@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/cognito/command/hosted/sim-cognito-hosted-credentials.js

@@ -0,0 +1,31 @@
+/**
+ * The username and password managed login's form posts.
+ *
+ * Real managed login reads these two out of its form, and this simulation
+ * reads them out of the authorize request, because a get carrying them and a
+ * post of the form it serves are the same request here. A request carrying
+ * neither has nobody to sign in, and the sign-in it is part of decides what to
+ * do about that.
+ */
+export class SimCognitoHostedCredentials {
+    username;
+    password;
+    constructor(username, password) {
+        this.username = username;
+        this.password = password;
+    }
+    /**
+     * The credentials an authorize request carries, where it carries both.
+     */
+    static in(input) {
+        const { username, password } = input;
+        if (username === undefined || username === "") {
+            return undefined;
+        }
+        if (password === undefined || password === "") {
+            return undefined;
+        }
+        return new SimCognitoHostedCredentials(username, password);
+    }
+}
+//# sourceMappingURL=sim-cognito-hosted-credentials.js.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-credentials.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-credentials.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA2B;IACtB,QAAQ,CAAS;IACjB,QAAQ,CAAS;IAEjC,YAAoB,QAAgB,EAAE,QAAgB;QACpD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,EAAE,CACP,KAA+B;QAE/B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAErC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.d.ts

@@ -1,7 +1,7 @@
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
 import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
-import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
+import type { SimCognitoHostedCredentials } from "./sim-cognito-hosted-credentials.js";
 /**
  * Signing one of a pool's own users in at the authorize endpoint.
  *
@@ -18,17 +18,9 @@ import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
  */
 export declare class SimCognitoHostedPasswordSignIn {
     /**
-     * The user this request signs in, having checked its password.
+     * The user these credentials sign in, having checked the password.
      */
-    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput): SimCognitoUser;
-    /**
-     * The username and password the request carried.
-     *
-     * A request carrying neither, and naming no identity provider, is one a
-     * browser is shown the sign-in page for. The serving layer is what answers
-     * with that page, from this refusal.
-     */
-    private requiredCredentials;
+    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, credentials: SimCognitoHostedCredentials): SimCognitoUser;
     /**
      * Refuse a sign-in real managed login answers with a page of its own.
      *

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-password-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAUzE;;;;;;;;;;;;;GAaG;AACH,qBAAa,8BAA8B;IACzC;;OAEG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,GAC9B,cAAc,CAWhB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;CAwB7B"}
+{"version":3,"file":"sim-cognito-hosted-password-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAEvF;;;;;;;;;;;;;GAaG;AACH,qBAAa,8BAA8B;IACzC;;OAEG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,WAAW,EAAE,2BAA2B,GACvC,cAAc,CAWhB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;CAwB7B"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.js

@@ -1,5 +1,4 @@
 import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
-import { SimCognitoManagedLoginRequired } from "../../error/sim-cognito-managed-login.error.js";
 import { requireSimCognitoConfirmed, requireSimCognitoPasswordSet, requireSimCognitoSignIn, requireSimCognitoSignInUser, } from "../../user-pool/auth/sim-cognito-sign-in.js";
 import { simCognitoChallengeFactor } from "../auth/sim-cognito-mfa-factor-choice.js";
 /**
@@ -18,10 +17,10 @@ import { simCognitoChallengeFactor } from "../auth/sim-cognito-mfa-factor-choice
  */
 export class SimCognitoHostedPasswordSignIn {
     /**
-     * The user this request signs in, having checked its password.
+     * The user these credentials sign in, having checked the password.
      */
-    signIn(pool, client, input) {
-        const { username, password } = this.requiredCredentials(input);
+    signIn(pool, client, credentials) {
+        const { username, password } = credentials;
         const user = requireSimCognitoSignInUser(pool, client, username);
         requireSimCognitoSignIn(user, password);
         requireSimCognitoConfirmed(user);
@@ -29,23 +28,6 @@ export class SimCognitoHostedPasswordSignIn {
         this.requireNoFurtherPage(pool, user);
         return user;
     }
-    /**
-     * The username and password the request carried.
-     *
-     * A request carrying neither, and naming no identity provider, is one a
-     * browser is shown the sign-in page for. The serving layer is what answers
-     * with that page, from this refusal.
-     */
-    requiredCredentials(input) {
-        const { username, password } = input;
-        if (username === undefined ||
-            username === "" ||
-            password === undefined ||
-            password === "") {
-            throw new SimCognitoManagedLoginRequired();
-        }
-        return { username, password };
-    }
     /**
      * Refuse a sign-in real managed login answers with a page of its own.
      *

