@kensio/yulin 1.16.0 → 1.16.1

package/README.md

@@ -54,9 +54,9 @@ npm i -D @kensio/yulin
 
 ### Intercept AWS SDK clients
 
-If your code uses the AWS SDK, you can intercept AWS SDK clients and route their Commands to
-simulated AWS services. Your implementation code uses the SDK as normal and never needs to know that
-it's dealing with a simulator behind the scenes:
+If your code uses the AWS SDK, you can intercept its clients and route their Commands to simulated
+AWS services. Your implementation code uses the SDK as normal and never needs to know a simulator is
+answering:
 
 ```typescript
 import {
@@ -90,9 +90,9 @@ simSdk.restoreAll(); // Or `using simSdk = new SimSdk();` to restore on scope ex
 ```
 
 You can intercept a client class, as above, or a single client instance. The simulated Account and
-Region scope is resolved per send: the Region comes from the sending client's configuration, and
-the Account from the ambient `simAws.runAs(...)` caller when one is set, falling back to the
-simulation defaults.
+Region scope is resolved per send. The Region comes from the sending client's configuration, and the
+Account from the ambient `simAws.runAs(...)` caller when one is set, falling back to the simulation
+defaults.
 
 Each `SimSdk` owns its own isolated simulated AWS, available as `simSdk.simAws` when a test needs
 to seed or inspect simulated state directly. To share state with an existing simulation, wrap it
@@ -130,8 +130,8 @@ await simAws.region("eu-west-2").dynamoDb().createTable({ ... });
 await simAws.account("111111111111").region("eu-west-2").dynamoDb().createTable({ ... });
 ```
 
-AWS state is simulated internally, so you can test realistic interactions with multiple AWS
-services.
+AWS state is simulated internally. A test can drive realistic interactions across several AWS
+services at once.
 
 An Account ID is a plain string wherever one is accepted. Code that wants to name the type can get a
 `SimAwsAccountId` from `simAwsAccountId(...)`, which refuses anything that is not a 12-digit AWS
@@ -144,8 +144,8 @@ const accountId = simAwsAccountId("111111111111");
 const someOtherAccountId = makeSimAwsAccountId();
 ```
 
-Each instance of `SimAws` is cheap and encapsulated so you can create them wherever you need them.
-It's fine to create a new instance of `SimAws` in every test case or in shared test setup.
+Each instance of `SimAws` is cheap and encapsulated. Make one wherever you need it, in every test
+case or in shared test setup, whichever suits.
 
 If you prefer, you can also instantiate simulated services individually:
 
@@ -209,7 +209,7 @@ const res = await fetch(new URL("/foo/", bucketWebsiteUrl));
 #### Send requests without a port
 
 A test usually wants the same requests with nothing listening. `SimAwsHttp` answers a Fetch API
-`Request` with a `Response` in process, so there is no port for parallel test files to collide over,
+`Request` with a `Response` in process. There is no port for parallel test files to collide over,
 and no server to start or tear down:
 
 ```typescript
@@ -224,24 +224,24 @@ const simAwsHttp = new SimAwsHttp({ simAws });
 const response = await simAwsHttp.fetch("https://www.example.com/");
 ```
 
-Nothing binds a port, so a URL a simulated service gives out is fetched as it is, with no
-`localUrl(...)` adapting, and a hostname a simulated Route53 answers for is requested by its own
-name. Both routes go through the same authentication, routing and service code, so `serveSimAws` is
-what you want only when the request comes from outside the process. See the
-[serving docs](./docs/serve "Serving simulated AWS on localhost docs") for which to reach for.
+A URL a simulated service gives out is fetched as it is, with no `localUrl(...)` adapting, and a
+hostname a simulated Route53 answers for is requested by its own name. Both routes go through the
+same authentication, routing and service code. Reach for `serveSimAws` when the request comes from
+outside the process. See the
+[serving docs](./docs/serve "Serving simulated AWS on localhost docs") for how to choose.
 
 #### Restarting a served environment
 
-A served environment takes an available port by default, so the URL changes every time the process
+A served environment takes an available port by default. The URL changes every time the process
 starts. Pin a port to keep the URL the same across restarts:
 
 ```typescript
 const srv = await serveSimAws({ simAws, port: 4599 });
 ```
 
-Closing the server ends the connections it is holding, so the process can exit rather than being
-kept alive by a browser tab. Yulin does not install signal handlers, so call `close()` from your
-own:
+Closing the server ends the connections it is holding, and the process can then exit. An open
+browser tab would otherwise keep it alive. Yulin installs no signal handlers, so call `close()` from
+your own:
 
 ```typescript
 process.on("SIGTERM", () => {
@@ -250,12 +250,12 @@ process.on("SIGTERM", () => {
 ```
 
 A restart usually overlaps the process it is replacing. `listen` waits a couple of seconds for a
-pinned port that is still held, then throws `SimAwsLocalPortInUse` naming the port, which means
-something other than the outgoing process owns it.
+pinned port that is still held, then throws `SimAwsLocalPortInUse` naming the port. Something other
+than the outgoing process owns it by then.
 
