@kensio/yulin 1.12.0 → 1.13.0

package/dist/service/cognito/user-pool/client/sim-cognito-redirect-urls.js

@@ -0,0 +1,47 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The origins real Cognito allows a callback URL to reach without TLS.
+ */
+const insecureCallbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/**
+ * The URLs an app client may send a browser to, checked as real Cognito checks
+ * them.
+ *
+ * A redirect URI has to be an absolute URI with no fragment, over HTTPS unless
+ * it is a loopback address, and an application's own scheme such as
+ * `myapp://example` is allowed. Checking them where they are set is what stops
+ * a callback URL that could never have been registered on real AWS reaching an
+ * authorize request here.
+ */
+export class SimCognitoRedirectUrls {
+    values;
+    constructor(option, requested) {
+        this.values = [...(requested ?? [])];
+        for (const value of this.values) {
+            SimCognitoRedirectUrls.requireRedirect(option, value);
+        }
+    }
+    static requireRedirect(option, value) {
+        const url = URL.parse(value);
+        if (url === null || value.includes("#")) {
+            throw new SimCognitoInvalidParameterException(`${option} '${value}' is not a redirect URI: a redirect URI is an ` +
+                `absolute URI with no fragment`);
+        }
+        if (url.protocol === "http:" && !insecureCallbackHosts.has(url.hostname)) {
+            throw new SimCognitoInvalidParameterException(`${option} '${value}' is not a redirect URI: Cognito requires ` +
+                `HTTPS except for ${insecureCallbackHosts
+                    .values()
+                    .toArray()
+                    .join(", ")}`);
+        }
+    }
+    /**
+     * Whether a URI is one of these, compared exactly as real Cognito compares
+     * one: a URL that differs by a trailing slash is a different URL, and one
+     * that matched loosely here would fail in a deployment.
+     */
+    includes(redirectUri) {
+        return this.values.includes(redirectUri);
+    }
+}
+//# sourceMappingURL=sim-cognito-redirect-urls.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-redirect-urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-redirect-urls.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-redirect-urls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;GAEG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3E;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IACjB,MAAM,CAAoB;IAE1C,YAAY,MAAc,EAAE,SAAwC;QAClE,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAErC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,sBAAsB,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,eAAe,CAAC,MAAc,EAAE,KAAa;QAC1D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE7B,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,GAAG,MAAM,KAAK,KAAK,gDAAgD;gBACjE,+BAA+B,CAClC,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,mCAAmC,CAC3C,GAAG,MAAM,KAAK,KAAK,4CAA4C;gBAC7D,oBAAoB,qBAAqB;qBACtC,MAAM,EAAE;qBACR,OAAO,EAAE;qBACT,IAAI,CAAC,IAAI,CAAC,EAAE,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,WAAmB;QAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-requested-oauth.d.ts

@@ -0,0 +1,29 @@
+import type { SimCognitoOAuthSettingsType } from "./sim-cognito-oauth-settings.js";
+import { SimCognitoRedirectUrls } from "./sim-cognito-redirect-urls.js";
+/**
+ * The OAuth settings a request asked an app client for, checked.
+ *
+ * Everything an app client's OAuth settings can be refused for is here, so
+ * that what the client then holds is a set of values nothing has left to say
+ * no to.
+ */
+export declare class SimCognitoRequestedOAuth {
+    readonly enabled: boolean;
+    readonly flows: readonly string[];
+    readonly scopes: readonly string[];
+    readonly callbackUrls: SimCognitoRedirectUrls;
+    readonly logoutUrls: SimCognitoRedirectUrls;
+    readonly defaultRedirectUri: string | undefined;
+    readonly identityProviders: readonly string[];
+    constructor(settings: SimCognitoOAuthSettingsType);
+    /**
+     * Refuse the settings that need the authorization server turned on first.
+     *
+     * Real Cognito requires `AllowedOAuthFlowsUserPoolClient` to be true before
+     * any of these can be set, so a client carrying them with it left false is
+     * refused here as it is there.
+     */
+    private requireEnabledFor;
+    private requiredDefaultRedirect;
+}
+//# sourceMappingURL=sim-cognito-requested-oauth.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-requested-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-requested-oauth.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-requested-oauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAKnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,OAAO,EAAE,OAAO,CAAC;IACjC,SAAgB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,UAAU,EAAE,sBAAsB,CAAC;IACnD,SAAgB,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvD,SAAgB,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAErD,YAAY,QAAQ,EAAE,2BAA2B,EAkBhD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAsBzB,OAAO,CAAC,uBAAuB;CAgBhC"}

