@kensio/yulin 1.18.0 → 1.18.2

package/dist/service/cognito/user-pool/client/sim-cognito-refresh-token-rotation.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The refresh token rotation setting of an app client, in the shape a request
+ * sets it and a described client reports it.
+ *
+ * https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RefreshTokenRotationType.html
+ */
+export interface SimCognitoRefreshTokenRotationType {
+    readonly Feature?: string | undefined;
+    readonly RetryGracePeriodSeconds?: number | undefined;
+}
+/**
+ * Whether an app client rotates its refresh tokens, and for how long it goes
+ * on honouring the one it rotated out.
+ *
+ * Rotation changes which operation renews a session.
+ * `GetTokensFromRefreshToken` answers a rotating client with a replacement
+ * refresh token, and `REFRESH_TOKEN_AUTH` is not available to one at all.
+ *
+ * The grace period is what lets a client retry a request whose answer it never
+ * saw: the spent token goes on working for that many seconds, so a retry with
+ * it succeeds rather than signing the user out.
+ */
+export declare class SimCognitoRefreshTokenRotation {
+    /**
+     * The feature as the request wrote it, which is what Cognito reports back.
+     */
+    readonly feature: string;
+    /**
+     * How many seconds a rotated-out refresh token keeps working. A client that
+     * asked for no grace period gets none, so its spent token stops working the
+     * moment the replacement is issued.
+     */
+    readonly retryGracePeriodSeconds: number;
+    private readonly requested;
+    constructor(requested: SimCognitoRefreshTokenRotationType | undefined);
+    private static requireFeature;
+    private static requireGraceSeconds;
+    /**
+     * Whether this client rotates its refresh tokens.
+     */
+    get enabled(): boolean;
+    /**
+     * The setting as a described app client reports it, which is only when the
+     * request set it. A client nobody configured for rotation reports none.
+     */
+    toOutput(): SimCognitoRefreshTokenRotationType | undefined;
+}
+//# sourceMappingURL=sim-cognito-refresh-token-rotation.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-refresh-token-rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-refresh-token-rotation.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-refresh-token-rotation.ts"],"names":[],"mappings":"AAkBA;;;;;GAKG;AACH,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,8BAA8B;IACzC;;OAEG;IACH,SAAgB,OAAO,EAAE,MAAM,CAAC;IAEhC;;;;OAIG;IACH,SAAgB,uBAAuB,EAAE,MAAM,CAAC;IAEhD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAE3E,YAAY,SAAS,EAAE,kCAAkC,GAAG,SAAS,EASpE;IAED,OAAO,CAAC,MAAM,CAAC,cAAc;IAe7B,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAgBlC;;OAEG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;OAGG;IACH,QAAQ,IAAI,kCAAkC,GAAG,SAAS,CAEzD;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-refresh-token-rotation.js

@@ -0,0 +1,79 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+const enabled = "ENABLED";
+const disabled = "DISABLED";
+const features = [enabled, disabled];
+/**
+ * The longest grace period Cognito allows a rotated-out refresh token.
+ */
+const mostGraceSeconds = 60;
+/**
+ * The grace period a client that asked for none gets, which is none: a
+ * rotated-out token stops working as soon as its replacement is issued.
+ */
+const defaultGraceSeconds = 0;
+/**
+ * Whether an app client rotates its refresh tokens, and for how long it goes
+ * on honouring the one it rotated out.
+ *
+ * Rotation changes which operation renews a session.
+ * `GetTokensFromRefreshToken` answers a rotating client with a replacement
+ * refresh token, and `REFRESH_TOKEN_AUTH` is not available to one at all.
+ *
+ * The grace period is what lets a client retry a request whose answer it never
+ * saw: the spent token goes on working for that many seconds, so a retry with
+ * it succeeds rather than signing the user out.
+ */
+export class SimCognitoRefreshTokenRotation {
+    /**
+     * The feature as the request wrote it, which is what Cognito reports back.
+     */
+    feature;
+    /**
+     * How many seconds a rotated-out refresh token keeps working. A client that
+     * asked for no grace period gets none, so its spent token stops working the
+     * moment the replacement is issued.
+     */
+    retryGracePeriodSeconds;
+    requested;
+    constructor(requested) {
+        this.requested = requested;
+        this.feature = SimCognitoRefreshTokenRotation.requireFeature(requested?.Feature);
+        this.retryGracePeriodSeconds =
+            SimCognitoRefreshTokenRotation.requireGraceSeconds(requested?.RetryGracePeriodSeconds);
+    }
+    static requireFeature(value) {
+        if (value === undefined) {
+            return disabled;
+        }
+        if (!features.includes(value)) {
+            throw new SimCognitoInvalidParameterException(`RefreshTokenRotation Feature '${value}' is not a Cognito setting: ` +
+                `use one of ${features.join(", ")}`);
+        }
+        return value;
+    }
+    static requireGraceSeconds(value) {
+        if (value === undefined) {
+            return defaultGraceSeconds;
+        }
+        if (!Number.isSafeInteger(value) || value < 0 || value > mostGraceSeconds) {
+            throw new SimCognitoInvalidParameterException(`RefreshTokenRotation RetryGracePeriodSeconds of ${String(value)} is ` +
+                `outside the range Cognito allows: a whole number of seconds ` +
+                `between 0 and ${String(mostGraceSeconds)}`);
+        }
+        return value;
+    }
+    /**
+     * Whether this client rotates its refresh tokens.
+     */
+    get enabled() {
+        return this.feature === enabled;
+    }
+    /**
+     * The setting as a described app client reports it, which is only when the
+     * request set it. A client nobody configured for rotation reports none.
+     */
+    toOutput() {
+        return this.requested;
+    }
+}
+//# sourceMappingURL=sim-cognito-refresh-token-rotation.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-refresh-token-rotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-refresh-token-rotation.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-refresh-token-rotation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF,MAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,MAAM,QAAQ,GAAG,UAAU,CAAC;AAE5B,MAAM,QAAQ,GAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAExD;;GAEG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAa9B;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,8BAA8B;IACzC;;OAEG;IACa,OAAO,CAAS;IAEhC;;;;OAIG;IACa,uBAAuB,CAAS;IAE/B,SAAS,CAAiD;IAE3E,YAAY,SAAyD;QACnE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,8BAA8B,CAAC,cAAc,CAC1D,SAAS,EAAE,OAAO,CACnB,CAAC;QACF,IAAI,CAAC,uBAAuB;YAC1B,8BAA8B,CAAC,mBAAmB,CAChD,SAAS,EAAE,uBAAuB,CACnC,CAAC;IACN,CAAC;IAEO,MAAM,CAAC,cAAc,CAAC,KAAyB;QACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,mCAAmC,CAC3C,iCAAiC,KAAK,8BAA8B;gBAClE,cAAc,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtC,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,mBAAmB,CAAC,KAAyB;QAC1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,gBAAgB,EAAE,CAAC;YAC1E,MAAM,IAAI,mCAAmC,CAC3C,mDAAmD,MAAM,CAAC,KAAK,CAAC,MAAM;gBACpE,8DAA8D;gBAC9D,iBAAiB,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.d.ts