 #### Reload the browser on a restart
 
-Yulin is the only thing in the response path of a page it serves, so it can tell the browser to
+Yulin is the only thing in the response path of a page it serves, and it can tell the browser to
 reload. Turning `liveReload` on puts a small script into the HTML pages served to browsers, and the
 page reloads itself when the process restarts:
 
@@ -273,16 +273,15 @@ the page refreshed:
 yulin watch -- tsx dev.ts
 ```
 
-It watches the working directory, plus the paths Yulin is holding that a module graph never mentions:
-a directory mounted into a Bucket, and a synthesized template. See the
+It watches the working directory. It also watches the paths Yulin is holding that a module graph
+never mentions, a directory mounted into a Bucket and a synthesized template. See the
 [serving docs](./docs/serve "Serving simulated AWS on localhost docs") for what gets the script, what
 is watched, and what is not.
 
 #### Update a stack when its template changes
 
-A synthesized template is data rather than code, so a change to one does not need the process
-restarted. Deploy it with `watch` and Yulin applies the file again whenever it changes, updating the
-stack in place:
+A synthesized template is data, and a change to one needs no restart. Deploy it with `watch` and
+Yulin applies the file again whenever it changes, updating the stack in place:
 
 ```typescript
 await simAws.cloudFormation().deployTemplateFile({
@@ -296,8 +295,8 @@ await simAws.cloudFormation().deployTemplateFile({
 ```
 
 Resources the change left alone keep what they hold, so simulated S3, DynamoDB and SQS survive a
-`cdk synth`. Under `yulin watch` the template is left to the process watching it rather than being a
-reason to restart. See the
+`cdk synth`. Under `yulin watch` the template is left to the process watching it, and never triggers
+a restart. See the
 [CloudFormation docs](./docs/services/cloudformation "Simulated CloudFormation docs") for what an
 update does to each resource.
 
@@ -328,37 +327,36 @@ await simAws.clock().advanceBy({ minutes: 20 });
 // Those session credentials have now expired.
 ```
 
-Advancing runs whatever falls due during the interval and returns once the simulation has settled,
-so the next line can assert. Time belongs to the `SimAws` instance, so moving it never disturbs
-another simulation, or the real clock. See the
+Advancing runs whatever falls due during the interval and returns once the simulation has settled.
+The next line can assert. Time belongs to the `SimAws` instance, so moving it never disturbs another
+simulation, or the real clock. See the
 [simulated time docs](./docs/time "Simulated time docs") for full usage.
 
-## What is yulin?
+## What is Yulin?
 
-TLDR: yulin is an AWS simulator for testing Node.js applications.
+TLDR: Yulin is an AWS simulator for testing Node.js applications.
 
-The simulation is not only local to the machine, but in the same single process
-with the test and application under test. No network or external i/o is
-involved. This is what "isolated" refers to.
+The simulation runs in the same single process as the test and the application
+under test, and not just on the same machine. No network or external i/o is
+involved. That is what "isolated" refers to.
 
 This "isolated system" approach to testing has a few advantages:
 
 - Tests run fast as everything is in memory with no real networking.
-- Test set-up is fast and uncomplicated, as there are no containers or extra
+- Test set-up is quick and uncomplicated, as there are no containers or extra
   dependencies to manage.
 - It's straightforward to use multiple other mocks and simulators alongside
-  yulin, such as [nock](https://github.com/nock/nock), as yulin makes no
+  Yulin, such as [nock](https://github.com/nock/nock), as Yulin makes no
   assumptions about the environment.
-- You can control everything in each isolated test process, such as controlling
-  the current time, even when multiple different AWS services are simulated.
+- You can control everything in each isolated test process, including the
+  current time, even when multiple different AWS services are simulated.
 - One test can cover **meaningful system behaviour** across multiple AWS
   services and applications, such as Lambdas sending events to SQS queues to be
   picked up by other Lambdas, or DynamoDB streams triggering Lambdas.
 
-That last point is the most important. The motivation behind yulin is to enable
-efficient tests that cover the logical behaviour of a system. That is in
-contrast to less valuable microscopic unit tests with fiddly mocks and brittle
-assertions. The goal of yulin is to allow you to test system behaviours that are
+That last point matters most. Yulin exists to make efficient tests that cover
+the logical behaviour of a system, in contrast to microscopic unit tests with
+fiddly mocks and brittle assertions. The behaviours worth testing are the ones
 meaningful to users and stakeholders.
 
 ## What's in a name?

package/dist/service/aws/factory/sim-aws-account-region-service-builder.js

@@ -16,7 +16,7 @@ import { simAwsEcsCollaborators } from "./sim-aws-ecs-collaborators.js";
 import { simAwsLambdaCollaborators } from "./sim-aws-lambda-collaborators.js";
 import { simAwsS3NotificationDestinations } from "./sim-aws-s3-notification-destinations.js";
 import { SimSns } from "../../sns/index.js";
-import { SimAwsSnsDeliveryEndpoints } from "../../sns/delivery/sim-aws-sns-delivery-endpoints.js";
+import { simAwsSnsDeliveryEndpoints } from "../../sns/delivery/sim-aws-sns-delivery-endpoints.js";
 import { SimSts } from "../../sts/sim-sts.js";
 /**
  * Builder for simulated AWS services scoped to one Account and Region.
@@ -172,7 +172,7 @@ export class SimAwsAccountRegionServiceBuilder {
      * and are resolved on delivery rather than here.
      */
     createSns(scope) {
-        const endpoints = new SimAwsSnsDeliveryEndpoints({ simAws: this.simAws });
+        const endpoints = simAwsSnsDeliveryEndpoints({ simAws: this.simAws });
         return new SimSns({ ...this.scoped(scope), deliveryEndpoints: endpoints });
     }
     /** Create simulated EventBridge Scheduler for an Account Region scope. */

