@kensio/yulin 0.34.2 → 0.35.0

package/dist/service/acm/validation/sim-acm-certificate-validation.js

@@ -0,0 +1,124 @@
+import { SimAcmDnsValidationMode } from "./sim-acm-dns-validation-mode.js";
+/**
+ * Drives sim ACM Certificate issuance through domain validation.
+ *
+ * A requested Certificate is evaluated once as background work, and then again
+ * whenever DNS records change, until every domain name on it is validated. The
+ * re-evaluation is driven by DNS record changes rather than by polling, so
+ * draining simulator background tasks always terminates: a Certificate whose
+ * validation record never appears simply stays pending.
+ */
+export class SimAcmCertificateValidation {
+    background;
+    dnsRecords;
+    pendingCertificates = new Set();
+    mode = SimAcmDnsValidationMode.auto();
+    listeningForRecordChanges = false;
+    constructor(properties) {
+        this.background = properties.background;
+        this.dnsRecords = properties.dnsRecords;
+    }
+    /**
+     * Always require a DNS validation record before issuing a Certificate.
+     *
+     * With no sim Route53 to validate against there is no way to satisfy this,
+     * so it is rejected rather than silently issuing certificates anyway.
+     */
+    alwaysRequireDnsValidation() {
+        if (this.dnsRecords === undefined) {
+            throw new Error("Sim ACM cannot require DNS validation with no sim Route53 to validate against. " +
+                "Use SimAws, so ACM can see Hosted Zones, rather than a standalone SimAcm.");
+        }
+        this.mode = SimAcmDnsValidationMode.always();
+    }
+    /**
+     * Never require a DNS validation record before issuing a Certificate.
+     */
+    neverRequireDnsValidation() {
+        this.mode = SimAcmDnsValidationMode.never();
+    }
+    /**
+     * Begin validating a newly requested Certificate.
+     */
+    begin(certificate) {
+        this.pendingCertificates.add(certificate);
+        this.listenForRecordChanges();
+        this.background.schedule(() => this.settle(certificate));
+    }
+    /**
+     * Validate whatever can be validated now, issuing the Certificate once every
+     * domain name on it has succeeded.
+     */
+    async settle(certificate) {
+        for (const domainValidation of certificate.domainValidationOptions) {
+            this.validateDomain(domainValidation);
+        }
+        if (!certificate.isValidated) {
+            return;
+        }
+        await certificate.issue();
+        this.pendingCertificates.delete(certificate);
+    }
+    /**
+     * Validate one domain name, if it is waiting and its record now exists.
+     */
+    validateDomain(domainValidation) {
+        if (!domainValidation.isPending) {
+            return;
+        }
+        const dnsRecords = this.dnsRecords;
+        if (dnsRecords === undefined) {
+            domainValidation.succeed();
+            return;
+        }
+        const requiredRecord = this.requiredDnsRecord(domainValidation, dnsRecords);
+        if (requiredRecord === undefined) {
+            domainValidation.succeed();
+            return;
+        }
+        if (dnsRecords.hasCname(requiredRecord.name, requiredRecord.value)) {
+            domainValidation.succeed();
+        }
+    }
+    /**
+     * The DNS record a domain name must publish before it can be validated.
+     *
+     * Undefined means this domain name does not need to prove anything through
+     * DNS: it is not using DNS validation, or nothing in the simulation is
+     * authoritative for it.
+     */
+    requiredDnsRecord(domainValidation, dnsRecords) {
+        const resourceRecord = domainValidation.resourceRecord;
+        if (resourceRecord === undefined ||
+            domainValidation.validationMethod !== "DNS") {
+            return undefined;
+        }
+        const requiresValidation = this.mode.requiresValidation(dnsRecords.hasAuthorityFor(domainValidation.domainName));
+        if (!requiresValidation) {
+            return undefined;
+        }
+        return resourceRecord;
+    }
+    /**
+     * Subscribe to DNS record changes the first time a Certificate needs them.
+     */
+    listenForRecordChanges() {
+        const dnsRecords = this.dnsRecords;
+        if (this.listeningForRecordChanges || dnsRecords === undefined) {
+            return;
+        }
+        this.listeningForRecordChanges = true;
+        dnsRecords.onRecordChange(() => {
+            this.revalidatePendingCertificates();
+        });
+    }
+    /**
+     * Schedule another look at every Certificate still waiting to be issued.
+     */
+    revalidatePendingCertificates() {
+        for (const certificate of this.pendingCertificates) {
+            this.background.schedule(() => this.settle(certificate));
+        }
+    }
+}
+//# sourceMappingURL=sim-acm-certificate-validation.js.map

