@kensio/yulin 1.21.0 → 1.21.2

package/dist/service/cloudformation/resource/ignore/sim-cfn-skipped-properties.js

@@ -0,0 +1,61 @@
+/**
+ * What one Resource's skipped properties say, and what they still have to
+ * satisfy.
+ *
+ * Simulated CloudFormation deploys what it can, so a property a service cannot
+ * act on is recorded against the Resource rather than taking it down. That
+ * leaves a gap. A skipped property can carry a value real AWS answers with a
+ * 400 as readily as a simulated one can, and deploying it here reports a
+ * template AWS refuses as working, which is the one failure a local deploy of
+ * a real template exists to catch.
+ *
+ * This is where a service closes that gap. The constraint sits beside the
+ * reason in the same map, and every service reaches it the same way, so the
+ * next one to need it has nothing to build.
+ */
+export class SimCfnSkippedProperties {
+    rules;
+    properties;
+    error;
+    constructor(properties) {
+        this.rules = properties.rules;
+        this.properties = properties.properties;
+        this.error = properties.error;
+    }
+    /**
+     * Refuse the Resource where a skipped value is one real AWS would answer
+     * with a 400.
+     *
+     * Every constraint runs before anything is recorded, so a Resource that
+     * fails one leaves no half-written list of what it was created without.
+     */
+    assertConstraints() {
+        for (const [name, value] of Object.entries(this.properties)) {
+            this.constraintOn(name)?.({
+                value,
+                properties: this.properties,
+                refuse: (reason) => {
+                    throw this.error(reason);
+                },
+            });
+        }
+    }
+    /**
+     * Why a property is skipped, or nothing where this service has no entry for
+     * it.
+     */
+    reasonFor(name) {
+        const rule = this.rules.get(name);
+        return typeof rule === "string" ? rule : rule?.reason;
+    }
+    /**
+     * What a property's value has to satisfy, where the service stated it.
+     *
+     * A rule that is a bare reason states nothing, which is the common case and
+     * the reason both shapes share one map.
+     */
+    constraintOn(name) {
+        const rule = this.rules.get(name);
+        return typeof rule === "string" ? undefined : rule?.constraint;
+    }
+}

package/dist/service/cloudformation/resource/ignore/sim-cfn-skipped-property.type.d.ts

@@ -0,0 +1,51 @@
+import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../template/value/sim-cfn-template-value.js";
+/**
+ * One skipped property, as a constraint on it reads the Resource.
+ *
+ * The whole Resource comes with it, because the constraints AWS enforces on a
+ * property it is not acting on are usually about a second one. Replication on
+ * an S3 Bucket needs versioning turned on beside it, and neither property is
+ * simulated.
+ */
+export interface SimCfnSkippedPropertyValue {
+    /** What the template declared for the skipped property. */
+    readonly value: SimCfnTemplateValue;
+    /** Everything else the Resource declared. */
+    readonly properties: SimCfnTemplateValueRecord;
+    /**
+     * Refuse the Resource, in the service's own words.
+     *
+     * The wording matters. Sim CloudFormation downgrades a failure that reads as
+     * an unsupported Resource type into a skip, and a skipped Resource here
+     * would deploy the very template this exists to refuse, so each service
+     * passes the error builder it already refuses its own Resources with.
+     */
+    refuse(reason: string): never;
+}
+/**
+ * What a skipped value has to satisfy even though nothing acts on it.
+ *
+ * A value that passes is recorded against the Resource as any skipped value
+ * is. One that fails takes the Resource with it, before anything is recorded.
+ */
+export type SimCfnSkippedPropertyConstraint = (declared: SimCfnSkippedPropertyValue) => void;
+/**
+ * What a service says about a property its Resource is created without acting
+ * on.
+ *
+ * A reason on its own is the common case and stays a bare string. A property
+ * carrying a value real AWS answers with a 400 states the constraint here too,
+ * beside the reason, rather than in a check of its own somewhere up the call
+ * path.
+ */
+export interface SimCfnSkippedPropertyRule {
+    readonly reason: string;
+    readonly constraint: SimCfnSkippedPropertyConstraint;
+}
+/**
+ * The properties one Resource type is created without acting on, by name.
+ *
+ * Most name a reason and nothing more. The rest state what the value has to
+ * satisfy alongside it.
+ */
+export type SimCfnSkippedPropertyRules = ReadonlyMap<string, SimCfnSkippedPropertyRule | string>;

package/dist/service/cloudformation/resource/ignore/sim-cfn-skipped-property.type.js