package/dist/service/aws/factory/sim-aws-account-region-service-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-account-region-service-builder.js","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-region-service-builder.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,gCAAgC,EAChC,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,sEAAsE,CAAC;AACrH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAClG,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAc9C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,iCAAiC;IAC3B,MAAM,CAAS;IACf,UAAU,CAA4C;IACtD,UAAU,CAAgC;IAC1C,WAAW,CAAiB;IAC5B,iBAAiB,CAAuB;IACxC,eAAe,CAA4B;IAE5D,YAAY,UAAuD;QACjE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED,wDAAwD;IACxD,mEAAmE;IACnE,oBAAoB,CAAC,KAAmC;QACtD,OAAO,IAAI,iBAAiB,CAAC;YAC3B,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,gBAAgB,CAAC,KAAmC;QAClD,OAAO,IAAI,aAAa,CAAC;YACvB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,6BAA6B,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,6BAA6B,CAC3B,KAAmC;QAEnC,OAAO,IAAI,0BAA0B,CAAC;YACpC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO;YACzC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc;YAC9C,gBAAgB,EAAE,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,SAAS,CAAC,KAAmC;QAC3C,OAAO,IAAI,MAAM,CAAC;YAChB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAmC;QACnD,OAAO,IAAI,cAAc,CAAC;YACxB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,eAAe,EAAE,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,UAAU,CAAC,KAAmC;QAC5C,OAAO,IAAI,OAAO,CAAC;YACjB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,YAAY,CAAC,KAAmC;QAC9C,OAAO,IAAI,SAAS,CAAC;YACnB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,yBAAyB,CAAC;gBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK;gBACL,WAAW,EAAE,IAAI,CAAC,iBAAiB;gBACnC,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAmC;QACnD,OAAO,IAAI,cAAc,CAAC;YACxB,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC;YAC1C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAmC;QAC1C,OAAO,IAAI,KAAK,CAAC;YACf,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YACpC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC;YAC1C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,wBAAwB,EAAE,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAmC;QAC3C,MAAM,SAAS,GAAG,IAAI,0BAA0B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAE1E,OAAO,IAAI,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,0EAA0E;IAC1E,eAAe,CAAC,KAAmC;QACjD,OAAO,IAAI,YAAY,CAAC;YACtB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,eAAe,EAAE,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,SAAS,CAAC,KAAmC;QAC3C,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAEtC,OAAO,IAAI,MAAM,CAAC;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CACZ,KAAmC;QAEnC,OAAO,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;CACF"}
+{"version":3,"file":"sim-aws-account-region-service-builder.js","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-region-service-builder.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,gCAAgC,EAChC,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,sEAAsE,CAAC;AACrH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAClG,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAc9C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,iCAAiC;IAC3B,MAAM,CAAS;IACf,UAAU,CAA4C;IACtD,UAAU,CAAgC;IAC1C,WAAW,CAAiB;IAC5B,iBAAiB,CAAuB;IACxC,eAAe,CAA4B;IAE5D,YAAY,UAAuD;QACjE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED,wDAAwD;IACxD,mEAAmE;IACnE,oBAAoB,CAAC,KAAmC;QACtD,OAAO,IAAI,iBAAiB,CAAC;YAC3B,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,gBAAgB,CAAC,KAAmC;QAClD,OAAO,IAAI,aAAa,CAAC;YACvB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,6BAA6B,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,6BAA6B,CAC3B,KAAmC;QAEnC,OAAO,IAAI,0BAA0B,CAAC;YACpC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO;YACzC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc;YAC9C,gBAAgB,EAAE,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,SAAS,CAAC,KAAmC;QAC3C,OAAO,IAAI,MAAM,CAAC;YAChB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAmC;QACnD,OAAO,IAAI,cAAc,CAAC;YACxB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,eAAe,EAAE,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,UAAU,CAAC,KAAmC;QAC5C,OAAO,IAAI,OAAO,CAAC;YACjB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,YAAY,CAAC,KAAmC;QAC9C,OAAO,IAAI,SAAS,CAAC;YACnB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,yBAAyB,CAAC;gBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK;gBACL,WAAW,EAAE,IAAI,CAAC,iBAAiB;gBACnC,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAmC;QACnD,OAAO,IAAI,cAAc,CAAC;YACxB,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC;YAC1C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAmC;QAC1C,OAAO,IAAI,KAAK,CAAC;YACf,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YACpC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC;YAC1C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,wBAAwB,EAAE,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAmC;QAC3C,MAAM,SAAS,GAAG,0BAA0B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtE,OAAO,IAAI,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,0EAA0E;IAC1E,eAAe,CAAC,KAAmC;QACjD,OAAO,IAAI,YAAY,CAAC;YACtB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,eAAe,EAAE,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,SAAS,CAAC,KAAmC;QAC3C,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAEtC,OAAO,IAAI,MAAM,CAAC;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CACZ,KAAmC;QAEnC,OAAO,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/service/cloudfront/origin/custom/sim-cf-custom-origin-request.d.ts

