@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/cloudfront/sim-cloudfront-commands.d.ts

@@ -17,6 +17,7 @@ import { type SimCloudFrontS3OriginResolver } from "./origin/s3/sim-cloudfront-s
 import type { SimCloudFrontOriginAccessControlRegistry } from "./origin-access-control/sim-cf-origin-access-control-registry.js";
 import type { SimCloudFrontResponseHeadersPolicyRegistry } from "./response-headers-policy/sim-cf-response-headers-policy-registry.js";
 import { SimCloudFrontRegistry } from "./registry/sim-cloud-front-registry.js";
+import type { SimCfWebAclResolver } from "./web-acl/sim-cf-web-acl.js";
 import { SimCfKeyValueStoreCommands } from "./key-value-store/sim-cf-key-value-store-commands.js";
 import { SimCloudFrontKeyValueStoreApi } from "./sim-cloudfront-key-value-store.js";
 /**
@@ -29,6 +30,8 @@ export interface SimCloudFrontProperties {
     readonly customOriginDispatcher?: SimCfCustomOriginDispatcher | undefined;
     readonly iam?: SimIamInterServiceAuthZ;
     readonly acmRegistry?: SimAcmRegistry | undefined;
+    /** How a Distribution's `WebACLId` is resolved to the web ACL it names. */
+    readonly webAclResolver?: SimCfWebAclResolver | undefined;
     readonly background?: BackgroundScheduler;
 }
 interface SimCloudFrontCommandsProperties extends SimCloudFrontProperties {
@@ -64,11 +67,7 @@ export declare class SimCloudFrontCommands {
     readonly keyValueStoreApi: SimCloudFrontKeyValueStoreApi;
     private readonly distributionState;
     private readonly functionState;
-    private readonly s3OriginResolver;
-    private readonly customOriginDispatcher;
-    private readonly acmRegistry;
-    private readonly originAccessControls;
-    private readonly responseHeadersPolicies;
+    private readonly configurationState;
     constructor(properties: SimCloudFrontCommandsProperties);
     /**
      * Handle a Create Distribution Command from the SDK.
@@ -94,10 +93,6 @@ export declare class SimCloudFrontCommands {
      * Handle a Delete Function Command from the SDK.
      */
     deleteFunction(command: SimDeleteFunctionCommand, options?: SimCloudFrontRequestOptions): Promise<SimDeleteFunctionCommandOutput>;
-    /**
-     * How the commands that configure a Distribution reach its Origins.
-     */
-    private originState;
 }
 export {};
 //# sourceMappingURL=sim-cloudfront-commands.d.ts.map

package/dist/service/cloudfront/sim-cloudfront-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront-commands.d.ts","sourceRoot":"","sources":["../../../src/service/cloudfront/sim-cloudfront-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,KAAK,EACV,4BAA4B,EAC5B,kCAAkC,EACnC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,KAAK,EACV,wBAAwB,EACxB,8BAA8B,EAC/B,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,sDAAsD,CAAC;AAC9D,OAAO,KAAK,EACV,4BAA4B,EAC5B,kCAAkC,EACnC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,KAAK,EACV,wBAAwB,EACxB,8BAA8B,EAC/B,MAAM,sDAAsD,CAAC;AAE9D,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EACV,4BAA4B,EAC5B,kCAAkC,EACnC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,kEAAkE,CAAC;AACjI,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,sEAAsE,CAAC;AACvI,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAElG,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AAGpF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IACpD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IAC1D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC1E,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,+BAAgC,SAAQ,uBAAuB;IACvE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,4BAA4B,CAAC;IACrD,QAAQ,CAAC,mBAAmB,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,oBAAoB,EAAE,wCAAwC,CAAC;IACxE,QAAQ,CAAC,uBAAuB,EAAE,0CAA0C,CAAC;CAC9E;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,MAAM,MAAM,4BAA4B,GAAG,GAAG,CAC5C,2BAA2B,EAC3B,yBAAyB,CAC1B,CAAC;AAwBF;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC;;OAEG;IACH,SAAgB,cAAc,EAAE,0BAA0B,CAAC;IAE3D;;OAEG;IACH,SAAgB,gBAAgB,EAAE,6BAA6B,CAAC;IAEhE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAiC;IACnE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgC;IACjE,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAEzB;IACd,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA2C;IAChF,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA6C;IAErF,YAAY,UAAU,EAAE,+BAA+B,EAkDtD;IAED;;OAEG;IACG,kBAAkB,CACtB,OAAO,EAAE,4BAA4B,EACrC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,kCAAkC,CAAC,CAK7C;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,+BAA+B,CAAC,CAI1C;IAED;;OAEG;IACG,kBAAkB,CACtB,OAAO,EAAE,4BAA4B,EACrC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,kCAAkC,CAAC,CAK7C;IAED;;OAEG;IACG,kBAAkB,CACtB,OAAO,EAAE,4BAA4B,EACrC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,kCAAkC,CAAC,CAI7C;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,8BAA8B,CAAC,CAKzC;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,8BAA8B,CAAC,CAKzC;IAED;;OAEG;IACH,OAAO,CAAC,WAAW;CAepB"}
+{"version":3,"file":"sim-cloudfront-commands.d.ts","sourceRoot":"","sources":["../../../src/service/cloudfront/sim-cloudfront-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,KAAK,EACV,4BAA4B,EAC5B,kCAAkC,EACnC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,KAAK,EACV,wBAAwB,EACxB,8BAA8B,EAC/B,MAAM,sDAAsD,CAAC;AAC9D,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,sDAAsD,CAAC;AAC9D,OAAO,KAAK,EACV,4BAA4B,EAC5B,kCAAkC,EACnC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,KAAK,EACV,wBAAwB,EACxB,8BAA8B,EAC/B,MAAM,sDAAsD,CAAC;AAE9D,OAAO,KAAK,EACV,yBAAyB,EACzB,+BAA+B,EAChC,MAAM,wDAAwD,CAAC;AAEhE,OAAO,KAAK,EACV,4BAA4B,EAC5B,kCAAkC,EACnC,MAAM,8DAA8D,CAAC;AAEtE,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oDAAoD,CAAC;AACtG,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,kEAAkE,CAAC;AACjI,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,sEAAsE,CAAC;AACvI,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAElG,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AAGpF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IACpD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IAC1D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC1E,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAClD,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,UAAU,+BAAgC,SAAQ,uBAAuB;IACvE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,4BAA4B,CAAC;IACrD,QAAQ,CAAC,mBAAmB,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,oBAAoB,EAAE,wCAAwC,CAAC;IACxE,QAAQ,CAAC,uBAAuB,EAAE,0CAA0C,CAAC;CAC9E;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,MAAM,MAAM,4BAA4B,GAAG,GAAG,CAC5C,2BAA2B,EAC3B,yBAAyB,CAC1B,CAAC;AAwBF;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC;;OAEG;IACH,SAAgB,cAAc,EAAE,0BAA0B,CAAC;IAE3D;;OAEG;IACH,SAAgB,gBAAgB,EAAE,6BAA6B,CAAC;IAEhE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAiC;IACnE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsC;IAEzE,YAAY,UAAU,EAAE,+BAA+B,EAsDtD;IAED;;OAEG;IACG,kBAAkB,CACtB,OAAO,EAAE,4BAA4B,EACrC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,kCAAkC,CAAC,CAK7C;IAED;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,yBAAyB,EAClC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,+BAA+B,CAAC,CAI1C;IAED;;OAEG;IACG,kBAAkB,CACtB,OAAO,EAAE,4BAA4B,EACrC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,kCAAkC,CAAC,CAK7C;IAED;;OAEG;IACG,kBAAkB,CACtB,OAAO,EAAE,4BAA4B,EACrC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,kCAAkC,CAAC,CAI7C;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,8BAA8B,CAAC,CAKzC;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,8BAA8B,CAAC,CAKzC;CACF"}