package/dist/service/acm/validation/sim-acm-certificate-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-certificate-validation.js","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-certificate-validation.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAO3E;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACrB,UAAU,CAAsB;IAChC,UAAU,CAA+B;IACzC,mBAAmB,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5D,IAAI,GAAG,uBAAuB,CAAC,IAAI,EAAE,CAAC;IACtC,yBAAyB,GAAG,KAAK,CAAC;IAE1C,YAAY,UAAiD;QAC3D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,0BAA0B;QACxB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,iFAAiF;gBAC/E,2EAA2E,CAC9E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC,MAAM,EAAE,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,yBAAyB;QACvB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAA8B;QAClC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,WAA8B;QACzC,KAAK,MAAM,gBAAgB,IAAI,WAAW,CAAC,uBAAuB,EAAE,CAAC;YACnE,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,gBAAwC;QAC7D,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;QAC5E,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CACvB,gBAAwC,EACxC,UAA4B;QAE5B,MAAM,cAAc,GAAG,gBAAgB,CAAC,cAAc,CAAC;QAEvD,IACE,cAAc,KAAK,SAAS;YAC5B,gBAAgB,CAAC,gBAAgB,KAAK,KAAK,EAC3C,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CACrD,UAAU,CAAC,eAAe,CAAC,gBAAgB,CAAC,UAAU,CAAC,CACxD,CAAC;QAEF,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAED;;OAEG;IACK,sBAAsB;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAEnC,IAAI,IAAI,CAAC,yBAAyB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC;QACtC,UAAU,CAAC,cAAc,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,6BAA6B;QACnC,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACnD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF"}

package/dist/service/acm/validation/sim-acm-dns-records.d.ts

@@ -0,0 +1,36 @@
+export type SimAcmDnsRecordChangeListener = () => void;
+/**
+ * DNS records visible to simulated ACM when validating domain ownership.
+ *
+ * Real ACM proves domain ownership by looking for a CNAME in public DNS. This
+ * port is how sim ACM does the same against sim Route53 without depending on
+ * Route53's own types or name normalisation rules. A standalone SimAcm has no
+ * implementation of this at all, which is what makes it issue certificates
+ * without validating them.
+ */
+export interface SimAcmDnsRecords {
+    /**
+     * Whether the simulation holds DNS authority for a domain name.
+     *
+     * This is the signal sim ACM uses to decide whether a certificate should
+     * wait for validation: with no Hosted Zone covering the domain name there is
+     * nothing in the simulation that could answer for it.
+     */
+    hasAuthorityFor(domainName: string): boolean;
+    /**
+     * Whether a CNAME record with this name and value exists.
+     */
+    hasCname(name: string, value: string): boolean;
+    /**
+     * Create a CNAME record in the Hosted Zone covering its name.
+     *
+     * Returns false when no Hosted Zone covers the name, so the caller can
+     * report which records it could not create.
+     */
+    createCname(name: string, value: string): boolean;
+    /**
+     * Register a listener called whenever any DNS record changes.
+     */
+    onRecordChange(listener: SimAcmDnsRecordChangeListener): void;
+}
+//# sourceMappingURL=sim-acm-dns-records.d.ts.map

package/dist/service/acm/validation/sim-acm-dns-records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-records.d.ts","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-records.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,6BAA6B,GAAG,MAAM,IAAI,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAE7C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAE/C;;;;;OAKG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAElD;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,6BAA6B,GAAG,IAAI,CAAC;CAC/D"}

package/dist/service/acm/validation/sim-acm-dns-records.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-acm-dns-records.js.map