@@ -3,8 +3,9 @@ interface SimCfCustomOriginRequestProperties {
     readonly originPath: string;
     readonly request: Request;
     /**
-     * Headers stating who the Origin request is from, which an Origin whose
-     * origin access control signs carries and an anonymous one does not.
+     * Headers stating who the Origin request is from and what its signature
+     * covers, which an Origin whose origin access control signs carries and an
+     * anonymous one does not.
      */
     readonly signingHeaders?: Readonly<Record<string, string>> | undefined;
 }

package/dist/service/cloudfront/origin/custom/sim-cf-custom-origin-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-custom-origin-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-custom-origin-request.ts"],"names":[],"mappings":"AAGA,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,kCAAkC,GAC7C,OAAO,CAuCT"}
+{"version":3,"file":"sim-cf-custom-origin-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-custom-origin-request.ts"],"names":[],"mappings":"AAGA,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,kCAAkC,GAC7C,OAAO,CAuCT"}

package/dist/service/cloudfront/origin/custom/sim-cf-custom-origin-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-custom-origin-request.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-custom-origin-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAa5F;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAA8C;IAE9C,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEvC,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC;QACnC,KAAK,EAAE,WAAW,UAAU,CAAC,UAAU,EAAE;KAC1C,CAAC,CAAC,KAAK,EAAE,CAAC;IACX,SAAS,CAAC,QAAQ,GAAG,iBAAiB,CACpC,UAAU,CAAC,UAAU,EACrB,SAAS,CAAC,QAAQ,CACnB,CAAC;IACF,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAEpC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAEpC,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,0DAA0D;IAC1D,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAEnC,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAEvE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/D,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACjD,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,UAAkB,EAAE,UAAkB;IAC/D,OAAO,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC"}
+{"version":3,"file":"sim-cf-custom-origin-request.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-custom-origin-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAc5F;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAA8C;IAE9C,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEvC,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC;QACnC,KAAK,EAAE,WAAW,UAAU,CAAC,UAAU,EAAE;KAC1C,CAAC,CAAC,KAAK,EAAE,CAAC;IACX,SAAS,CAAC,QAAQ,GAAG,iBAAiB,CACpC,UAAU,CAAC,UAAU,EACrB,SAAS,CAAC,QAAQ,CACnB,CAAC;IACF,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAEpC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAEpC,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,0DAA0D;IAC1D,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAEnC,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAEvE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/D,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACjD,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,UAAkB,EAAE,UAAkB;IAC/D,OAAO,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC"}

package/dist/service/cloudfront/origin/custom/sim-cf-custom-origin-signer.d.ts

@@ -14,6 +14,9 @@ import type { SimCloudFrontOriginRequest } from "../sim-cloudfront-request-respo
  * the same way anything else calling into simulated AWS in process says who it
  * is.
  *
+ * The payload hash a real signature covers is stated as itself, since it is
+ * the one part of a signature an Origin turns a request away over.
+ *
  * Which Distribution the request belongs to is only known per request, so this
  * answers per fetch rather than when the Origin is built.
  */
@@ -21,8 +24,8 @@ export declare class SimCfCustomOriginSigner {
     private readonly originAccessControl;
     constructor(originAccessControl?: SimCloudFrontOriginAccessControl);
     /**
-     * The headers stating who one Origin request is from, which are none when the
-     * Origin is reached anonymously.
+     * The headers stating who one Origin request is from and what its signature
+     * covers, which are none when the Origin is reached anonymously.
      */
     forRequest(request: SimCloudFrontOriginRequest): Record<string, string>;
 }

package/dist/service/cloudfront/origin/custom/sim-cf-custom-origin-signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-custom-origin-signer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-custom-origin-signer.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6DAA6D,CAAC;AAEpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAExF;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAEtB;IAEd,YAAY,mBAAmB,CAAC,EAAE,gCAAgC,EAEjE;IAED;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,0BAA0B,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAetE;CACF"}
+{"version":3,"file":"sim-cf-custom-origin-signer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-custom-origin-signer.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,6DAA6D,CAAC;AAEpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAYxF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAEtB;IAEd,YAAY,mBAAmB,CAAC,EAAE,gCAAgC,EAEjE;IAED;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,0BAA0B,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBtE;CACF"}