@@ -1,6 +1,7 @@
 import { SimCognitoExplicitAuthFlows } from "./sim-cognito-explicit-auth-flows.js";
 import { SimCognitoOAuthSettings, type SimCognitoOAuthSettingsType } from "./sim-cognito-oauth-settings.js";
 import { SimCognitoPreventUserExistenceErrors } from "./sim-cognito-prevent-user-existence-errors.js";
+import { SimCognitoRefreshTokenRotation, type SimCognitoRefreshTokenRotationType } from "./sim-cognito-refresh-token-rotation.js";
 import { SimCognitoTokenValidity, type SimCognitoTokenValidityInput } from "./sim-cognito-token-validity.js";
 /**
  * The app client properties a request can set.
@@ -13,6 +14,7 @@ export interface SimCognitoUserPoolClientSettingsProperties extends SimCognitoTo
     readonly ClientName?: string | undefined;
     readonly ExplicitAuthFlows?: readonly string[] | undefined;
     readonly PreventUserExistenceErrors?: string | undefined;
+    readonly RefreshTokenRotation?: SimCognitoRefreshTokenRotationType | undefined;
 }
 /**
  * The settable properties of one simulated app client.
@@ -28,6 +30,11 @@ export declare class SimCognitoUserPoolClientSettings {
     readonly explicitAuthFlows: SimCognitoExplicitAuthFlows;
     readonly preventUserExistenceErrors: SimCognitoPreventUserExistenceErrors;
     readonly tokenValidity: SimCognitoTokenValidity;
+    /**
+     * Whether this client rotates its refresh tokens, which decides what
+     * renews a session made through it.
+     */
+    readonly refreshTokenRotation: SimCognitoRefreshTokenRotation;
     /**
      * What this client may do at the pool's hosted domain.
      */

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client-settings.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,KAAK,2BAA2B,EACjC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AACtG,OAAO,EACL,uBAAuB,EACvB,KAAK,4BAA4B,EAClC,MAAM,iCAAiC,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,WAAW,0CACf,SAAQ,4BAA4B,EAAE,2BAA2B;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,qBAAa,gCAAgC;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,0BAA0B,EAAE,oCAAoC,CAAC;IACjF,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IAEvD;;OAEG;IACH,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAE/C,YAAY,UAAU,EAAE,0CAA0C,EAajE;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-client-settings.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,KAAK,2BAA2B,EACjC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AACtG,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACxC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,KAAK,4BAA4B,EAClC,MAAM,iCAAiC,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,WAAW,0CACf,SAAQ,4BAA4B,EAAE,2BAA2B;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAC1B,kCAAkC,GAClC,SAAS,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,qBAAa,gCAAgC;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,0BAA0B,EAAE,oCAAoC,CAAC;IACjF,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IAEvD;;;OAGG;IACH,SAAgB,oBAAoB,EAAE,8BAA8B,CAAC;IAErE;;OAEG;IACH,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAE/C,YAAY,UAAU,EAAE,0CAA0C,EAgBjE;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.js