package/dist/service/cloudfront/sim-cloudfront-commands.js

@@ -32,13 +32,9 @@ export class SimCloudFrontCommands {
     keyValueStoreApi;
     distributionState;
     functionState;
-    s3OriginResolver;
-    customOriginDispatcher;
-    acmRegistry;
-    originAccessControls;
-    responseHeadersPolicies;
+    configurationState;
     constructor(properties) {
-        const { accountId, distributions, cloudFrontFunctions, cloudFrontRegistry = new SimCloudFrontRegistry(), s3OriginResolver = emptyCloudFrontS3OriginResolver, customOriginDispatcher, iam = new SimIamAllowAllAuth(), acmRegistry, background = new BackgroundTasks(), } = properties;
+        const { accountId, distributions, cloudFrontFunctions, cloudFrontRegistry = new SimCloudFrontRegistry(), s3OriginResolver = emptyCloudFrontS3OriginResolver, customOriginDispatcher, iam = new SimIamAllowAllAuth(), acmRegistry, webAclResolver, background = new BackgroundTasks(), } = properties;
         const keyValueStores = new SimCloudFrontKeyValueStoreRegistry();
         this.distributionState = {
             accountId,
@@ -54,11 +50,14 @@ export class SimCloudFrontCommands {
             background,
             keyValueStores,
         };
-        this.s3OriginResolver = s3OriginResolver;
-        this.customOriginDispatcher = customOriginDispatcher;
-        this.acmRegistry = acmRegistry;
-        this.originAccessControls = properties.originAccessControls;
-        this.responseHeadersPolicies = properties.responseHeadersPolicies;
+        this.configurationState = {
+            s3OriginResolver,
+            customOriginDispatcher,
+            acmRegistry,
+            webAclResolver,
+            originAccessControls: properties.originAccessControls,
+            responseHeadersPolicies: properties.responseHeadersPolicies,
+        };
         const keyValueStoreAccess = new SimCfKeyValueStoreAccess({
             accountId,
             stores: keyValueStores,
@@ -76,7 +75,7 @@ export class SimCloudFrontCommands {
     async createDistribution(command, options) {
         return await new CreateDistributionCommandHandler({
             ...this.distributionState,
-            ...this.originState(),
+            ...this.configurationState,
         }).handle(command, options);
     }
     /**
@@ -91,7 +90,7 @@ export class SimCloudFrontCommands {
     async updateDistribution(command, options) {
         return await new UpdateDistributionCommandHandler({
             ...this.distributionState,
-            ...this.originState(),
+            ...this.configurationState,
         }).handle(command, options);
     }
     /**
@@ -112,17 +111,5 @@ export class SimCloudFrontCommands {
     async deleteFunction(command, options) {
         return await new DeleteFunctionCommandHandler(this.functionState).handle(command, options);
     }
-    /**
-     * How the commands that configure a Distribution reach its Origins.
-     */
-    originState() {
-        return {
-            s3OriginResolver: this.s3OriginResolver,
-            customOriginDispatcher: this.customOriginDispatcher,
-            acmRegistry: this.acmRegistry,
-            originAccessControls: this.originAccessControls,
-            responseHeadersPolicies: this.responseHeadersPolicies,
-        };
-    }
 }
 //# sourceMappingURL=sim-cloudfront-commands.js.map