package/dist/service/acm/validation/sim-acm-dns-records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-records.js","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-records.ts"],"names":[],"mappings":""}

package/dist/service/acm/validation/sim-acm-dns-validation-completer.d.ts

@@ -0,0 +1,37 @@
+import type { SimArn } from "../../aws/arn.js";
+import type { SimAcmCertificate } from "../certificate/sim-acm-certificate.js";
+import type { SimAcmCertificateValidation } from "./sim-acm-certificate-validation.js";
+import type { SimAcmDnsRecords } from "./sim-acm-dns-records.js";
+interface SimAcmDnsValidationCompleterProperties {
+    readonly certificates: ReadonlyMap<SimArn, SimAcmCertificate>;
+    readonly validation: SimAcmCertificateValidation;
+    readonly dnsRecords?: SimAcmDnsRecords | undefined;
+}
+/**
+ * Creates the DNS validation records a pending sim Certificate is waiting for.
+ *
+ * This is the shortcut for users who want realistic DNS routing but not the
+ * certificate ceremony: it writes each validation CNAME into the Hosted Zone
+ * covering it, then settles the Certificate, so the Certificate is issued by
+ * the time the call returns.
+ */
+export declare class SimAcmDnsValidationCompleter {
+    private readonly certificates;
+    private readonly validation;
+    private readonly dnsRecords;
+    constructor(properties: SimAcmDnsValidationCompleterProperties);
+    /**
+     * Publish the validation records for a Certificate and wait for issuance.
+     */
+    complete(certificateArn: string | undefined): Promise<void>;
+    /**
+     * Resolve the Certificate this ARN refers to.
+     */
+    private findCertificate;
+    /**
+     * Create each validation record, reporting the names that had nowhere to go.
+     */
+    private createValidationRecords;
+}
+export {};
+//# sourceMappingURL=sim-acm-dns-validation-completer.d.ts.map

package/dist/service/acm/validation/sim-acm-dns-validation-completer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-validation-completer.d.ts","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-validation-completer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAM/E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC9D,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;;GAOG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyC;IACtE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAE1D,YAAY,UAAU,EAAE,sCAAsC,EAI7D;IAED;;OAEG;IACG,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAchE;IAED;;OAEG;IACH,OAAO,CAAC,eAAe;IAoBvB;;OAEG;IACH,OAAO,CAAC,uBAAuB;CAyBhC"}

package/dist/service/acm/validation/sim-acm-dns-validation-completer.js

@@ -0,0 +1,66 @@
+import { SimAcmDnsValidationFailed, SimAcmInvalidArgumentsException, SimAcmResourceNotFoundException, } from "../error/sim-acm.error.js";
+/**
+ * Creates the DNS validation records a pending sim Certificate is waiting for.
+ *
+ * This is the shortcut for users who want realistic DNS routing but not the
+ * certificate ceremony: it writes each validation CNAME into the Hosted Zone
+ * covering it, then settles the Certificate, so the Certificate is issued by
+ * the time the call returns.
+ */
+export class SimAcmDnsValidationCompleter {
+    certificates;
+    validation;
+    dnsRecords;
+    constructor(properties) {
+        this.certificates = properties.certificates;
+        this.validation = properties.validation;
+        this.dnsRecords = properties.dnsRecords;
+    }
+    /**
+     * Publish the validation records for a Certificate and wait for issuance.
+     */
+    async complete(certificateArn) {
+        const certificate = this.findCertificate(certificateArn);
+        const uncreatedRecordNames = this.createValidationRecords(certificate);
+        await this.validation.settle(certificate);
+        if (certificate.status === "ISSUED") {
+            return;
+        }
+        throw new SimAcmDnsValidationFailed(`Cannot complete DNS validation of sim ACM Certificate ${certificate.certificateArn}: ` +
+            `no sim Route53 Hosted Zone covers ${uncreatedRecordNames.join(", ")}`);
+    }
+    /**
+     * Resolve the Certificate this ARN refers to.
+     */
+    findCertificate(certificateArn) {
+        if (certificateArn === undefined) {
+            throw new SimAcmInvalidArgumentsException("SimAcm.completeDnsValidation requires a CertificateArn");
+        }
+        const certificate = this.certificates.get(certificateArn);
+        if (certificate === undefined) {
+            throw new SimAcmResourceNotFoundException(`No sim ACM Certificate found with ARN ${certificateArn}`);
+        }
+        return certificate;
+    }
+    /**
+     * Create each validation record, reporting the names that had nowhere to go.
+     */
+    createValidationRecords(certificate) {
+        const dnsRecords = this.dnsRecords;
+        if (dnsRecords === undefined) {
+            return [];
+        }
+        const uncreatedRecordNames = [];
+        for (const domainValidation of certificate.domainValidationOptions) {
+            const resourceRecord = domainValidation.resourceRecord;
+            if (resourceRecord === undefined) {
+                continue;
+            }
+            if (!dnsRecords.createCname(resourceRecord.name, resourceRecord.value)) {
+                uncreatedRecordNames.push(resourceRecord.name);
+            }
+        }
+        return uncreatedRecordNames;
+    }
+}
+//# sourceMappingURL=sim-acm-dns-validation-completer.js.map