package/dist/service/cloudfront/origin/custom/sim-cf-custom-origin-signer.js

@@ -1,7 +1,17 @@
 import { simAwsCallerHeaderName, simAwsCallerHeaderValue, } from "../../../iam/request/sim-aws-caller-header.js";
 import { simAwsSourceAccountHeaderName, simAwsSourceArnHeaderName, } from "../../../iam/request/sim-aws-request-source.js";
+import { simIamSigV4ContentSha256Header, simIamSigV4UnsignedPayload, } from "../../../iam/sigv4/canonical/sim-iam-sigv4-payload-hash.js";
 import { simCloudFrontDistributionArn } from "../../distribution/sim-cf-distribution-view.js";
 import { simCloudFrontServicePrincipal } from "../../sim-cloudfront-service-principal.js";
+/**
+ * The viewer methods CloudFront has a body to hash for.
+ *
+ * These are the two AWS names on the Function URL Origin documentation, and
+ * the two a viewer sends a body with in practice. Anything else is left alone
+ * rather than guessed at, since refusing a method real CloudFront lets through
+ * would be the more expensive mistake.
+ */
+const bodyCarryingMethods = new Set(["POST", "PUT"]);
 /**
  * Who a CloudFront custom Origin is reached as.
  *
@@ -16,6 +26,9 @@ import { simCloudFrontServicePrincipal } from "../../sim-cloudfront-service-prin
  * the same way anything else calling into simulated AWS in process says who it
  * is.
  *
+ * The payload hash a real signature covers is stated as itself, since it is
+ * the one part of a signature an Origin turns a request away over.
+ *
  * Which Distribution the request belongs to is only known per request, so this
  * answers per fetch rather than when the Origin is built.
  */
@@ -25,8 +38,8 @@ export class SimCfCustomOriginSigner {
         this.originAccessControl = originAccessControl;
     }
     /**
-     * The headers stating who one Origin request is from, which are none when the
-     * Origin is reached anonymously.
+     * The headers stating who one Origin request is from and what its signature
+     * covers, which are none when the Origin is reached anonymously.
      */
     forRequest(request) {
         if (this.originAccessControl?.signs !== true) {
@@ -39,7 +52,30 @@ export class SimCfCustomOriginSigner {
             }),
             [simAwsSourceArnHeaderName]: simCloudFrontDistributionArn(request.distribution),
             [simAwsSourceAccountHeaderName]: request.distribution.accountId,
+            ...payloadDeclaration(request.req),
         };
     }
 }
+/**
+ * What the signature says the Origin request body hashes to.
+ *
+ * CloudFront streams the viewer's body on to the Origin rather than buffering
+ * it, so it has no hash of its own to sign with. It signs the viewer's
+ * `x-amz-content-sha256` when the viewer sent one, and `UNSIGNED-PAYLOAD` when
+ * it did not. A Lambda Function URL does not accept an unsigned payload, so a
+ * POST or PUT that carried no hash through a signing origin access control is
+ * refused at the Origin, which is what real CloudFront and Lambda do with one.
+ *
+ * A viewer's own header travels with the rest of its headers, so nothing is
+ * stated for it here.
+ *
+ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-lambda.html
+ */
+function payloadDeclaration(viewerRequest) {
+    if (!bodyCarryingMethods.has(viewerRequest.method.toUpperCase()) ||
+        viewerRequest.headers.has(simIamSigV4ContentSha256Header)) {
+        return {};
+    }
+    return { [simIamSigV4ContentSha256Header]: simIamSigV4UnsignedPayload };
+}
 //# sourceMappingURL=sim-cf-custom-origin-signer.js.map

package/dist/service/cloudfront/origin/custom/sim-cf-custom-origin-signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-custom-origin-signer.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-custom-origin-signer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAE9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAG1F;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,uBAAuB;IACjB,mBAAmB,CAEtB;IAEd,YAAY,mBAAsD;QAChE,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,OAAmC;QAC5C,IAAI,IAAI,CAAC,mBAAmB,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAChD,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,6BAA6B;aACvC,CAAC;YACF,CAAC,yBAAyB,CAAC,EAAE,4BAA4B,CACvD,OAAO,CAAC,YAAY,CACrB;YACD,CAAC,6BAA6B,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS;SAChE,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cf-custom-origin-signer.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-custom-origin-signer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,4DAA4D,CAAC;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAC;AAE9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAG1F;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAErD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,uBAAuB;IACjB,mBAAmB,CAEtB;IAEd,YAAY,mBAAsD;QAChE,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,OAAmC;QAC5C,IAAI,IAAI,CAAC,mBAAmB,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO;YACL,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC;gBAChD,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,6BAA6B;aACvC,CAAC;YACF,CAAC,yBAAyB,CAAC,EAAE,4BAA4B,CACvD,OAAO,CAAC,YAAY,CACrB;YACD,CAAC,6BAA6B,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS;YAC/D,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC;SACnC,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,kBAAkB,CAAC,aAAsB;IAChD,IACE,CAAC,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5D,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,EACzD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,EAAE,CAAC,8BAA8B,CAAC,EAAE,0BAA0B,EAAE,CAAC;AAC1E,CAAC"}

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-function-url-origin-template.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAC;AAClG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,EACL,KAAK,mCAAmC,EAEzC,MAAM,2CAA2C,CAAC;AAanD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,mBAUlC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC,sFAmFjD,CAAC"}
+{"version":3,"file":"sim-cf-function-url-origin-template.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAC;AAClG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,EACL,KAAK,mCAAmC,EAEzC,MAAM,2CAA2C,CAAC;AAanD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,mBAUlC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC,sFAsFjD,CAAC"}

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.js

@@ -60,8 +60,11 @@ export const simCfFunctionUrlOriginTemplateFactory = new MappedFactory(() => ({
                 FunctionName: "greeter",
                 Role: { "Fn::GetAtt": ["GreeterRole", "Arn"] },
                 Code: {
-                    ZipFile: "exports.handler = async () => " +
-                        "({ statusCode: 200, body: 'Hello from behind CloudFront' });",
+                    // The handler answers with whatever it was sent, so a test about a
+                    // request with a body can see that the body reached it, and one
+                    // about a request without stays as readable as it was.
+                    ZipFile: "exports.handler = async (event) => ({ statusCode: 200, " +
+                        "body: event.body ?? 'Hello from behind CloudFront' });",
                 },
                 Handler: "index.handler",
                 Runtime: "nodejs22.x",