package/dist/service/cloudfront/sim-cloudfront-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloudfront-commands.js","sourceRoot":"","sources":["../../../src/service/cloudfront/sim-cloudfront-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAK1D,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAKhH,OAAO,EACL,4BAA4B,GAE7B,MAAM,sDAAsD,CAAC;AAK9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAKhH,OAAO,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AAKpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AAKvG,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAMhH,OAAO,EACL,+BAA+B,GAEhC,MAAM,yCAAyC,CAAC;AAGjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAClG,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAyDtF;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IAChC;;OAEG;IACa,cAAc,CAA6B;IAE3D;;OAEG;IACa,gBAAgB,CAAgC;IAE/C,iBAAiB,CAAiC;IAClD,aAAa,CAA6B;IAC1C,gBAAgB,CAAgC;IAChD,sBAAsB,CAEzB;IACG,WAAW,CAA6B;IACxC,oBAAoB,CAA2C;IAC/D,uBAAuB,CAA6C;IAErF,YAAY,UAA2C;QACrD,MAAM,EACJ,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GAAG,IAAI,qBAAqB,EAAE,EAChD,gBAAgB,GAAG,+BAA+B,EAClD,sBAAsB,EACtB,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,WAAW,EACX,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,MAAM,cAAc,GAAG,IAAI,kCAAkC,EAAE,CAAC;QAEhE,IAAI,CAAC,iBAAiB,GAAG;YACvB,SAAS;YACT,aAAa;YACb,kBAAkB;YAClB,GAAG;YACH,UAAU;SACX,CAAC;QACF,IAAI,CAAC,aAAa,GAAG;YACnB,SAAS;YACT,mBAAmB;YACnB,GAAG;YACH,UAAU;YACV,cAAc;SACf,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,sBAAsB,GAAG,sBAAsB,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,oBAAoB,GAAG,UAAU,CAAC,oBAAoB,CAAC;QAC5D,IAAI,CAAC,uBAAuB,GAAG,UAAU,CAAC,uBAAuB,CAAC;QAClE,MAAM,mBAAmB,GAAG,IAAI,wBAAwB,CAAC;YACvD,SAAS;YACT,MAAM,EAAE,cAAc;YACtB,GAAG;YACH,UAAU;SACX,CAAC,CAAC;QAEH,qEAAqE;QACrE,2CAA2C;QAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,0BAA0B,CAClD,mBAAmB,EACnB,IAAI,wBAAwB,CAAC,mBAAmB,CAAC,CAClD,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,6BAA6B,CACvD,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,OAAqC,EACrC,OAAqC;QAErC,OAAO,MAAM,IAAI,gCAAgC,CAAC;YAChD,GAAG,IAAI,CAAC,iBAAiB;YACzB,GAAG,IAAI,CAAC,WAAW,EAAE;SACtB,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,OAAkC,EAClC,OAAqC;QAErC,OAAO,MAAM,IAAI,6BAA6B,CAC5C,IAAI,CAAC,iBAAiB,CACvB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,OAAqC,EACrC,OAAqC;QAErC,OAAO,MAAM,IAAI,gCAAgC,CAAC;YAChD,GAAG,IAAI,CAAC,iBAAiB;YACzB,GAAG,IAAI,CAAC,WAAW,EAAE;SACtB,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,OAAqC,EACrC,OAAqC;QAErC,OAAO,MAAM,IAAI,gCAAgC,CAC/C,IAAI,CAAC,iBAAiB,CACvB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAiC,EACjC,OAAqC;QAErC,OAAO,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CACtE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAiC,EACjC,OAAqC;QAErC,OAAO,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CACtE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,WAAW;QAOjB,OAAO;YACL,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;SACtD,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cloudfront-commands.js","sourceRoot":"","sources":["../../../src/service/cloudfront/sim-cloudfront-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAK1D,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAKhH,OAAO,EACL,4BAA4B,GAE7B,MAAM,sDAAsD,CAAC;AAK9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAKhH,OAAO,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AAKpG,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AAKvG,OAAO,EAAE,gCAAgC,EAAE,MAAM,8DAA8D,CAAC;AAMhH,OAAO,EACL,+BAA+B,GAEhC,MAAM,yCAAyC,CAAC;AAGjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAG/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAClG,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AA2DtF;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IAChC;;OAEG;IACa,cAAc,CAA6B;IAE3D;;OAEG;IACa,gBAAgB,CAAgC;IAE/C,iBAAiB,CAAiC;IAClD,aAAa,CAA6B;IAC1C,kBAAkB,CAAsC;IAEzE,YAAY,UAA2C;QACrD,MAAM,EACJ,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GAAG,IAAI,qBAAqB,EAAE,EAChD,gBAAgB,GAAG,+BAA+B,EAClD,sBAAsB,EACtB,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,WAAW,EACX,cAAc,EACd,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,UAAU,CAAC;QAEf,MAAM,cAAc,GAAG,IAAI,kCAAkC,EAAE,CAAC;QAEhE,IAAI,CAAC,iBAAiB,GAAG;YACvB,SAAS;YACT,aAAa;YACb,kBAAkB;YAClB,GAAG;YACH,UAAU;SACX,CAAC;QACF,IAAI,CAAC,aAAa,GAAG;YACnB,SAAS;YACT,mBAAmB;YACnB,GAAG;YACH,UAAU;YACV,cAAc;SACf,CAAC;QACF,IAAI,CAAC,kBAAkB,GAAG;YACxB,gBAAgB;YAChB,sBAAsB;YACtB,WAAW;YACX,cAAc;YACd,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;YACrD,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;SAC5D,CAAC;QACF,MAAM,mBAAmB,GAAG,IAAI,wBAAwB,CAAC;YACvD,SAAS;YACT,MAAM,EAAE,cAAc;YACtB,GAAG;YACH,UAAU;SACX,CAAC,CAAC;QAEH,qEAAqE;QACrE,2CAA2C;QAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,0BAA0B,CAClD,mBAAmB,EACnB,IAAI,wBAAwB,CAAC,mBAAmB,CAAC,CAClD,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,6BAA6B,CACvD,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,OAAqC,EACrC,OAAqC;QAErC,OAAO,MAAM,IAAI,gCAAgC,CAAC;YAChD,GAAG,IAAI,CAAC,iBAAiB;YACzB,GAAG,IAAI,CAAC,kBAAkB;SAC3B,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,OAAkC,EAClC,OAAqC;QAErC,OAAO,MAAM,IAAI,6BAA6B,CAC5C,IAAI,CAAC,iBAAiB,CACvB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,OAAqC,EACrC,OAAqC;QAErC,OAAO,MAAM,IAAI,gCAAgC,CAAC;YAChD,GAAG,IAAI,CAAC,iBAAiB;YACzB,GAAG,IAAI,CAAC,kBAAkB;SAC3B,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CACtB,OAAqC,EACrC,OAAqC;QAErC,OAAO,MAAM,IAAI,gCAAgC,CAC/C,IAAI,CAAC,iBAAiB,CACvB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAiC,EACjC,OAAqC;QAErC,OAAO,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CACtE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAiC,EACjC,OAAqC;QAErC,OAAO,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CACtE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cloudfront/typings/cloudfront-functions.namespace.d.ts

