@kensio/yulin 1.17.2 → 1.18.0

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.d.ts

@@ -4,6 +4,7 @@ import type { SimCognitoAuthSession } from "./sim-cognito-auth-session.js";
 import { type SimCognitoAuthSessionRequest } from "./sim-cognito-auth-session-store.js";
 import type { SimCognitoAuthorizationCode } from "./sim-cognito-authorization-code.js";
 import type { SimCognitoIssuedToken } from "./sim-cognito-issued-token.js";
+import type { SimCognitoManagedLoginSession } from "./sim-cognito-managed-login-session.js";
 import { type SimCognitoRefreshTokenRequest } from "./sim-cognito-issued-token-store.js";
 /**
  * The authentication state of one simulated user pool: where users can sign
@@ -26,6 +27,7 @@ export declare class SimCognitoPoolAuth {
      */
     readonly identityProviders: SimCognitoIdentityProviderStore;
     private readonly sessions;
+    private readonly managedLogin;
     private readonly codes;
     private readonly tokens;
     /**
@@ -84,8 +86,26 @@ export declare class SimCognitoPoolAuth {
      * Find an access token this pool issued and still honours.
      */
     findAccessToken(value: string): SimCognitoIssuedToken | undefined;
+    /**
+     * Remember the managed login session a hosted sign-in started for a browser.
+     */
+    addManagedLoginSession(session: SimCognitoManagedLoginSession): void;
+    /**
+     * The managed login session a browser presented, if this pool still holds
+     * it and it has not run out.
+     */
+    findManagedLoginSession(value: string | undefined, now: Date): SimCognitoManagedLoginSession | undefined;
+    /**
+     * End the managed login session a browser presented at `/logout`.
+     */
+    endManagedLoginSession(value: string | undefined): void;
     /**
      * Sign a user out of every app client, forgetting the tokens it holds.
+     *
+     * The managed login sessions are left alone, because real `GlobalSignOut`
+     * and `AdminUserGlobalSignOut` leave them alone. They revoke tokens, and a
+     * browser still holding the `cognito` cookie signs in again at the authorize
+     * endpoint without a password. `/logout` is what ends that.
      */
     signOut(username: string): void;
 }

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-pool-auth.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAEvF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAkB;;IAC7B;;OAEG;IACH,SAAgB,iBAAiB,kCAAyC;IAE1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAI3D;;;;;OAKG;IACH,IAAI,MAAM,IAAI,wBAAwB,GAAG,SAAS,CAEjD;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,IAAI,IAAI,CAEnB;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,2BAA2B,GAAG,IAAI,CAE5D;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,2BAA2B,GAAG,SAAS,CAEzC;IAED;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAE/C;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,4BAA4B,GAAG,qBAAqB,CAE3E;IAED;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAEvB;IAED;;OAEG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,qBAAqB,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE9B;CACF"}
+{"version":3,"file":"sim-cognito-pool-auth.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAEvF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAkB;;IAC7B;;OAEG;IACH,SAAgB,iBAAiB,kCAAyC;IAE1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IACzE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAI3D;;;;;OAKG;IACH,IAAI,MAAM,IAAI,wBAAwB,GAAG,SAAS,CAEjD;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,IAAI,IAAI,CAEnB;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,2BAA2B,GAAG,IAAI,CAE5D;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,2BAA2B,GAAG,SAAS,CAEzC;IAED;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAE/C;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,4BAA4B,GAAG,qBAAqB,CAE3E;IAED;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAEvB;IAED;;OAEG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,qBAAqB,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;OAEG;IACH,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,IAAI,CAEnE;IAED;;;OAGG;IACH,uBAAuB,CACrB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,6BAA6B,GAAG,SAAS,CAE3C;IAED;;OAEG;IACH,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEtD;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE9B;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.js

@@ -1,6 +1,7 @@
 import { SimCognitoIdentityProviderStore } from "../idp/sim-cognito-identity-provider-store.js";
 import { SimCognitoAuthSessionStore, } from "./sim-cognito-auth-session-store.js";
 import { SimCognitoAuthorizationCodeStore } from "./sim-cognito-authorization-code-store.js";
+import { SimCognitoManagedLoginSessionStore } from "./sim-cognito-managed-login-session-store.js";
 import { SimCognitoIssuedTokenStore, } from "./sim-cognito-issued-token-store.js";
 /**
  * The authentication state of one simulated user pool: where users can sign
@@ -22,6 +23,7 @@ export class SimCognitoPoolAuth {
      */
     identityProviders = new SimCognitoIdentityProviderStore();
     sessions = new SimCognitoAuthSessionStore();
+    managedLogin = new SimCognitoManagedLoginSessionStore();
     codes = new SimCognitoAuthorizationCodeStore();
     tokens = new SimCognitoIssuedTokenStore();
     #domain;
@@ -107,8 +109,32 @@ export class SimCognitoPoolAuth {
     findAccessToken(value) {
         return this.tokens.findAccessToken(value);
     }
+    /**
+     * Remember the managed login session a hosted sign-in started for a browser.
+     */
+    addManagedLoginSession(session) {
+        this.managedLogin.add(session);
+    }
+    /**
+     * The managed login session a browser presented, if this pool still holds
+     * it and it has not run out.
+     */
+    findManagedLoginSession(value, now) {
+        return this.managedLogin.find(value, now);
+    }
+    /**
+     * End the managed login session a browser presented at `/logout`.
+     */
+    endManagedLoginSession(value) {
+        this.managedLogin.end(value);
+    }
     /**
      * Sign a user out of every app client, forgetting the tokens it holds.
+     *
+     * The managed login sessions are left alone, because real `GlobalSignOut`
+     * and `AdminUserGlobalSignOut` leave them alone. They revoke tokens, and a
+     * browser still holding the `cognito` cookie signs in again at the authorize
+     * endpoint without a password. `/logout` is what ends that.
      */
     signOut(username) {
         this.tokens.forgetUser(username);