package/dist/service/cognito/user-pool/client/sim-cognito-requested-oauth.js

@@ -0,0 +1,64 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+import { simCognitoRequiredOAuthFlows, simCognitoRequiredOAuthScopes, } from "./sim-cognito-oauth-grants.js";
+import { SimCognitoRedirectUrls } from "./sim-cognito-redirect-urls.js";
+/**
+ * The OAuth settings a request asked an app client for, checked.
+ *
+ * Everything an app client's OAuth settings can be refused for is here, so
+ * that what the client then holds is a set of values nothing has left to say
+ * no to.
+ */
+export class SimCognitoRequestedOAuth {
+    enabled;
+    flows;
+    scopes;
+    callbackUrls;
+    logoutUrls;
+    defaultRedirectUri;
+    identityProviders;
+    constructor(settings) {
+        this.enabled = settings.AllowedOAuthFlowsUserPoolClient ?? false;
+        this.requireEnabledFor(settings);
+        this.flows = simCognitoRequiredOAuthFlows(settings.AllowedOAuthFlows);
+        this.scopes = simCognitoRequiredOAuthScopes(settings.AllowedOAuthScopes);
+        this.callbackUrls = new SimCognitoRedirectUrls("CallbackURLs", settings.CallbackURLs);
+        this.logoutUrls = new SimCognitoRedirectUrls("LogoutURLs", settings.LogoutURLs);
+        this.defaultRedirectUri = this.requiredDefaultRedirect(settings.DefaultRedirectURI);
+        this.identityProviders = [...(settings.SupportedIdentityProviders ?? [])];
+    }
+    /**
+     * Refuse the settings that need the authorization server turned on first.
+     *
+     * Real Cognito requires `AllowedOAuthFlowsUserPoolClient` to be true before
+     * any of these can be set, so a client carrying them with it left false is
+     * refused here as it is there.
+     */
+    requireEnabledFor(settings) {
+        if (this.enabled) {
+            return;
+        }
+        const gated = [
+            ["AllowedOAuthFlows", settings.AllowedOAuthFlows],
+            ["AllowedOAuthScopes", settings.AllowedOAuthScopes],
+            ["CallbackURLs", settings.CallbackURLs],
+            ["LogoutURLs", settings.LogoutURLs],
+        ];
+        for (const [option, value] of gated) {
+            if (value !== undefined) {
+                throw new SimCognitoInvalidParameterException(`${option} needs AllowedOAuthFlowsUserPoolClient to be true: the ` +
+                    `app client has no authorization server to configure until it is`);
+            }
+        }
+    }
+    requiredDefaultRedirect(requested) {
+        if (requested === undefined) {
+            return undefined;
+        }
+        if (!this.callbackUrls.includes(requested)) {
+            throw new SimCognitoInvalidParameterException(`DefaultRedirectURI '${requested}' is not one of the app client's ` +
+                `CallbackURLs`);
+        }
+        return requested;
+    }
+}
+//# sourceMappingURL=sim-cognito-requested-oauth.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-requested-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-requested-oauth.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-requested-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IACnB,OAAO,CAAU;IACjB,KAAK,CAAoB;IACzB,MAAM,CAAoB;IAC1B,YAAY,CAAyB;IACrC,UAAU,CAAyB;IACnC,kBAAkB,CAAqB;IACvC,iBAAiB,CAAoB;IAErD,YAAY,QAAqC;QAC/C,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,+BAA+B,IAAI,KAAK,CAAC;QACjE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEjC,IAAI,CAAC,KAAK,GAAG,4BAA4B,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG,6BAA6B,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAC5C,cAAc,EACd,QAAQ,CAAC,YAAY,CACtB,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,IAAI,sBAAsB,CAC1C,YAAY,EACZ,QAAQ,CAAC,UAAU,CACpB,CAAC;QACF,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,uBAAuB,CACpD,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;OAMG;IACK,iBAAiB,CAAC,QAAqC;QAC7D,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG;YACZ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,iBAAiB,CAAC;YACjD,CAAC,oBAAoB,EAAE,QAAQ,CAAC,kBAAkB,CAAC;YACnD,CAAC,cAAc,EAAE,QAAQ,CAAC,YAAY,CAAC;YACvC,CAAC,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC;SAC3B,CAAC;QAEX,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,mCAAmC,CAC3C,GAAG,MAAM,yDAAyD;oBAChE,iEAAiE,CACpE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,uBAAuB,CAC7B,SAA6B;QAE7B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,mCAAmC,CAC3C,uBAAuB,SAAS,mCAAmC;gBACjE,cAAc,CACjB,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.d.ts