package/dist/service/acm/validation/sim-acm-dns-validation-completer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-validation-completer.js","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-validation-completer.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AAUnC;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA4B;IACtB,YAAY,CAAyC;IACrD,UAAU,CAA8B;IACxC,UAAU,CAA+B;IAE1D,YAAY,UAAkD;QAC5D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,cAAkC;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,oBAAoB,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAEvE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAE1C,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,yDAAyD,WAAW,CAAC,cAAc,IAAI;YACrF,qCAAqC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,cAAkC;QAElC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,+BAA+B,CACvC,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAwB,CAAC,CAAC;QAEpE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,+BAA+B,CACvC,yCAAyC,cAAc,EAAE,CAC1D,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC7B,WAA8B;QAE9B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAEnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,oBAAoB,GAAa,EAAE,CAAC;QAE1C,KAAK,MAAM,gBAAgB,IAAI,WAAW,CAAC,uBAAuB,EAAE,CAAC;YACnE,MAAM,cAAc,GAAG,gBAAgB,CAAC,cAAc,CAAC;YAEvD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,SAAS;YACX,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvE,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,oBAAoB,CAAC;IAC9B,CAAC;CACF"}

package/dist/service/acm/validation/sim-acm-dns-validation-mode.d.ts

@@ -0,0 +1,30 @@
+/**
+ * When sim ACM requires a DNS validation record before issuing a Certificate.
+ *
+ * The default is `auto`, which requires validation only for domain names the
+ * simulation actually holds DNS authority for. That keeps sim ACM realistic
+ * for users who are simulating Route53, without obstructing users whose DNS
+ * lives outside the simulation entirely.
+ */
+export declare class SimAcmDnsValidationMode {
+    private readonly name;
+    private constructor();
+    /**
+     * Require validation only where a Hosted Zone covers the domain name.
+     */
+    static auto(): SimAcmDnsValidationMode;
+    /**
+     * Always require validation, whether or not a Hosted Zone covers the domain.
+     */
+    static always(): SimAcmDnsValidationMode;
+    /**
+     * Never require validation.
+     */
+    static never(): SimAcmDnsValidationMode;
+    /**
+     * Whether a domain name needs its DNS validation record before the
+     * Certificate can be issued.
+     */
+    requiresValidation(hasDnsAuthority: boolean): boolean;
+}
+//# sourceMappingURL=sim-acm-dns-validation-mode.d.ts.map

package/dist/service/acm/validation/sim-acm-dns-validation-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-validation-mode.d.ts","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-validation-mode.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IACd,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAzC,OAAO,eAAmE;IAE1E;;OAEG;IACH,MAAM,CAAC,IAAI,IAAI,uBAAuB,CAErC;IAED;;OAEG;IACH,MAAM,CAAC,MAAM,IAAI,uBAAuB,CAEvC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAEtC;IAED;;;OAGG;IACH,kBAAkB,CAAC,eAAe,EAAE,OAAO,GAAG,OAAO,CAYpD;CACF"}