@@ -2,6 +2,7 @@ import { SimCognitoName } from "../sim-cognito-name.js";
 import { SimCognitoExplicitAuthFlows } from "./sim-cognito-explicit-auth-flows.js";
 import { SimCognitoOAuthSettings, } from "./sim-cognito-oauth-settings.js";
 import { SimCognitoPreventUserExistenceErrors } from "./sim-cognito-prevent-user-existence-errors.js";
+import { SimCognitoRefreshTokenRotation, } from "./sim-cognito-refresh-token-rotation.js";
 import { SimCognitoTokenValidity, } from "./sim-cognito-token-validity.js";
 /**
  * The settable properties of one simulated app client.
@@ -17,6 +18,11 @@ export class SimCognitoUserPoolClientSettings {
     explicitAuthFlows;
     preventUserExistenceErrors;
     tokenValidity;
+    /**
+     * Whether this client rotates its refresh tokens, which decides what
+     * renews a session made through it.
+     */
+    refreshTokenRotation;
     /**
      * What this client may do at the pool's hosted domain.
      */
@@ -29,6 +35,7 @@ export class SimCognitoUserPoolClientSettings {
         this.explicitAuthFlows = new SimCognitoExplicitAuthFlows(properties.ExplicitAuthFlows);
         this.preventUserExistenceErrors = new SimCognitoPreventUserExistenceErrors(properties.PreventUserExistenceErrors);
         this.tokenValidity = new SimCognitoTokenValidity(properties);
+        this.refreshTokenRotation = new SimCognitoRefreshTokenRotation(properties.RefreshTokenRotation);
         this.oauth = new SimCognitoOAuthSettings(properties);
     }
 }

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client-settings.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AACtG,OAAO,EACL,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AAgBzC;;;;;;;;GAQG;AACH,MAAM,OAAO,gCAAgC;IAC3B,IAAI,CAAS;IACb,iBAAiB,CAA8B;IAC/C,0BAA0B,CAAuC;IACjE,aAAa,CAA0B;IAEvD;;OAEG;IACa,KAAK,CAA0B;IAE/C,YAAY,UAAsD;QAChE,IAAI,CAAC,IAAI,GAAG,IAAI,cAAc,CAAC;YAC7B,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,UAAU,CAAC,UAAU;SAC7B,CAAC,CAAC,KAAK,CAAC;QACT,IAAI,CAAC,iBAAiB,GAAG,IAAI,2BAA2B,CACtD,UAAU,CAAC,iBAAiB,CAC7B,CAAC;QACF,IAAI,CAAC,0BAA0B,GAAG,IAAI,oCAAoC,CACxE,UAAU,CAAC,0BAA0B,CACtC,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,IAAI,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-client-settings.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AACtG,OAAO,EACL,8BAA8B,GAE/B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AAmBzC;;;;;;;;GAQG;AACH,MAAM,OAAO,gCAAgC;IAC3B,IAAI,CAAS;IACb,iBAAiB,CAA8B;IAC/C,0BAA0B,CAAuC;IACjE,aAAa,CAA0B;IAEvD;;;OAGG;IACa,oBAAoB,CAAiC;IAErE;;OAEG;IACa,KAAK,CAA0B;IAE/C,YAAY,UAAsD;QAChE,IAAI,CAAC,IAAI,GAAG,IAAI,cAAc,CAAC;YAC7B,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,UAAU,CAAC,UAAU;SAC7B,CAAC,CAAC,KAAK,CAAC;QACT,IAAI,CAAC,iBAAiB,GAAG,IAAI,2BAA2B,CACtD,UAAU,CAAC,iBAAiB,CAC7B,CAAC;QACF,IAAI,CAAC,0BAA0B,GAAG,IAAI,oCAAoC,CACxE,UAAU,CAAC,0BAA0B,CACtC,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,IAAI,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,GAAG,IAAI,8BAA8B,CAC5D,UAAU,CAAC,oBAAoB,CAChC,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client.d.ts

@@ -2,6 +2,7 @@ import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoUserPoolId } from "../sim-cognito-user-pool-id.js";
 import type { SimCognitoExplicitAuthFlows } from "./sim-cognito-explicit-auth-flows.js";
 import type { SimCognitoPreventUserExistenceErrors } from "./sim-cognito-prevent-user-existence-errors.js";
+import type { SimCognitoRefreshTokenRotation } from "./sim-cognito-refresh-token-rotation.js";
 import type { SimCognitoTokenValidity } from "./sim-cognito-token-validity.js";
 import type { SimCognitoOAuthSettings } from "./sim-cognito-oauth-settings.js";
 import type { SimCognitoUserPoolClientSettings } from "./sim-cognito-user-pool-client-settings.js";
@@ -50,6 +51,11 @@ export declare class SimCognitoUserPoolClient {
      * How long each kind of token this client is given lasts.
      */
     get tokenValidity(): SimCognitoTokenValidity;
+    /**
+     * Whether this client rotates its refresh tokens, and how long it goes on
+     * honouring one it rotated out.
+     */
+    get refreshTokenRotation(): SimCognitoRefreshTokenRotation;
     /**
      * What this client may do at its pool's hosted domain: which grant, which
      * scopes, which redirects and which identity providers.

