@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/apigatewayv2/serve/auth/sim-http-api-authorizer-invocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-authorizer-invocation.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-authorizer-invocation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAC5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AAC3G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;AAE5F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAKhF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,WAAW,CACT,SAAS,EAAE,mBAAmB,GAC7B,wBAAwB,GAAG,SAAS,CAAC;CACzC;AAED,UAAU,wCAAwC;IAChD,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAEhE,YAAY,UAAU,EAAE,wCAAwC,EAK/D;IAED;;OAEG;IACG,MAAM,CACV,KAAK,EAAE,6BAA6B,EACpC,UAAU,EAAE,2BAA2B,EACvC,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAkClC;CACF"}
+{"version":3,"file":"sim-http-api-authorizer-invocation.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-authorizer-invocation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAC5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AAC3G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;AAE5F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAKnF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,WAAW,CACT,SAAS,EAAE,mBAAmB,GAC7B,wBAAwB,GAAG,SAAS,CAAC;CACzC;AAED,UAAU,wCAAwC;IAChD,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAEhE,YAAY,UAAU,EAAE,wCAAwC,EAK/D;IAED;;OAEG;IACG,MAAM,CACV,KAAK,EAAE,6BAA6B,EACpC,UAAU,EAAE,2BAA2B,EACvC,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAkClC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.d.ts

@@ -1,20 +1,15 @@
 import type { SimIamAuthorizationDecision, SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
-import type { SimLambdaFunction } from "../../../lambda/function/sim-lambda-function.js";
 import type { SimHttpApiRequestAuthorizer } from "../../api/authorizer/sim-http-api-request-authorizer.js";
 import { SimHttpApiExecuteApiArn } from "../../api/sim-http-api-execute-api-arn.js";
 import type { SimHttpApi } from "../../api/sim-http-api.js";
-import type { SimHttpApiFunctionTarget } from "../sim-api-gateway-v2-router.js";
-/**
- * The service principal API Gateway invokes a Lambda function as, whether that
- * function is behind an integration or behind an authorizer.
- */
-export declare const simApiGatewayServicePrincipal = "apigateway.amazonaws.com";
+import type { SimHttpApiFunctionTarget } from "../sim-http-api-function-target.js";
 interface SimHttpApiInvokeAuthorizerProperties {
     readonly iam: SimIamInterServiceAuthZ;
 }
 interface SimHttpApiInvokeAuthorizationInput {
     readonly api: SimHttpApi;
-    readonly simFunction: SimLambdaFunction;
+    /** The function to invoke, and the resource the grant was made on. */
+    readonly target: SimHttpApiFunctionTarget;
     readonly sourceArn: SimHttpApiExecuteApiArn;
 }
 /**
@@ -45,6 +40,10 @@ export declare class SimHttpApiInvokeAuthorizer {
      * usable as an authorizer. The API's own Account is supplied as
      * `AWS:SourceAccount`, which is the Account the source ARN names rather than
      * the one owning the function.
+     *
+     * A URI ending in a version or an alias is decided against that resource and
+     * its own policy. An integration on `orders:live` needs a grant made on
+     * `live`.
      */
     authorize(input: SimHttpApiInvokeAuthorizationInput): SimIamAuthorizationDecision;
 }

package/dist/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-invoke-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AAC3G,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmC;IAEpE,YAAY,UAAU,EAAE,oCAAoC,EAI3D;IAED;;;;;;;;;OASG;IACH,SAAS,CACP,KAAK,EAAE,kCAAkC,GACxC,2BAA2B,CAO7B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,UAAU,EACf,UAAU,EAAE,2BAA2B,EACvC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAST"}
+{"version":3,"file":"sim-http-api-invoke-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AAC3G,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAEnF,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmC;IAEpE,YAAY,UAAU,EAAE,oCAAoC,EAI3D;IAED;;;;;;;;;;;;;OAaG;IACH,SAAS,CACP,KAAK,EAAE,kCAAkC,GACxC,2BAA2B,CAO7B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,UAAU,EACf,UAAU,EAAE,2BAA2B,EACvC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAST"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.js

@@ -1,10 +1,6 @@
+import { simApiGatewayServicePrincipal } from "../../../apigateway/sim-api-gateway-service-principal.js";
 import { SimLambdaServiceInvokeAuthorizer } from "../../../lambda/command/authorize/sim-lambda-service-invoke-authorizer.js";
 import { SimHttpApiExecuteApiArn } from "../../api/sim-http-api-execute-api-arn.js";
-/**
- * The service principal API Gateway invokes a Lambda function as, whether that
- * function is behind an integration or behind an authorizer.
- */
-export const simApiGatewayServicePrincipal = "apigateway.amazonaws.com";
 /**
  * Decides whether an HTTP API may invoke one of its Lambda functions.
  *
@@ -37,10 +33,14 @@ export class SimHttpApiInvokeAuthorizer {
      * usable as an authorizer. The API's own Account is supplied as
      * `AWS:SourceAccount`, which is the Account the source ARN names rather than
      * the one owning the function.
+     *
+     * A URI ending in a version or an alias is decided against that resource and
+     * its own policy. An integration on `orders:live` needs a grant made on
+     * `live`.
      */
     authorize(input) {
         return this.lambdaAuthorizer.authorize({
-            simFunction: input.simFunction,
+            resource: input.target.resource,
             servicePrincipal: simApiGatewayServicePrincipal,
             sourceArn: input.sourceArn.toString(),
             sourceAccount: input.api.accountRegionScope.accountId,
@@ -57,7 +57,7 @@ export class SimHttpApiInvokeAuthorizer {
 export function simHttpApiMayNotInvokeAuthorizer(api, authorizer, target) {
     return new SimHttpApiInvokeAuthorizer({ iam: target.iam }).authorize({
         api,
-        simFunction: target.simFunction,
+        target,
         sourceArn: SimHttpApiExecuteApiArn.forAuthorizer(api, authorizer.authorizerId),
     }).isDenied;
 }