@@ -0,0 +1 @@
+export {};

package/dist/service/cloudformation/resource/resolve/service/sim-cfn-service-factories.js

@@ -23,6 +23,10 @@ export const simCfnServiceResourceFactories = new Map([
         "Athena",
         (scopedAws) => scopedAws.athena().cfnResourceFactory(),
     ],
+    [
+        "Backup",
+        (scopedAws) => scopedAws.backup().cfnResourceFactory(),
+    ],
     [
         "ApiGateway",
         (scopedAws) => scopedAws.apiGateway().cfnResourceFactory(),

package/dist/service/cloudwatch/index.d.ts

@@ -22,4 +22,5 @@ export { requiredSimCloudWatchNamespace, requiredSimCloudWatchWritableNamespace,
 export { requiredSimCloudWatchPeriod, simCloudWatchMinimumPeriodSeconds, simCloudWatchPeriodAggregates, simCloudWatchPeriodStart, } from "./metric/sim-cloudwatch-period.js";
 export { requiredSimCloudWatchStatistic, type SimCloudWatchStatistic, simCloudWatchStatistics, simCloudWatchStatisticValue, } from "./metric/sim-cloudwatch-statistic.js";
 export { requiredSimCloudWatchTimeRange, type SimCloudWatchTimeRange, } from "./metric/sim-cloudwatch-time-range.js";
+export { SimCloudWatchServiceWriter, type SimCloudWatchServiceDatum, } from "./write/sim-cloudwatch-service-writer.js";
 export { SimCloudWatchError, type SimCloudWatchErrorMetadata, SimCloudWatchInvalidParameterCombinationException, SimCloudWatchInvalidParameterValueException, SimCloudWatchMissingRequiredParameterException, } from "./error/sim-cloudwatch.error.js";

package/dist/service/cloudwatch/index.js

@@ -21,4 +21,5 @@ export { requiredSimCloudWatchNamespace, requiredSimCloudWatchWritableNamespace,
 export { requiredSimCloudWatchPeriod, simCloudWatchMinimumPeriodSeconds, simCloudWatchPeriodAggregates, simCloudWatchPeriodStart, } from "./metric/sim-cloudwatch-period.js";
 export { requiredSimCloudWatchStatistic, simCloudWatchStatistics, simCloudWatchStatisticValue, } from "./metric/sim-cloudwatch-statistic.js";
 export { requiredSimCloudWatchTimeRange, } from "./metric/sim-cloudwatch-time-range.js";
+export { SimCloudWatchServiceWriter, } from "./write/sim-cloudwatch-service-writer.js";
 export { SimCloudWatchError, SimCloudWatchInvalidParameterCombinationException, SimCloudWatchInvalidParameterValueException, SimCloudWatchMissingRequiredParameterException, } from "./error/sim-cloudwatch.error.js";

package/dist/service/cloudwatch/sim-cloudwatch-commands.d.ts

@@ -12,6 +12,7 @@ import { SimCloudWatchGetMetricData } from "./command/query/sim-cloudwatch-get-m
 import { SimCloudWatchGetMetricStatistics } from "./command/query/sim-cloudwatch-get-metric-statistics.js";
 import { SimCloudWatchListMetrics } from "./command/query/sim-cloudwatch-list-metrics.js";
 import { SimCloudWatchMetricStore } from "./metric/sim-cloudwatch-metric-store.js";
+import { SimCloudWatchServiceWriter } from "./write/sim-cloudwatch-service-writer.js";
 export interface SimCloudWatchProperties {
     readonly accountRegionScope?: SimAwsAccountRegionScope;
     readonly iam?: SimIamInterServiceAuthZ;
@@ -32,6 +33,7 @@ export interface SimCloudWatchProperties {
  */
 export declare class SimCloudWatchCommands {
     readonly metrics: SimCloudWatchMetricStore;
+    readonly serviceWriter: SimCloudWatchServiceWriter;
     readonly putMetricData: SimCloudWatchPutMetricData;
     readonly listMetrics: SimCloudWatchListMetrics;
     readonly getMetricStatistics: SimCloudWatchGetMetricStatistics;