@@ -6,7 +6,7 @@ export declare namespace CloudFrontFunction {
         value: string;
         multiValue: Value[];
     }
-    type Headers = Record<string, Value>;
+    type Headers = Record<string, Value | MultiValue>;
     type QueryString = Record<string, Value | MultiValue>;
     type Cookies = Record<string, Value>;
     interface Request {

package/dist/service/cloudfront/typings/cloudfront-functions.namespace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudfront-functions.namespace.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/typings/cloudfront-functions.namespace.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,OAAO,WAAW,kBAAkB,CAAC;IAC1C,UAAiB,KAAK;QACpB,KAAK,EAAE,MAAM,CAAC;KACf;IAED,UAAiB,UAAU;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,KAAK,EAAE,CAAC;KACrB;IAED,KAAY,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAE5C,KAAY,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,UAAU,CAAC,CAAC;IAE7D,KAAY,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAE5C,UAAiB,OAAO;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,OAAO,CAAC;QACjB,WAAW,EAAE,WAAW,CAAC;QACzB,OAAO,EAAE,OAAO,CAAC;KAClB;IAED,UAAiB,QAAQ;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;KAClC;IAED,KAAY,SAAS,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;IAE7D,UAAiB,YAAY;QAC3B,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,EAAE,SAAS,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;KACnB;IAED,UAAiB,MAAM;QACrB,EAAE,EAAE,MAAM,CAAC;KACZ;IAED,UAAU,SAAS;QACjB,OAAO,EAAE,YAAY,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAC;KAClB;IAED,UAAiB,kBAAmB,SAAQ,SAAS;QACnD,OAAO,EAAE,YAAY,GAAG;YACtB,SAAS,EAAE,gBAAgB,CAAC;SAC7B,CAAC;KACH;IAED,UAAiB,mBAAoB,SAAQ,SAAS;QACpD,OAAO,EAAE,YAAY,GAAG;YACtB,SAAS,EAAE,iBAAiB,CAAC;SAC9B,CAAC;QACF,QAAQ,EAAE,QAAQ,CAAC;KACpB;IAED,KAAY,KAAK,GAAG,kBAAkB,GAAG,mBAAmB,CAAC;IAE7D;;;;;;OAMG;IACH,KAAY,oBAAoB,GAAG,CACjC,KAAK,EAAE,kBAAkB,KACtB,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC;IAEtD,KAAY,qBAAqB,GAAG,CAClC,KAAK,EAAE,mBAAmB,KACvB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAElC,KAAY,OAAO,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;CACpE"}
+{"version":3,"file":"cloudfront-functions.namespace.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/typings/cloudfront-functions.namespace.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,OAAO,WAAW,kBAAkB,CAAC;IAC1C,UAAiB,KAAK;QACpB,KAAK,EAAE,MAAM,CAAC;KACf;IAED,UAAiB,UAAU;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,KAAK,EAAE,CAAC;KACrB;IAED,KAAY,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,UAAU,CAAC,CAAC;IAEzD,KAAY,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,UAAU,CAAC,CAAC;IAE7D,KAAY,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAE5C,UAAiB,OAAO;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,OAAO,CAAC;QACjB,WAAW,EAAE,WAAW,CAAC;QACzB,OAAO,EAAE,OAAO,CAAC;KAClB;IAED,UAAiB,QAAQ;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;KAClC;IAED,KAAY,SAAS,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;IAE7D,UAAiB,YAAY;QAC3B,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,EAAE,SAAS,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;KACnB;IAED,UAAiB,MAAM;QACrB,EAAE,EAAE,MAAM,CAAC;KACZ;IAED,UAAU,SAAS;QACjB,OAAO,EAAE,YAAY,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAC;KAClB;IAED,UAAiB,kBAAmB,SAAQ,SAAS;QACnD,OAAO,EAAE,YAAY,GAAG;YACtB,SAAS,EAAE,gBAAgB,CAAC;SAC7B,CAAC;KACH;IAED,UAAiB,mBAAoB,SAAQ,SAAS;QACpD,OAAO,EAAE,YAAY,GAAG;YACtB,SAAS,EAAE,iBAAiB,CAAC;SAC9B,CAAC;QACF,QAAQ,EAAE,QAAQ,CAAC;KACpB;IAED,KAAY,KAAK,GAAG,kBAAkB,GAAG,mBAAmB,CAAC;IAE7D;;;;;;OAMG;IACH,KAAY,oBAAoB,GAAG,CACjC,KAAK,EAAE,kBAAkB,KACtB,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC;IAEtD,KAAY,qBAAqB,GAAG,CAClC,KAAK,EAAE,mBAAmB,KACvB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAElC,KAAY,OAAO,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;CACpE"}