@@ -1,7 +1,7 @@
 import { SimCognitoExplicitAuthFlows } from "./sim-cognito-explicit-auth-flows.js";
+import { SimCognitoOAuthSettings, type SimCognitoOAuthSettingsType } from "./sim-cognito-oauth-settings.js";
 import { SimCognitoPreventUserExistenceErrors } from "./sim-cognito-prevent-user-existence-errors.js";
 import { SimCognitoTokenValidity, type SimCognitoTokenValidityInput } from "./sim-cognito-token-validity.js";
-import { SimCognitoUnsimulatedClientSettings, type SimCognitoUnsimulatedClientSettingsType } from "./sim-cognito-unsimulated-client-settings.js";
 /**
  * The app client properties a request can set.
  *
@@ -9,7 +9,7 @@ import { SimCognitoUnsimulatedClientSettings, type SimCognitoUnsimulatedClientSe
  * `UpdateUserPoolClient` cannot change it. Nor is the secret, which an update
  * cannot touch either.
  */
-export interface SimCognitoUserPoolClientSettingsProperties extends SimCognitoTokenValidityInput, SimCognitoUnsimulatedClientSettingsType {
+export interface SimCognitoUserPoolClientSettingsProperties extends SimCognitoTokenValidityInput, SimCognitoOAuthSettingsType {
     readonly ClientName?: string | undefined;
     readonly ExplicitAuthFlows?: readonly string[] | undefined;
     readonly PreventUserExistenceErrors?: string | undefined;
@@ -29,10 +29,9 @@ export declare class SimCognitoUserPoolClientSettings {
     readonly preventUserExistenceErrors: SimCognitoPreventUserExistenceErrors;
     readonly tokenValidity: SimCognitoTokenValidity;
     /**
-     * What the request set and nothing here acts on, kept so a described client
-     * reports it.
+     * What this client may do at the pool's hosted domain.
      */
-    readonly unsimulated: SimCognitoUnsimulatedClientSettings;
+    readonly oauth: SimCognitoOAuthSettings;
     constructor(properties: SimCognitoUserPoolClientSettingsProperties);
 }
 //# sourceMappingURL=sim-cognito-user-pool-client-settings.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client-settings.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AACtG,OAAO,EACL,uBAAuB,EACvB,KAAK,4BAA4B,EAClC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,mCAAmC,EACnC,KAAK,uCAAuC,EAC7C,MAAM,8CAA8C,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,WAAW,0CACf,SACE,4BAA4B,EAC5B,uCAAuC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,qBAAa,gCAAgC;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,0BAA0B,EAAE,oCAAoC,CAAC;IACjF,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IAEvD;;;OAGG;IACH,SAAgB,WAAW,EAAE,mCAAmC,CAAC;IAEjE,YAAY,UAAU,EAAE,0CAA0C,EAajE;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-client-settings.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,KAAK,2BAA2B,EACjC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AACtG,OAAO,EACL,uBAAuB,EACvB,KAAK,4BAA4B,EAClC,MAAM,iCAAiC,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,WAAW,0CACf,SAAQ,4BAA4B,EAAE,2BAA2B;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,qBAAa,gCAAgC;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,0BAA0B,EAAE,oCAAoC,CAAC;IACjF,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IAEvD;;OAEG;IACH,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAE/C,YAAY,UAAU,EAAE,0CAA0C,EAajE;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.js