package/dist/service/acm/validation/sim-acm-dns-validation-mode.js

@@ -0,0 +1,50 @@
+/**
+ * When sim ACM requires a DNS validation record before issuing a Certificate.
+ *
+ * The default is `auto`, which requires validation only for domain names the
+ * simulation actually holds DNS authority for. That keeps sim ACM realistic
+ * for users who are simulating Route53, without obstructing users whose DNS
+ * lives outside the simulation entirely.
+ */
+export class SimAcmDnsValidationMode {
+    name;
+    constructor(name) {
+        this.name = name;
+    }
+    /**
+     * Require validation only where a Hosted Zone covers the domain name.
+     */
+    static auto() {
+        return new SimAcmDnsValidationMode("auto");
+    }
+    /**
+     * Always require validation, whether or not a Hosted Zone covers the domain.
+     */
+    static always() {
+        return new SimAcmDnsValidationMode("always");
+    }
+    /**
+     * Never require validation.
+     */
+    static never() {
+        return new SimAcmDnsValidationMode("never");
+    }
+    /**
+     * Whether a domain name needs its DNS validation record before the
+     * Certificate can be issued.
+     */
+    requiresValidation(hasDnsAuthority) {
+        switch (this.name) {
+            case "always": {
+                return true;
+            }
+            case "never": {
+                return false;
+            }
+            case "auto": {
+                return hasDnsAuthority;
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-acm-dns-validation-mode.js.map

package/dist/service/acm/validation/sim-acm-dns-validation-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-validation-mode.js","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-validation-mode.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IACG,IAAI;IAAzC,YAAqC,IAAiC;oBAAjC,IAAI;IAAgC,CAAC;IAE1E;;OAEG;IACH,MAAM,CAAC,IAAI;QACT,OAAO,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK;QACV,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,eAAwB;QACzC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,OAAO,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,MAAM,EAAE,CAAC;gBACZ,OAAO,eAAe,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/acm/validation/sim-acm-dns-validation.fixture.d.ts

@@ -0,0 +1,34 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+interface ValidationRecord {
+    readonly name: string;
+    readonly value: string;
+}
+/**
+ * Test support for the sim ACM DNS validation flow.
+ *
+ * These helpers drive the simulator through structural command shapes rather
+ * than real SDK command objects, because this is source rather than a test
+ * file. The colocated tests cover SDK-shaped input.
+ */
+/**
+ * Create a Hosted Zone, optionally owned by another simulated Account.
+ */
+export declare function createHostedZone(simAws: SimAws, name: string, accountId?: string): Promise<string>;
+/**
+ * Read the current status of a Certificate.
+ */
+export declare function certificateStatus(simAws: SimAws, certificateArn: string | undefined): Promise<string | undefined>;
+/**
+ * Read the per-domain validation statuses of a Certificate, in order.
+ */
+export declare function domainValidationStatuses(simAws: SimAws, certificateArn: string | undefined): Promise<readonly (string | undefined)[]>;
+/**
+ * Read the DNS validation records ACM is waiting for, in domain order.
+ */
+export declare function validationRecords(simAws: SimAws, certificateArn: string | undefined): Promise<readonly ValidationRecord[]>;
+/**
+ * Publish one CNAME into a Hosted Zone through the Route53 command path.
+ */
+export declare function publishCname(simAws: SimAws, hostedZoneId: string, record: ValidationRecord, value?: string): Promise<void>;
+export {};
+//# sourceMappingURL=sim-acm-dns-validation.fixture.d.ts.map

package/dist/service/acm/validation/sim-acm-dns-validation.fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-validation.fixture.d.ts","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-validation.fixture.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,UAAU,gBAAgB;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AAEH;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAM7B;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAS1C;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAetC;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,gBAAgB,EACxB,KAAK,SAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/service/acm/validation/sim-acm-dns-validation.fixture.js