package/dist/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-invoke-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAG7H,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAIpF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AAYxE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,0BAA0B;IACpB,gBAAgB,CAAmC;IAEpE,YAAY,UAAgD;QAC1D,IAAI,CAAC,gBAAgB,GAAG,IAAI,gCAAgC,CAAC;YAC3D,GAAG,EAAE,UAAU,CAAC,GAAG;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,SAAS,CACP,KAAyC;QAEzC,OAAO,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YACrC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,gBAAgB,EAAE,6BAA6B;YAC/C,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE;YACrC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,SAAS;SACtD,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAC9C,GAAe,EACf,UAAuC,EACvC,MAAgC;IAEhC,OAAO,IAAI,0BAA0B,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;QACnE,GAAG;QACH,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,uBAAuB,CAAC,aAAa,CAC9C,GAAG,EACH,UAAU,CAAC,YAAY,CACxB;KACF,CAAC,CAAC,QAAQ,CAAC;AACd,CAAC"}
+{"version":3,"file":"sim-http-api-invoke-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-invoke-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,0DAA0D,CAAC;AAKzG,OAAO,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAE7H,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAepF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,0BAA0B;IACpB,gBAAgB,CAAmC;IAEpE,YAAY,UAAgD;QAC1D,IAAI,CAAC,gBAAgB,GAAG,IAAI,gCAAgC,CAAC;YAC3D,GAAG,EAAE,UAAU,CAAC,GAAG;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,SAAS,CACP,KAAyC;QAEzC,OAAO,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YACrC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;YAC/B,gBAAgB,EAAE,6BAA6B;YAC/C,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE;YACrC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,SAAS;SACtD,CAAC,CAAC;IACL,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAC9C,GAAe,EACf,UAAuC,EACvC,MAAgC;IAEhC,OAAO,IAAI,0BAA0B,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;QACnE,GAAG;QACH,MAAM;QACN,SAAS,EAAE,uBAAuB,CAAC,aAAa,CAC9C,GAAG,EACH,UAAU,CAAC,YAAY,CACxB;KACF,CAAC,CAAC,QAAQ,CAAC;AACd,CAAC"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-jwt-route-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAI5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F,UAAU,sCAAsC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,sCAAsC,EAE7D;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,uBAAuB,CA0CvE;CACF"}
+{"version":3,"file":"sim-http-api-jwt-route-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAG5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F,UAAU,sCAAsC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,sCAAsC,EAE7D;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,uBAAuB,CA0CvE;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.js

@@ -1,5 +1,5 @@
+import { simJwtBearerToken } from "../../../../util/jwt/sim-jwt-bearer-token.js";
 import { SimHttpApiRefused, } from "../../api/authorizer/sim-http-api-authorization.js";
-import { simHttpApiBearerToken } from "../../api/authorizer/sim-http-api-bearer-token.js";
 import { SimHttpApiJwtAuthorizer } from "../../api/authorizer/sim-http-api-jwt-authorizer.js";
 import { SimHttpApiJwtVerification } from "../../api/authorizer/sim-http-api-jwt-verification.js";
 /**
@@ -27,7 +27,7 @@ export class SimHttpApiJwtRouteAuthorizer {
         if (!(authorizer instanceof SimHttpApiJwtAuthorizer)) {
             return SimHttpApiRefused.unauthorized();
         }
-        const presented = simHttpApiBearerToken(authorizer.identitySource.value({
+        const presented = simJwtBearerToken(authorizer.identitySource.value({
             request,
             routeKey: route.routeKey,
         }));

package/dist/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-jwt-route-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,MAAM,uDAAuD,CAAC;AAWlG;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,KAAK,CAAW;IAEjC,YAAY,UAAkD;QAC5D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAoC;QAC5C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QACtC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAExB,2EAA2E;QAC3E,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAElE,IAAI,CAAC,CAAC,UAAU,YAAY,uBAAuB,CAAC,EAAE,CAAC;YACrD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,SAAS,GAAG,qBAAqB,CACrC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC;YAC9B,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CACH,CAAC;QAEF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,yBAAyB,CAAC;YAClD,UAAU,EAAE,GAAG,CAAC,aAAa;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAEjC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,oBAAoB;QACpB,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;YAC1E,OAAO,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"sim-http-api-jwt-route-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-jwt-route-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAEL,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,MAAM,uDAAuD,CAAC;AAWlG;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,KAAK,CAAW;IAEjC,YAAY,UAAkD;QAC5D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAoC;QAC5C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QACtC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAExB,2EAA2E;QAC3E,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAElE,IAAI,CAAC,CAAC,UAAU,YAAY,uBAAuB,CAAC,EAAE,CAAC;YACrD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CACjC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC;YAC9B,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CACH,CAAC;QAEF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,yBAAyB,CAAC;YAClD,UAAU,EAAE,GAAG,CAAC,aAAa;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAEjC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,oBAAoB;QACpB,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;YAC1E,OAAO,iBAAiB,CAAC,SAAS,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-router.d.ts

@@ -1,24 +1,13 @@
 import type { SimAwsServiceTarget } from "../../../serve/controller/sim-service-controller.js";
 import { SimAws } from "../../aws/sim-aws.js";
-import type { SimLambdaFunction } from "../../lambda/function/sim-lambda-function.js";
 import type { SimHttpApiIntegration } from "../api/integration/sim-http-api-integration.js";
 import type { SimHttpApiLambdaUri } from "../api/integration/sim-http-api-lambda-uri.js";
 import type { SimHttpApi } from "../api/sim-http-api.js";
+import type { SimHttpApiFunctionTarget } from "./sim-http-api-function-target.js";
 import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
 interface SimApiGatewayV2RouterProperties {
     readonly simAws?: SimAws;
 }
-/**
- * A function the API invokes, and what decides whether it may.
- */
-export interface SimHttpApiFunctionTarget {
-    readonly simFunction: SimLambdaFunction;
-    /**
-     * IAM of the Account that owns the function, which is what the API's invoke
-     * permission is evaluated against. It need not be the API's Account.
-     */
-    readonly iam: SimIamInterServiceAuthZ;
-}
 /**
  * Routes a served HTTP API request to the API behind it, and an integration to
  * the function behind that.
@@ -64,6 +53,16 @@ export declare class SimApiGatewayV2Router {
      * The function is looked up in the Account and Region its own ARN names, not
      * the API's, because an integration URI and an authorizer URI are each free
      * to name either.
+     *
+     * A version or alias qualifier on the URI is resolved here, once per
+     * request. A route built on an alias runs whichever version the alias points
+     * at now. A qualifier naming neither a version nor an alias answers with
+     * nothing, the way a function that was never created does. Both are
+     * invocation-time failures on real AWS.
+     *
+     * The target carries the resource the URI named as well as the version that
+     * runs. They differ for an alias, and the grant admitting the call was made
+     * on the alias.
      */
     functionFor(lambdaUri: SimHttpApiLambdaUri): SimHttpApiFunctionTarget | undefined;
 }

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-api-gateway-v2-router.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE/F,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAEnG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC;;;;;;OAMG;IACH,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAE9C,YAAY,UAAU,GAAE,+BAAoC,EAG3D;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,EAAE,mBAAmB,GAAG,UAAU,GAAG,SAAS,CAWzD;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,uBAAuB,CAI/C;IAED;;;OAGG;IACH,SAAS,CACP,WAAW,EAAE,qBAAqB,GACjC,wBAAwB,GAAG,SAAS,CAEtC;IAED;;;;;;;OAOG;IACH,WAAW,CACT,SAAS,EAAE,mBAAmB,GAC7B,wBAAwB,GAAG,SAAS,CActC;CACF"}
+{"version":3,"file":"sim-api-gateway-v2-router.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE/F,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAEnG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC;;;;;;OAMG;IACH,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAE9C,YAAY,UAAU,GAAE,+BAAoC,EAG3D;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,EAAE,mBAAmB,GAAG,UAAU,GAAG,SAAS,CAWzD;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,uBAAuB,CAI/C;IAED;;;OAGG;IACH,SAAS,CACP,WAAW,EAAE,qBAAqB,GACjC,wBAAwB,GAAG,SAAS,CAEtC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CACT,SAAS,EAAE,mBAAmB,GAC7B,wBAAwB,GAAG,SAAS,CAUtC;CACF"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-router.js