@@ -1,8 +1,8 @@
 import { SimCognitoName } from "../sim-cognito-name.js";
 import { SimCognitoExplicitAuthFlows } from "./sim-cognito-explicit-auth-flows.js";
+import { SimCognitoOAuthSettings, } from "./sim-cognito-oauth-settings.js";
 import { SimCognitoPreventUserExistenceErrors } from "./sim-cognito-prevent-user-existence-errors.js";
 import { SimCognitoTokenValidity, } from "./sim-cognito-token-validity.js";
-import { SimCognitoUnsimulatedClientSettings, } from "./sim-cognito-unsimulated-client-settings.js";
 /**
  * The settable properties of one simulated app client.
  *
@@ -18,10 +18,9 @@ export class SimCognitoUserPoolClientSettings {
     preventUserExistenceErrors;
     tokenValidity;
     /**
-     * What the request set and nothing here acts on, kept so a described client
-     * reports it.
+     * What this client may do at the pool's hosted domain.
      */
-    unsimulated;
+    oauth;
     constructor(properties) {
         this.name = new SimCognitoName({
             field: "ClientName",
@@ -30,7 +29,7 @@ export class SimCognitoUserPoolClientSettings {
         this.explicitAuthFlows = new SimCognitoExplicitAuthFlows(properties.ExplicitAuthFlows);
         this.preventUserExistenceErrors = new SimCognitoPreventUserExistenceErrors(properties.PreventUserExistenceErrors);
         this.tokenValidity = new SimCognitoTokenValidity(properties);
-        this.unsimulated = new SimCognitoUnsimulatedClientSettings(properties);
+        this.oauth = new SimCognitoOAuthSettings(properties);
     }
 }
 //# sourceMappingURL=sim-cognito-user-pool-client-settings.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client-settings.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AACtG,OAAO,EACL,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,mCAAmC,GAEpC,MAAM,8CAA8C,CAAC;AAkBtD;;;;;;;;GAQG;AACH,MAAM,OAAO,gCAAgC;IAC3B,IAAI,CAAS;IACb,iBAAiB,CAA8B;IAC/C,0BAA0B,CAAuC;IACjE,aAAa,CAA0B;IAEvD;;;OAGG;IACa,WAAW,CAAsC;IAEjE,YAAY,UAAsD;QAChE,IAAI,CAAC,IAAI,GAAG,IAAI,cAAc,CAAC;YAC7B,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,UAAU,CAAC,UAAU;SAC7B,CAAC,CAAC,KAAK,CAAC;QACT,IAAI,CAAC,iBAAiB,GAAG,IAAI,2BAA2B,CACtD,UAAU,CAAC,iBAAiB,CAC7B,CAAC;QACF,IAAI,CAAC,0BAA0B,GAAG,IAAI,oCAAoC,CACxE,UAAU,CAAC,0BAA0B,CACtC,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,IAAI,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,GAAG,IAAI,mCAAmC,CAAC,UAAU,CAAC,CAAC;IACzE,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-client-settings.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AACtG,OAAO,EACL,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AAgBzC;;;;;;;;GAQG;AACH,MAAM,OAAO,gCAAgC;IAC3B,IAAI,CAAS;IACb,iBAAiB,CAA8B;IAC/C,0BAA0B,CAAuC;IACjE,aAAa,CAA0B;IAEvD;;OAEG;IACa,KAAK,CAA0B;IAE/C,YAAY,UAAsD;QAChE,IAAI,CAAC,IAAI,GAAG,IAAI,cAAc,CAAC;YAC7B,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,UAAU,CAAC,UAAU;SAC7B,CAAC,CAAC,KAAK,CAAC;QACT,IAAI,CAAC,iBAAiB,GAAG,IAAI,2BAA2B,CACtD,UAAU,CAAC,iBAAiB,CAC7B,CAAC;QACF,IAAI,CAAC,0BAA0B,GAAG,IAAI,oCAAoC,CACxE,UAAU,CAAC,0BAA0B,CACtC,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,IAAI,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client.d.ts

@@ -3,7 +3,7 @@ import type { SimCognitoUserPoolId } from "../sim-cognito-user-pool-id.js";
 import type { SimCognitoExplicitAuthFlows } from "./sim-cognito-explicit-auth-flows.js";
 import type { SimCognitoPreventUserExistenceErrors } from "./sim-cognito-prevent-user-existence-errors.js";
 import type { SimCognitoTokenValidity } from "./sim-cognito-token-validity.js";
-import type { SimCognitoUnsimulatedClientSettings } from "./sim-cognito-unsimulated-client-settings.js";
+import type { SimCognitoOAuthSettings } from "./sim-cognito-oauth-settings.js";
 import type { SimCognitoUserPoolClientSettings } from "./sim-cognito-user-pool-client-settings.js";
 import type { SimCognitoUserPoolClientId } from "./sim-cognito-user-pool-client-id.js";
 interface SimCognitoUserPoolClientProperties {
@@ -51,10 +51,10 @@ export declare class SimCognitoUserPoolClient {
      */
     get tokenValidity(): SimCognitoTokenValidity;
     /**
-     * What the client was given and nothing here acts on, kept so a described
-     * client reports it.
+     * What this client may do at its pool's hosted domain: which grant, which
+     * scopes, which redirects and which identity providers.
      */
-    get unsimulatedSettings(): SimCognitoUnsimulatedClientSettings;
+    get oauth(): SimCognitoOAuthSettings;
     /**
      * When the client's settings last changed, which is its creation date until
      * something updates it.