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-pool-auth.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAGhG,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAE7F,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;OAEG;IACa,iBAAiB,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAEzD,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,KAAK,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAC/C,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D,OAAO,CAAuC;IAE9C;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAiC;QACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAyB,EACzB,GAAS;QAET,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAA8B;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAqC;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAA8B;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,KAAyB;QAEzB,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,QAAgB;QACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-pool-auth.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAGhG,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAG7F,OAAO,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAClG,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;OAEG;IACa,iBAAiB,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAEzD,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,YAAY,GAAG,IAAI,kCAAkC,EAAE,CAAC;IACxD,KAAK,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAC/C,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D,OAAO,CAAuC;IAE9C;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAiC;QACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAyB,EACzB,GAAS;QAET,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAA8B;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAqC;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAA8B;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,KAAyB;QAEzB,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,OAAsC;QAC3D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,uBAAuB,CACrB,KAAyB,EACzB,GAAS;QAET,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,KAAyB;QAC9C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,QAAgB;QACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-signed-in.factory.d.ts

@@ -17,6 +17,8 @@ export interface SimCognitoSignedInInput {
  */
 export interface SimCognitoSignedIn {
     readonly userPoolId: string;
+    /** The ARN of that pool, which is how another service names it. */
+    readonly userPoolArn: string;
     readonly clientId: string;
     readonly username: string;
     readonly accessToken: string;

package/dist/service/cognito/user-pool/auth/sim-cognito-signed-in.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-signed-in.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-signed-in.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,yEAsFrC,CAAC"}
+{"version":3,"file":"sim-cognito-signed-in.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-signed-in.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,yEAuFrC,CAAC"}

package/dist/service/cognito/user-pool/auth/sim-cognito-signed-in.factory.js

@@ -77,6 +77,7 @@ export const simCognitoSignedInFactory = new AsyncMappedFactory(() => ({
     const userPool = cognito.userPool(userPoolId);
     return {
         userPoolId,
+        userPoolArn: userPool.arn.value,
         clientId,
         username: input.username,
         accessToken,

package/dist/service/cognito/user-pool/auth/sim-cognito-signed-in.factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-signed-in.factory.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-signed-in.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AA+BvE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,kBAAkB,CAK7D,GAAG,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,aAAa;IACvB,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,iBAAiB;IAC3B,UAAU,EAAE,EAAE;CACf,CAAC,EACF,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,uBAAuB,EAAE,CAAC;IAEjD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;QACxC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;KACpC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;IACrC,aAAa,CAAC,UAAU,EAAE,sCAAsC,CAAC,CAAC;IAElE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC;QACnD,KAAK,EAAE;YACL,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,iBAAiB,EAAE,CAAC,gCAAgC,CAAC;SACtD;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC;IACpD,aAAa,CAAC,QAAQ,EAAE,uCAAuC,CAAC,CAAC;IAEjE,MAAM,OAAO,CAAC,eAAe,CAAC;QAC5B,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;KAC5D,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,oBAAoB,CAAC;QACjC,KAAK,EAAE;YACL,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,IAAI;SAChB;KACF,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACvC,MAAM,OAAO,CAAC,WAAW,CAAC;YACxB,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE;SACxD,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,mBAAmB,CAAC;YAChC,KAAK,EAAE;gBACL,UAAU,EAAE,UAAU;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,SAAS;aACrB;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC;QAC/C,KAAK,EAAE;YACL,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,0BAA0B;YACpC,cAAc,EAAE;gBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB;SACF;KACF,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,QAAQ,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvD,aAAa,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;IAClE,aAAa,CAAC,OAAO,EAAE,iCAAiC,CAAC,CAAC;IAE1D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE9C,OAAO;QACL,UAAU;QACV,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW;QACX,OAAO;QACP,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;KACtB,CAAC;AACJ,CAAC,CACF,CAAC"}
+{"version":3,"file":"sim-cognito-signed-in.factory.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-signed-in.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAiCvE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,kBAAkB,CAK7D,GAAG,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,aAAa;IACvB,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,iBAAiB;IAC3B,UAAU,EAAE,EAAE;CACf,CAAC,EACF,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,uBAAuB,EAAE,CAAC;IAEjD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;QACxC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;KACpC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;IACrC,aAAa,CAAC,UAAU,EAAE,sCAAsC,CAAC,CAAC;IAElE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC;QACnD,KAAK,EAAE;YACL,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,iBAAiB,EAAE,CAAC,gCAAgC,CAAC;SACtD;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC;IACpD,aAAa,CAAC,QAAQ,EAAE,uCAAuC,CAAC,CAAC;IAEjE,MAAM,OAAO,CAAC,eAAe,CAAC;QAC5B,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;KAC5D,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,oBAAoB,CAAC;QACjC,KAAK,EAAE;YACL,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,IAAI;SAChB;KACF,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACvC,MAAM,OAAO,CAAC,WAAW,CAAC;YACxB,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE;SACxD,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,mBAAmB,CAAC;YAChC,KAAK,EAAE;gBACL,UAAU,EAAE,UAAU;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,SAAS;aACrB;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC;QAC/C,KAAK,EAAE;YACL,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,0BAA0B;YACpC,cAAc,EAAE;gBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB;SACF;KACF,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,QAAQ,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvD,aAAa,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;IAClE,aAAa,CAAC,OAAO,EAAE,iCAAiC,CAAC,CAAC;IAE1D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE9C,OAAO;QACL,UAAU;QACV,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK;QAC/B,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW;QACX,OAAO;QACP,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;KACtB,CAAC;AACJ,CAAC,CACF,CAAC"}