@@ -20,7 +20,7 @@ export class SimApiGatewayV2Router {
     registry;
     constructor(properties = {}) {
         this.simAws = properties.simAws ?? new SimAws();
-        this.registry = this.simAws.serviceFactory.httpApiRegistry;
+        this.registry = this.simAws.serviceFactory.registries.httpApi;
     }
     /**
      * Find the API a request target addresses.
@@ -61,15 +61,23 @@ export class SimApiGatewayV2Router {
      * The function is looked up in the Account and Region its own ARN names, not
      * the API's, because an integration URI and an authorizer URI are each free
      * to name either.
+     *
+     * A version or alias qualifier on the URI is resolved here, once per
+     * request. A route built on an alias runs whichever version the alias points
+     * at now. A qualifier naming neither a version nor an alias answers with
+     * nothing, the way a function that was never created does. Both are
+     * invocation-time failures on real AWS.
+     *
+     * The target carries the resource the URI named as well as the version that
+     * runs. They differ for an alias, and the grant admitting the call was made
+     * on the alias.
      */
     functionFor(lambdaUri) {
-        const { accountId, regionName, functionName } = lambdaUri;
-        const scope = this.simAws.accountRegionScope(accountId, regionName);
-        const simFunction = scope.lambda().getSimFunctionByName(functionName);
-        if (simFunction === undefined) {
-            return undefined;
-        }
-        return { simFunction, iam: scope.iam() };
+        const scope = this.simAws.accountRegionScope(lambdaUri.accountId, lambdaUri.regionName);
+        const target = scope
+            .lambda()
+            .getSimFunctionTarget(lambdaUri.functionName, lambdaUri.qualifier);
+        return target === undefined ? undefined : { ...target, iam: scope.iam() };
     }
 }
 //# sourceMappingURL=sim-api-gateway-v2-router.js.map

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-api-gateway-v2-router.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-router.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAyB9C;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChC;;;;;;OAMG;IACa,MAAM,CAAS;IAEd,QAAQ,CAAqB;IAE9C,YAAY,UAAU,GAAoC,EAAE;QAC1D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAA2B;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAErE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,MAAM;aACf,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;aAChD,YAAY,EAAE;aACd,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAe;QACpB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,kBAAkB,CAAC;QAEzD,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,SAAS,CACP,WAAkC;QAElC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CACT,SAA8B;QAE9B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;QAE1D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAC1C,SAA4B,EAC5B,UAA2B,CAC5B,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAEtE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"sim-api-gateway-v2-router.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-router.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAa9C;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChC;;;;;;OAMG;IACa,MAAM,CAAS;IAEd,QAAQ,CAAqB;IAE9C,YAAY,UAAU,GAAoC,EAAE;QAC1D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAA2B;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAErE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,MAAM;aACf,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;aAChD,YAAY,EAAE;aACd,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAe;QACpB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,kBAAkB,CAAC;QAEzD,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,SAAS,CACP,WAAkC;QAElC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CACT,SAA8B;QAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAC1C,SAAS,CAAC,SAA4B,EACtC,SAAS,CAAC,UAA2B,CACtC,CAAC;QACF,MAAM,MAAM,GAAG,KAAK;aACjB,MAAM,EAAE;aACR,oBAAoB,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAErE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IAC5E,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/sim-http-api-function-target.d.ts

@@ -0,0 +1,17 @@
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimLambdaFunctionTarget } from "../../lambda/function/version/sim-lambda-function-target.js";
+/**
+ * A function the API invokes, and what decides whether it may.
+ *
+ * What the API invokes is what any service delivering to a function ARN
+ * invokes, so the resource named and the version that runs come from Lambda's
+ * own target. All this adds is the IAM the decision is made in.
+ */
+export interface SimHttpApiFunctionTarget extends SimLambdaFunctionTarget {
+    /**
+     * IAM of the Account that owns the function, which is what the API's invoke
+     * permission is evaluated against. It need not be the API's Account.
+     */
+    readonly iam: SimIamInterServiceAuthZ;
+}
+//# sourceMappingURL=sim-http-api-function-target.d.ts.map

package/dist/service/apigatewayv2/serve/sim-http-api-function-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-function-target.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-http-api-function-target.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6DAA6D,CAAC;AAE3G;;;;;;GAMG;AACH,MAAM,WAAW,wBAAyB,SAAQ,uBAAuB;IACvE;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC"}

package/dist/service/apigatewayv2/serve/sim-http-api-function-target.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-http-api-function-target.js.map

package/dist/service/apigatewayv2/serve/sim-http-api-function-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-function-target.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-http-api-function-target.ts"],"names":[],"mappings":""}

package/dist/service/apigatewayv2/serve/sim-http-api-integration-invocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-integration-invocation.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-http-api-integration-invocation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,gCAAgC,CAAC;AAGxC,UAAU,yCAAyC;IACjD,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAC;CAC5C;AAED;;;;;;;;GAQG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IAEpE,YAAY,UAAU,EAAE,yCAAyC,EAKhE;IAED;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,oCAAoC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8B3E;IAED;;;;;OAKG;IACH,OAAO,CAAC,YAAY;CAgBrB"}
+{"version":3,"file":"sim-http-api-integration-invocation.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-http-api-integration-invocation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAI5E,UAAU,yCAAyC;IACjD,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAC;CAC5C;AAED;;;;;;;;GAQG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IACvD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IAEpE,YAAY,UAAU,EAAE,yCAAyC,EAKhE;IAED;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,oCAAoC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8B3E;IAED;;;;;OAKG;IACH,OAAO,CAAC,YAAY;CAgBrB"}

package/dist/service/apigatewayv2/serve/sim-http-api-integration-invocation.js

@@ -62,7 +62,7 @@ export class SimHttpApiIntegrationInvocation {
         const { api, match, request } = input;
         return new SimHttpApiInvokeAuthorizer({ iam: target.iam }).authorize({
             api,
-            simFunction: target.simFunction,
+            target,
             sourceArn: SimHttpApiExecuteApiArn.forMatchedRoute(api, match, request.method),
         }).isDenied;
     }