@@ -0,0 +1,80 @@
+import { assertNonNullable } from "@kensio/smartass";
+/**
+ * Test support for the sim ACM DNS validation flow.
+ *
+ * These helpers drive the simulator through structural command shapes rather
+ * than real SDK command objects, because this is source rather than a test
+ * file. The colocated tests cover SDK-shaped input.
+ */
+/**
+ * Create a Hosted Zone, optionally owned by another simulated Account.
+ */
+export async function createHostedZone(simAws, name, accountId) {
+    const output = await simAws
+        .account(accountId)
+        .route53()
+        .createHostedZone({ input: { Name: name, CallerReference: name } });
+    assertNonNullable(output.HostedZone?.Id);
+    return output.HostedZone.Id;
+}
+/**
+ * Read the current status of a Certificate.
+ */
+export async function certificateStatus(simAws, certificateArn) {
+    const output = await simAws
+        .acm()
+        .describeCertificate({ input: { CertificateArn: certificateArn } });
+    return output.Certificate?.Status;
+}
+/**
+ * Read the per-domain validation statuses of a Certificate, in order.
+ */
+export async function domainValidationStatuses(simAws, certificateArn) {
+    const output = await simAws
+        .acm()
+        .describeCertificate({ input: { CertificateArn: certificateArn } });
+    const validations = output.Certificate?.DomainValidationOptions;
+    assertNonNullable(validations);
+    return validations.map((validation) => validation.ValidationStatus);
+}
+/**
+ * Read the DNS validation records ACM is waiting for, in domain order.
+ */
+export async function validationRecords(simAws, certificateArn) {
+    const output = await simAws
+        .acm()
+        .describeCertificate({ input: { CertificateArn: certificateArn } });
+    const validations = output.Certificate?.DomainValidationOptions;
+    assertNonNullable(validations);
+    return validations.map((validation) => {
+        const resourceRecord = validation.ResourceRecord;
+        assertNonNullable(resourceRecord?.Name);
+        assertNonNullable(resourceRecord.Value);
+        return { name: resourceRecord.Name, value: resourceRecord.Value };
+    });
+}
+/**
+ * Publish one CNAME into a Hosted Zone through the Route53 command path.
+ */
+export async function publishCname(simAws, hostedZoneId, record, value = record.value) {
+    await simAws.route53().changeResourceRecordSets({
+        input: {
+            HostedZoneId: hostedZoneId,
+            ChangeBatch: {
+                Changes: [
+                    {
+                        Action: "CREATE",
+                        ResourceRecordSet: {
+                            Name: record.name,
+                            Type: "CNAME",
+                            TTL: 300,
+                            ResourceRecords: [{ Value: value }],
+                        },
+                    },
+                ],
+            },
+        },
+    });
+    await simAws.backgroundTasksComplete();
+}
+//# sourceMappingURL=sim-acm-dns-validation.fixture.js.map

package/dist/service/acm/validation/sim-acm-dns-validation.fixture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-acm-dns-validation.fixture.js","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-acm-dns-validation.fixture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AASrD;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,IAAY,EACZ,SAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,MAAM;SACxB,OAAO,CAAC,SAAS,CAAC;SAClB,OAAO,EAAE;SACT,gBAAgB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAEtE,iBAAiB,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEzC,OAAO,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,cAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,MAAM;SACxB,GAAG,EAAE;SACL,mBAAmB,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IAEtE,OAAO,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,cAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,MAAM;SACxB,GAAG,EAAE;SACL,mBAAmB,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,uBAAuB,CAAC;IAEhE,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAE/B,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,cAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,MAAM;SACxB,GAAG,EAAE;SACL,mBAAmB,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,uBAAuB,CAAC;IAEhE,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAE/B,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QACpC,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QACjD,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACxC,iBAAiB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAExC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,YAAoB,EACpB,MAAwB,EACxB,KAAK,GAAG,MAAM,CAAC,KAAK;IAEpB,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,wBAAwB,CAAC;QAC9C,KAAK,EAAE;YACL,YAAY,EAAE,YAAY;YAC1B,WAAW,EAAE;gBACX,OAAO,EAAE;oBACP;wBACE,MAAM,EAAE,QAAQ;wBAChB,iBAAiB,EAAE;4BACjB,IAAI,EAAE,MAAM,CAAC,IAAI;4BACjB,IAAI,EAAE,OAAO;4BACb,GAAG,EAAE,GAAG;4BACR,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;yBACpC;qBACF;iBACF;aACF;SACF;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,uBAAuB,EAAE,CAAC;AACzC,CAAC"}