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AAC3G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AACnG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAEvF,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,EAAE,EAAE,0BAA0B,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,EAAE,EAAE,0BAA0B,CAAC;IAC/C,SAAgB,UAAU,EAAE,oBAAoB,CAAC;IACjD,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC;;;OAGG;IACH,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,cAAc,CAAmC;IACzD,OAAO,CAAC,YAAY,CAAO;IAE3B,YAAY,UAAU,EAAE,kCAAkC,EAQzD;IAED;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,IAAI,iBAAiB,IAAI,2BAA2B,CAEnD;IAED;;OAEG;IACH,IAAI,0BAA0B,IAAI,oCAAoC,CAErE;IAED;;OAEG;IACH,IAAI,aAAa,IAAI,uBAAuB,CAE3C;IAED;;;OAGG;IACH,IAAI,KAAK,IAAI,uBAAuB,CAEnC;IAED;;;OAGG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,QAAQ,EAAE,gCAAgC,GAAG,IAAI,CAGvD;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-client.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AAC3G,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAC9F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AACnG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAEvF,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,EAAE,EAAE,0BAA0B,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,EAAE,EAAE,0BAA0B,CAAC;IAC/C,SAAgB,UAAU,EAAE,oBAAoB,CAAC;IACjD,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC;;;OAGG;IACH,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,cAAc,CAAmC;IACzD,OAAO,CAAC,YAAY,CAAO;IAE3B,YAAY,UAAU,EAAE,kCAAkC,EAQzD;IAED;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,IAAI,iBAAiB,IAAI,2BAA2B,CAEnD;IAED;;OAEG;IACH,IAAI,0BAA0B,IAAI,oCAAoC,CAErE;IAED;;OAEG;IACH,IAAI,aAAa,IAAI,uBAAuB,CAE3C;IAED;;;OAGG;IACH,IAAI,oBAAoB,IAAI,8BAA8B,CAEzD;IAED;;;OAGG;IACH,IAAI,KAAK,IAAI,uBAAuB,CAEnC;IAED;;;OAGG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,QAAQ,EAAE,gCAAgC,GAAG,IAAI,CAGvD;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client.js

@@ -51,6 +51,13 @@ export class SimCognitoUserPoolClient {
     get tokenValidity() {
         return this.clientSettings.tokenValidity;
     }
+    /**
+     * Whether this client rotates its refresh tokens, and how long it goes on
+     * honouring one it rotated out.
+     */
+    get refreshTokenRotation() {
+        return this.clientSettings.refreshTokenRotation;
+    }
     /**
      * What this client may do at its pool's hosted domain: which grant, which
      * scopes, which redirects and which identity providers.

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client.ts"],"names":[],"mappings":"AAiBA;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnB,EAAE,CAA6B;IAC/B,UAAU,CAAuB;IACjC,YAAY,CAAO;IAEnC;;;OAGG;IACa,MAAM,CAAqB;IAE1B,KAAK,CAAW;IACzB,cAAc,CAAmC;IACjD,YAAY,CAAO;IAE3B,YAAY,UAA8C;QACxD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,QAA0C;QAC/C,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-client.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client.ts"],"names":[],"mappings":"AAkBA;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnB,EAAE,CAA6B;IAC/B,UAAU,CAAuB;IACjC,YAAY,CAAO;IAEnC;;;OAGG;IACa,MAAM,CAAqB;IAE1B,KAAK,CAAW;IACzB,cAAc,CAAmC;IACjD,YAAY,CAAO;IAE3B,YAAY,UAA8C;QACxD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,QAA0C;QAC/C,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.d.ts

@@ -1,4 +1,5 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { SimCognitoIssuedToken } from "../auth/sim-cognito-issued-token.js";
 import type { SimCognitoUserPoolClient } from "../client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
 import type { SimCognitoTriggerOccasion } from "../trigger/sim-cognito-trigger-occasion.js";
@@ -41,6 +42,16 @@ interface SimCognitoIssueTokensProperties {
      */
     readonly scopes?: readonly string[] | undefined;
 }
+/**
+ * Reissuing tokens for a refresh token the caller presented.
+ */
+interface SimCognitoRefreshTokensProperties extends SimCognitoIssueTokensProperties {
+    /**
+     * The refresh token the request was made with, which a rotating app client
+     * spends and replaces.
+     */
+    readonly spent: SimCognitoIssuedToken;
+}
 /**
  * Issues the tokens a successful authentication answers with.
  *
@@ -62,6 +73,10 @@ export declare class SimCognitoTokenIssuer {
     private readonly triggers;
     constructor(properties: SimCognitoTokenIssuerProperties);
     private static expiryOf;
+    /**
+     * Mint an opaque refresh token, as real Cognito's is opaque.
+     */
+    private static mintRefreshToken;
     /**
      * Sign an id token and an access token for a user, and mint a refresh
      * token to go with them.
@@ -84,6 +99,25 @@ export declare class SimCognitoTokenIssuer {
      * that expires.
      */
     reissue(properties: SimCognitoIssueTokensProperties): Promise<SimCognitoIssuedTokens>;
+    /**
+     * Sign fresh tokens for a refresh token the caller presented.
+     *
+     * Whether a new refresh token comes back is the app client's to decide. A
+     * rotating client hands one out and spends the token that bought it, and a
+     * client with rotation off answers with the two JWTs alone, leaving the
+     * caller the refresh token it already has until that expires.
+     */
+    refresh(properties: SimCognitoRefreshTokensProperties): Promise<SimCognitoIssuedTokens>;
+    /**
+     * Sign fresh tokens and rotate the refresh token that bought them.
+     *
+     * The replacement runs out when the token it replaced would have, so a
+     * rotating session ends at the app client's `RefreshTokenValidity` however
+     * often it was renewed. The spent token is revoked after the replacement is
+     * stored, so it stays refusable for the grace period rather than being
+     * swept away with the tokens that have already run out.
+     */
+    private rotate;
     private signTokens;
     private claimsOverride;
 }