package/dist/service/apigatewayv2/serve/sim-http-api-integration-invocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-integration-invocation.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-http-api-integration-invocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AAIxG,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAKtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAgBhE;;;;;;;;GAQG;AACH,MAAM,OAAO,+BAA+B;IACzB,MAAM,CAAwB;IAC9B,YAAY,CAA0B;IACtC,eAAe,GAAG,IAAI,0BAA0B,EAAE,CAAC;IACnD,aAAa,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAEpE,YAAY,UAAqD;QAC/D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,IAAI,uBAAuB,CAAC;YAC9C,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAA2C;QACtD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAExD,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7D,kEAAkE;YAClE,wEAAwE;YACxE,uEAAuE;YACvE,OAAO,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC;QAClD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CACzC,OAAO,EACP,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,EAC9B;gBACE,GAAG,EAAE,aAAa,CAAC,GAAG;gBACtB,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,MAAM,EAAE,aAAa,CAAC,MAAM;aAC7B,CACF,CAAC;YAEF,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,oEAAoE;YACpE,sEAAsE;YACtE,YAAY;YACZ,OAAO,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,YAAY,CAClB,KAA2C,EAC3C,MAAgC;QAEhC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAEtC,OAAO,IAAI,0BAA0B,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;YACnE,GAAG;YACH,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,uBAAuB,CAAC,eAAe,CAChD,GAAG,EACH,KAAK,EACL,OAAO,CAAC,MAAM,CACf;SACF,CAAC,CAAC,QAAQ,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"sim-http-api-integration-invocation.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-http-api-integration-invocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AAIxG,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAGtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAgBhE;;;;;;;;GAQG;AACH,MAAM,OAAO,+BAA+B;IACzB,MAAM,CAAwB;IAC9B,YAAY,CAA0B;IACtC,eAAe,GAAG,IAAI,0BAA0B,EAAE,CAAC;IACnD,aAAa,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAEpE,YAAY,UAAqD;QAC/D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,IAAI,uBAAuB,CAAC;YAC9C,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAA2C;QACtD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAExD,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7D,kEAAkE;YAClE,wEAAwE;YACxE,uEAAuE;YACvE,OAAO,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC;QAClD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CACzC,OAAO,EACP,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,EAC9B;gBACE,GAAG,EAAE,aAAa,CAAC,GAAG;gBACtB,MAAM,EAAE,aAAa,CAAC,MAAM;gBAC5B,MAAM,EAAE,aAAa,CAAC,MAAM;aAC7B,CACF,CAAC;YAEF,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,oEAAoE;YACpE,sEAAsE;YACtE,YAAY;YACZ,OAAO,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,YAAY,CAClB,KAA2C,EAC3C,MAAgC;QAEhC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAEtC,OAAO,IAAI,0BAA0B,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;YACnE,GAAG;YACH,MAAM;YACN,SAAS,EAAE,uBAAuB,CAAC,eAAe,CAChD,GAAG,EACH,KAAK,EACL,OAAO,CAAC,MAAM,CACf;SACF,CAAC,CAAC,QAAQ,CAAC;IACd,CAAC;CACF"}

package/dist/service/aws/factory/sim-aws-account-region-service-builder.d.ts

@@ -15,6 +15,7 @@ import { SimS3 } from "../../s3/sim-s3.js";
 import { SimScheduler } from "../../scheduler/index.js";
 import { SimSns } from "../../sns/index.js";
 import { SimSts } from "../../sts/sim-sts.js";
+import { SimWafV2 } from "../../wafv2/index.js";
 import type { SimAwsAccountServiceCache } from "./sim-aws-account-service-cache.js";
 import type { SimAwsScopedServiceRegistries } from "./sim-aws-scoped-service-registries.js";
 interface SimAwsAccountRegionServiceBuilderProperties {
@@ -118,6 +119,15 @@ export declare class SimAwsAccountRegionServiceBuilder {
     createSns(scope: SimAwsAccountRegionContainer): SimSns;
     /** Create simulated EventBridge Scheduler for an Account Region scope. */
     createScheduler(scope: SimAwsAccountRegionContainer): SimScheduler;
+    /**
+     * Create simulated WAFv2 for an Account Region scope.
+     *
+     * Web ACLs are Region-scoped on real AWS, and the `CLOUDFRONT` scope is held
+     * in `us-east-1` because CloudFront is global. It reaches outside itself for
+     * the resources an association can name: a stage ARN carries no Account, so
+     * the resource it names is looked for in this same scope.
+     */
+    createWafV2(scope: SimAwsAccountRegionContainer): SimWafV2;
     /** Create simulated STS for an Account/Region scope. */
     createSts(scope: SimAwsAccountRegionContainer): SimSts;
     /**

package/dist/service/aws/factory/sim-aws-account-region-service-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-account-region-service-builder.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-region-service-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAM5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAIxD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAEpF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,UAAU,2CAA2C;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,mBAAmB,GAAG,mBAAmB,CAAC;IAC/D,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;IACjD,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,iCAAiC;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4C;IACvE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgC;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAuB;IACzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAE5D,YAAY,UAAU,EAAE,2CAA2C,EAOlE;IAED,wDAAwD;IACxD,mEAAmE;IACnE,oBAAoB,CAAC,KAAK,EAAE,4BAA4B,GAAG,iBAAiB,CAK3E;IAED;;;;;;;;OAQG;IACH,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,aAAa,CAKnE;IAED;;;;;OAKG;IACH,6BAA6B,CAC3B,KAAK,EAAE,4BAA4B,GAClC,0BAA0B,CAO5B;IAED,wDAAwD;IACxD,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAKrD;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAK,EAAE,4BAA4B,GAAG,cAAc,CAKrE;IAED,oEAAoE;IACpE,UAAU,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAKvD;IAED,2DAA2D;IAC3D,YAAY,CAAC,KAAK,EAAE,4BAA4B,GAAG,SAAS,CAU3D;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAK,EAAE,4BAA4B,GAAG,cAAc,CAOrE;IAED;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,EAAE,4BAA4B,GAAG,KAAK,CAQnD;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAIrD;IAED,0EAA0E;IAC1E,eAAe,CAAC,KAAK,EAAE,4BAA4B,GAAG,YAAY,CAKjE;IAED,wDAAwD;IACxD,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAQrD;IAED;;OAEG;IACH,OAAO,CAAC,MAAM;CAKf"}
+{"version":3,"file":"sim-aws-account-region-service-builder.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-region-service-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAM5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAIxD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAEpF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,UAAU,2CAA2C;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,mBAAmB,GAAG,mBAAmB,CAAC;IAC/D,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;IACjD,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,iCAAiC;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4C;IACvE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgC;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAuB;IACzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAE5D,YAAY,UAAU,EAAE,2CAA2C,EAOlE;IAED,wDAAwD;IACxD,mEAAmE;IACnE,oBAAoB,CAAC,KAAK,EAAE,4BAA4B,GAAG,iBAAiB,CAK3E;IAED;;;;;;;;OAQG;IACH,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,aAAa,CAKnE;IAED;;;;;OAKG;IACH,6BAA6B,CAC3B,KAAK,EAAE,4BAA4B,GAClC,0BAA0B,CAU5B;IAED,wDAAwD;IACxD,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAKrD;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAK,EAAE,4BAA4B,GAAG,cAAc,CAKrE;IAED,oEAAoE;IACpE,UAAU,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAKvD;IAED,2DAA2D;IAC3D,YAAY,CAAC,KAAK,EAAE,4BAA4B,GAAG,SAAS,CAU3D;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAK,EAAE,4BAA4B,GAAG,cAAc,CAOrE;IAED;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,EAAE,4BAA4B,GAAG,KAAK,CAQnD;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAIrD;IAED,0EAA0E;IAC1E,eAAe,CAAC,KAAK,EAAE,4BAA4B,GAAG,YAAY,CAKjE;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,KAAK,EAAE,4BAA4B,GAAG,QAAQ,CAQzD;IAED,wDAAwD;IACxD,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAQrD;IAED;;OAEG;IACH,OAAO,CAAC,MAAM;CAKf"}