package/dist/service/cloudfront/web-acl/sim-cf-distribution-web-acl.d.ts

@@ -0,0 +1,33 @@
+import type { SimCloudFrontDistributionConfig } from "../command/create-distribution/create-distribution.command.js";
+import type { SimCfWebAclResolver } from "./sim-cf-web-acl.js";
+/**
+ * The web ACL ARN a DistributionConfig names, or nothing when it names none.
+ *
+ * An empty `WebACLId` is how CloudFront says there is no web ACL, and it is
+ * what CloudFormation emits for a Distribution that was never given one, so it
+ * means the same here as an absent one.
+ */
+export declare function simCfWebAclArn(distributionConfig: SimCloudFrontDistributionConfig): string | undefined;
+/**
+ * Refuses a DistributionConfig naming a web ACL that cannot go in front of a
+ * Distribution.
+ *
+ * Real CloudFront checks this when the Distribution is created or updated, so
+ * a template naming a mistyped ARN or a `REGIONAL` scope web ACL fails the
+ * deploy there too, rather than deploying successfully and answering every
+ * request as though there were no web ACL at all.
+ */
+export declare class SimCfDistributionWebAcl {
+    private readonly resolve;
+    constructor(resolve: SimCfWebAclResolver | undefined);
+    /**
+     * Refuse a DistributionConfig whose `WebACLId` names no web ACL this
+     * simulation can use, without touching the Distribution.
+     *
+     * An update replaces a Distribution's whole configuration, so this runs
+     * before any of it is torn down: a refusal here leaves the Distribution
+     * serving exactly what it served before.
+     */
+    assertUsable(distributionConfig: SimCloudFrontDistributionConfig): void;
+}
+//# sourceMappingURL=sim-cf-distribution-web-acl.d.ts.map

package/dist/service/cloudfront/web-acl/sim-cf-distribution-web-acl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-distribution-web-acl.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/web-acl/sim-cf-distribution-web-acl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,+DAA+D,CAAC;AAErH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,kBAAkB,EAAE,+BAA+B,GAClD,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;;;;GAQG;AACH,qBAAa,uBAAuB;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,mBAAmB,GAAG,SAAS,EAAI;IAEzE;;;;;;;OAOG;IACH,YAAY,CAAC,kBAAkB,EAAE,+BAA+B,GAAG,IAAI,CA6BtE;CACF"}

package/dist/service/cloudfront/web-acl/sim-cf-distribution-web-acl.js

@@ -0,0 +1,58 @@
+import { SimCloudFrontInvalidWebAclId } from "../error/sim-cloudfront.error.js";
+/**
+ * The web ACL ARN a DistributionConfig names, or nothing when it names none.
+ *
+ * An empty `WebACLId` is how CloudFront says there is no web ACL, and it is
+ * what CloudFormation emits for a Distribution that was never given one, so it
+ * means the same here as an absent one.
+ */
+export function simCfWebAclArn(distributionConfig) {
+    const webAclId = distributionConfig.WebACLId;
+    return webAclId === undefined || webAclId === "" ? undefined : webAclId;
+}
+/**
+ * Refuses a DistributionConfig naming a web ACL that cannot go in front of a
+ * Distribution.
+ *
+ * Real CloudFront checks this when the Distribution is created or updated, so
+ * a template naming a mistyped ARN or a `REGIONAL` scope web ACL fails the
+ * deploy there too, rather than deploying successfully and answering every
+ * request as though there were no web ACL at all.
+ */
+export class SimCfDistributionWebAcl {
+    resolve;
+    constructor(resolve) {
+        this.resolve = resolve;
+    }
+    /**
+     * Refuse a DistributionConfig whose `WebACLId` names no web ACL this
+     * simulation can use, without touching the Distribution.
+     *
+     * An update replaces a Distribution's whole configuration, so this runs
+     * before any of it is torn down: a refusal here leaves the Distribution
+     * serving exactly what it served before.
+     */
+    assertUsable(distributionConfig) {
+        const webAclArn = simCfWebAclArn(distributionConfig);
+        if (webAclArn === undefined) {
+            return;
+        }
+        // A simulated CloudFront built on its own has no simulation around it
+        // holding web ACLs, and a resolver that finds nothing means the same thing
+        // here as one that looked and came back empty.
+        const found = this.resolve?.(webAclArn);
+        if (found === undefined) {
+            throw new SimCloudFrontInvalidWebAclId(`Sim CloudFront DistributionConfig names web ACL ${webAclArn}, which ` +
+                `does not exist. Only a web ACL created in this simulation can be ` +
+                `named, so a managed web ACL ARN, or one from a real account, will ` +
+                `not be found.`);
+        }
+        if (found.webAcl.scope !== "CLOUDFRONT") {
+            throw new SimCloudFrontInvalidWebAclId(`Sim CloudFront DistributionConfig names web ACL ${webAclArn}, which ` +
+                `is a ${found.webAcl.scope} scope web ACL. A Distribution takes a ` +
+                `CLOUDFRONT scope web ACL, created in us-east-1, and a REGIONAL one ` +
+                `goes in front of an API Gateway stage or a load balancer instead.`);
+        }
+    }
+}
+//# sourceMappingURL=sim-cf-distribution-web-acl.js.map

package/dist/service/cloudfront/web-acl/sim-cf-distribution-web-acl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-distribution-web-acl.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/web-acl/sim-cf-distribution-web-acl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAGhF;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,kBAAmD;IAEnD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC;IAE7C,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,uBAAuB;IACL,OAAO;IAApC,YAA6B,OAAwC;uBAAxC,OAAO;IAAoC,CAAC;IAEzE;;;;;;;OAOG;IACH,YAAY,CAAC,kBAAmD;QAC9D,MAAM,SAAS,GAAG,cAAc,CAAC,kBAAkB,CAAC,CAAC;QAErD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,sEAAsE;QACtE,2EAA2E;QAC3E,+CAA+C;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,4BAA4B,CACpC,mDAAmD,SAAS,UAAU;gBACpE,mEAAmE;gBACnE,oEAAoE;gBACpE,eAAe,CAClB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YACxC,MAAM,IAAI,4BAA4B,CACpC,mDAAmD,SAAS,UAAU;gBACpE,QAAQ,KAAK,CAAC,MAAM,CAAC,KAAK,yCAAyC;gBACnE,qEAAqE;gBACrE,mEAAmE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cloudfront/web-acl/sim-cf-web-acl-resolver.factory.d.ts