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-token-issuer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAclE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAE7C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAEvE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB;;;;;;;;;;;OAWG;IACG,KAAK,CACT,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAuBjC;IAED;;;;;;;OAOG;IACG,OAAO,CACX,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAEjC;YAEa,UAAU;YAyDV,cAAc;CAY7B"}
+{"version":3,"file":"sim-cognito-token-issuer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAclE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAE7C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAEvE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAED;;GAEG;AACH,UAAU,iCAAkC,SAAQ,+BAA+B;IACjF;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;CACvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAI/B;;;;;;;;;;;OAWG;IACG,KAAK,CACT,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAuBjC;IAED;;;;;;;OAOG;IACG,OAAO,CACX,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAEjC;IAED;;;;;;;OAOG;IACG,OAAO,CACX,UAAU,EAAE,iCAAiC,GAC5C,OAAO,CAAC,sBAAsB,CAAC,CAQjC;IAED;;;;;;;;OAQG;YACW,MAAM;YAkBN,UAAU;YAyDV,cAAc;CAY7B"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.js

@@ -36,6 +36,12 @@ export class SimCognitoTokenIssuer {
     static expiryOf(issuedAt, seconds) {
         return new Date(issuedAt.getTime() + seconds * 1000);
     }
+    /**
+     * Mint an opaque refresh token, as real Cognito's is opaque.
+     */
+    static mintRefreshToken() {
+        return randomBytes(refreshTokenBytes).toString("base64url");
+    }
     /**
      * Sign an id token and an access token for a user, and mint a refresh
      * token to go with them.
@@ -52,7 +58,7 @@ export class SimCognitoTokenIssuer {
         const { pool, client, user } = properties;
         const issuedAt = this.clock.now();
         const signed = await this.signTokens(properties, issuedAt);
-        const refreshToken = randomBytes(refreshTokenBytes).toString("base64url");
+        const refreshToken = SimCognitoTokenIssuer.mintRefreshToken();
         pool.auth.addRefreshToken(new SimCognitoIssuedToken({
             value: refreshToken,
             username: user.username,
@@ -76,6 +82,39 @@ export class SimCognitoTokenIssuer {
     async reissue(properties) {
         return await this.signTokens(properties, this.clock.now());
     }
+    /**
+     * Sign fresh tokens for a refresh token the caller presented.
+     *
+     * Whether a new refresh token comes back is the app client's to decide. A
+     * rotating client hands one out and spends the token that bought it, and a
+     * client with rotation off answers with the two JWTs alone, leaving the
+     * caller the refresh token it already has until that expires.
+     */
+    async refresh(properties) {
+        const rotation = properties.client.refreshTokenRotation;
+        if (!rotation.enabled) {
+            return await this.reissue(properties);
+        }
+        return await this.rotate(properties, rotation.retryGracePeriodSeconds);
+    }
+    /**
+     * Sign fresh tokens and rotate the refresh token that bought them.
+     *
+     * The replacement runs out when the token it replaced would have, so a
+     * rotating session ends at the app client's `RefreshTokenValidity` however
+     * often it was renewed. The spent token is revoked after the replacement is
+     * stored, so it stays refusable for the grace period rather than being
+     * swept away with the tokens that have already run out.
+     */
+    async rotate(properties, gracePeriodSeconds) {
+        const { pool, spent } = properties;
+        const issuedAt = this.clock.now();
+        const signed = await this.signTokens(properties, issuedAt);
+        const refreshToken = SimCognitoTokenIssuer.mintRefreshToken();
+        pool.auth.addRefreshToken(spent.replacedBy(refreshToken, issuedAt));
+        pool.auth.revokeRefreshTokenAt(spent, SimCognitoTokenIssuer.expiryOf(issuedAt, gracePeriodSeconds));
+        return { ...signed, refreshToken };
+    }
     async signTokens(properties, issuedAt) {
         const { pool, client, user } = properties;
         const claimsOverride = await this.claimsOverride(properties);

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-token-issuer.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAM5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AA6C7B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAW;IAChB,QAAQ,CAA6B;IAEtD,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,QAAc,EAAE,OAAe;QACrD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CACT,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1E,IAAI,CAAC,IAAI,CAAC,eAAe,CACvB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAC1C;YACD,sEAAsE;YACtE,iCAAiC;YACjC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,UAA2C;QAE3C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,UAA2C,EAC3C,QAAc;QAEd,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC;QACpE,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,QAAQ,CACzD,QAAQ,EACR,kBAAkB,CACnB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACpC,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CACrC;YACD,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC;YAC5C,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,4EAA4E;QAC5E,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAC5C,cAAc,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CACnD,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,cAAc,CACtB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,uEAAuE;YACvE,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CACH,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,WAAW,EAAE,iBAAiB;YAC9B,SAAS,EAAE,kBAAkB;SAC9B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,UAAU,CAAC;QAEpE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,EAAE;YACtD,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-token-issuer.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAM5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAwD7B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAW;IAChB,QAAQ,CAA6B;IAEtD,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,QAAc,EAAE,OAAe;QACrD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,gBAAgB;QAC7B,OAAO,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CACT,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,CAAC;QAE9D,IAAI,CAAC,IAAI,CAAC,eAAe,CACvB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAC1C;YACD,sEAAsE;YACtE,iCAAiC;YACjC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,UAA2C;QAE3C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,UAA6C;QAE7C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAExD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,MAAM,CAClB,UAA6C,EAC7C,kBAA0B;QAE1B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,CAAC;QAE9D,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAC5B,KAAK,EACL,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAC7D,CAAC;QAEF,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,UAA2C,EAC3C,QAAc;QAEd,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC;QACpE,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,QAAQ,CACzD,QAAQ,EACR,kBAAkB,CACnB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACpC,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CACrC;YACD,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC;YAC5C,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,4EAA4E;QAC5E,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAC5C,cAAc,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CACnD,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,cAAc,CACtB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,uEAAuE;YACvE,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CACH,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,WAAW,EAAE,iBAAiB;YAC9B,SAAS,EAAE,kBAAkB;SAC9B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,UAAU,CAAC;QAEpE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,EAAE;YACtD,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/lambda/command/create-function/create-function-input.js