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AAC3G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,8CAA8C,CAAC;AACxG,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AACnG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAEvF,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,EAAE,EAAE,0BAA0B,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,EAAE,EAAE,0BAA0B,CAAC;IAC/C,SAAgB,UAAU,EAAE,oBAAoB,CAAC;IACjD,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC;;;OAGG;IACH,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,cAAc,CAAmC;IACzD,OAAO,CAAC,YAAY,CAAO;IAE3B,YAAY,UAAU,EAAE,kCAAkC,EAQzD;IAED;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,IAAI,iBAAiB,IAAI,2BAA2B,CAEnD;IAED;;OAEG;IACH,IAAI,0BAA0B,IAAI,oCAAoC,CAErE;IAED;;OAEG;IACH,IAAI,aAAa,IAAI,uBAAuB,CAE3C;IAED;;;OAGG;IACH,IAAI,mBAAmB,IAAI,mCAAmC,CAE7D;IAED;;;OAGG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,QAAQ,EAAE,gCAAgC,GAAG,IAAI,CAGvD;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-client.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AAC3G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AACnG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAEvF,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,EAAE,EAAE,0BAA0B,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,EAAE,EAAE,0BAA0B,CAAC;IAC/C,SAAgB,UAAU,EAAE,oBAAoB,CAAC;IACjD,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC;;;OAGG;IACH,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,cAAc,CAAmC;IACzD,OAAO,CAAC,YAAY,CAAO;IAE3B,YAAY,UAAU,EAAE,kCAAkC,EAQzD;IAED;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,IAAI,iBAAiB,IAAI,2BAA2B,CAEnD;IAED;;OAEG;IACH,IAAI,0BAA0B,IAAI,oCAAoC,CAErE;IAED;;OAEG;IACH,IAAI,aAAa,IAAI,uBAAuB,CAE3C;IAED;;;OAGG;IACH,IAAI,KAAK,IAAI,uBAAuB,CAEnC;IAED;;;OAGG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,QAAQ,EAAE,gCAAgC,GAAG,IAAI,CAGvD;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client.js

@@ -52,11 +52,11 @@ export class SimCognitoUserPoolClient {
         return this.clientSettings.tokenValidity;
     }
     /**
-     * What the client was given and nothing here acts on, kept so a described
-     * client reports it.
+     * What this client may do at its pool's hosted domain: which grant, which
+     * scopes, which redirects and which identity providers.
      */
-    get unsimulatedSettings() {
-        return this.clientSettings.unsimulated;
+    get oauth() {
+        return this.clientSettings.oauth;
     }
     /**
      * When the client's settings last changed, which is its creation date until

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client.ts"],"names":[],"mappings":"AAiBA;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnB,EAAE,CAA6B;IAC/B,UAAU,CAAuB;IACjC,YAAY,CAAO;IAEnC;;;OAGG;IACa,MAAM,CAAqB;IAE1B,KAAK,CAAW;IACzB,cAAc,CAAmC;IACjD,YAAY,CAAO;IAE3B,YAAY,UAA8C;QACxD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,QAA0C;QAC/C,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-client.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client.ts"],"names":[],"mappings":"AAiBA;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnB,EAAE,CAA6B;IAC/B,UAAU,CAAuB;IACjC,YAAY,CAAO;IAEnC;;;OAGG;IACa,MAAM,CAAqB;IAE1B,KAAK,CAAW;IACzB,cAAc,CAAmC;IACjD,YAAY,CAAO;IAE3B,YAAY,UAA8C;QACxD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,QAA0C;QAC/C,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;CACF"}

package/dist/service/cognito/user-pool/domain/sim-cognito-custom-domain-config.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The custom domain configuration of a user pool domain, in the shape a
+ * request sets it and a described domain reports it.
+ */
+export interface SimCognitoCustomDomainConfigType {
+    readonly CertificateArn?: string | undefined;
+    readonly SecurityPolicy?: string | undefined;
+}
+/**
+ * The certificate a custom domain is served with.
+ *
+ * Nothing here terminates TLS, so the certificate is recorded rather than
+ * used. It is still required, as real Cognito requires it: a custom domain
+ * created without one is a request that fails on the way to AWS, and a
+ * simulation that accepted it would hide that.
+ *
+ * The certificate is not resolved against simulated ACM. Real Cognito requires
+ * one issued in `us-east-1`, whatever region the pool is in, and checking that
+ * here would only repeat a rule no request in a test is trying to break.
+ */
+export declare class SimCognitoCustomDomainConfig {
+    readonly certificateArn: string;
+    readonly securityPolicy: string | undefined;
+    constructor(config: SimCognitoCustomDomainConfigType);
+    /**
+     * This configuration as a described domain reports it.
+     */
+    toOutput(): SimCognitoCustomDomainConfigType;
+}
+//# sourceMappingURL=sim-cognito-custom-domain-config.d.ts.map

package/dist/service/cognito/user-pool/domain/sim-cognito-custom-domain-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-custom-domain-config.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/domain/sim-cognito-custom-domain-config.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,4BAA4B;IACvC,SAAgB,cAAc,EAAE,MAAM,CAAC;IACvC,SAAgB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnD,YAAY,MAAM,EAAE,gCAAgC,EAUnD;IAED;;OAEG;IACH,QAAQ,IAAI,gCAAgC,CAO3C;CACF"}

package/dist/service/cognito/user-pool/domain/sim-cognito-custom-domain-config.js