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-password-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAChG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAIrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAWrF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,8BAA8B;IACzC;;OAEG;IACH,MAAM,CACJ,IAAwB,EACxB,MAAgC,EAChC,KAA+B;QAE/B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACjC,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,mBAAmB,CACzB,KAA+B;QAE/B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAErC,IACE,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,EAAE;YACf,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,EAAE,EACf,CAAC;YACD,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAC1B,IAAwB,EACxB,IAAoB;QAEpB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAmC,CAC3C,QAAQ,IAAI,CAAC,QAAQ,+CAA+C;gBAClE,oEAAoE;gBACpE,oEAAoE;gBACpE,uBAAuB,CAC1B,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAErD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,mCAAmC,CAC3C,QAAQ,IAAI,CAAC,QAAQ,sBAAsB,MAAM,oBAAoB;gBACnE,mEAAmE;gBACnE,oEAAoE;gBACpE,+CAA+C,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-hosted-password-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAIrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAGrF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,8BAA8B;IACzC;;OAEG;IACH,MAAM,CACJ,IAAwB,EACxB,MAAgC,EAChC,WAAwC;QAExC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC;QAC3C,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACjC,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAEnC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAC1B,IAAwB,EACxB,IAAoB;QAEpB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAmC,CAC3C,QAAQ,IAAI,CAAC,QAAQ,+CAA+C;gBAClE,oEAAoE;gBACpE,oEAAoE;gBACpE,uBAAuB,CAC1B,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAErD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,mCAAmC,CAC3C,QAAQ,IAAI,CAAC,QAAQ,sBAAsB,MAAM,oBAAoB;gBACnE,mEAAmE;gBACnE,oEAAoE;gBACpE,+CAA+C,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.d.ts

@@ -2,7 +2,7 @@ import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoFederatedSignIn } from "../../user-pool/idp/sim-cognito-federated-sign-in.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
-import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoHostedSignedIn } from "./sim-cognito-hosted-signed-in.js";
 import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
 interface SimCognitoHostedSignInProperties {
     readonly federatedSignIn: SimCognitoFederatedSignIn;
@@ -11,22 +11,36 @@ interface SimCognitoHostedSignInProperties {
 /**
  * Which user an authorize request signs in.
  *
- * Real Cognito has two answers here. A request naming an identity provider
- * goes to that provider's own sign-in page, and one naming none goes to
- * managed login's form. The choice is made from the same parameter either way,
- * so it is made in one place, and what comes back is the pool user the
- * authorization code is issued for.
+ * Real Cognito has three answers here. A request naming an identity provider
+ * goes to that provider's own sign-in page. A request carrying credentials is
+ * managed login's form coming back. A request carrying neither is answered by
+ * the browser's own managed login session, and by the form where the browser
+ * holds none. What comes back is the pool user the authorization code is
+ * issued for, and what the browser should hold afterwards.
  */
 export declare class SimCognitoHostedSignIn {
     private readonly federatedSignIn;
     private readonly clock;
     private readonly request;
     private readonly passwordSignIn;
+    private readonly browserSession;
     constructor(properties: SimCognitoHostedSignInProperties);
     /**
-     * The user this request signs in, at a provider or in the pool itself.
+     * The user this request signs in, at a provider, in the pool itself, or from
+     * the managed login session the browser presented.
      */
-    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput): SimCognitoUser;
+    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput, presentedSession: string | undefined): SimCognitoHostedSignedIn;
+    /**
+     * Sign in one of the pool's own users, from a password or from the session
+     * the browser is already holding.
+     *
+     * Credentials win over a session, because a request carrying them is the
+     * sign-in form coming back and real managed login answers that with a fresh
+     * sign-in. A request carrying neither, from a browser holding no session, is
+     * one the sign-in form is shown for. The serving layer answers with that
+     * page, from this refusal.
+     */
+    private localSignIn;
 }
 export {};
 //# sourceMappingURL=sim-cognito-hosted-sign-in.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAG/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IAEvE,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;OAEG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,GAC9B,cAAc,CAYhB;CACF"}
+{"version":3,"file":"sim-cognito-hosted-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAKnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkC;IAEjE,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,EAC/B,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,wBAAwB,CAW1B;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;CAuBpB"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.js