@@ -0,0 +1,13 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimCfWebAclResolver } from "./sim-cf-web-acl.js";
+/**
+ * Create a web ACL resolver backed by a simulated AWS environment.
+ *
+ * A `CLOUDFRONT` scope web ACL is held by the WAFv2 of the Account and Region
+ * its ARN names, which is `us-east-1` for every web ACL CloudFront can use.
+ * The ARN is read for that scope rather than assumed, so a `REGIONAL` web ACL
+ * named here is found in the Region it was created in and refused for what it
+ * is, rather than going missing.
+ */
+export declare function makeSimCfWebAclResolver(simAws: SimAws): SimCfWebAclResolver;
+//# sourceMappingURL=sim-cf-web-acl-resolver.factory.d.ts.map

package/dist/service/cloudfront/web-acl/sim-cf-web-acl-resolver.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-web-acl-resolver.factory.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/web-acl/sim-cf-web-acl-resolver.factory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAiB3E"}

package/dist/service/cloudfront/web-acl/sim-cf-web-acl-resolver.factory.js

@@ -0,0 +1,25 @@
+import { parseSimArn } from "../../aws/arn.js";
+/**
+ * Create a web ACL resolver backed by a simulated AWS environment.
+ *
+ * A `CLOUDFRONT` scope web ACL is held by the WAFv2 of the Account and Region
+ * its ARN names, which is `us-east-1` for every web ACL CloudFront can use.
+ * The ARN is read for that scope rather than assumed, so a `REGIONAL` web ACL
+ * named here is found in the Region it was created in and refused for what it
+ * is, rather than going missing.
+ */
+export function makeSimCfWebAclResolver(simAws) {
+    return (webAclArn) => {
+        const arn = parseSimArn(webAclArn);
+        if (arn?.service !== "wafv2") {
+            return;
+        }
+        const wafV2 = simAws.accountRegionScope(arn.accountId, arn.region).wafV2();
+        const webAcl = wafV2.findWebAclByArn(webAclArn);
+        if (webAcl === undefined) {
+            return;
+        }
+        return { wafV2, webAcl };
+    };
+}
+//# sourceMappingURL=sim-cf-web-acl-resolver.factory.js.map

package/dist/service/cloudfront/web-acl/sim-cf-web-acl-resolver.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-web-acl-resolver.factory.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/web-acl/sim-cf-web-acl-resolver.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAI/C;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,CAAC,SAAiB,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QAEnC,IAAI,GAAG,EAAE,OAAO,KAAK,OAAO,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAEhD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC"}

package/dist/service/cloudfront/web-acl/sim-cf-web-acl.d.ts

@@ -0,0 +1,24 @@
+import type { SimWafV2 } from "../../wafv2/sim-wafv2.js";
+import type { SimWafWebAcl } from "../../wafv2/web-acl/sim-waf-web-acl.js";
+/**
+ * A web ACL a Distribution's `WebACLId` names, and the simulated WAFv2 that
+ * holds it.
+ *
+ * The service comes back with the web ACL because it is what decides a
+ * request: `evaluateRequest` is the entry point WAFv2 offers a fronting
+ * service, and the web ACL itself is what says whether it can be put in front
+ * of a Distribution at all.
+ */
+export interface SimCfWebAcl {
+    readonly wafV2: SimWafV2;
+    readonly webAcl: SimWafWebAcl;
+}
+/**
+ * Find the web ACL an ARN names, wherever in the simulation it was created.
+ *
+ * Nothing means no web ACL of that ARN, which is what a Distribution naming
+ * one is refused for. A simulated CloudFront built outside a SimAws has no
+ * resolver at all, and a `WebACLId` is refused there for the same reason.
+ */
+export type SimCfWebAclResolver = (webAclArn: string) => SimCfWebAcl | undefined;
+//# sourceMappingURL=sim-cf-web-acl.d.ts.map

package/dist/service/cloudfront/web-acl/sim-cf-web-acl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-web-acl.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/web-acl/sim-cf-web-acl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,SAAS,EAAE,MAAM,KACd,WAAW,GAAG,SAAS,CAAC"}

package/dist/service/cloudfront/web-acl/sim-cf-web-acl.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-cf-web-acl.js.map

package/dist/service/cloudfront/web-acl/sim-cf-web-acl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cf-web-acl.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/web-acl/sim-cf-web-acl.ts"],"names":[],"mappings":""}

package/dist/service/cognito/command/hosted/hosted-auth.command.d.ts

@@ -1,3 +1,4 @@
+import type { SimCognitoSessionChange } from "./sim-cognito-session-change.js";
 /**
  * The `/oauth2/authorize` query parameters this simulation reads.
  *
@@ -35,6 +36,15 @@ export interface SimCognitoHostedRedirect {
     readonly location: string;
     /** The user the redirect signed in, where one was signed in. */
     readonly username?: string | undefined;
+    /**
+     * What the request did to the browser's managed login session.
+     *
+     * A sign-in that took credentials starts one, a sign-in the browser's own
+     * session answered reuses it, and a sign-out ends it. Every request that
+     * reaches a redirect has done one of the three, so reading this is how a
+     * test tells a sign-in that needed a password from one that did not.
+     */
+    readonly session: SimCognitoSessionChange;
 }
 /**
  * The `/oauth2/token` request fields this simulation reads.