package/dist/service/elbv2/serve/sim-elbv2-router.js

@@ -23,7 +23,7 @@ export class SimElbV2Router {
     registry;
     constructor(properties) {
         this.simAws = properties.simAws;
-        this.registry = this.simAws.serviceFactory.elbV2Registry;
+        this.registry = this.simAws.serviceFactory.registries.elbV2;
     }
     /**
      * Find the load balancer a request target addresses.

package/dist/service/elbv2/serve/sim-elbv2-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-elbv2-router.js","sourceRoot":"","sources":["../../../../src/service/elbv2/serve/sim-elbv2-router.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAIpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAmCnG;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAc;IACzB;;;;;;OAMG;IACa,MAAM,CAAS;IAEd,QAAQ,CAAmB;IAE5C,YAAY,UAAoC;QAC9C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAA2B;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAEjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM;aACtB,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC;aACrD,KAAK,EAAE,CAAC;QACX,MAAM,YAAY,GAAG,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAE1E,yEAAyE;QACzE,8CAA8C;QAC9C,aAAa,CACX,YAAY,EACZ,GAAG,KAAK,CAAC,SAAS,OAAO,KAAK,CAAC,UAAU,8BAA8B;YACrE,qBAAqB,MAAM,CAAC,YAAY,uBAAuB,CAClE,CAAC;QAEF,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CACT,WAAgC;QAEhC,MAAM,MAAM,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAEhD,uEAAuE;QACvE,mDAAmD;QACnD,aAAa,CACX,MAAM,EACN,gBAAgB,WAAW,CAAC,IAAI,2BAA2B,CAC5D,CAAC;QAEF,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,kBAAkB,CAAC;QAEjE,qEAAqE;QACrE,gEAAgE;QAChE,aAAa,CACX,KAAK,EACL,WAAW,MAAM,CAAC,EAAE,qBAAqB,WAAW,CAAC,IAAI,YAAY;YACnE,qBAAqB,CACxB,CAAC;QAEF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACrE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE5E,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACH,YAAY,CACV,WAAgC;QAEhC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,kBAAkB,CAAC;QAEjE,OAAO,IAAI,CAAC,MAAM;aACf,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC;aACzC,GAAG,EAAE;aACL,gBAAgB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;CACF"}
+{"version":3,"file":"sim-elbv2-router.js","sourceRoot":"","sources":["../../../../src/service/elbv2/serve/sim-elbv2-router.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAIpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAmCnG;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAc;IACzB;;;;;;OAMG;IACa,MAAM,CAAS;IAEd,QAAQ,CAAmB;IAE5C,YAAY,UAAoC;QAC9C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAA2B;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAEjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM;aACtB,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC;aACrD,KAAK,EAAE,CAAC;QACX,MAAM,YAAY,GAAG,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAE1E,yEAAyE;QACzE,8CAA8C;QAC9C,aAAa,CACX,YAAY,EACZ,GAAG,KAAK,CAAC,SAAS,OAAO,KAAK,CAAC,UAAU,8BAA8B;YACrE,qBAAqB,MAAM,CAAC,YAAY,uBAAuB,CAClE,CAAC;QAEF,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CACT,WAAgC;QAEhC,MAAM,MAAM,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAEhD,uEAAuE;QACvE,mDAAmD;QACnD,aAAa,CACX,MAAM,EACN,gBAAgB,WAAW,CAAC,IAAI,2BAA2B,CAC5D,CAAC;QAEF,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,kBAAkB,CAAC;QAEjE,qEAAqE;QACrE,gEAAgE;QAChE,aAAa,CACX,KAAK,EACL,WAAW,MAAM,CAAC,EAAE,qBAAqB,WAAW,CAAC,IAAI,YAAY;YACnE,qBAAqB,CACxB,CAAC;QAEF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACrE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAE5E,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACH,YAAY,CACV,WAAgC;QAEhC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,kBAAkB,CAAC;QAEjE,OAAO,IAAI,CAAC,MAAM;aACf,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC;aACzC,GAAG,EAAE;aACL,gBAAgB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/service/lambda/function/uri/sim-lambda-invocation-uri.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The Lambda function a URI names, and the version or alias qualifier that
+ * came with it.
+ */
+export interface SimLambdaInvocationUri {
+    /** The function ARN, in the form the reading service hands back. */
+    readonly functionArn: string;
+    readonly regionName: string;
+    readonly accountId: string;
+    readonly functionName: string;
+    /** The published version or the alias the URI named, if it named one. */
+    readonly qualifier: string | undefined;
+}
+/**
+ * Read a URI naming the Lambda function something invokes.
+ *
+ * Both API Gateway services write these, for an `AWS_PROXY` integration and
+ * for a `REQUEST` authorizer, in either of the two forms above. Neither the
+ * function nor the qualifier is resolved here. The name finds the function and
+ * the qualifier picks which of its versions runs, and holding them apart is
+ * what lets an integration built on an alias follow that alias wherever it is
+ * moved to afterwards.
+ *
+ * A URI naming anything other than a Lambda function reads as `undefined`.
+ * Each service refuses it in its own words, because the option carrying the
+ * URI is named differently in each of them.
+ */
+export declare function simLambdaInvocationUriOf(uri: string): SimLambdaInvocationUri | undefined;
+//# sourceMappingURL=sim-lambda-invocation-uri.d.ts.map