@@ -1,36 +1,63 @@
+import { SimCognitoManagedLoginRequired } from "../../error/sim-cognito-managed-login.error.js";
 import { SimCognitoAuthorizeRequest } from "./sim-cognito-authorize-request.js";
+import { SimCognitoBrowserSession } from "./sim-cognito-browser-session.js";
+import { SimCognitoHostedCredentials } from "./sim-cognito-hosted-credentials.js";
 import { SimCognitoHostedPasswordSignIn } from "./sim-cognito-hosted-password-sign-in.js";
 /**
  * Which user an authorize request signs in.
  *
- * Real Cognito has two answers here. A request naming an identity provider
- * goes to that provider's own sign-in page, and one naming none goes to
- * managed login's form. The choice is made from the same parameter either way,
- * so it is made in one place, and what comes back is the pool user the
- * authorization code is issued for.
+ * Real Cognito has three answers here. A request naming an identity provider
+ * goes to that provider's own sign-in page. A request carrying credentials is
+ * managed login's form coming back. A request carrying neither is answered by
+ * the browser's own managed login session, and by the form where the browser
+ * holds none. What comes back is the pool user the authorization code is
+ * issued for, and what the browser should hold afterwards.
  */
 export class SimCognitoHostedSignIn {
     federatedSignIn;
     clock;
     request = new SimCognitoAuthorizeRequest();
     passwordSignIn = new SimCognitoHostedPasswordSignIn();
+    browserSession = new SimCognitoBrowserSession();
     constructor(properties) {
         this.federatedSignIn = properties.federatedSignIn;
         this.clock = properties.clock;
     }
     /**
-     * The user this request signs in, at a provider or in the pool itself.
+     * The user this request signs in, at a provider, in the pool itself, or from
+     * the managed login session the browser presented.
      */
-    signIn(pool, client, input) {
+    signIn(pool, client, input, presentedSession) {
         const provider = this.request.signInProvider(pool, client, input);
         if (provider === undefined) {
-            return this.passwordSignIn.signIn(pool, client, input);
+            return this.localSignIn(pool, client, input, presentedSession);
         }
-        return this.federatedSignIn.signIn({
-            pool,
-            provider,
-            now: this.clock.now(),
-        });
+        const now = this.clock.now();
+        const user = this.federatedSignIn.signIn({ pool, provider, now });
+        return this.browserSession.start(pool, user, now);
+    }
+    /**
+     * Sign in one of the pool's own users, from a password or from the session
+     * the browser is already holding.
+     *
+     * Credentials win over a session, because a request carrying them is the
+     * sign-in form coming back and real managed login answers that with a fresh
+     * sign-in. A request carrying neither, from a browser holding no session, is
+     * one the sign-in form is shown for. The serving layer answers with that
+     * page, from this refusal.
+     */
+    localSignIn(pool, client, input, presentedSession) {
+        const now = this.clock.now();
+        const credentials = SimCognitoHostedCredentials.in(input);
+        if (credentials === undefined) {
+            const returning = this.browserSession.signIn(pool, presentedSession, now);
+            if (returning === undefined) {
+                throw new SimCognitoManagedLoginRequired();
+            }
+            return returning;
+        }
+        const user = this.passwordSignIn.signIn(pool, client, credentials);
+        return this.browserSession.start(pool, user, now);
     }
 }
 //# sourceMappingURL=sim-cognito-hosted-sign-in.js.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAQ1F;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAsB;IAChB,eAAe,CAA4B;IAC3C,KAAK,CAAW;IAChB,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC3C,cAAc,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAEvE,YAAY,UAA4C;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,IAAwB,EACxB,MAAgC,EAChC,KAA+B;QAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAElE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACjC,IAAI;YACJ,QAAQ;YACR,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-hosted-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAIhG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAS1F;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IAChB,eAAe,CAA4B;IAC3C,KAAK,CAAW;IAChB,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC3C,cAAc,GAAG,IAAI,8BAA8B,EAAE,CAAC;IACtD,cAAc,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAEjE,YAAY,UAA4C;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,MAAgC,EAChC,KAA+B,EAC/B,gBAAoC;QAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAElE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAElE,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;OASG;IACK,WAAW,CACjB,IAAwB,EACxB,MAAgC,EAChC,KAA+B,EAC/B,gBAAoC;QAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,2BAA2B,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAE1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,8BAA8B,EAAE,CAAC;YAC7C,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAEnE,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-signed-in.d.ts

@@ -0,0 +1,21 @@
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoSessionChange } from "./sim-cognito-session-change.js";
+interface SimCognitoHostedSignedInProperties {
+    readonly user: SimCognitoUser;
+    readonly session: SimCognitoSessionChange;
+}
+/**
+ * Who an authorize request signed in, and what it did to the browser's managed
+ * login session on the way.
+ *
+ * The two travel together because the endpoint needs both: the user is who the
+ * authorization code is issued for, and the session change is what the
+ * response tells the browser to hold.
+ */
+export declare class SimCognitoHostedSignedIn {
+    readonly user: SimCognitoUser;
+    readonly session: SimCognitoSessionChange;
+    constructor(properties: SimCognitoHostedSignedInProperties);
+}
+export {};
+//# sourceMappingURL=sim-cognito-hosted-signed-in.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-signed-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-signed-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-signed-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;CAC3C;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,IAAI,EAAE,cAAc,CAAC;IACrC,SAAgB,OAAO,EAAE,uBAAuB,CAAC;IAEjD,YAAY,UAAU,EAAE,kCAAkC,EAGzD;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-signed-in.js

@@ -0,0 +1,17 @@
+/**
+ * Who an authorize request signed in, and what it did to the browser's managed
+ * login session on the way.
+ *
+ * The two travel together because the endpoint needs both: the user is who the
+ * authorization code is issued for, and the session change is what the
+ * response tells the browser to hold.
+ */
+export class SimCognitoHostedSignedIn {
+    user;
+    session;
+    constructor(properties) {
+        this.user = properties.user;
+        this.session = properties.session;
+    }
+}
+//# sourceMappingURL=sim-cognito-hosted-signed-in.js.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-signed-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-signed-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-signed-in.ts"],"names":[],"mappings":"AAQA;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnB,IAAI,CAAiB;IACrB,OAAO,CAA0B;IAEjD,YAAY,UAA8C;QACxD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-logout-endpoint.d.ts