package/dist/service/aws/factory/sim-aws-account-region-service-builder.js

@@ -18,6 +18,8 @@ import { simAwsS3NotificationDestinations } from "./sim-aws-s3-notification-dest
 import { SimSns } from "../../sns/index.js";
 import { simAwsSnsDeliveryEndpoints } from "../../sns/delivery/sim-aws-sns-delivery-endpoints.js";
 import { SimSts } from "../../sts/sim-sts.js";
+import { SimWafV2 } from "../../wafv2/index.js";
+import { SimAwsWafProtectedResources } from "../../wafv2/association/sim-aws-waf-protected-resources.js";
 /**
  * Builder for simulated AWS services scoped to one Account and Region.
  *
@@ -90,6 +92,9 @@ export class SimAwsAccountRegionServiceBuilder {
             userPoolRegistry: this.registries.cognito,
             domainRegistry: this.registries.cognitoDomains,
             triggerFunctions: simAwsCognitoTriggerFunctions(this.simAws),
+            // A web ACL protecting a pool is in the same Account and Region as the
+            // pool, as it is on AWS, so this scope's own WAFv2 is the one to ask.
+            webAcls: scope.wafV2().protection(),
         });
     }
     /** Create simulated ECS for an Account Region scope. */
@@ -183,6 +188,23 @@ export class SimAwsAccountRegionServiceBuilder {
             deliveryTargets: simAwsSchedulerDeliveryTargets(this.simAws),
         });
     }
+    /**
+     * Create simulated WAFv2 for an Account Region scope.
+     *
+     * Web ACLs are Region-scoped on real AWS, and the `CLOUDFRONT` scope is held
+     * in `us-east-1` because CloudFront is global. It reaches outside itself for
+     * the resources an association can name: a stage ARN carries no Account, so
+     * the resource it names is looked for in this same scope.
+     */
+    createWafV2(scope) {
+        return new SimWafV2({
+            ...this.scoped(scope),
+            protectedResources: new SimAwsWafProtectedResources({
+                simAws: this.simAws,
+                accountRegionScope: scope.accountRegionScope,
+            }),
+        });
+    }
     /** Create simulated STS for an Account/Region scope. */
     createSts(scope) {
         this.accountServices.createIam(scope);

package/dist/service/aws/factory/sim-aws-account-region-service-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-account-region-service-builder.js","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-region-service-builder.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,gCAAgC,EAChC,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,sEAAsE,CAAC;AACrH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAClG,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAc9C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,iCAAiC;IAC3B,MAAM,CAAS;IACf,UAAU,CAA4C;IACtD,UAAU,CAAgC;IAC1C,WAAW,CAAiB;IAC5B,iBAAiB,CAAuB;IACxC,eAAe,CAA4B;IAE5D,YAAY,UAAuD;QACjE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED,wDAAwD;IACxD,mEAAmE;IACnE,oBAAoB,CAAC,KAAmC;QACtD,OAAO,IAAI,iBAAiB,CAAC;YAC3B,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,gBAAgB,CAAC,KAAmC;QAClD,OAAO,IAAI,aAAa,CAAC;YACvB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,6BAA6B,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,6BAA6B,CAC3B,KAAmC;QAEnC,OAAO,IAAI,0BAA0B,CAAC;YACpC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO;YACzC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc;YAC9C,gBAAgB,EAAE,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,SAAS,CAAC,KAAmC;QAC3C,OAAO,IAAI,MAAM,CAAC;YAChB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAmC;QACnD,OAAO,IAAI,cAAc,CAAC;YACxB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,eAAe,EAAE,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,UAAU,CAAC,KAAmC;QAC5C,OAAO,IAAI,OAAO,CAAC;YACjB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,YAAY,CAAC,KAAmC;QAC9C,OAAO,IAAI,SAAS,CAAC;YACnB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,yBAAyB,CAAC;gBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK;gBACL,WAAW,EAAE,IAAI,CAAC,iBAAiB;gBACnC,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAmC;QACnD,OAAO,IAAI,cAAc,CAAC;YACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC;YAC1C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAmC;QAC1C,OAAO,IAAI,KAAK,CAAC;YACf,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YACpC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC;YAC1C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,wBAAwB,EAAE,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAmC;QAC3C,MAAM,SAAS,GAAG,0BAA0B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtE,OAAO,IAAI,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,0EAA0E;IAC1E,eAAe,CAAC,KAAmC;QACjD,OAAO,IAAI,YAAY,CAAC;YACtB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,eAAe,EAAE,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,SAAS,CAAC,KAAmC;QAC3C,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAEtC,OAAO,IAAI,MAAM,CAAC;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CACZ,KAAmC;QAEnC,OAAO,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;CACF"}
+{"version":3,"file":"sim-aws-account-region-service-builder.js","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-region-service-builder.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,gCAAgC,EAChC,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,sEAAsE,CAAC;AACrH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAClG,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,2BAA2B,EAAE,MAAM,4DAA4D,CAAC;AAczG;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,iCAAiC;IAC3B,MAAM,CAAS;IACf,UAAU,CAA4C;IACtD,UAAU,CAAgC;IAC1C,WAAW,CAAiB;IAC5B,iBAAiB,CAAuB;IACxC,eAAe,CAA4B;IAE5D,YAAY,UAAuD;QACjE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED,wDAAwD;IACxD,mEAAmE;IACnE,oBAAoB,CAAC,KAAmC;QACtD,OAAO,IAAI,iBAAiB,CAAC;YAC3B,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,gBAAgB,CAAC,KAAmC;QAClD,OAAO,IAAI,aAAa,CAAC;YACvB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,6BAA6B,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,6BAA6B,CAC3B,KAAmC;QAEnC,OAAO,IAAI,0BAA0B,CAAC;YACpC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO;YACzC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc;YAC9C,gBAAgB,EAAE,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;YAC5D,uEAAuE;YACvE,sEAAsE;YACtE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,SAAS,CAAC,KAAmC;QAC3C,OAAO,IAAI,MAAM,CAAC;YAChB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAmC;QACnD,OAAO,IAAI,cAAc,CAAC;YACxB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,eAAe,EAAE,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,UAAU,CAAC,KAAmC;QAC5C,OAAO,IAAI,OAAO,CAAC;YACjB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,YAAY,CAAC,KAAmC;QAC9C,OAAO,IAAI,SAAS,CAAC;YACnB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,GAAG,yBAAyB,CAAC;gBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK;gBACL,WAAW,EAAE,IAAI,CAAC,iBAAiB;gBACnC,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAmC;QACnD,OAAO,IAAI,cAAc,CAAC;YACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC;YAC1C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAmC;QAC1C,OAAO,IAAI,KAAK,CAAC;YACf,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;YACpC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC;YAC1C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,wBAAwB,EAAE,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAmC;QAC3C,MAAM,SAAS,GAAG,0BAA0B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtE,OAAO,IAAI,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,0EAA0E;IAC1E,eAAe,CAAC,KAAmC;QACjD,OAAO,IAAI,YAAY,CAAC;YACtB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,eAAe,EAAE,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,KAAmC;QAC7C,OAAO,IAAI,QAAQ,CAAC;YAClB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,kBAAkB,EAAE,IAAI,2BAA2B,CAAC;gBAClD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;aAC7C,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,SAAS,CAAC,KAAmC;QAC3C,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAEtC,OAAO,IAAI,MAAM,CAAC;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CACZ,KAAmC;QAEnC,OAAO,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/service/aws/factory/sim-aws-account-service-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-account-service-cache.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-service-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uDAAuD,CAAC;AAGnG,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yDAAyD,CAAC;AAIlG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,mBAAmB,GAAG,mBAAmB,CAAC;IAC/D,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,kBAAkB,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4C;IACvE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwB;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0B;IAC5D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAElD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmD;IAE5E,YAAY,UAAU,EAAE,mCAAmC,EAU1D;IAED;;;;;;OAMG;IACH,uBAAuB,CACrB,KAAK,EAAE,4BAA4B,GAClC,6BAA6B,CAM/B;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,aAAa,CAgBnE;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CA0BrD;IAED;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,4BAA4B,GAAG,UAAU,CAgB7D;CACF"}
+{"version":3,"file":"sim-aws-account-service-cache.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-service-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uDAAuD,CAAC;AAGnG,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAEnE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yDAAyD,CAAC;AAIlG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,mBAAmB,GAAG,mBAAmB,CAAC;IAC/D,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,qBAAqB,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,kBAAkB,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4C;IACvE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAwB;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0B;IAC5D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAElD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmD;IAE5E,YAAY,UAAU,EAAE,mCAAmC,EAU1D;IAED;;;;;;OAMG;IACH,uBAAuB,CACrB,KAAK,EAAE,4BAA4B,GAClC,6BAA6B,CAM/B;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,aAAa,CAoBnE;IAED;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CA0BrD;IAED;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,4BAA4B,GAAG,UAAU,CAgB7D;CACF"}