package/dist/service/acm/validation/sim-route53-acm-dns-records.d.ts

@@ -0,0 +1,43 @@
+import type { SimRoute53Registry } from "../../route53/registry/sim-route53-registry.js";
+import type { SimAcmDnsRecordChangeListener, SimAcmDnsRecords } from "./sim-acm-dns-records.js";
+interface SimRoute53AcmDnsRecordsProperties {
+    readonly route53Registry: SimRoute53Registry;
+}
+/**
+ * Sim Route53 as the DNS sim ACM validates Certificates against.
+ *
+ * All of the DNS name handling lives here rather than in ACM: Route53 stores
+ * record names and values normalised, so comparisons have to be normalised the
+ * same way for a trailing dot not to look like a mismatch.
+ *
+ * The registry spans simulated Accounts, which matches real ACM validating
+ * against public DNS. A Certificate in one Account can be validated by a
+ * Hosted Zone in another.
+ */
+export declare class SimRoute53AcmDnsRecords implements SimAcmDnsRecords {
+    private readonly route53Registry;
+    constructor(properties: SimRoute53AcmDnsRecordsProperties);
+    /**
+     * Whether any Hosted Zone covers this domain name.
+     */
+    hasAuthorityFor(domainName: string): boolean;
+    /**
+     * Whether a CNAME with this name resolves to this value.
+     */
+    hasCname(name: string, value: string): boolean;
+    /**
+     * Create a CNAME in the Hosted Zone covering its name.
+     */
+    createCname(name: string, value: string): boolean;
+    /**
+     * Watch every registered Hosted Zone for record changes.
+     */
+    onRecordChange(listener: SimAcmDnsRecordChangeListener): void;
+    /**
+     * Hosted zones are registered over time, so the finder is built per lookup
+     * rather than held, to always see the current set of zones.
+     */
+    private recordFinder;
+}
+export {};
+//# sourceMappingURL=sim-route53-acm-dns-records.d.ts.map

package/dist/service/acm/validation/sim-route53-acm-dns-records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-acm-dns-records.d.ts","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-route53-acm-dns-records.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEzF,OAAO,KAAK,EACV,6BAA6B,EAC7B,gBAAgB,EACjB,MAAM,0BAA0B,CAAC;AAIlC,UAAU,iCAAiC;IACzC,QAAQ,CAAC,eAAe,EAAE,kBAAkB,CAAC;CAC9C;AAED;;;;;;;;;;GAUG;AACH,qBAAa,uBAAwB,YAAW,gBAAgB;IAC9D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IAErD,YAAY,UAAU,EAAE,iCAAiC,EAExD;IAED;;OAEG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAK3C;IAED;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAW7C;IAED;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAgBhD;IAED;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,6BAA6B,GAAG,IAAI,CAE5D;IAED;;;OAGG;IACH,OAAO,CAAC,YAAY;CAKrB"}