@@ -1,6 +1,6 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
 import { requireLambdaCodeSource, } from "../../function/code/lambda-code-source.js";
-import { requireLambdaEnvironmentVariables } from "./create-function-environment.js";
+import { requireLambdaEnvironmentVariables } from "../../function/environment/lambda-environment-variables.js";
 /**
  * Require the AWS-required CreateFunction input fields, and validate the
  * function code input into a sim Lambda code source.

package/dist/service/lambda/command/create-function/create-function-input.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-function-input.js","sourceRoot":"","sources":["../../../../../src/service/lambda/command/create-function/create-function-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EACL,uBAAuB,GAExB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AAkBrF;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAiC;IAEjC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1B,aAAa,CACX,KAAK,CAAC,YAAY,EAClB,mDAAmD,CACpD,CAAC;IACF,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,2CAA2C,CAAC,CAAC;IAEvE,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,OAAO,EAAE,KAAK,CAAC,IAAI;QACnB,UAAU,EAAE,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC;QAC/C,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,OAAO;QAC7B,YAAY,EAAE,KAAK,CAAC,UAAU;QAC9B,oBAAoB,EAAE,iCAAiC,CAAC,KAAK,CAAC,WAAW,CAAC;KAC3E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"create-function-input.js","sourceRoot":"","sources":["../../../../../src/service/lambda/command/create-function/create-function-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EACL,uBAAuB,GAExB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,iCAAiC,EAAE,MAAM,4DAA4D,CAAC;AAkB/G;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAiC;IAEjC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1B,aAAa,CACX,KAAK,CAAC,YAAY,EAClB,mDAAmD,CACpD,CAAC;IACF,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,2CAA2C,CAAC,CAAC;IAEvE,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,OAAO,EAAE,KAAK,CAAC,IAAI;QACnB,UAAU,EAAE,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC;QAC/C,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,WAAW,EAAE,KAAK,CAAC,OAAO;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,OAAO;QAC7B,YAAY,EAAE,KAAK,CAAC,UAAU;QAC9B,oBAAoB,EAAE,iCAAiC,CAAC,KAAK,CAAC,WAAW,CAAC;KAC3E,CAAC;AACJ,CAAC"}

package/dist/service/lambda/command/function/sim-lambda-function-commands.d.ts

@@ -10,15 +10,20 @@ import type { SimLogsServiceWriter } from "../../../logs/write/sim-logs-service-
 import type { SimLambdaOutboundHttp } from "../../function/outbound/sim-lambda-outbound-http.js";
 import type { SimLambdaEnvironmentConflicts } from "../../function/environment/sim-lambda-environment-conflicts.js";
 import type { SimLambdaFunctionMap } from "../../function/sim-lambda-function.js";
+import type { SimLambdaFunctionLookup } from "../../function/url/sim-lambda-function-lookup.js";
 import type { SimLambdaFunctionUrlStore } from "../../function/url/sim-lambda-function-url-store.js";
 import type { SimLambdaFunctionVersionStore } from "../../function/version/sim-lambda-function-version-store.js";
 import type { SimCreateFunctionCommand, SimCreateFunctionCommandOutput } from "../create-function/create-function.command.js";
 import type { SimDeleteFunctionCommand, SimDeleteFunctionCommandOutput } from "../delete-function/delete-function.command.js";
 import type { SimGetFunctionCommand, SimGetFunctionCommandOutput } from "../get-function/get-function.command.js";
 import type { SimInvokeCommand, SimInvokeCommandOutput } from "../invoke/invoke.command.js";
+import type { SimListFunctionsCommand, SimListFunctionsCommandOutput } from "../list-functions/list-functions.command.js";
+import type { SimUpdateFunctionCodeCommand, SimUpdateFunctionCodeCommandOutput } from "../update-function-code/update-function-code.command.js";
+import type { SimUpdateFunctionConfigurationCommand, SimUpdateFunctionConfigurationCommandOutput } from "../update-function-configuration/update-function-configuration.command.js";
 interface SimLambdaFunctionCommandsProperties {
     readonly accountRegionScope: SimAwsAccountRegionScope;
     readonly functions: SimLambdaFunctionMap;
+    readonly functionLookup: SimLambdaFunctionLookup;
     readonly iam: SimIamInterServiceAuthZ;
     readonly background: BackgroundScheduler;
     readonly runAsOwner: SimAwsRunAsOwner;
@@ -52,6 +57,18 @@ export declare class SimLambdaFunctionCommands {
      * Read a function's configuration.
      */
     get(command: SimGetFunctionCommand, options?: SimLambdaFunctionCommandOptions): Promise<SimGetFunctionCommandOutput>;
+    /**
+     * Replace the code a function runs.
+     */
+    updateCode(command: SimUpdateFunctionCodeCommand, options?: SimLambdaFunctionCommandOptions): Promise<SimUpdateFunctionCodeCommandOutput>;
+    /**
+     * Change a function's settings.
+     */
+    updateConfiguration(command: SimUpdateFunctionConfigurationCommand, options?: SimLambdaFunctionCommandOptions): Promise<SimUpdateFunctionConfigurationCommandOutput>;
+    /**
+     * List the functions that exist in this Account and Region.
+     */
+    list(command: SimListFunctionsCommand, options?: SimLambdaFunctionCommandOptions): Promise<SimListFunctionsCommandOutput>;
     /**
      * Delete a function, and the Function URL that belongs to it.
      */