package/dist/service/aws/factory/sim-aws-account-service-cache.js

@@ -1,6 +1,7 @@
 import { makeSimCfS3OriginResolver } from "../../cloudfront/origin/s3/sim-cf-s3-origin-resolver-factory.js";
 import { makeSimCfCustomOriginDispatcher } from "../../cloudfront/origin/custom/sim-cf-custom-origin-dispatcher.factory.js";
 import { SimCloudFront } from "../../cloudfront/sim-cloudfront.js";
+import { makeSimCfWebAclResolver } from "../../cloudfront/web-acl/sim-cf-web-acl-resolver.factory.js";
 import { SimRoute53 } from "../../route53/index.js";
 import { SimIam } from "../../iam/index.js";
 import { SimIamAccountAccessKeyIndex, } from "../../iam/registry/sim-iam-access-key-registry.js";
@@ -83,6 +84,10 @@ export class SimAwsAccountServiceCache {
             customOriginDispatcher: makeSimCfCustomOriginDispatcher(this.simAws),
             iam,
             acmRegistry: this.acmRegistry,
+            // A CLOUDFRONT scope web ACL is held by the WAFv2 of the Account and
+            // Region its ARN names, which CloudFront reaches through the
+            // simulation rather than holding itself.
+            webAclResolver: makeSimCfWebAclResolver(this.simAws),
             background: this.background,
         }));
     }

package/dist/service/aws/factory/sim-aws-account-service-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-account-service-cache.js","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-service-cache.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iEAAiE,CAAC;AAC5G,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EACL,2BAA2B,GAE5B,MAAM,mDAAmD,CAAC;AAE3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAexE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,yBAAyB;IACnB,MAAM,CAAS;IACf,UAAU,CAA4C;IACtD,WAAW,CAAiB;IAC5B,kBAAkB,CAAwB;IAC1C,WAAW,CAAiB;IAC5B,iBAAiB,CAA0B;IAC3C,eAAe,CAAqB;IACpC,WAAW,CAAiB;IAC5B,YAAY,CAAqB;IAElD;;;;;;OAMG;IACc,QAAQ,GAAG,IAAI,IAAI,EAAuC,CAAC;IAE5E,YAAY,UAA+C;QACzD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,uBAAuB,CACrB,KAAmC;QAEnC,OAAO;YACL,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAmC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAElC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,sBAAsB,CAAC,YAAY,EAAE,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACxE,GAAG,EAAE,CACH,IAAI,aAAa,CAAC;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,gBAAgB,EAAE,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC;YACxD,sBAAsB,EAAE,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC;YACpE,GAAG;YACH,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAmC;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACjE,GAAG,EAAE;YACH,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC;gBACrB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,mEAAmE;gBACnE,iEAAiE;gBACjE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,mEAAmE;gBACnE,qEAAqE;gBACrE,kBAAkB,EAAE,IAAI,wBAAwB,CAAC;oBAC/C,KAAK,EAAE,IAAI,CAAC,UAAU;oBACtB,cAAc,EAAE,IAAI,2BAA2B,CAC7C,IAAI,CAAC,iBAAiB,EACtB,KAAK,CAAC,kBAAkB,CAAC,SAAS,CACnC;iBACF,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAEnE,OAAO,GAAG,CAAC;QACb,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAmC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAElC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACrE,GAAG,EAAE,CACH,IAAI,UAAU,CAAC;YACb,GAAG;YACH,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,gEAAgE;YAChE,gEAAgE;YAChE,OAAO,EAAE,IAAI,CAAC,WAAW;SAC1B,CAAC,CACL,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-aws-account-service-cache.js","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-account-service-cache.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iEAAiE,CAAC;AAC5G,OAAO,EAAE,+BAA+B,EAAE,MAAM,2EAA2E,CAAC;AAC5H,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6DAA6D,CAAC;AACtG,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EACL,2BAA2B,GAE5B,MAAM,mDAAmD,CAAC;AAE3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAexE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,yBAAyB;IACnB,MAAM,CAAS;IACf,UAAU,CAA4C;IACtD,WAAW,CAAiB;IAC5B,kBAAkB,CAAwB;IAC1C,WAAW,CAAiB;IAC5B,iBAAiB,CAA0B;IAC3C,eAAe,CAAqB;IACpC,WAAW,CAAiB;IAC5B,YAAY,CAAqB;IAElD;;;;;;OAMG;IACc,QAAQ,GAAG,IAAI,IAAI,EAAuC,CAAC;IAE5E,YAAY,UAA+C;QACzD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,uBAAuB,CACrB,KAAmC;QAEnC,OAAO;YACL,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAmC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAElC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,sBAAsB,CAAC,YAAY,EAAE,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACxE,GAAG,EAAE,CACH,IAAI,aAAa,CAAC;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,gBAAgB,EAAE,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC;YACxD,sBAAsB,EAAE,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC;YACpE,GAAG;YACH,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,qEAAqE;YACrE,6DAA6D;YAC7D,yCAAyC;YACzC,cAAc,EAAE,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC;YACpD,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAmC;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACjE,GAAG,EAAE;YACH,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC;gBACrB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,mEAAmE;gBACnE,iEAAiE;gBACjE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,mEAAmE;gBACnE,qEAAqE;gBACrE,kBAAkB,EAAE,IAAI,wBAAwB,CAAC;oBAC/C,KAAK,EAAE,IAAI,CAAC,UAAU;oBACtB,cAAc,EAAE,IAAI,2BAA2B,CAC7C,IAAI,CAAC,iBAAiB,EACtB,KAAK,CAAC,kBAAkB,CAAC,SAAS,CACnC;iBACF,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAEnE,OAAO,GAAG,CAAC;QACb,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAmC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAElC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,kBAAkB,CAAC,SAAS,CAAC,EACrE,GAAG,EAAE,CACH,IAAI,UAAU,CAAC;YACb,GAAG;YACH,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,gEAAgE;YAChE,gEAAgE;YAChE,OAAO,EAAE,IAAI,CAAC,WAAW;SAC1B,CAAC,CACL,CAAC;IACJ,CAAC;CACF"}