package/dist/service/acm/validation/sim-route53-acm-dns-records.js

@@ -0,0 +1,68 @@
+import { normaliseSimRoute53Name } from "../../route53/local-name/sim-route53-local-name.js";
+import { SimRoute53HostedZoneRecordFinder } from "../../route53/resolve/sim-r53-zone-record-finder.js";
+const validationRecordTtl = 300;
+/**
+ * Sim Route53 as the DNS sim ACM validates Certificates against.
+ *
+ * All of the DNS name handling lives here rather than in ACM: Route53 stores
+ * record names and values normalised, so comparisons have to be normalised the
+ * same way for a trailing dot not to look like a mismatch.
+ *
+ * The registry spans simulated Accounts, which matches real ACM validating
+ * against public DNS. A Certificate in one Account can be validated by a
+ * Hosted Zone in another.
+ */
+export class SimRoute53AcmDnsRecords {
+    route53Registry;
+    constructor(properties) {
+        this.route53Registry = properties.route53Registry;
+    }
+    /**
+     * Whether any Hosted Zone covers this domain name.
+     */
+    hasAuthorityFor(domainName) {
+        return (this.recordFinder().findZone(normaliseSimRoute53Name(domainName)) !==
+            undefined);
+    }
+    /**
+     * Whether a CNAME with this name resolves to this value.
+     */
+    hasCname(name, value) {
+        const record = this.recordFinder().findRecord(normaliseSimRoute53Name(name), "CNAME");
+        if (record === undefined) {
+            return false;
+        }
+        return record.values.includes(normaliseSimRoute53Name(value));
+    }
+    /**
+     * Create a CNAME in the Hosted Zone covering its name.
+     */
+    createCname(name, value) {
+        const normalisedName = normaliseSimRoute53Name(name);
+        const hostedZone = this.recordFinder().findZone(normalisedName);
+        if (hostedZone === undefined) {
+            return false;
+        }
+        hostedZone.records.upsert({
+            name: normalisedName,
+            type: "CNAME",
+            values: [value],
+            ttl: validationRecordTtl,
+        });
+        return true;
+    }
+    /**
+     * Watch every registered Hosted Zone for record changes.
+     */
+    onRecordChange(listener) {
+        this.route53Registry.onRecordChange(listener);
+    }
+    /**
+     * Hosted zones are registered over time, so the finder is built per lookup
+     * rather than held, to always see the current set of zones.
+     */
+    recordFinder() {
+        return new SimRoute53HostedZoneRecordFinder(this.route53Registry.hostedZones);
+    }
+}
+//# sourceMappingURL=sim-route53-acm-dns-records.js.map

package/dist/service/acm/validation/sim-route53-acm-dns-records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-acm-dns-records.js","sourceRoot":"","sources":["../../../../src/service/acm/validation/sim-route53-acm-dns-records.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAE7F,OAAO,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAC;AAMvG,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAMhC;;;;;;;;;;GAUG;AACH,MAAM,OAAO,uBAAuB;IACjB,eAAe,CAAqB;IAErD,YAAY,UAA6C;QACvD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,UAAkB;QAChC,OAAO,CACL,IAAI,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;YACjE,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,IAAY,EAAE,KAAa;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,UAAU,CAC3C,uBAAuB,CAAC,IAAI,CAAC,EAC7B,OAAO,CACR,CAAC;QAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,IAAY,EAAE,KAAa;QACrC,MAAM,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAEhE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;YACxB,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,CAAC,KAAK,CAAC;YACf,GAAG,EAAE,mBAAmB;SACzB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,QAAuC;QACpD,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACK,YAAY;QAClB,OAAO,IAAI,gCAAgC,CACzC,IAAI,CAAC,eAAe,CAAC,WAAW,CACjC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/aws/arn.d.ts

@@ -14,4 +14,13 @@ export interface SimArnComponents {
  * Generate a fake ARN.
  */
 export declare function makeSimArn(overrides?: Partial<SimArnComponents>): SimArn;
+/**
+ * Read the parts of an ARN.
+ *
+ * Undefined means the value is not an ARN of this shape, rather than that
+ * something went wrong: ARNs reach the simulator from user templates and SDK
+ * input, where a value that is not an ARN at all is an ordinary case a caller
+ * reports in its own terms.
+ */
+export declare function parseSimArn(value: string): SimArnComponents | undefined;
 //# sourceMappingURL=arn.d.ts.map

package/dist/service/aws/arn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"arn.d.ts","sourceRoot":"","sources":["../../../src/service/aws/arn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAqB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAI9B,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEvC,MAAM,MAAM,MAAM,GAChB,WAAW,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,KAAK,CAAC;IACjB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAaD;;GAEG;AACH,wBAAgB,UAAU,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAGxE"}
+{"version":3,"file":"arn.d.ts","sourceRoot":"","sources":["../../../src/service/aws/arn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAqB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAI9B,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEvC,MAAM,MAAM,MAAM,GAChB,WAAW,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,KAAK,CAAC;IACjB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAaD;;GAEG;AACH,wBAAgB,UAAU,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAGxE;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CA6BvE"}