@@ -4,19 +4,26 @@ import type { SimCognitoHostedRedirect, SimCognitoLogoutInput } from "./hosted-a
  * The `/logout` endpoint of a pool's hosted domain.
  *
  * Real Cognito ends the managed login session in the browser's cookie and
- * sends the user to one of the app client's sign-out URLs. There is no such
- * session here, because every authorize request signs in afresh at the
- * identity provider rather than reusing a cookie, so what is left is the
- * redirect and the check that the URL is one the app client registered.
+ * sends the user to one of the app client's sign-out URLs. Both happen here.
+ * Ending the session is what makes the next authorize request ask for a
+ * password again, and it is why an application's own sign-out has to come
+ * through this endpoint. Clearing its own cookies and revoking the user's
+ * tokens leaves this session where it was.
  *
- * It signs nobody out at the identity provider either, which real Cognito also
- * does not do: a user signed out here is still signed in at Google.
+ * It signs nobody out at the identity provider, which real Cognito also does
+ * not do: a user signed out here is still signed in at Google.
  */
 export declare class SimCognitoLogoutEndpoint {
     private readonly hostedClient;
     /**
-     * Send the browser to the application's sign-out page.
+     * End the browser's managed login session, and send it to the application's
+     * sign-out page.
+     *
+     * `presentedSession` is the session the browser carried, which the serving
+     * layer reads out of the `cognito` cookie. A request arriving without one is
+     * a sign-out by a browser that holds no session, and it redirects the same
+     * way.
      */
-    handle(pool: SimCognitoUserPool, input: SimCognitoLogoutInput): SimCognitoHostedRedirect;
+    handle(pool: SimCognitoUserPool, input: SimCognitoLogoutInput, presentedSession?: string): SimCognitoHostedRedirect;
 }
 //# sourceMappingURL=sim-cognito-logout-endpoint.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-logout-endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-logout-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-logout-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAEnF,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAE7D;;OAEG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,qBAAqB,GAC3B,wBAAwB,CA0B1B;CACF"}
+{"version":3,"file":"sim-cognito-logout-endpoint.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-logout-endpoint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAGnF,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;GAYG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAE7D;;;;;;;;OAQG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,qBAAqB,EAC5B,gBAAgB,CAAC,EAAE,MAAM,GACxB,wBAAwB,CA4B1B;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-logout-endpoint.js

@@ -1,23 +1,31 @@
 import { SimCognitoOAuthError } from "../../error/sim-cognito-oauth.error.js";
 import { SimCognitoHostedClient } from "./sim-cognito-hosted-client.js";
+import { SimCognitoSessionChange } from "./sim-cognito-session-change.js";
 /**
  * The `/logout` endpoint of a pool's hosted domain.
  *
  * Real Cognito ends the managed login session in the browser's cookie and
- * sends the user to one of the app client's sign-out URLs. There is no such
- * session here, because every authorize request signs in afresh at the
- * identity provider rather than reusing a cookie, so what is left is the
- * redirect and the check that the URL is one the app client registered.
+ * sends the user to one of the app client's sign-out URLs. Both happen here.
+ * Ending the session is what makes the next authorize request ask for a
+ * password again, and it is why an application's own sign-out has to come
+ * through this endpoint. Clearing its own cookies and revoking the user's
+ * tokens leaves this session where it was.
  *
- * It signs nobody out at the identity provider either, which real Cognito also
- * does not do: a user signed out here is still signed in at Google.
+ * It signs nobody out at the identity provider, which real Cognito also does
+ * not do: a user signed out here is still signed in at Google.
  */
 export class SimCognitoLogoutEndpoint {
     hostedClient = new SimCognitoHostedClient();
     /**
-     * Send the browser to the application's sign-out page.
+     * End the browser's managed login session, and send it to the application's
+     * sign-out page.
+     *
+     * `presentedSession` is the session the browser carried, which the serving
+     * layer reads out of the `cognito` cookie. A request arriving without one is
+     * a sign-out by a browser that holds no session, and it redirects the same
+     * way.
      */
-    handle(pool, input) {
+    handle(pool, input, presentedSession) {
         const client = this.hostedClient.forAuthorize(pool, input.client_id);
         const { logout_uri: logoutUri } = input;
         if (logoutUri === undefined) {
@@ -37,7 +45,8 @@ export class SimCognitoLogoutEndpoint {
                 redirectable: false,
             });
         }
-        return { location: logoutUri };
+        pool.auth.endManagedLoginSession(presentedSession);
+        return { location: logoutUri, session: SimCognitoSessionChange.ended() };
     }
 }
 //# sourceMappingURL=sim-cognito-logout-endpoint.js.map