package/dist/service/lambda/function/uri/sim-lambda-invocation-uri.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-invocation-uri.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/function/uri/sim-lambda-invocation-uri.ts"],"names":[],"mappings":"AAgCA;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,GACV,sBAAsB,GAAG,SAAS,CAiBpC"}

package/dist/service/lambda/function/uri/sim-lambda-invocation-uri.js

@@ -0,0 +1,86 @@
+/**
+ * A Lambda function ARN, with the fields an ARN carries broken out.
+ */
+const lambdaFunctionArn = /^arn:aws:lambda:(?<regionName>[a-z0-9-]+):(?<accountId>\d{12}):function:(?<functionName>[a-zA-Z0-9-_]+)$/;
+/**
+ * A version number or an alias name on the end of a function ARN. `$LATEST`
+ * is one of them, which is what the `$` is there for.
+ */
+const lambdaQualifier = /^[a-zA-Z0-9-_$]+$/;
+/**
+ * How many colon-separated fields an unqualified function ARN has. A
+ * qualified one has an eighth.
+ */
+const functionArnFieldCount = 7;
+/**
+ * The other form an integration URI is written in, wrapping a Lambda function
+ * ARN in an API Gateway path:
+ *
+ *   arn:aws:apigateway:eu-west-2:lambda:path/2015-03-31/functions/<function-arn>/invocations
+ *
+ * The date is the Lambda invoke API version and is part of the literal rather
+ * than something a caller chooses. An OpenAPI document being imported writes
+ * this form, and so does a hand-written CloudFormation template, while CDK
+ * emits the bare function ARN.
+ */
+const apiGatewayLambdaPathUri = /^arn:[^:]+:apigateway:[^:]+:lambda:path\/2015-03-31\/functions\/(?<functionArn>arn:[^/]+)\/invocations$/;
+/**
+ * Read a URI naming the Lambda function something invokes.
+ *
+ * Both API Gateway services write these, for an `AWS_PROXY` integration and
+ * for a `REQUEST` authorizer, in either of the two forms above. Neither the
+ * function nor the qualifier is resolved here. The name finds the function and
+ * the qualifier picks which of its versions runs, and holding them apart is
+ * what lets an integration built on an alias follow that alias wherever it is
+ * moved to afterwards.
+ *
+ * A URI naming anything other than a Lambda function reads as `undefined`.
+ * Each service refuses it in its own words, because the option carrying the
+ * URI is named differently in each of them.
+ */
+export function simLambdaInvocationUriOf(uri) {
+    const functionArn = wrappedFunctionArn(uri);
+    const { unqualified, qualifier } = splitQualifier(functionArn);
+    const groups = lambdaFunctionArn.exec(unqualified)?.groups;
+    if (groups === undefined || !qualifierAccepted(qualifier)) {
+        return undefined;
+    }
+    return {
+        functionArn,
+        /* v8 ignore next 3 -- the pattern that matched fills each of these three */
+        regionName: groups["regionName"] ?? "",
+        accountId: groups["accountId"] ?? "",
+        functionName: groups["functionName"] ?? "",
+        qualifier,
+    };
+}
+/**
+ * The function ARN a URI names, in either form it is written in.
+ */
+function wrappedFunctionArn(uri) {
+    return apiGatewayLambdaPathUri.exec(uri)?.groups?.["functionArn"] ?? uri;
+}
+/**
+ * A function ARN split from the qualifier on the end of it.
+ *
+ * The split is by field rather than by pattern, since a function name and a
+ * qualifier are written from the same characters and only the colon between
+ * them tells the two apart.
+ */
+function splitQualifier(functionArn) {
+    const fields = functionArn.split(":");
+    return fields.length > functionArnFieldCount
+        ? {
+            unqualified: fields.slice(0, functionArnFieldCount).join(":"),
+            qualifier: fields.slice(functionArnFieldCount).join(":"),
+        }
+        : { unqualified: functionArn, qualifier: undefined };
+}
+/**
+ * Whether what came off the end of the ARN could be a qualifier at all. A URI
+ * carrying more fields than a qualified function ARN has is refused here.
+ */
+function qualifierAccepted(qualifier) {
+    return qualifier === undefined || lambdaQualifier.test(qualifier);
+}
+//# sourceMappingURL=sim-lambda-invocation-uri.js.map