package/dist/service/cognito/command/hosted/hosted-auth.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-auth.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/hosted-auth.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpD;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC"}
+{"version":3,"file":"hosted-auth.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/hosted-auth.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpD;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEvC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC"}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.d.ts

@@ -18,9 +18,10 @@ interface SimCognitoAuthorizeEndpointProperties {
  * A request naming a provider signs in the user that provider has been told is
  * signed in at it. A request naming none signs in one of the pool's own users,
  * with the username and password real managed login would have taken from its
- * form. Nothing here draws the form: the serving layer is what answers a
- * browser with a page, and a test calling this directly passes the two fields
- * the form would have posted.
+ * form, or from the managed login session the browser presented. Nothing here
+ * draws the form: the serving layer is what answers a browser with a page, and
+ * a test calling this directly passes the two fields the form would have
+ * posted.
  */
 export declare class SimCognitoAuthorizeEndpoint {
     private readonly signIn;
@@ -31,8 +32,11 @@ export declare class SimCognitoAuthorizeEndpoint {
     /**
      * Sign a user in, and send the browser back to the application with an
      * authorization code.
+     *
+     * `presentedSession` is the managed login session the browser carried, which
+     * the serving layer reads out of the `cognito` cookie.
      */
-    handle(pool: SimCognitoUserPool, input: SimCognitoAuthorizeInput): SimCognitoHostedRedirect;
+    handle(pool: SimCognitoUserPool, input: SimCognitoAuthorizeInput, presentedSession?: string): SimCognitoHostedRedirect;
     private redirectWithCode;
 }
 export {};

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authorize-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAInF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EACV,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAElC,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,wBAAwB,GAC9B,wBAAwB,CAgC1B;IAED,OAAO,CAAC,gBAAgB;CAezB"}
+{"version":3,"file":"sim-cognito-authorize-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAInF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EACV,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAElC,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;;;;;OAMG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,wBAAwB,EAC/B,gBAAgB,CAAC,EAAE,MAAM,GACxB,wBAAwB,CAkC1B;IAED,OAAO,CAAC,gBAAgB;CAezB"}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.js

@@ -14,9 +14,10 @@ import { SimCognitoHostedClient } from "./sim-cognito-hosted-client.js";
  * A request naming a provider signs in the user that provider has been told is
  * signed in at it. A request naming none signs in one of the pool's own users,
  * with the username and password real managed login would have taken from its
- * form. Nothing here draws the form: the serving layer is what answers a
- * browser with a page, and a test calling this directly passes the two fields
- * the form would have posted.
+ * form, or from the managed login session the browser presented. Nothing here
+ * draws the form: the serving layer is what answers a browser with a page, and
+ * a test calling this directly passes the two fields the form would have
+ * posted.
  */
 export class SimCognitoAuthorizeEndpoint {
     signIn;
@@ -30,8 +31,11 @@ export class SimCognitoAuthorizeEndpoint {
     /**
      * Sign a user in, and send the browser back to the application with an
      * authorization code.
+     *
+     * `presentedSession` is the managed login session the browser carried, which
+     * the serving layer reads out of the `cognito` cookie.
      */
-    handle(pool, input) {
+    handle(pool, input, presentedSession) {
         const client = this.hostedClient.forAuthorize(pool, input.client_id);
         const redirectUri = this.hostedClient.requiredRedirectUri(client, input.redirect_uri);
         // Everything from here on is refused by sending the browser back to the
@@ -41,7 +45,8 @@ export class SimCognitoAuthorizeEndpoint {
         this.hostedClient.requireCodeGrant(client, true);
         this.request.requireChallengeMethod(input);
         const scopes = new SimCognitoGrantedScopes(client, input.scope);
-        const user = this.signIn.signIn(pool, client, input);
+        const signedIn = this.signIn.signIn(pool, client, input, presentedSession);
+        const { user } = signedIn;
         const code = new SimCognitoAuthorizationCode({
             username: user.username,
             clientId: client.id,
@@ -54,6 +59,7 @@ export class SimCognitoAuthorizeEndpoint {
         return {
             location: this.redirectWithCode(redirectUri, code.value, input.state),
             username: user.username,
+            session: signedIn.session,
         };
     }
     redirectWithCode(redirectUri, code, state) {

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authorize-endpoint.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AAErG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAyB;IAC/B,KAAK,CAAW;IAChB,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC5C,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE5D,YAAY,UAAiD;QAC3D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,KAA+B;QAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CACvD,MAAM,EACN,KAAK,CAAC,YAAY,CACnB,CAAC;QAEF,wEAAwE;QACxE,0EAA0E;QAC1E,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAI,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAErD,MAAM,IAAI,GAAG,IAAI,2BAA2B,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,KAAK,CAAC,cAAc;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAErC,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACrE,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,WAAmB,EACnB,IAAY,EACZ,KAAyB;QAEzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-authorize-endpoint.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-authorize-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,wDAAwD,CAAC;AAErG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAyB;IAC/B,KAAK,CAAW;IAChB,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC5C,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE5D,YAAY,UAAiD;QAC3D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,IAAwB,EACxB,KAA+B,EAC/B,gBAAyB;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CACvD,MAAM,EACN,KAAK,CAAC,YAAY,CACnB,CAAC;QAEF,wEAAwE;QACxE,0EAA0E;QAC1E,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAI,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC3E,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;QAE1B,MAAM,IAAI,GAAG,IAAI,2BAA2B,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,KAAK,CAAC,cAAc;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAErC,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACrE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,WAAmB,EACnB,IAAY,EACZ,KAAyB;QAEzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAEtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAExC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-browser-session.d.ts