@@ -0,0 +1,37 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The certificate a custom domain is served with.
+ *
+ * Nothing here terminates TLS, so the certificate is recorded rather than
+ * used. It is still required, as real Cognito requires it: a custom domain
+ * created without one is a request that fails on the way to AWS, and a
+ * simulation that accepted it would hide that.
+ *
+ * The certificate is not resolved against simulated ACM. Real Cognito requires
+ * one issued in `us-east-1`, whatever region the pool is in, and checking that
+ * here would only repeat a rule no request in a test is trying to break.
+ */
+export class SimCognitoCustomDomainConfig {
+    certificateArn;
+    securityPolicy;
+    constructor(config) {
+        if (config.CertificateArn === undefined || config.CertificateArn === "") {
+            throw new SimCognitoInvalidParameterException("CustomDomainConfig CertificateArn is required: a custom domain is " +
+                "served with a certificate");
+        }
+        this.certificateArn = config.CertificateArn;
+        this.securityPolicy = config.SecurityPolicy;
+    }
+    /**
+     * This configuration as a described domain reports it.
+     */
+    toOutput() {
+        return {
+            CertificateArn: this.certificateArn,
+            ...(this.securityPolicy !== undefined && {
+                SecurityPolicy: this.securityPolicy,
+            }),
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-custom-domain-config.js.map

package/dist/service/cognito/user-pool/domain/sim-cognito-custom-domain-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-custom-domain-config.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/domain/sim-cognito-custom-domain-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAWvF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,4BAA4B;IACvB,cAAc,CAAS;IACvB,cAAc,CAAqB;IAEnD,YAAY,MAAwC;QAClD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,MAAM,CAAC,cAAc,KAAK,EAAE,EAAE,CAAC;YACxE,MAAM,IAAI,mCAAmC,CAC3C,oEAAoE;gBAClE,2BAA2B,CAC9B,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI;gBACvC,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC;SACH,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/domain/sim-cognito-domain-name.d.ts

@@ -0,0 +1,58 @@
+interface SimCognitoDomainNameProperties {
+    readonly value: string | undefined;
+    /**
+     * Whether the request asked for a custom domain, which is what a
+     * `CustomDomainConfig` says. A prefix and a custom domain are validated
+     * differently, and the request rather than the value is what decides which
+     * one is being asked for.
+     */
+    readonly custom: boolean;
+    /** The region the pool lives in, which a prefix domain is served under. */
+    readonly regionName: string;
+}
+/**
+ * The domain string of one user pool domain, and the hostname it is served on.
+ *
+ * A prefix domain is one DNS label, and Cognito puts it under
+ * `auth.<region>.amazoncognito.com`. A custom domain is the whole hostname,
+ * which the request owns rather than Cognito. The two are different enough
+ * that a value is checked against the form the request asked for rather than
+ * being guessed at from the value itself.
+ */
+export declare class SimCognitoDomainName {
+    readonly value: string;
+    readonly custom: boolean;
+    /**
+     * The hostname real Cognito would serve this domain on.
+     */
+    readonly hostname: string;
+    constructor(properties: SimCognitoDomainNameProperties);
+    private static required;
+    /**
+     * The hostname this domain answers on inside the simulation.
+     *
+     * Serving drops the AWS domain from an AWS hostname, in the same way it
+     * drops `.amazonaws.com` from an S3 endpoint, so a prefix domain is reached
+     * locally by the part in front of it. A custom domain is the hostname the
+     * request chose, and there is nothing to drop.
+     */
+    get localHostname(): string;
+    /**
+     * Check a prefix domain, which is one label with no reserved word in it.
+     *
+     * Real Cognito refuses a prefix containing `aws`, `amazon` or `cognito`, and
+     * a pool deployed with one here would fail on the way to AWS rather than
+     * here.
+     */
+    private requirePrefix;
+    /**
+     * Check a custom domain, which is a fully qualified name below a domain the
+     * request owns.
+     *
+     * Real Cognito requires a subdomain rather than a bare registered domain,
+     * so `auth.example.com` is accepted and `example.com` is not.
+     */
+    private requireCustomDomain;
+}
+export {};
+//# sourceMappingURL=sim-cognito-domain-name.d.ts.map