package/dist/service/lambda/command/function/sim-lambda-function-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-function-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/command/function/sim-lambda-function-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,iEAAiE,CAAC;AACpH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AACjG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,gEAAgE,CAAC;AACpH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AACrG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6DAA6D,CAAC;AAEjH,OAAO,KAAK,EACV,wBAAwB,EACxB,8BAA8B,EAC/B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EACV,wBAAwB,EACxB,8BAA8B,EAC/B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EACV,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,6BAA6B,CAAC;AAErC,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,6BAA6B,CAAC;IACjD,QAAQ,CAAC,oBAAoB,EAAE,6BAA6B,CAAC;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,eAAe,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC3D;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsC;IAEjE,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,8BAA8B,CAAC,CAKzC;IAED;;OAEG;IACG,GAAG,CACP,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,2BAA2B,CAAC,CAKtC;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,8BAA8B,CAAC,CAKzC;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,sBAAsB,CAAC,CAKjC;CACF"}
+{"version":3,"file":"sim-lambda-function-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/command/function/sim-lambda-function-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,iEAAiE,CAAC;AACpH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AACjG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,gEAAgE,CAAC;AACpH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kDAAkD,CAAC;AAChG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AACrG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6DAA6D,CAAC;AAEjH,OAAO,KAAK,EACV,wBAAwB,EACxB,8BAA8B,EAC/B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EACV,wBAAwB,EACxB,8BAA8B,EAC/B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EACV,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,6CAA6C,CAAC;AAErD,OAAO,KAAK,EACV,4BAA4B,EAC5B,kCAAkC,EACnC,MAAM,yDAAyD,CAAC;AAEjE,OAAO,KAAK,EACV,qCAAqC,EACrC,2CAA2C,EAC5C,MAAM,2EAA2E,CAAC;AAEnF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,uBAAuB,CAAC;IACjD,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,6BAA6B,CAAC;IACjD,QAAQ,CAAC,oBAAoB,EAAE,6BAA6B,CAAC;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,eAAe,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC3D;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsC;IAEjE,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,8BAA8B,CAAC,CAKzC;IAED;;OAEG;IACG,GAAG,CACP,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,2BAA2B,CAAC,CAKtC;IAED;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,4BAA4B,EACrC,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,kCAAkC,CAAC,CAwB7C;IAED;;OAEG;IACG,mBAAmB,CACvB,OAAO,EAAE,qCAAqC,EAC9C,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,2CAA2C,CAAC,CActD;IAED;;OAEG;IACG,IAAI,CACR,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,6BAA6B,CAAC,CAKxC;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,8BAA8B,CAAC,CAKzC;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,sBAAsB,CAAC,CAKjC;CACF"}

package/dist/service/lambda/command/function/sim-lambda-function-commands.js

@@ -2,6 +2,9 @@ import { CreateFunctionCommandHandler } from "../create-function/create-function
 import { DeleteFunctionCommandHandler } from "../delete-function/delete-function.handler.js";
 import { GetFunctionCommandHandler } from "../get-function/get-function.handler.js";
 import { InvokeCommandHandler } from "../invoke/invoke.handler.js";
+import { ListFunctionsCommandHandler } from "../list-functions/list-functions.handler.js";
+import { UpdateFunctionCodeCommandHandler } from "../update-function-code/update-function-code.handler.js";
+import { UpdateFunctionConfigurationCommandHandler } from "../update-function-configuration/update-function-configuration.handler.js";
 /**
  * The function lifecycle commands of one simulated Lambda scope.
  *
@@ -26,6 +29,46 @@ export class SimLambdaFunctionCommands {
     async get(command, options) {
         return await new GetFunctionCommandHandler(this.properties).handle(command, options);
     }
+    /**
+     * Replace the code a function runs.
+     */
+    async updateCode(command, options) {
+        const { functionLookup, versions, iam, background, codeStore, containerImages, vmSdkModuleProvider, outboundHttp, } = this.properties;
+        return await new UpdateFunctionCodeCommandHandler({
+            // The lookup rather than the map itself, because this command resolves
+            // a name that may arrive as a function ARN.
+            functions: functionLookup,
+            versions,
+            iam,
+            background,
+            codeStore,
+            containerImages,
+            vmSdkModuleProvider,
+            outboundHttp,
+        }).handle(command, options);
+    }
+    /**
+     * Change a function's settings.
+     */
+    async updateConfiguration(command, options) {
+        const { functionLookup, functions, iam, background, environmentConflicts } = this.properties;
+        return await new UpdateFunctionConfigurationCommandHandler({
+            // The lookup rather than the map itself, because this command resolves
+            // a name that may arrive as a function ARN. The map comes too, for the
+            // environments a changed one is checked against.
+            functions: functionLookup,
+            functionMap: functions,
+            iam,
+            background,
+            environmentConflicts,
+        }).handle(command, options);
+    }
+    /**
+     * List the functions that exist in this Account and Region.
+     */
+    async list(command, options) {
+        return await new ListFunctionsCommandHandler(this.properties).handle(command, options);
+    }
     /**
      * Delete a function, and the Function URL that belongs to it.
      */