@@ -0,0 +1,28 @@
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import { SimCognitoHostedSignedIn } from "./sim-cognito-hosted-signed-in.js";
+/**
+ * The managed login session a browser holds at a pool's hosted domain.
+ *
+ * Real managed login starts one whenever a user signs in at the domain, with
+ * its own credentials or at an identity provider, and answers an authorize
+ * request carrying it with a code and no further questions. That is what makes
+ * a sign-out which clears the application's own cookies and revokes the user's
+ * tokens leave the browser signed in here.
+ */
+export declare class SimCognitoBrowserSession {
+    /**
+     * Start a session for a browser that has just signed in.
+     */
+    start(pool: SimCognitoUserPool, user: SimCognitoUser, now: Date): SimCognitoHostedSignedIn;
+    /**
+     * The user the session a browser presented signs in, where it still has one.
+     *
+     * Real Cognito lets attribute and authentication changes go by without
+     * disturbing the session, so nothing is rechecked but the user itself. A
+     * user deleted since the session started leaves it with nobody to sign in,
+     * and a disabled user is refused the way every other sign-in refuses one.
+     */
+    signIn(pool: SimCognitoUserPool, presented: string | undefined, now: Date): SimCognitoHostedSignedIn | undefined;
+}
+//# sourceMappingURL=sim-cognito-browser-session.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-browser-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-browser-session.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-browser-session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAG7E;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC;;OAEG;IACH,KAAK,CACH,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,IAAI,GACR,wBAAwB,CAY1B;IAED;;;;;;;OAOG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,EAAE,IAAI,GACR,wBAAwB,GAAG,SAAS,CAqBtC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-browser-session.js

@@ -0,0 +1,54 @@
+import { SimCognitoManagedLoginSession } from "../../user-pool/auth/sim-cognito-managed-login-session.js";
+import { requireSimCognitoEnabled } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { SimCognitoHostedSignedIn } from "./sim-cognito-hosted-signed-in.js";
+import { SimCognitoSessionChange } from "./sim-cognito-session-change.js";
+/**
+ * The managed login session a browser holds at a pool's hosted domain.
+ *
+ * Real managed login starts one whenever a user signs in at the domain, with
+ * its own credentials or at an identity provider, and answers an authorize
+ * request carrying it with a code and no further questions. That is what makes
+ * a sign-out which clears the application's own cookies and revokes the user's
+ * tokens leave the browser signed in here.
+ */
+export class SimCognitoBrowserSession {
+    /**
+     * Start a session for a browser that has just signed in.
+     */
+    start(pool, user, now) {
+        const session = new SimCognitoManagedLoginSession({
+            username: user.username,
+            startedAt: now,
+        });
+        pool.auth.addManagedLoginSession(session);
+        return new SimCognitoHostedSignedIn({
+            user,
+            session: SimCognitoSessionChange.started(session.value),
+        });
+    }
+    /**
+     * The user the session a browser presented signs in, where it still has one.
+     *
+     * Real Cognito lets attribute and authentication changes go by without
+     * disturbing the session, so nothing is rechecked but the user itself. A
+     * user deleted since the session started leaves it with nobody to sign in,
+     * and a disabled user is refused the way every other sign-in refuses one.
+     */
+    signIn(pool, presented, now) {
+        const session = pool.auth.findManagedLoginSession(presented, now);
+        if (session === undefined) {
+            return undefined;
+        }
+        const user = pool.findUser(session.username);
+        if (user === undefined) {
+            pool.auth.endManagedLoginSession(session.value);
+            return undefined;
+        }
+        requireSimCognitoEnabled(user);
+        return new SimCognitoHostedSignedIn({
+            user,
+            session: SimCognitoSessionChange.reused(),
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-browser-session.js.map

package/dist/service/cognito/command/hosted/sim-cognito-browser-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-browser-session.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-browser-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAGvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IACnC;;OAEG;IACH,KAAK,CACH,IAAwB,EACxB,IAAoB,EACpB,GAAS;QAET,MAAM,OAAO,GAAG,IAAI,6BAA6B,CAAC;YAChD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAE1C,OAAO,IAAI,wBAAwB,CAAC;YAClC,IAAI;YACJ,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CACJ,IAAwB,EACxB,SAA6B,EAC7B,GAAS;QAET,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAElE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAEhD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAE/B,OAAO,IAAI,wBAAwB,CAAC;YAClC,IAAI;YACJ,OAAO,EAAE,uBAAuB,CAAC,MAAM,EAAE;SAC1C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-credentials.d.ts

@@ -0,0 +1,20 @@
+import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
+/**
+ * The username and password managed login's form posts.
+ *
+ * Real managed login reads these two out of its form, and this simulation
+ * reads them out of the authorize request, because a get carrying them and a
+ * post of the form it serves are the same request here. A request carrying
+ * neither has nobody to sign in, and the sign-in it is part of decides what to
+ * do about that.
+ */
+export declare class SimCognitoHostedCredentials {
+    readonly username: string;
+    readonly password: string;
+    private constructor();
+    /**
+     * The credentials an authorize request carries, where it carries both.
+     */
+    static in(input: SimCognitoAuthorizeInput): SimCognitoHostedCredentials | undefined;
+}
+//# sourceMappingURL=sim-cognito-hosted-credentials.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-credentials.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE;;;;;;;;GAQG;AACH,qBAAa,2BAA2B;IACtC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,OAAO,eAGN;IAED;;OAEG;IACH,MAAM,CAAC,EAAE,CACP,KAAK,EAAE,wBAAwB,GAC9B,2BAA2B,GAAG,SAAS,CAYzC;CACF"}