package/dist/service/lambda/function/uri/sim-lambda-invocation-uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-invocation-uri.js","sourceRoot":"","sources":["../../../../../src/service/lambda/function/uri/sim-lambda-invocation-uri.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,iBAAiB,GACrB,0GAA0G,CAAC;AAE7G;;;GAGG;AACH,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC;;;;;;;;;;GAUG;AACH,MAAM,uBAAuB,GAC3B,yGAAyG,CAAC;AAgB5G;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAW;IAEX,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE3D,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,WAAW;QACX,4EAA4E;QAC5E,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACtC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE;QACpC,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE;QAC1C,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,WAAmB;IAIzC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEtC,OAAO,MAAM,CAAC,MAAM,GAAG,qBAAqB;QAC1C,CAAC,CAAC;YACE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACzD;QACH,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,SAA6B;IACtD,OAAO,SAAS,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACpE,CAAC"}

package/dist/service/route53/resolve/sim-r53-regional-service-target.js

@@ -82,7 +82,7 @@ export class SimRoute53RegionalServiceTargets {
             return "lambda";
         }
         if (service === executeApiHostLabel) {
-            return "apiGatewayV2";
+            return "executeApi";
         }
         return undefined;
     }

package/dist/service/route53/resolve/sim-r53-regional-service-target.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-r53-regional-service-target.js","sourceRoot":"","sources":["../../../../src/service/route53/resolve/sim-r53-regional-service-target.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAElF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAEvG,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,OAAO,gCAAgC;IAC3C;;OAEG;IACH,OAAO,CAAC,WAAmB;QACzB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;;;;;OAWG;IACK,gBAAgB,CACtB,MAAyB;QAEzB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC;QAErC,IAAI,OAAO,KAAK,sBAAsB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,yBAAyB;YAClC,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,UAA2B;SACxC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,sBAAsB,CAC5B,MAAyB;QAEzB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC;QAEnD,iEAAiE;QACjE,IAAI,YAAY,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,eAAe;YACxB,YAAY;YACZ,UAAU,EAAE,UAA2B;SACxC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,OAA2B;QAE3B,IAAI,OAAO,KAAK,0BAA0B,EAAE,CAAC;YAC3C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;YACpC,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"sim-r53-regional-service-target.js","sourceRoot":"","sources":["../../../../src/service/route53/resolve/sim-r53-regional-service-target.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAElF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAEvG,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,OAAO,gCAAgC;IAC3C;;OAEG;IACH,OAAO,CAAC,WAAmB;QACzB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;;;;;OAWG;IACK,gBAAgB,CACtB,MAAyB;QAEzB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC;QAErC,IAAI,OAAO,KAAK,sBAAsB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,yBAAyB;YAClC,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,UAA2B;SACxC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,sBAAsB,CAC5B,MAAyB;QAEzB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC;QAEnD,iEAAiE;QACjE,IAAI,YAAY,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAEtD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,eAAe;YACxB,YAAY;YACZ,UAAU,EAAE,UAA2B;SACxC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,OAA2B;QAE3B,IAAI,OAAO,KAAK,0BAA0B,EAAE,CAAC;YAC3C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;YACpC,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.d.ts