package/dist/service/aws/factory/sim-aws-cross-account-collaborators.d.ts

@@ -1,4 +1,5 @@
 import { SimRoute53AcmDnsRecords } from "../../acm/validation/sim-route53-acm-dns-records.js";
+import { SimCognitoRestApiUserPools } from "../../apigateway/api/authorizer/sim-cognito-rest-api-user-pools.js";
 import { SimCognitoHttpApiJwtIssuerKeys } from "../../apigatewayv2/api/authorizer/sim-cognito-http-api-jwt-issuer-keys.js";
 import { SimAwsEventBridgeDeliveryTargets } from "../../eventbridge/delivery/sim-aws-event-bridge-delivery-targets.js";
 import { SimAwsRekognitionImageObjects } from "../../rekognition/image/s3/sim-aws-rekognition-image-objects.js";
@@ -21,6 +22,13 @@ export declare function simAwsAcmDnsRecords(registries: SimAwsScopedServiceRegis
  * this reads the whole simulation's Cognito rather than one scope's.
  */
 export declare function simAwsHttpApiJwtIssuerKeys(registries: SimAwsScopedServiceRegistries): SimCognitoHttpApiJwtIssuerKeys;
+/**
+ * The user pools a simulated REST API's Cognito authorizer verifies against.
+ *
+ * An authorizer can name a pool in any Account, as a real one can, so this
+ * reads the whole simulation's Cognito rather than one scope's.
+ */
+export declare function simAwsRestApiUserPools(registries: SimAwsScopedServiceRegistries): SimCognitoRestApiUserPools;
 /**
  * Everywhere a simulated EventBridge rule can deliver.
  *

package/dist/service/aws/factory/sim-aws-cross-account-collaborators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-cross-account-collaborators.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-cross-account-collaborators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,2EAA2E,CAAC;AAC3H,OAAO,EAAE,gCAAgC,EAAE,MAAM,qEAAqE,CAAC;AACvH,OAAO,EAAE,6BAA6B,EAAE,MAAM,iEAAiE,CAAC;AAChH,OAAO,EAAE,8BAA8B,EAAE,MAAM,gEAAgE,CAAC;AAChH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,6BAA6B,GACxC,uBAAuB,CAEzB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,6BAA6B,GACxC,8BAA8B,CAIhC;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,GACb,gCAAgC,CAElC;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,GACb,8BAA8B,CAEhC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,GAClC,6BAA6B,CAK/B"}
+{"version":3,"file":"sim-aws-cross-account-collaborators.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-cross-account-collaborators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,oEAAoE,CAAC;AAChH,OAAO,EAAE,8BAA8B,EAAE,MAAM,2EAA2E,CAAC;AAC3H,OAAO,EAAE,gCAAgC,EAAE,MAAM,qEAAqE,CAAC;AACvH,OAAO,EAAE,6BAA6B,EAAE,MAAM,iEAAiE,CAAC;AAChH,OAAO,EAAE,8BAA8B,EAAE,MAAM,gEAAgE,CAAC;AAChH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,6BAA6B,GACxC,uBAAuB,CAEzB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,6BAA6B,GACxC,8BAA8B,CAIhC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,6BAA6B,GACxC,0BAA0B,CAI5B;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,GACb,gCAAgC,CAElC;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,GACb,8BAA8B,CAEhC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,4BAA4B,GAClC,6BAA6B,CAK/B"}

package/dist/service/aws/factory/sim-aws-cross-account-collaborators.js

@@ -1,4 +1,5 @@
 import { SimRoute53AcmDnsRecords } from "../../acm/validation/sim-route53-acm-dns-records.js";
+import { SimCognitoRestApiUserPools } from "../../apigateway/api/authorizer/sim-cognito-rest-api-user-pools.js";
 import { SimCognitoHttpApiJwtIssuerKeys } from "../../apigatewayv2/api/authorizer/sim-cognito-http-api-jwt-issuer-keys.js";
 import { SimAwsEventBridgeDeliveryTargets } from "../../eventbridge/delivery/sim-aws-event-bridge-delivery-targets.js";
 import { SimAwsRekognitionImageObjects } from "../../rekognition/image/s3/sim-aws-rekognition-image-objects.js";
@@ -24,6 +25,17 @@ export function simAwsHttpApiJwtIssuerKeys(registries) {
         userPoolRegistry: registries.cognito,
     });
 }
+/**
+ * The user pools a simulated REST API's Cognito authorizer verifies against.
+ *
+ * An authorizer can name a pool in any Account, as a real one can, so this
+ * reads the whole simulation's Cognito rather than one scope's.
+ */
+export function simAwsRestApiUserPools(registries) {
+    return new SimCognitoRestApiUserPools({
+        userPoolRegistry: registries.cognito,
+    });
+}
 /**
  * Everywhere a simulated EventBridge rule can deliver.
  *

package/dist/service/aws/factory/sim-aws-cross-account-collaborators.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-cross-account-collaborators.js","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-cross-account-collaborators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,2EAA2E,CAAC;AAC3H,OAAO,EAAE,gCAAgC,EAAE,MAAM,qEAAqE,CAAC;AACvH,OAAO,EAAE,6BAA6B,EAAE,MAAM,iEAAiE,CAAC;AAChH,OAAO,EAAE,8BAA8B,EAAE,MAAM,gEAAgE,CAAC;AAKhH;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAyC;IAEzC,OAAO,IAAI,uBAAuB,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAyC;IAEzC,OAAO,IAAI,8BAA8B,CAAC;QACxC,gBAAgB,EAAE,UAAU,CAAC,OAAO;KACrC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,MAAc;IAEd,OAAO,IAAI,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAc;IAEd,OAAO,IAAI,8BAA8B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,KAAmC;IAEnC,OAAO,IAAI,6BAA6B,CAAC;QACvC,MAAM;QACN,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sim-aws-cross-account-collaborators.js","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-cross-account-collaborators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,oEAAoE,CAAC;AAChH,OAAO,EAAE,8BAA8B,EAAE,MAAM,2EAA2E,CAAC;AAC3H,OAAO,EAAE,gCAAgC,EAAE,MAAM,qEAAqE,CAAC;AACvH,OAAO,EAAE,6BAA6B,EAAE,MAAM,iEAAiE,CAAC;AAChH,OAAO,EAAE,8BAA8B,EAAE,MAAM,gEAAgE,CAAC;AAKhH;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAyC;IAEzC,OAAO,IAAI,uBAAuB,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAyC;IAEzC,OAAO,IAAI,8BAA8B,CAAC;QACxC,gBAAgB,EAAE,UAAU,CAAC,OAAO;KACrC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAyC;IAEzC,OAAO,IAAI,0BAA0B,CAAC;QACpC,gBAAgB,EAAE,UAAU,CAAC,OAAO;KACrC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,MAAc;IAEd,OAAO,IAAI,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAc;IAEd,OAAO,IAAI,8BAA8B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,KAAmC;IAEnC,OAAO,IAAI,6BAA6B,CAAC;QACvC,MAAM;QACN,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;AACL,CAAC"}