package/dist/service/cognito/command/hosted/sim-cognito-logout-endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-logout-endpoint.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-logout-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAE9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAMxE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IAClB,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAE7D;;OAEG;IACH,MAAM,CACJ,IAAwB,EACxB,KAA4B;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QAExC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,kEAAkE;oBAClE,8DAA8D;oBAC9D,kDAAkD;gBACpD,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,eAAe,SAAS,8BAA8B,MAAM,CAAC,EAAE,KAAK;oBACpE,YAAY;gBACd,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-logout-endpoint.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-logout-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAE9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAM1E;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,wBAAwB;IAClB,YAAY,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAE7D;;;;;;;;OAQG;IACH,MAAM,CACJ,IAAwB,EACxB,KAA4B,EAC5B,gBAAyB;QAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QAExC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,kEAAkE;oBAClE,8DAA8D;oBAC9D,kDAAkD;gBACpD,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,eAAe,SAAS,8BAA8B,MAAM,CAAC,EAAE,KAAK;oBACpE,YAAY;gBACd,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;QAEnD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-session-change.d.ts

@@ -0,0 +1,40 @@
+/**
+ * What a hosted request did to the browser's managed login session.
+ */
+export type SimCognitoSessionOutcome = "started" | "reused" | "ended";
+/**
+ * The change a hosted endpoint makes to the browser's managed login session.
+ *
+ * Real managed login keeps the session in the `cognito` cookie on the pool's
+ * domain, and the serving layer here is what sets and clears that cookie. A
+ * test calling an endpoint directly reads the change from here, which is how
+ * it tells a sign-in that took a password from one the session answered.
+ */
+export declare class SimCognitoSessionChange {
+    readonly outcome: SimCognitoSessionOutcome;
+    /**
+     * The session the browser is given, where this request started one.
+     */
+    readonly startedSession: string | undefined;
+    private constructor();
+    /**
+     * A sign-in that took credentials and started a session for the browser.
+     */
+    static started(value: string): SimCognitoSessionChange;
+    /**
+     * A sign-in the browser's own session answered, taking no credentials.
+     *
+     * Nothing is handed back, because the browser already holds the session.
+     * Real Cognito leaves the hour where the first sign-in started it.
+     */
+    static reused(): SimCognitoSessionChange;
+    /**
+     * A sign-out, which leaves the browser holding no session.
+     */
+    static ended(): SimCognitoSessionChange;
+    /**
+     * Whether this request took the session out of the browser.
+     */
+    get endsSession(): boolean;
+}
+//# sourceMappingURL=sim-cognito-session-change.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-session-change.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-session-change.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-session-change.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEtE;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC,SAAgB,OAAO,EAAE,wBAAwB,CAAC;IAElD;;OAEG;IACH,SAAgB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnD,OAAO,eAMN;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB,CAErD;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAAM,IAAI,uBAAuB,CAEvC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAEtC;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-session-change.js

@@ -0,0 +1,47 @@
+/**
+ * The change a hosted endpoint makes to the browser's managed login session.
+ *
+ * Real managed login keeps the session in the `cognito` cookie on the pool's
+ * domain, and the serving layer here is what sets and clears that cookie. A
+ * test calling an endpoint directly reads the change from here, which is how
+ * it tells a sign-in that took a password from one the session answered.
+ */
+export class SimCognitoSessionChange {
+    outcome;
+    /**
+     * The session the browser is given, where this request started one.
+     */
+    startedSession;
+    constructor(outcome, startedSession) {
+        this.outcome = outcome;
+        this.startedSession = startedSession;
+    }
+    /**
+     * A sign-in that took credentials and started a session for the browser.
+     */
+    static started(value) {
+        return new SimCognitoSessionChange("started", value);
+    }
+    /**
+     * A sign-in the browser's own session answered, taking no credentials.
+     *
+     * Nothing is handed back, because the browser already holds the session.
+     * Real Cognito leaves the hour where the first sign-in started it.
+     */
+    static reused() {
+        return new SimCognitoSessionChange("reused", undefined);
+    }
+    /**
+     * A sign-out, which leaves the browser holding no session.
+     */
+    static ended() {
+        return new SimCognitoSessionChange("ended", undefined);
+    }
+    /**
+     * Whether this request took the session out of the browser.
+     */
+    get endsSession() {
+        return this.outcome === "ended";
+    }
+}
+//# sourceMappingURL=sim-cognito-session-change.js.map

package/dist/service/cognito/command/hosted/sim-cognito-session-change.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-session-change.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-session-change.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IAClB,OAAO,CAA2B;IAElD;;OAEG;IACa,cAAc,CAAqB;IAEnD,YACE,OAAiC,EACjC,cAAkC;QAElC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,uBAAuB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,uBAAuB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK;QACV,OAAO,IAAI,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC;IAClC,CAAC;CACF"}