@@ -0,0 +1,45 @@
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimWafProtectedResource } from "./sim-waf-protected-resource.js";
+import type { SimWafProtectedResources } from "./sim-waf-protected-resources.js";
+interface SimAwsWafProtectedResourcesProperties {
+    readonly simAws: SimAws;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+}
+/**
+ * The resources of one simulated AWS instance a web ACL can be put in front
+ * of.
+ *
+ * The lookup is made in the Account and Region the WAFv2 handling the request
+ * belongs to. A stage ARN names no Account, and AWS WAF associates within one
+ * Account, so a stage created elsewhere in the simulation is not there to be
+ * found. A user pool ARN does name an Account, and one naming another Account
+ * was already refused before the lookup.
+ */
+export declare class SimAwsWafProtectedResources implements SimWafProtectedResources {
+    #private;
+    constructor(properties: SimAwsWafProtectedResourcesProperties);
+    /**
+     * Whether the resource an ARN names is one this scope holds.
+     */
+    has(resource: SimWafProtectedResource): boolean;
+    /**
+     * Whether this scope holds the REST API stage an ARN names.
+     */
+    private hasRestApiStage;
+    /**
+     * Whether this scope holds the user pool an ARN names.
+     *
+     * The ARN is compared rather than the id alone. A pool id is unique across
+     * the whole simulation, so a pool this scope does not hold is simply not
+     * found, and comparing the ARN says the same thing about a pool id that is
+     * there under a different Account.
+     */
+    private hasUserPool;
+    /**
+     * The simulated services of the Account and Region this WAFv2 belongs to.
+     */
+    private scope;
+}
+export {};
+//# sourceMappingURL=sim-aws-waf-protected-resources.d.ts.map

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-waf-protected-resources.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-aws-waf-protected-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,wBAAwB,EACzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAIjF,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;CACvD;AAED;;;;;;;;;GASG;AACH,qBAAa,2BAA4B,YAAW,wBAAwB;;IAI1E,YAAY,UAAU,EAAE,qCAAqC,EAG5D;IAED;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAM9C;IAED;;OAEG;IACH,OAAO,CAAC,eAAe;IAMvB;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW;IAQnB;;OAEG;IACH,OAAO,CAAC,KAAK;CAKd"}

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.js

@@ -0,0 +1,56 @@
+/**
+ * The resources of one simulated AWS instance a web ACL can be put in front
+ * of.
+ *
+ * The lookup is made in the Account and Region the WAFv2 handling the request
+ * belongs to. A stage ARN names no Account, and AWS WAF associates within one
+ * Account, so a stage created elsewhere in the simulation is not there to be
+ * found. A user pool ARN does name an Account, and one naming another Account
+ * was already refused before the lookup.
+ */
+export class SimAwsWafProtectedResources {
+    #simAws;
+    #accountRegionScope;
+    constructor(properties) {
+        this.#simAws = properties.simAws;
+        this.#accountRegionScope = properties.accountRegionScope;
+    }
+    /**
+     * Whether the resource an ARN names is one this scope holds.
+     */
+    has(resource) {
+        if (resource.resourceType === "COGNITO_USER_POOL") {
+            return this.hasUserPool(resource);
+        }
+        return this.hasRestApiStage(resource);
+    }
+    /**
+     * Whether this scope holds the REST API stage an ARN names.
+     */
+    hasRestApiStage(resource) {
+        const restApi = this.scope().apiGateway().findRestApi(resource.restApiId);
+        return restApi?.stages.find(resource.stageName) !== undefined;
+    }
+    /**
+     * Whether this scope holds the user pool an ARN names.
+     *
+     * The ARN is compared rather than the id alone. A pool id is unique across
+     * the whole simulation, so a pool this scope does not hold is simply not
+     * found, and comparing the ARN says the same thing about a pool id that is
+     * there under a different Account.
+     */
+    hasUserPool(resource) {
+        const pool = this.scope()
+            .cognitoIdentityProvider()
+            .findUserPool(resource.userPoolId);
+        return pool?.arn.value === resource.arn;
+    }
+    /**
+     * The simulated services of the Account and Region this WAFv2 belongs to.
+     */
+    scope() {
+        const { accountId, regionName } = this.#accountRegionScope;
+        return this.#simAws.accountRegionScope(accountId, regionName);
+    }
+}
+//# sourceMappingURL=sim-aws-waf-protected-resources.js.map

package/dist/service/wafv2/association/sim-aws-waf-protected-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-waf-protected-resources.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-aws-waf-protected-resources.ts"],"names":[],"mappings":"AAeA;;;;;;;;;GASG;AACH,MAAM,OAAO,2BAA2B;IAC7B,OAAO,CAAS;IAChB,mBAAmB,CAA2B;IAEvD,YAAY,UAAiD;QAC3D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,QAAiC;QACnC,IAAI,QAAQ,CAAC,YAAY,KAAK,mBAAmB,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,QAA4B;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE1E,OAAO,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;IAChE,CAAC;IAED;;;;;;;OAOG;IACK,WAAW,CAAC,QAAwB;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE;aACtB,uBAAuB,EAAE;aACzB,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAErC,OAAO,IAAI,EAAE,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,GAAG,CAAC;IAC1C,CAAC;IAED;;OAEG;IACK,KAAK;QACX,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAE3D,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAChE,CAAC;CACF"}