package/dist/service/lambda/command/function/sim-lambda-function-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-function-commands.js","sourceRoot":"","sources":["../../../../../src/service/lambda/command/function/sim-lambda-function-commands.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAK7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAK7F,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAKpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AA0BnE;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACnB,UAAU,CAAsC;IAEjE,YAAY,UAA+C;QACzD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAiC,EACjC,OAAyC;QAEzC,OAAO,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CACnE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CACP,OAA8B,EAC9B,OAAyC;QAEzC,OAAO,MAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAChE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAiC,EACjC,OAAyC;QAEzC,OAAO,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CACnE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAyB,EACzB,OAAyC;QAEzC,OAAO,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAC3D,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-lambda-function-commands.js","sourceRoot":"","sources":["../../../../../src/service/lambda/command/function/sim-lambda-function-commands.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAK7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAK7F,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAKpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAKnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AAK1F,OAAO,EAAE,gCAAgC,EAAE,MAAM,yDAAyD,CAAC;AAK3G,OAAO,EAAE,yCAAyC,EAAE,MAAM,2EAA2E,CAAC;AA2BtI;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACnB,UAAU,CAAsC;IAEjE,YAAY,UAA+C;QACzD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAiC,EACjC,OAAyC;QAEzC,OAAO,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CACnE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CACP,OAA8B,EAC9B,OAAyC;QAEzC,OAAO,MAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAChE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,OAAqC,EACrC,OAAyC;QAEzC,MAAM,EACJ,cAAc,EACd,QAAQ,EACR,GAAG,EACH,UAAU,EACV,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,YAAY,GACb,GAAG,IAAI,CAAC,UAAU,CAAC;QAEpB,OAAO,MAAM,IAAI,gCAAgC,CAAC;YAChD,uEAAuE;YACvE,4CAA4C;YAC5C,SAAS,EAAE,cAAc;YACzB,QAAQ;YACR,GAAG;YACH,UAAU;YACV,SAAS;YACT,eAAe;YACf,mBAAmB;YACnB,YAAY;SACb,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAA8C,EAC9C,OAAyC;QAEzC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,oBAAoB,EAAE,GACxE,IAAI,CAAC,UAAU,CAAC;QAElB,OAAO,MAAM,IAAI,yCAAyC,CAAC;YACzD,uEAAuE;YACvE,uEAAuE;YACvE,iDAAiD;YACjD,SAAS,EAAE,cAAc;YACzB,WAAW,EAAE,SAAS;YACtB,GAAG;YACH,UAAU;YACV,oBAAoB;SACrB,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CACR,OAAgC,EAChC,OAAyC;QAEzC,OAAO,MAAM,IAAI,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAClE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAiC,EACjC,OAAyC;QAEzC,OAAO,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CACnE,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAyB,EACzB,OAAyC;QAEzC,OAAO,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAC3D,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}

package/dist/service/lambda/command/list-functions/list-functions-authorizer.d.ts

@@ -0,0 +1,31 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+interface ListFunctionsAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to a Lambda ListFunctions request.
+ *
+ * AWS maps the ListFunctions API operation to the lambda:ListFunctions IAM
+ * action. The operation reaches every function in the Account and Region, so
+ * AWS documents its resource as "*" rather than any one function ARN.
+ *
+ * Authorization therefore applies to the whole operation. A denied caller
+ * receives AccessDenied rather than a filtered listing.
+ */
+export declare class ListFunctionsAuthorizer {
+    private static readonly action;
+    private static readonly resource;
+    private readonly iam;
+    constructor(properties: ListFunctionsAuthorizerProperties);
+    /**
+     * Ensure the caller may list the simulated Account's Lambda functions.
+     *
+     * The caller is passed through unchanged so sim IAM can distinguish an
+     * omitted caller, which defaults to Account root, from an explicit anonymous
+     * caller.
+     */
+    authorize(caller?: SimAwsCaller): void;
+}
+export {};
+//# sourceMappingURL=list-functions-authorizer.d.ts.map

package/dist/service/lambda/command/list-functions/list-functions-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-functions-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/command/list-functions/list-functions-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAGtG,UAAU,iCAAiC;IACzC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACxD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAO;IAEvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,iCAAiC,EAExD;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAcrC;CACF"}