validation-completer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-validation-completer.js","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-validation-completer.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AAUnC;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA4B;IACtB,YAAY,CAAyC;IACrD,UAAU,CAA8B;IACxC,UAAU,CAA+B;IAE1D,YAAY,UAAkD;QAC5D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,cAAkC;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,oBAAoB,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAEvE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAE1C,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,yDAAyD,WAAW,CAAC,cAAc,IAAI;YACrF,qCAAqC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,cAAkC;QAElC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,+BAA+B,CACvC,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAwB,CAAC,CAAC;QAEpE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,+BAA+B,CACvC,yCAAyC,cAAc,EAAE,CAC1D,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC7B,WAA8B;QAE9B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAEnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,oBAAoB,GAAa,EAAE,CAAC;QAE1C,KAAK,MAAM,gBAAgB,IAAI,WAAW,CAAC,uBAAuB,EAAE,CAAC;YACnE,MAAM,cAAc,GAAG,gBAAgB,CAAC,cAAc,CAAC;YAEvD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,SAAS;YACX,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvE,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,oBAAoB,CAAC;IAC9B,CAAC;CACF"}

package/dist/service/acm/validation/sim-acm-dns-validation-mode.d.ts

@@ -0,0 +1,30 @@
+/**
+ * When sim ACM requires a DNS validation record before issuing a Certificate.
+ *
+ * The default is `auto`, which requires validation only for domain names the
+ * simulation actually holds DNS authority for. That keeps sim ACM realistic
+ * for users who are simulating Route53, without obstructing users whose DNS
+ * lives outside the simulation entirely.
+ */
+export declare class SimAcmDnsValidationMode {
+    private readonly name;
+    private constructor();
+    /**
+     * Require validation only where a Hosted Zone covers the domain name.
+     */
+    static auto(): SimAcmDnsValidationMode;
+    /**
+     * Always require validation, whether or not a Hosted Zone covers the domain.
+     */
+    static always(): SimAcmDnsValidationMode;
+    /**
+     * Never require validation.
+     */
+    static never(): SimAcmDnsValidationMode;
+    /**
+     * Whether a domain name needs its DNS validation record before the
+     * Certificate can be issued.
+     */
+    requiresValidation(hasDnsAuthority: boolean): boolean;
+}
+//# sourceMappingURL=sim-acm-dns-validation-mode.d.ts.map

package/dist/service/acm/validation/sim-acm-dns-validation-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-validation-mode.d.ts","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-validation-mode.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IACd,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAzC,OAAO,eAAmE;IAE1E;;OAEG;IACH,MAAM,CAAC,IAAI,IAAI,uBAAuB,CAErC;IAED;;OAEG;IACH,MAAM,CAAC,MAAM,IAAI,uBAAuB,CAEvC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAEtC;IAED;;;OAGG;IACH,kBAAkB,CAAC,eAAe,EAAE,OAAO,GAAG,OAAO,CAYpD;CACF"}

package/dist/service/acm/validation/sim-acm-dns-validation-mode.js

@@ -0,0 +1,50 @@
+/**
+ * When sim ACM requires a DNS validation record before issuing a Certificate.
+ *
+ * The default is `auto`, which requires validation only for domain names the
+ * simulation actually holds DNS authority for. That keeps sim ACM realistic
+ * for users who are simulating Route53, without obstructing users whose DNS
+ * lives outside the simulation entirely.
+ */
+export class SimAcmDnsValidationMode {
+    name;
+    constructor(name) {
+        this.name = name;
+    }
+    /**
+     * Require validation only where a Hosted Zone covers the domain name.
+     */
+    static auto() {
+        return new SimAcmDnsValidationMode("auto");
+    }
+    /**
+     * Always require validation, whether or not a Hosted Zone covers the domain.
+     */
+    static always() {
+        return new SimAcmDnsValidationMode("always");
+    }
+    /**
+     * Never require validation.
+     */
+    static never() {
+        return new SimAcmDnsValidationMode("never");
+    }
+    /**
+     * Whether a domain name needs its DNS validation record before the
+     * Certificate can be issued.
+     */
+    requiresValidation(hasDnsAuthority) {
+        switch (this.name) {
+            case "always": {
+                return true;
+            }
+            case "never": {
+                return false;
+            }
+            case "auto": {
+                return hasDnsAuthority;
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-acm-dns-validation-mode.js.map

package/dist/service/acm/validation/sim-acm-dns-validation-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-validation-mode.js","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-validation-mode.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IACG,IAAI;IAAzC,YAAqC,IAAiC;oBAAjC,IAAI;IAAgC,CAAC;IAE1E;;OAEG;IACH,MAAM,CAAC,IAAI;QACT,OAAO,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK;QACV,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,eAAwB;QACzC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,OAAO,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,MAAM,EAAE,CAAC;gBACZ,OAAO,eAAe,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/acm/validation/sim-acm-dns-validation.fixture.d.ts

@@ -0,0 +1,34 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+interface ValidationRecord {
+    readonly name: string;
+    readonly value: string;
+}
+/**
+ * Test support for the sim ACM DNS validation flow.
+ *
+ * These helpers drive the simulator through structural command shapes rather
+ * than real SDK command objects, because this is source rather than a test
+ * file. The colocated tests cover SDK-shaped input.
+ */
+/**
+ * Create a Hosted Zone, optionally owned by another simulated Account.
+ */
+export declare function createHostedZone(simAws: SimAws, name: string, accountId?: string): Promise<string>;
+/**
+ * Read the current status of a Certificate.
+ */
+export declare function certificateStatus(simAws: SimAws, certificateArn: string | undefined): Promise<string | undefined>;
+/**
+ * Read the per-domain validation statuses of a Certificate, in order.
+ */
+export declare function domainValidationStatuses(simAws: SimAws, certificateArn: string | undefined): Promise<readonly (string | undefined)[]>;
+/**
+ * Read the DNS validation records ACM is waiting for, in domain order.
+ */
+export declare function validationRecords(simAws: SimAws, certificateArn: string | undefined): Promise<readonly ValidationRecord[]>;
+/**
+ * Publish one CNAME into a Hosted Zone through the Route53 command path.
+ */
+export declare function publishCname(simAws: SimAws, hostedZoneId: string, record: ValidationRecord, value?: string): Promise<void>;
+export {};
+//# sourceMappingURL=sim-acm-dns-validation.fixture.d.ts.map

package/dist/service/acm/validation/sim-acm-dns-validation.fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-validation.fixture.d.ts","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-validation.fixture.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,UAAU,gBAAgB;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AAEH;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAM7B;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAS1C;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAetC;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,gBAAgB,EACxB,KAAK,SAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CAqBf"}