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-function-url-origin-template.factory.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,OAAO,EAEL,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AAEnD,MAAM,wBAAwB,GAAG;IAC/B,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE;QACT;YACE,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE;YAC9C,MAAM,EAAE,gBAAgB;SACzB;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,UAAU,EAAE;QACV,EAAE;QACF;YACE,sBAAsB;YACtB,EAAE,GAAG,EAAE,gBAAgB,EAAE;YACzB,gBAAgB;YAChB,EAAE,GAAG,EAAE,kBAAkB,EAAE;SAC5B;KACF;CACF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,aAAa,CAIpE,GAAG,EAAE,CAAC,CAAC;IACL,eAAe,EAAE,QAAQ;IACzB,mBAAmB,EAAE,IAAI;IACzB,SAAS,EAAE,IAAI;IACf,gBAAgB,EAAE,CAAC,0BAA0B,EAAE,uBAAuB,CAAC;IACvE,mBAAmB,EAAE,oBAAoB;CAC1C,CAAC,EACF,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACV,SAAS,EAAE;QACT,WAAW,EAAE;YACX,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE;gBACV,QAAQ,EAAE,aAAa;gBACvB,wBAAwB,EAAE,wBAAwB;aACnD;SACF;QACD,eAAe,EAAE;YACf,IAAI,EAAE,uBAAuB;YAC7B,UAAU,EAAE;gBACV,YAAY,EAAE,SAAS;gBACvB,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE;gBAC9C,IAAI,EAAE;oBACJ,OAAO,EACL,gCAAgC;wBAChC,8DAA8D;iBACjE;gBACD,OAAO,EAAE,eAAe;gBACxB,OAAO,EAAE,YAAY;aACtB;SACF;QACD,UAAU,EAAE;YACV,IAAI,EAAE,kBAAkB;YACxB,UAAU,EAAE;gBACV,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;gBAC/D,QAAQ,EAAE,SAAS;aACpB;SACF;QACD,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,mBAAmB;QACzD,gBAAgB,EAAE;YAChB,IAAI,EAAE,+BAA+B;YACrC,UAAU,EAAE;gBACV,kBAAkB,EAAE;oBAClB,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,EAAE,EAAE,mBAAmB;4BACvB,4DAA4D;4BAC5D,iDAAiD;4BACjD,UAAU,EAAE;gCACV,YAAY,EAAE;oCACZ,CAAC;oCACD;wCACE,WAAW,EAAE;4CACX,GAAG;4CACH,EAAE,YAAY,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE;yCAChD;qCACF;iCACF;6BACF;4BACD,kBAAkB,EAAE,EAAE,oBAAoB,EAAE,YAAY,EAAE;4BAC1D,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,qBAAqB;yBAC5D;qBACF;oBACD,oBAAoB,EAAE;wBACpB,cAAc,EAAE,mBAAmB;wBACnC,oBAAoB,EAAE,mBAAmB;qBAC1C;iBACF;aACF;SACF;QACD,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,gBAAgB;KACvD;IACD,OAAO,EAAE;QACP,sBAAsB,EAAE;YACtB,KAAK,EAAE,EAAE,YAAY,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE;SAC5D;QACD,eAAe,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE;KACjD;CACF,CAAC,CACH,CAAC"}
+{"version":3,"file":"sim-cf-function-url-origin-template.factory.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,OAAO,EAEL,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AAEnD,MAAM,wBAAwB,GAAG;IAC/B,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE;QACT;YACE,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE;YAC9C,MAAM,EAAE,gBAAgB;SACzB;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,UAAU,EAAE;QACV,EAAE;QACF;YACE,sBAAsB;YACtB,EAAE,GAAG,EAAE,gBAAgB,EAAE;YACzB,gBAAgB;YAChB,EAAE,GAAG,EAAE,kBAAkB,EAAE;SAC5B;KACF;CACF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,aAAa,CAIpE,GAAG,EAAE,CAAC,CAAC;IACL,eAAe,EAAE,QAAQ;IACzB,mBAAmB,EAAE,IAAI;IACzB,SAAS,EAAE,IAAI;IACf,gBAAgB,EAAE,CAAC,0BAA0B,EAAE,uBAAuB,CAAC;IACvE,mBAAmB,EAAE,oBAAoB;CAC1C,CAAC,EACF,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACV,SAAS,EAAE;QACT,WAAW,EAAE;YACX,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE;gBACV,QAAQ,EAAE,aAAa;gBACvB,wBAAwB,EAAE,wBAAwB;aACnD;SACF;QACD,eAAe,EAAE;YACf,IAAI,EAAE,uBAAuB;YAC7B,UAAU,EAAE;gBACV,YAAY,EAAE,SAAS;gBACvB,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE;gBAC9C,IAAI,EAAE;oBACJ,mEAAmE;oBACnE,gEAAgE;oBAChE,uDAAuD;oBACvD,OAAO,EACL,yDAAyD;wBACzD,wDAAwD;iBAC3D;gBACD,OAAO,EAAE,eAAe;gBACxB,OAAO,EAAE,YAAY;aACtB;SACF;QACD,UAAU,EAAE;YACV,IAAI,EAAE,kBAAkB;YACxB,UAAU,EAAE;gBACV,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;gBAC/D,QAAQ,EAAE,SAAS;aACpB;SACF;QACD,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,mBAAmB;QACzD,gBAAgB,EAAE;YAChB,IAAI,EAAE,+BAA+B;YACrC,UAAU,EAAE;gBACV,kBAAkB,EAAE;oBAClB,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,EAAE,EAAE,mBAAmB;4BACvB,4DAA4D;4BAC5D,iDAAiD;4BACjD,UAAU,EAAE;gCACV,YAAY,EAAE;oCACZ,CAAC;oCACD;wCACE,WAAW,EAAE;4CACX,GAAG;4CACH,EAAE,YAAY,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE;yCAChD;qCACF;iCACF;6BACF;4BACD,kBAAkB,EAAE,EAAE,oBAAoB,EAAE,YAAY,EAAE;4BAC1D,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,qBAAqB;yBAC5D;qBACF;oBACD,oBAAoB,EAAE;wBACpB,cAAc,EAAE,mBAAmB;wBACnC,oBAAoB,EAAE,mBAAmB;qBAC1C;iBACF;aACF;SACF;QACD,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,gBAAgB;KACvD;IACD,OAAO,EAAE;QACP,sBAAsB,EAAE;YACtB,KAAK,EAAE,EAAE,YAAY,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE;SAC5D;QACD,eAAe,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE;KACjD;CACF,CAAC,CACH,CAAC"}