package/dist/service/aws/factory/sim-aws-registered-service-builder.d.ts

@@ -1,5 +1,6 @@
 import type { SimAwsAccountRegionContainer } from "../sim-aws-account-region-scope.js";
 import { SimAcm } from "../../acm/sim-acm.js";
+import { SimApiGateway } from "../../apigateway/index.js";
 import { SimApiGatewayV2 } from "../../apigatewayv2/index.js";
 import { SimEcr } from "../../ecr/index.js";
 import { SimElbV2 } from "../../elbv2/index.js";
@@ -31,6 +32,13 @@ export declare class SimAwsRegisteredServiceBuilder {
     private readonly accountServices;
     constructor(properties: SimAwsRegisteredServiceBuilderProperties);
     createAcm(scope: SimAwsAccountRegionContainer): SimAcm;
+    /**
+     * Create simulated API Gateway REST APIs for an Account Region scope.
+     *
+     * REST APIs are Region-scoped on real AWS: the endpoint API Gateway
+     * generates names the Region, and an API cannot be reached from another one.
+     */
+    createApiGateway(scope: SimAwsAccountRegionContainer): SimApiGateway;
     /**
      * Create simulated API Gateway v2 for an Account Region scope.
      *

package/dist/service/aws/factory/sim-aws-registered-service-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-registered-service-builder.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-registered-service-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAK9D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAEpF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,UAAU,wCAAwC;IAChD,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;CACrD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgC;IAC3D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAE5D,YAAY,UAAU,EAAE,wCAAwC,EAG/D;IAED,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAQrD;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,KAAK,EAAE,4BAA4B,GAAG,eAAe,CAQvE;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAKrD;IAED;;;;;OAKG;IACH,WAAW,CAAC,KAAK,EAAE,4BAA4B,GAAG,QAAQ,CAIzD;IAED;;;;;;OAMG;IACH,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAIrD;IAED;;OAEG;IACH,OAAO,CAAC,MAAM;CAKf"}
+{"version":3,"file":"sim-aws-registered-service-builder.d.ts","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-registered-service-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAM9D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAEpF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,UAAU,wCAAwC;IAChD,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;CACrD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgC;IAC3D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAE5D,YAAY,UAAU,EAAE,wCAAwC,EAG/D;IAED,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAQrD;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,aAAa,CAWnE;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,KAAK,EAAE,4BAA4B,GAAG,eAAe,CAQvE;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAKrD;IAED;;;;;OAKG;IACH,WAAW,CAAC,KAAK,EAAE,4BAA4B,GAAG,QAAQ,CAIzD;IAED;;;;;;OAMG;IACH,SAAS,CAAC,KAAK,EAAE,4BAA4B,GAAG,MAAM,CAIrD;IAED;;OAEG;IACH,OAAO,CAAC,MAAM;CAKf"}

package/dist/service/aws/factory/sim-aws-registered-service-builder.js

@@ -1,6 +1,7 @@
 import { SimAcm } from "../../acm/sim-acm.js";
+import { SimApiGateway } from "../../apigateway/index.js";
 import { SimApiGatewayV2 } from "../../apigatewayv2/index.js";
-import { simAwsAcmDnsRecords, simAwsHttpApiJwtIssuerKeys, } from "./sim-aws-cross-account-collaborators.js";
+import { simAwsAcmDnsRecords, simAwsHttpApiJwtIssuerKeys, simAwsRestApiUserPools, } from "./sim-aws-cross-account-collaborators.js";
 import { SimEcr } from "../../ecr/index.js";
 import { SimElbV2 } from "../../elbv2/index.js";
 import { SimKms } from "../../kms/index.js";
@@ -35,6 +36,24 @@ export class SimAwsRegisteredServiceBuilder {
         this.registries.acm.register(scope.accountRegionScope, acm);
         return acm;
     }
+    /**
+     * Create simulated API Gateway REST APIs for an Account Region scope.
+     *
+     * REST APIs are Region-scoped on real AWS: the endpoint API Gateway
+     * generates names the Region, and an API cannot be reached from another one.
+     */
+    createApiGateway(scope) {
+        return new SimApiGateway({
+            ...this.scoped(scope),
+            // API ids are unique across the simulation, and an API is reachable by
+            // id alone from the serving layer, whichever scope created it.
+            registry: this.registries.restApi,
+            userPools: simAwsRestApiUserPools(this.registries),
+            // A web ACL protecting a stage is in the same Account and Region as the
+            // API, as it is on AWS, so this scope's own WAFv2 is the one to ask.
+            webAcls: scope.wafV2().protection(),
+        });
+    }
     /**
      * Create simulated API Gateway v2 for an Account Region scope.
      *

package/dist/service/aws/factory/sim-aws-registered-service-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-registered-service-builder.js","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-registered-service-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAU5C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,8BAA8B;IACxB,UAAU,CAAgC;IAC1C,eAAe,CAA4B;IAE5D,YAAY,UAAoD;QAC9D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED,SAAS,CAAC,KAAmC;QAC3C,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC;YACrB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAE5D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,KAAmC;QACpD,OAAO,IAAI,eAAe,CAAC;YACzB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,uEAAuE;YACvE,+DAA+D;YAC/D,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO;YACjC,aAAa,EAAE,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAmC;QAC3C,OAAO,IAAI,MAAM,CAAC;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,KAAmC;QAC7C,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAE9D,OAAO,IAAI,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,KAAmC;QAC3C,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACK,MAAM,CACZ,KAAmC;QAEnC,OAAO,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;CACF"}
+{"version":3,"file":"sim-aws-registered-service-builder.js","sourceRoot":"","sources":["../../../../src/service/aws/factory/sim-aws-registered-service-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAU5C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,8BAA8B;IACxB,UAAU,CAAgC;IAC1C,eAAe,CAA4B;IAE5D,YAAY,UAAoD;QAC9D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED,SAAS,CAAC,KAAmC;QAC3C,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC;YACrB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAE5D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,KAAmC;QAClD,OAAO,IAAI,aAAa,CAAC;YACvB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,uEAAuE;YACvE,+DAA+D;YAC/D,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO;YACjC,SAAS,EAAE,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC;YAClD,wEAAwE;YACxE,qEAAqE;YACrE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,KAAmC;QACpD,OAAO,IAAI,eAAe,CAAC;YACzB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACrB,uEAAuE;YACvE,+DAA+D;YAC/D,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO;YACjC,aAAa,EAAE,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAmC;QAC3C,OAAO,IAAI,MAAM,CAAC;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,KAAmC;QAC7C,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAE9D,OAAO,IAAI,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,KAAmC;QAC3C,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACK,MAAM,CACZ,KAAmC;QAEnC,OAAO,IAAI,CAAC,eAAe,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;CACF"}