package/dist/service/wafv2/association/sim-waf-associations.d.ts

@@ -0,0 +1,52 @@
+import type { SimWafDecision } from "../evaluate/sim-waf-decision.js";
+import type { SimWafWebAcl } from "../web-acl/sim-waf-web-acl.js";
+import type { SimWafProtectedResource, SimWafProtectedResourceType } from "./sim-waf-protected-resource.js";
+import type { SimWafProtectedRequest, SimWafProtection } from "./sim-waf-protection.js";
+/**
+ * The web ACLs one Account and Region has in front of things.
+ *
+ * A resource carries at most one web ACL, which is why this is keyed by
+ * resource ARN. The web ACL itself is held rather than its ARN, so a request
+ * reaching a protected resource is evaluated without a second lookup, and so a
+ * web ACL cannot be deleted out from under a resource still pointing at it.
+ */
+export declare class SimWafAssociations implements SimWafProtection {
+    #private;
+    /**
+     * Put a web ACL in front of one resource, replacing whatever was there.
+     *
+     * AssociateWebACL overwrites rather than refusing, because a resource has
+     * one web ACL and pointing it at another is how it is changed.
+     */
+    associate(resource: SimWafProtectedResource, webAcl: SimWafWebAcl): void;
+    /**
+     * The web ACL in front of one resource, or nothing when it has none.
+     */
+    webAclFor(resourceArn: string): SimWafWebAcl | undefined;
+    /**
+     * The resources one web ACL is in front of, in the order they were
+     * associated.
+     *
+     * A resource type narrows the answer to the resources of that type, as
+     * `ListResourcesForWebACL` does. Naming none answers with all of them, which
+     * is what `DeleteWebACL` asks for when it refuses a web ACL still in use.
+     */
+    resourceArnsFor(webAcl: SimWafWebAcl, resourceType?: SimWafProtectedResourceType): readonly string[];
+    /**
+     * Whether a web ACL is in front of one resource.
+     */
+    protects(resourceArn: string): boolean;
+    /**
+     * What the web ACL in front of one resource decides about a request.
+     */
+    decide(request: SimWafProtectedRequest): SimWafDecision | undefined;
+    /**
+     * Forget whatever is in front of one resource.
+     *
+     * This is both what DisassociateWebACL does and what deleting the resource
+     * does. A stage that is deleted and created again under the same name is
+     * unprotected, as it is on AWS.
+     */
+    release(resourceArn: string): void;
+}
+//# sourceMappingURL=sim-waf-associations.d.ts.map

package/dist/service/wafv2/association/sim-waf-associations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-associations.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-associations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EACV,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AAcjC;;;;;;;GAOG;AACH,qBAAa,kBAAmB,YAAW,gBAAgB;;IAGzD;;;;;OAKG;IACH,SAAS,CAAC,QAAQ,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAKvE;IAED;;OAEG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAEvD;IAED;;;;;;;OAOG;IACH,eAAe,CACb,MAAM,EAAE,YAAY,EACpB,YAAY,CAAC,EAAE,2BAA2B,GACzC,SAAS,MAAM,EAAE,CAWnB;IAED;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAErC;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,sBAAsB,GAAG,cAAc,GAAG,SAAS,CAUlE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAEjC;CACF"}