package/dist/service/cognito/command/sim-cognito-commands.d.ts

@@ -5,6 +5,7 @@ import { SimCognitoRegistrations } from "../user-pool/sim-cognito-registrations.
 import type { SimCognitoUserPoolStore } from "../user-pool/sim-cognito-user-pool-store.js";
 import type { SimCognitoTriggerFunctions } from "../user-pool/trigger/sim-cognito-trigger-functions.js";
 import type { SimCognitoDomainRegistry } from "../registry/sim-cognito-domain-registry.js";
+import type { SimWafProtection } from "../../wafv2/association/sim-waf-protection.js";
 import { SimCognitoAuthCommands } from "./auth/sim-cognito-auth-commands.js";
 import { SimCognitoDomainCommands } from "./domain/sim-cognito-domain-commands.js";
 import { SimCognitoHostedCommands } from "./hosted/sim-cognito-hosted-commands.js";
@@ -30,6 +31,7 @@ interface SimCognitoCommandsProperties {
     readonly pools: SimCognitoUserPoolStore;
     readonly domains: SimCognitoDomainRegistry;
     readonly triggerFunctions: SimCognitoTriggerFunctions;
+    readonly webAcls: SimWafProtection;
 }
 /**
  * The command handlers of one simulated Cognito scope.
@@ -62,6 +64,12 @@ export declare class SimCognitoCommands {
      * AWS operation creates.
      */
     readonly registrations: SimCognitoRegistrations;
+    /**
+     * The web ACLs in front of this scope's pools. Held here because a request
+     * to a hosted domain reaches it without a Command, the way a fronting
+     * service reaches AWS WAF.
+     */
+    readonly webAcls: SimWafProtection;
     constructor(properties: SimCognitoCommandsProperties);
 }
 export {};

package/dist/service/cognito/command/sim-cognito-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-commands.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/command/sim-cognito-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAGnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAEpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAE3F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uDAAuD,CAAC;AAGxG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAE3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,kCAAkC,EAAE,MAAM,iDAAiD,CAAC;AAGrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,mDAAmD,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAElF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAEpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAElG,UAAU,4BAA4B;IACpC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;CACvD;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC7B,SAAgB,SAAS,EAAE,0BAA0B,CAAC;IACtD,SAAgB,WAAW,EAAE,6BAA6B,CAAC;IAC3D,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IACvD,SAAgB,OAAO,EAAE,gCAAgC,CAAC;IAC1D,SAAgB,WAAW,EAAE,6BAA6B,CAAC;IAC3D,SAAgB,KAAK,EAAE,sBAAsB,CAAC;IAC9C,SAAgB,OAAO,EAAE,yBAAyB,CAAC;IACnD,SAAgB,MAAM,EAAE,wBAAwB,CAAC;IACjD,SAAgB,aAAa,EAAE,+BAA+B,CAAC;IAC/D,SAAgB,WAAW,EAAE,4BAA4B,CAAC;IAC1D,SAAgB,SAAS,EAAE,mBAAmB,CAAC;IAC/C,SAAgB,MAAM,EAAE,uBAAuB,CAAC;IAChD,SAAgB,eAAe,EAAE,iCAAiC,CAAC;IACnE,SAAgB,UAAU,EAAE,oBAAoB,CAAC;IACjD,SAAgB,IAAI,EAAE,sBAAsB,CAAC;IAC7C,SAAgB,OAAO,EAAE,wBAAwB,CAAC;IAClD,SAAgB,iBAAiB,EAAE,kCAAkC,CAAC;IACtE,SAAgB,MAAM,EAAE,wBAAwB,CAAC;IAEjD;;;OAGG;IACH,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IAEvD,YAAY,UAAU,EAAE,4BAA4B,EA8GnD;CACF"}
+{"version":3,"file":"sim-cognito-commands.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/command/sim-cognito-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAGnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAEpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAE3F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uDAAuD,CAAC;AAGxG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAEtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,kCAAkC,EAAE,MAAM,iDAAiD,CAAC;AAGrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,mDAAmD,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAElF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAEpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAElG,UAAU,4BAA4B;IACpC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;CACpC;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC7B,SAAgB,SAAS,EAAE,0BAA0B,CAAC;IACtD,SAAgB,WAAW,EAAE,6BAA6B,CAAC;IAC3D,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IACvD,SAAgB,OAAO,EAAE,gCAAgC,CAAC;IAC1D,SAAgB,WAAW,EAAE,6BAA6B,CAAC;IAC3D,SAAgB,KAAK,EAAE,sBAAsB,CAAC;IAC9C,SAAgB,OAAO,EAAE,yBAAyB,CAAC;IACnD,SAAgB,MAAM,EAAE,wBAAwB,CAAC;IACjD,SAAgB,aAAa,EAAE,+BAA+B,CAAC;IAC/D,SAAgB,WAAW,EAAE,4BAA4B,CAAC;IAC1D,SAAgB,SAAS,EAAE,mBAAmB,CAAC;IAC/C,SAAgB,MAAM,EAAE,uBAAuB,CAAC;IAChD,SAAgB,eAAe,EAAE,iCAAiC,CAAC;IACnE,SAAgB,UAAU,EAAE,oBAAoB,CAAC;IACjD,SAAgB,IAAI,EAAE,sBAAsB,CAAC;IAC7C,SAAgB,OAAO,EAAE,wBAAwB,CAAC;IAClD,SAAgB,iBAAiB,EAAE,kCAAkC,CAAC;IACtE,SAAgB,MAAM,EAAE,wBAAwB,CAAC;IAEjD;;;OAGG;IACH,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IAEvD;;;;OAIG;IACH,SAAgB,OAAO,EAAE,gBAAgB,CAAC;IAE1C,YAAY,UAAU,EAAE,4BAA4B,EAkHnD;CACF"}