package/dist/service/cognito/command/hosted/hosted-auth.command.d.ts

@@ -17,6 +17,16 @@ export interface SimCognitoAuthorizeInput {
     readonly idp_identifier?: string | undefined;
     readonly code_challenge?: string | undefined;
     readonly code_challenge_method?: string | undefined;
+    /**
+     * The username a pool's own user signs in with.
+     *
+     * Real Cognito takes these two from the managed login form rather than from
+     * the query string, and a request carrying them here is the form post the
+     * simulation's own sign-in page makes. Naming no identity provider and
+     * carrying these two is what tells a local sign-in from a federated one.
+     */
+    readonly username?: string | undefined;
+    readonly password?: string | undefined;
 }
 /**
  * Where a hosted endpoint sends the browser next.

package/dist/service/cognito/command/hosted/hosted-auth.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-auth.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/hosted-auth.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC"}
+{"version":3,"file":"hosted-auth.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/hosted-auth.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpD;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC"}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.d.ts

@@ -1,9 +1,9 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
-import type { SimCognitoFederatedSignIn } from "../../user-pool/idp/sim-cognito-federated-sign-in.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoHostedSignIn } from "./sim-cognito-hosted-sign-in.js";
 import type { SimCognitoAuthorizeInput, SimCognitoHostedRedirect } from "./hosted-auth.command.js";
 interface SimCognitoAuthorizeEndpointProperties {
-    readonly federatedSignIn: SimCognitoFederatedSignIn;
+    readonly signIn: SimCognitoHostedSignIn;
     readonly clock: SimClock;
 }
 /**
@@ -11,25 +11,26 @@ interface SimCognitoAuthorizeEndpointProperties {
  *
  * Real Cognito answers this request in one of two ways: it sends the browser
  * to an identity provider's sign-in page when the request names a provider,
- * and to managed login's own page when it does not. Only the first has an
- * equivalent here, because the second is a web page a person fills in, and a
- * simulation of a person filling it in would be a simulation of nothing.
+ * and to managed login's own form when it does not. Both end in the same
+ * place, which is the app client's callback URL carrying an authorization
+ * code, and both end there here.
  *
- * So a request naming a provider signs in the user that provider has been told
- * is signed in at it, and answers with the code real Cognito would answer
- * with. A request naming no provider, or naming the pool's own users, is
- * refused with a message saying so, rather than being answered with a page or
- * with a user nothing put there.
+ * A request naming a provider signs in the user that provider has been told is
+ * signed in at it. A request naming none signs in one of the pool's own users,
+ * with the username and password real managed login would have taken from its
+ * form. Nothing here draws the form: the serving layer is what answers a
+ * browser with a page, and a test calling this directly passes the two fields
+ * the form would have posted.
  */
 export declare class SimCognitoAuthorizeEndpoint {
-    private readonly federatedSignIn;
+    private readonly signIn;
     private readonly clock;
     private readonly hostedClient;
     private readonly request;
     constructor(properties: SimCognitoAuthorizeEndpointProperties);
     /**
-     * Sign a user in through an identity provider, and send the browser back to
-     * the application with an authorization code.
+     * Sign a user in, and send the browser back to the application with an
+     * authorization code.
      */
     handle(pool: SimCognitoUserPool, input: SimCognitoAuthorizeInput): SimCognitoHostedRedirect;
     private redirectWithCode;

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authorize-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAInF,OAAO,KAAK,EACV,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAElC,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,wBAAwB,GAC9B,wBAAwB,CAqC1B;IAED,OAAO,CAAC,gBAAgB;CAezB"}
+{"version":3,"file":"sim-cognito-authorize-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAInF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EACV,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAElC,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,wBAAwB,GAC9B,wBAAwB,CAgC1B;IAED,OAAO,CAAC,gBAAgB;CAezB"}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.js