package/dist/service/wafv2/association/sim-waf-associations.js

@@ -0,0 +1,74 @@
+import { simWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+/**
+ * The web ACLs one Account and Region has in front of things.
+ *
+ * A resource carries at most one web ACL, which is why this is keyed by
+ * resource ARN. The web ACL itself is held rather than its ARN, so a request
+ * reaching a protected resource is evaluated without a second lookup, and so a
+ * web ACL cannot be deleted out from under a resource still pointing at it.
+ */
+export class SimWafAssociations {
+    #associations = new Map();
+    /**
+     * Put a web ACL in front of one resource, replacing whatever was there.
+     *
+     * AssociateWebACL overwrites rather than refusing, because a resource has
+     * one web ACL and pointing it at another is how it is changed.
+     */
+    associate(resource, webAcl) {
+        this.#associations.set(resource.arn, {
+            webAcl,
+            resourceType: resource.resourceType,
+        });
+    }
+    /**
+     * The web ACL in front of one resource, or nothing when it has none.
+     */
+    webAclFor(resourceArn) {
+        return this.#associations.get(resourceArn)?.webAcl;
+    }
+    /**
+     * The resources one web ACL is in front of, in the order they were
+     * associated.
+     *
+     * A resource type narrows the answer to the resources of that type, as
+     * `ListResourcesForWebACL` does. Naming none answers with all of them, which
+     * is what `DeleteWebACL` asks for when it refuses a web ACL still in use.
+     */
+    resourceArnsFor(webAcl, resourceType) {
+        return this.#associations
+            .entries()
+            .filter(([, association]) => association.webAcl === webAcl)
+            .filter(([, association]) => resourceType === undefined ||
+            association.resourceType === resourceType)
+            .map(([resourceArn]) => resourceArn)
+            .toArray();
+    }
+    /**
+     * Whether a web ACL is in front of one resource.
+     */
+    protects(resourceArn) {
+        return this.#associations.has(resourceArn);
+    }
+    /**
+     * What the web ACL in front of one resource decides about a request.
+     */
+    decide(request) {
+        const association = this.#associations.get(request.resourceArn);
+        if (association === undefined) {
+            return undefined;
+        }
+        return association.webAcl.evaluate(simWafInspectedRequest(request.request, request.body));
+    }
+    /**
+     * Forget whatever is in front of one resource.
+     *
+     * This is both what DisassociateWebACL does and what deleting the resource
+     * does. A stage that is deleted and created again under the same name is
+     * unprotected, as it is on AWS.
+     */
+    release(resourceArn) {
+        this.#associations.delete(resourceArn);
+    }
+}
+//# sourceMappingURL=sim-waf-associations.js.map

package/dist/service/wafv2/association/sim-waf-associations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-associations.js","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-associations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAuBlF;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACpB,aAAa,GAAG,IAAI,GAAG,EAA6B,CAAC;IAE9D;;;;;OAKG;IACH,SAAS,CAAC,QAAiC,EAAE,MAAoB;QAC/D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE;YACnC,MAAM;YACN,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,WAAmB;QAC3B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrD,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CACb,MAAoB,EACpB,YAA0C;QAE1C,OAAO,IAAI,CAAC,aAAa;aACtB,OAAO,EAAE;aACT,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC;aAC1D,MAAM,CACL,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,EAAE,CAClB,YAAY,KAAK,SAAS;YAC1B,WAAW,CAAC,YAAY,KAAK,YAAY,CAC5C;aACA,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC;aACnC,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,WAAmB;QAC1B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAA+B;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAEhE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,WAAW,CAAC,MAAM,CAAC,QAAQ,CAChC,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CACtD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,WAAmB;QACzB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;CACF"}

package/dist/service/wafv2/association/sim-waf-protected-resource.d.ts

@@ -0,0 +1,38 @@
+import { SimWafRestApiStage } from "./sim-waf-rest-api-stage.js";
+import { SimWafUserPool } from "./sim-waf-user-pool.js";
+/**
+ * A resource a `REGIONAL` web ACL can be put in front of.
+ *
+ * Two types are simulated. A third one joins this union and the reader below
+ * gains a branch for it, and everything that holds an association goes on
+ * addressing a resource by its ARN.
+ */
+export type SimWafProtectedResource = SimWafRestApiStage | SimWafUserPool;
+/**
+ * The type ListResourcesForWebACL lists one simulated resource under.
+ */
+export type SimWafProtectedResourceType = SimWafProtectedResource["resourceType"];
+/**
+ * The type ListResourcesForWebACL lists a simulated REST API stage under.
+ */
+export declare const simWafApiGatewayResourceType = "API_GATEWAY";
+/**
+ * The type ListResourcesForWebACL lists a simulated user pool under.
+ */
+export declare const simWafUserPoolResourceType = "COGNITO_USER_POOL";
+/**
+ * The resource types this simulation holds, as a refusal names them.
+ */
+export declare const simWafProtectedResourceTypes: readonly SimWafProtectedResourceType[];
+/**
+ * Read the resource an association names, refusing anything a web ACL cannot
+ * be put in front of here.
+ *
+ * The three refusals mean different things. An HTTP API stage is refused
+ * because AWS WAF protects no HTTP API, so an association accepted here would
+ * let a test cover protection AWS never applies. A load balancer and the rest
+ * are resource types AWS does protect and this simulation does not, which is
+ * the ordinary unsimulated refusal. Anything else is not a resource ARN.
+ */
+export declare function simWafProtectedResource(arn: string): SimWafProtectedResource;
+//# sourceMappingURL=sim-waf-protected-resource.d.ts.map

package/dist/service/wafv2/association/sim-waf-protected-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-protected-resource.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/association/sim-waf-protected-resource.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,GAAG,cAAc,CAAC;AAE1E;;GAEG;AACH,MAAM,MAAM,2BAA2B,GACrC,uBAAuB,CAAC,cAAc,CAAC,CAAC;AAE1C;;GAEG;AACH,eAAO,MAAM,4BAA4B,gBAAgB,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,0BAA0B,sBAAsB,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,2BAA2B,EACnB,CAAC;AAuB7D;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,uBAAuB,CA4B5E"}