package/dist/service/cognito/command/sim-cognito-commands.js

@@ -59,8 +59,15 @@ export class SimCognitoCommands {
      * AWS operation creates.
      */
     registrations;
+    /**
+     * The web ACLs in front of this scope's pools. Held here because a request
+     * to a hosted domain reaches it without a Command, the way a fronting
+     * service reaches AWS WAF.
+     */
+    webAcls;
     constructor(properties) {
         const { accountRegionScope, iam, clock, pools, domains, triggerFunctions } = properties;
+        this.webAcls = properties.webAcls;
         const authorizer = new SimCognitoAuthorizer({ iam, accountRegionScope });
         const resolver = new SimCognitoRequestResolver({ pools, authorizer });
         const authResolver = new SimCognitoAuthResolver({ resolver, pools });
@@ -91,6 +98,7 @@ export class SimCognitoCommands {
             pools,
             poolFactory,
             authorizer,
+            webAcls: properties.webAcls,
         });
         this.userPoolMfa = new SimCognitoUserPoolMfaCommands({ pools, authorizer });
         this.listUserPools = new SimCognitoListUserPools({ pools, authorizer });

package/dist/service/cognito/command/sim-cognito-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-commands.js","sourceRoot":"","sources":["../../../../src/service/cognito/command/sim-cognito-commands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,+BAA+B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAE1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAE7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AAEtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,kCAAkC,EAAE,MAAM,iDAAiD,CAAC;AACrG,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,mDAAmD,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAWlG;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACb,SAAS,CAA6B;IACtC,WAAW,CAAgC;IAC3C,aAAa,CAA0B;IACvC,OAAO,CAAmC;IAC1C,WAAW,CAAgC;IAC3C,KAAK,CAAyB;IAC9B,OAAO,CAA4B;IACnC,MAAM,CAA2B;IACjC,aAAa,CAAkC;IAC/C,WAAW,CAA+B;IAC1C,SAAS,CAAsB;IAC/B,MAAM,CAA0B;IAChC,eAAe,CAAoC;IACnD,UAAU,CAAuB;IACjC,IAAI,CAAyB;IAC7B,OAAO,CAA2B;IAClC,iBAAiB,CAAqC;IACtD,MAAM,CAA2B;IAEjD;;;OAGG;IACa,aAAa,CAA0B;IAEvD,YAAY,UAAwC;QAClD,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,GACxE,UAAU,CAAC;QACb,MAAM,UAAU,GAAG,IAAI,oBAAoB,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,yBAAyB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,IAAI,sBAAsB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,IAAI,0BAA0B,CAAC;YAC9C,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAC;QACH,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,uBAAuB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,0EAA0E;QAC1E,uDAAuD;QACvD,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnE,0EAA0E;QAC1E,+DAA+D;QAC/D,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5D,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,yBAAyB,CAAC;YAChD,kBAAkB;YAClB,KAAK;YACL,KAAK;SACN,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,+BAA+B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC,SAAS,GAAG,IAAI,0BAA0B,CAAC;YAC9C,KAAK;YACL,WAAW;YACX,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,6BAA6B,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,aAAa,GAAG,IAAI,uBAAuB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,GAAG,IAAI,gCAAgC,CAAC;YAClD,KAAK;YACL,aAAa;YACb,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,IAAI,uBAAuB,CAAC;YAC/C,UAAU,EAAE,kBAAkB,CAAC,UAAU;YACzC,KAAK;YACL,WAAW;YACX,aAAa;SACd,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,6BAA6B,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,GAAG,IAAI,sBAAsB,CAAC;YACtC,QAAQ;YACR,SAAS;YACT,WAAW;YACX,QAAQ;YACR,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAyB,CAAC;YAC3C,QAAQ;YACR,SAAS;YACT,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,wBAAwB,CAAC;YACzC,YAAY;YACZ,QAAQ;YACR,WAAW;YACX,QAAQ;YACR,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,IAAI,+BAA+B,CAAC;YACvD,YAAY;YACZ,QAAQ;YACR,QAAQ;YACR,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,4BAA4B,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,SAAS,GAAG,IAAI,mBAAmB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,GAAG,IAAI,uBAAuB,CAAC;YACxC,QAAQ;YACR,YAAY,EAAE,IAAI,sBAAsB,CAAC,EAAE,KAAK,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,GAAG,IAAI,iCAAiC