package/dist/service/cognito/user-pool/domain/sim-cognito-domain-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-domain-name.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/domain/sim-cognito-domain-name.ts"],"names":[],"mappings":"AA0CA,UAAU,8BAA8B;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEzB,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,MAAM,EAAE,OAAO,CAAC;IAEhC;;OAEG;IACH,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,YAAY,UAAU,EAAE,8BAA8B,EAarD;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;IAiBvB;;;;;;;OAOG;IACH,IAAI,aAAa,IAAI,MAAM,CAM1B;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAmBrB;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;CAU5B"}

package/dist/service/cognito/user-pool/domain/sim-cognito-domain-name.js

@@ -0,0 +1,123 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * How long a domain string may be, prefix and custom alike.
+ */
+const maxDomainLength = 63;
+/**
+ * The characters one DNS label holds, which is what a prefix domain is.
+ */
+const domainLabelPattern = /^[\da-z-]+$/u;
+/**
+ * Whether a value is one DNS label: those characters, starting and ending with
+ * a letter or a number.
+ *
+ * The first and last characters are checked separately rather than in the
+ * pattern, because a pattern saying all three things at once is the kind that
+ * backtracks.
+ */
+function isDomainLabel(value) {
+    const first = value.at(0) ?? "";
+    const last = value.at(-1) ?? "";
+    return domainLabelPattern.test(value) && first !== "-" && last !== "-";
+}
+/**
+ * The words real Cognito refuses in a prefix domain.
+ */
+const reservedWords = ["aws", "amazon", "cognito"];
+/**
+ * The label a hosted domain sits under, between the prefix and the region.
+ */
+const cognitoDomainHostLabel = "auth";
+/**
+ * The domain suffix real Cognito serves a prefix domain on.
+ */
+const cognitoDomainHostSuffix = "amazoncognito.com";
+/**
+ * The domain string of one user pool domain, and the hostname it is served on.
+ *
+ * A prefix domain is one DNS label, and Cognito puts it under
+ * `auth.<region>.amazoncognito.com`. A custom domain is the whole hostname,
+ * which the request owns rather than Cognito. The two are different enough
+ * that a value is checked against the form the request asked for rather than
+ * being guessed at from the value itself.
+ */
+export class SimCognitoDomainName {
+    value;
+    custom;
+    /**
+     * The hostname real Cognito would serve this domain on.
+     */
+    hostname;
+    constructor(properties) {
+        this.value = SimCognitoDomainName.required(properties.value);
+        this.custom = properties.custom;
+        if (this.custom) {
+            this.requireCustomDomain();
+            this.hostname = this.value;
+        }
+        else {
+            this.requirePrefix();
+            this.hostname =
+                `${this.value}.${cognitoDomainHostLabel}.` +
+                    `${properties.regionName}.${cognitoDomainHostSuffix}`;
+        }
+    }
+    static required(value) {
+        if (value === undefined || value === "") {
+            throw new SimCognitoInvalidParameterException("Domain is required: name the domain the pool is served on");
+        }
+        if (value.length > maxDomainLength) {
+            throw new SimCognitoInvalidParameterException(`Domain '${value}' is too long: a domain is at most ` +
+                `${String(maxDomainLength)} characters`);
+        }
+        return value;
+    }
+    /**
+     * The hostname this domain answers on inside the simulation.
+     *
+     * Serving drops the AWS domain from an AWS hostname, in the same way it
+     * drops `.amazonaws.com` from an S3 endpoint, so a prefix domain is reached
+     * locally by the part in front of it. A custom domain is the hostname the
+     * request chose, and there is nothing to drop.
+     */
+    get localHostname() {
+        if (this.custom) {
+            return this.value;
+        }
+        return this.hostname.replace(`.${cognitoDomainHostSuffix}`, "");
+    }
+    /**
+     * Check a prefix domain, which is one label with no reserved word in it.
+     *
+     * Real Cognito refuses a prefix containing `aws`, `amazon` or `cognito`, and
+     * a pool deployed with one here would fail on the way to AWS rather than
+     * here.
+     */
+    requirePrefix() {
+        if (!isDomainLabel(this.value)) {
+            throw new SimCognitoInvalidParameterException(`Domain '${this.value}' is not a domain prefix: a prefix is lower ` +
+                `case letters, numbers and hyphens, starting and ending with a ` +
+                `letter or a number`);
+        }
+        const reserved = reservedWords.find((word) => this.value.includes(word));
+        if (reserved !== undefined) {
+            throw new SimCognitoInvalidParameterException(`Domain '${this.value}' contains the reserved word '${reserved}': a ` +
+                `domain prefix cannot contain ${reservedWords.join(", ")}`);
+        }
+    }
+    /**
+     * Check a custom domain, which is a fully qualified name below a domain the
+     * request owns.
+     *
+     * Real Cognito requires a subdomain rather than a bare registered domain,
+     * so `auth.example.com` is accepted and `example.com` is not.
+     */
+    requireCustomDomain() {
+        const labels = this.value.split(".");
+        if (labels.length < 3 || labels.some((label) => !isDomainLabel(label))) {
+            throw new SimCognitoInvalidParameterException(`Domain '${this.value}' is not a custom domain: a custom domain is a ` +
+                `fully qualified subdomain, such as 'auth.example.com'`);
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-domain-name.js.map