@@ -7,28 +7,29 @@ import { SimCognitoHostedClient } from "./sim-cognito-hosted-client.js";
  *
  * Real Cognito answers this request in one of two ways: it sends the browser
  * to an identity provider's sign-in page when the request names a provider,
- * and to managed login's own page when it does not. Only the first has an
- * equivalent here, because the second is a web page a person fills in, and a
- * simulation of a person filling it in would be a simulation of nothing.
+ * and to managed login's own form when it does not. Both end in the same
+ * place, which is the app client's callback URL carrying an authorization
+ * code, and both end there here.
  *
- * So a request naming a provider signs in the user that provider has been told
- * is signed in at it, and answers with the code real Cognito would answer
- * with. A request naming no provider, or naming the pool's own users, is
- * refused with a message saying so, rather than being answered with a page or
- * with a user nothing put there.
+ * A request naming a provider signs in the user that provider has been told is
+ * signed in at it. A request naming none signs in one of the pool's own users,
+ * with the username and password real managed login would have taken from its
+ * form. Nothing here draws the form: the serving layer is what answers a
+ * browser with a page, and a test calling this directly passes the two fields
+ * the form would have posted.
  */
 export class SimCognitoAuthorizeEndpoint {
-    federatedSignIn;
+    signIn;
     clock;
     hostedClient = new SimCognitoHostedClient();
     request = new SimCognitoAuthorizeRequest();
     constructor(properties) {
-        this.federatedSignIn = properties.federatedSignIn;
+        this.signIn = properties.signIn;
         this.clock = properties.clock;
     }
     /**
-     * Sign a user in through an identity provider, and send the browser back to
-     * the application with an authorization code.
+     * Sign a user in, and send the browser back to the application with an
+     * authorization code.
      */
     handle(pool, input) {
         const client = this.hostedClient.forAuthorize(pool, input.client_id);
@@ -40,12 +41,7 @@ export class SimCognitoAuthorizeEndpoint {
         this.hostedClient.requireCodeGrant(client, true);
         this.request.requireChallengeMethod(input);
         const scopes = new SimCognitoGrantedScopes(client, input.scope);
-        const provider = this.request.requiredProvider(pool, client, input);
-        const user = this.federatedSignIn.signIn({
-            pool,
-            provider,
-            now: this.clock.now(),
-        });
+        const user = this.signIn.signIn(pool, client, input);
         const code = new SimCognitoAuthorizationCode({
             username: user.username,
             clientId: client.id,

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authorize-endpoint.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AAGrG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAWxE;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,2BAA2B;IACrB,eAAe,CAA4B;IAC3C,KAAK,CAAW;IAChB,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC5C,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE5D,YAAY,UAAiD;QAC3D,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,KAA+B;QAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CACvD,MAAM,EACN,KAAK,CAAC,YAAY,CACnB,CAAC;QAEF,wEAAwE;QACxE,0EAA0E;QAC1E,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAI,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACvC,IAAI;YACJ,QAAQ;YACR,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,IAAI,2BAA2B,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,KAAK,CAAC,cAAc;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAErC,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACrE,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,WAAmB,EACnB,IAAY,EACZ,KAAyB;QAEzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-authorize-endpoint.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AAErG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAyB;IAC/B,KAAK,CAAW;IAChB,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC5C,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE5D,YAAY,UAAiD;QAC3D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,KAA+B;QAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CACvD,MAAM,EACN,KAAK,CAAC,YAAY,CACnB,CAAC;QAEF,wEAAwE;QACxE,0EAA0E;QAC1E,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAI,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAErD,MAAM,IAAI,GAAG,IAAI,2BAA2B,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,KAAK,CAAC,cAAc;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAErC,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACrE,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,WAAmB,EACnB,IAAY,EACZ,KAAyB;QAEzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-request.d.ts

@@ -25,13 +25,22 @@ export declare class SimCognitoAuthorizeRequest {
      */
     requireChallengeMethod(input: SimCognitoAuthorizeInput): void;
     /**
-     * The identity provider this request signs the user in through.
+     * The identity provider this request signs the user in through, and nothing
+     * where it signs one of the pool's own users in.
      *
-     * A request naming none would reach managed login on real Cognito, which is
-     * a page rather than anything an API answers, so it is refused here with a
-     * message saying what to do instead.
+     * A request naming no provider, or naming `COGNITO`, is a local sign-in: on
+     * real Cognito it reaches managed login's own form, and here it carries the
+     * username and password that form would have posted.
      */
-    requiredProvider(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput): SimCognitoUserPoolIdentityProvider;
-    private requireSupportedProvider;
+    signInProvider(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput): SimCognitoUserPoolIdentityProvider | undefined;
+    /**
+     * Refuse a provider the app client does not offer.
+     *
+     * `COGNITO` is checked the same way, because real Cognito treats it as one
+     * of the entries in `SupportedIdentityProviders`: a client without it there
+     * signs nobody in at the hosted domain with a password, however many local
+     * users the pool holds.
+     */
+    private requireSupportedProviderName;
 }
 //# sourceMappingURL=sim-cognito-authorize-request.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-authorize-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authorize-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-request.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,gEAAgE,CAAC;AACzH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAiBzE;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC;;OAEG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAuB1D;IAED;;;;;;;OAOG;IACH,sBAAsB,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI,CA8B5D;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,GAC9B,kCAAkC,CA6BpC;IAED,OAAO,CAAC,wBAAwB;CAejC"}
+{"version":3,"file":"sim-cognito-authorize-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-request.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,gEAAgE,CAAC;AACzH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAqBzE;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC;;OAEG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAuB1D;IAED;;;;;;;OAOG;IACH,sBAAsB,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI,CA8B5D;IAED;;;;;;;OAOG;IACH,cAAc,CACZ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,GAC9B,kCAAkC,GAAG,SAAS,CAuBhD;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,4BAA4B;CAerC"}