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,UAAU,GAAG,IAAI,oBAAoB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAsB,CAAC;YACrC,QAAQ;YACR,YAAY;YACZ,KAAK;YACL,KAAK;YACL,QAAQ;YACR,WAAW;YACX,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,wBAAwB,CAAC;YAC1C,KAAK;YACL,OAAO;YACP,UAAU;YACV,kBAAkB;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,IAAI,kCAAkC,CAAC;YAC9D,QAAQ;YACR,KAAK;SACN,CAAC,CAAC;QACH,yEAAyE;QACzE,uEAAuE;QACvE,oDAAoD;QACpD,IAAI,CAAC,MAAM,GAAG,IAAI,wBAAwB,CAAC;YACzC,WAAW;YACX,WAAW;YACX,KAAK;SACN,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-commands.js","sourceRoot":"","sources":["../../../../src/service/cognito/command/sim-cognito-commands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,+BAA+B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAE1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,oDAAoD,CAAC;AAE7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AAGtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,kCAAkC,EAAE,MAAM,iDAAiD,CAAC;AACrG,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,mDAAmD,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAYlG;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACb,SAAS,CAA6B;IACtC,WAAW,CAAgC;IAC3C,aAAa,CAA0B;IACvC,OAAO,CAAmC;IAC1C,WAAW,CAAgC;IAC3C,KAAK,CAAyB;IAC9B,OAAO,CAA4B;IACnC,MAAM,CAA2B;IACjC,aAAa,CAAkC;IAC/C,WAAW,CAA+B;IAC1C,SAAS,CAAsB;IAC/B,MAAM,CAA0B;IAChC,eAAe,CAAoC;IACnD,UAAU,CAAuB;IACjC,IAAI,CAAyB;IAC7B,OAAO,CAA2B;IAClC,iBAAiB,CAAqC;IACtD,MAAM,CAA2B;IAEjD;;;OAGG;IACa,aAAa,CAA0B;IAEvD;;;;OAIG;IACa,OAAO,CAAmB;IAE1C,YAAY,UAAwC;QAClD,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,GACxE,UAAU,CAAC;QAEb,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAElC,MAAM,UAAU,GAAG,IAAI,oBAAoB,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,yBAAyB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,IAAI,sBAAsB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,IAAI,0BAA0B,CAAC;YAC9C,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAC;QACH,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,uBAAuB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,0EAA0E;QAC1E,uDAAuD;QACvD,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnE,0EAA0E;QAC1E,+DAA+D;QAC/D,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5D,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,yBAAyB,CAAC;YAChD,kBAAkB;YAClB,KAAK;YACL,KAAK;SACN,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,+BAA+B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC,SAAS,GAAG,IAAI,0BAA0B,CAAC;YAC9C,KAAK;YACL,WAAW;YACX,UAAU;YACV,OAAO,EAAE,UAAU,CAAC,OAAO;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,6BAA6B,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,aAAa,GAAG,IAAI,uBAAuB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,GAAG,IAAI,gCAAgC,CAAC;YAClD,KAAK;YACL,aAAa;YACb,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,IAAI,uBAAuB,CAAC;YAC/C,UAAU,EAAE,kBAAkB,CAAC,UAAU;YACzC,KAAK;YACL,WAAW;YACX,aAAa;SACd,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,6BAA6B,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,GAAG,IAAI,sBAAsB,CAAC;YACtC,QAAQ;YACR,SAAS;YACT,WAAW;YACX,QAAQ;YACR,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAyB,CAAC;YAC3C,QAAQ;YACR,SAAS;YACT,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,wBAAwB,CAAC;YACzC,YAAY;YACZ,QAAQ;YACR,WAAW;YACX,QAAQ;YACR,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,GAAG,IAAI,+BAA+B,CAAC;YACvD,YAAY;YACZ,QAAQ;YACR,QAAQ;YACR,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,4BAA4B,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,SAAS,GAAG,IAAI,mBAAmB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,GAAG,IAAI,uBAAuB,CAAC;YACxC,QAAQ;YACR,YAAY,EAAE,IAAI,sBAAsB,CAAC,EAAE,KAAK,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,GAAG,IAAI,iCAAiC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,UAAU,GAAG,IAAI,oBAAoB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAsB,CAAC;YACrC,QAAQ;YACR,YAAY;YACZ,KAAK;YACL,KAAK;YACL,QAAQ;YACR,WAAW;YACX,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,wBAAwB,CAAC;YAC1C,KAAK;YACL,OAAO;YACP,UAAU;YACV,kBAAkB;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,IAAI,kCAAkC,CAAC;YAC9D,QAAQ;YACR,KAAK;SACN,CAAC,CAAC;QACH,yEAAyE;QACzE,uEAAuE;QACvE,oDAAoD;QACpD,IAAI,CAAC,MAAM,GAAG,IAAI,wBAAwB,CAAC;YACzC,WAAW;YACX,WAAW;YACX,KAAK;SACN,CAAC,CAAC;IACL,CAAC;CACF"}