package/dist/service/cognito/user-pool/domain/sim-cognito-domain-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-domain-name.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/domain/sim-cognito-domain-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;GAEG;AACH,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;GAEG;AACH,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAE1C;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEhC,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAEnD;;GAEG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC;;GAEG;AACH,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAiBpD;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoB;IACf,KAAK,CAAS;IACd,MAAM,CAAU;IAEhC;;OAEG;IACa,QAAQ,CAAS;IAEjC,YAAY,UAA0C;QACpD,IAAI,CAAC,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAEhC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ;gBACX,GAAG,IAAI,CAAC,KAAK,IAAI,sBAAsB,GAAG;oBAC1C,GAAG,UAAU,CAAC,UAAU,IAAI,uBAAuB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,KAAyB;QAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAmC,CAC3C,WAAW,KAAK,qCAAqC;gBACnD,GAAG,MAAM,CAAC,eAAe,CAAC,aAAa,CAC1C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,aAAa;QACf,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,uBAAuB,EAAE,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;OAMG;IACK,aAAa;QACnB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,mCAAmC,CAC3C,WAAW,IAAI,CAAC,KAAK,8CAA8C;gBACjE,gEAAgE;gBAChE,oBAAoB,CACvB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAEzE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,mCAAmC,CAC3C,WAAW,IAAI,CAAC,KAAK,iCAAiC,QAAQ,OAAO;gBACnE,gCAAgC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,mCAAmC,CAC3C,WAAW,IAAI,CAAC,KAAK,iDAAiD;gBACpE,uDAAuD,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/domain/sim-cognito-pool-domains.d.ts

@@ -0,0 +1,33 @@
+import type { SimCreateUserPoolDomainCommandInput } from "../../command/domain/user-pool-domain.command.js";
+import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
+import { SimCognitoUserPoolDomain } from "./sim-cognito-user-pool-domain.js";
+/**
+ * The one domain a pool can have: building the one a request asked for, and
+ * resolving the one the pool holds.
+ *
+ * A `CustomDomainConfig` is what says the request wants a custom domain rather
+ * than a Cognito prefix, so it decides both how the domain string is checked
+ * and whether a certificate is required.
+ */
+export declare class SimCognitoPoolDomains {
+    /**
+     * Refuse a second domain on a pool that has one.
+     *
+     * Real Cognito allows one domain per pool, prefix or custom, so a request
+     * adding another is refused rather than quietly replacing what is there.
+     */
+    private static requireNoDomain;
+    private static customDomainConfig;
+    /**
+     * Make a pool's domain, refusing a pool that already has one.
+     */
+    make(pool: SimCognitoUserPool, input: SimCreateUserPoolDomainCommandInput): SimCognitoUserPoolDomain;
+    /**
+     * The domain a delete request named, or a refusal.
+     *
+     * Real Cognito answers a request naming a domain the pool does not hold the
+     * same way it answers one naming no pool at all, and says no more than that.
+     */
+    require(pool: SimCognitoUserPool, domainValue: string | undefined): SimCognitoUserPoolDomain;
+}
+//# sourceMappingURL=sim-cognito-pool-domains.d.ts.map

package/dist/service/cognito/user-pool/domain/sim-cognito-pool-domains.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-pool-domains.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/domain/sim-cognito-pool-domains.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AAC5G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAOtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAE7E;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;IAW9B,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAUjC;;OAEG;IACH,IAAI,CACF,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,mCAAmC,GACzC,wBAAwB,CAiB1B;IAED;;;;;OAKG;IACH,OAAO,CACL,IAAI,EAAE,kBAAkB,EACxB,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,wBAAwB,CAU1B;CACF"}