package/dist/service/cloudwatch/sim-cloudwatch-commands.js

@@ -14,6 +14,7 @@ import { SimCloudWatchGetMetricData } from "./command/query/sim-cloudwatch-get-m
 import { SimCloudWatchGetMetricStatistics } from "./command/query/sim-cloudwatch-get-metric-statistics.js";
 import { SimCloudWatchListMetrics } from "./command/query/sim-cloudwatch-list-metrics.js";
 import { SimCloudWatchMetricStore } from "./metric/sim-cloudwatch-metric-store.js";
+import { SimCloudWatchServiceWriter } from "./write/sim-cloudwatch-service-writer.js";
 /**
  * The collaborators one simulated CloudWatch scope is built from.
  *
@@ -24,6 +25,7 @@ import { SimCloudWatchMetricStore } from "./metric/sim-cloudwatch-metric-store.j
  */
 export class SimCloudWatchCommands {
     metrics;
+    serviceWriter;
     putMetricData;
     listMetrics;
     getMetricStatistics;
@@ -39,6 +41,10 @@ export class SimCloudWatchCommands {
         const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         const authorizer = new SimCloudWatchAuthorizer({ iam, accountRegionScope });
         const metrics = new SimCloudWatchMetricStore();
+        this.serviceWriter = new SimCloudWatchServiceWriter({
+            metrics,
+            clock: background,
+        });
         const alarms = new SimCloudWatchAlarmStore();
         const alarmActions = new SimCloudWatchAlarmActions({
             targets: alarmTargets,

package/dist/service/cloudwatch/sim-cloudwatch.d.ts

@@ -5,6 +5,7 @@ import type { SimCloudWatchRequestOptions } from "./command/sim-cloudwatch-reque
 import type { SimCloudWatchAlarmActionFailure } from "./alarm/action/sim-cloudwatch-alarm-action-failures.js";
 import type { SimCloudWatchAlarm } from "./alarm/sim-cloudwatch-alarm.js";
 import type { SimCloudWatchMetric } from "./metric/sim-cloudwatch-metric.js";
+import type { SimCloudWatchServiceWriter } from "./write/sim-cloudwatch-service-writer.js";
 import { type SimCloudWatchProperties } from "./sim-cloudwatch-commands.js";
 /**
  * Simulated CloudWatch metrics. Handles SDK commands. Emulates AWS behaviour
@@ -28,6 +29,14 @@ export declare class SimCloudWatch {
      * without going through a Command and its authorization.
      */
     allMetrics(): readonly SimCloudWatchMetric[];
+    /**
+     * How the rest of the simulation publishes the metrics AWS publishes.
+     *
+     * A simulated service counting its own work reaches the metric store through
+     * here rather than through `PutMetricData`, which refuses a reserved `AWS/`
+     * namespace exactly as an account does.
+     */
+    serviceWriter(): SimCloudWatchServiceWriter;
     /**
      * Every alarm in this scope, in the order each was created.
      *

package/dist/service/cloudwatch/sim-cloudwatch.js

@@ -31,6 +31,16 @@ export class SimCloudWatch {
     allMetrics() {
         return this.#commands.metrics.all;
     }
+    /**
+     * How the rest of the simulation publishes the metrics AWS publishes.
+     *
+     * A simulated service counting its own work reaches the metric store through
+     * here rather than through `PutMetricData`, which refuses a reserved `AWS/`
+     * namespace exactly as an account does.
+     */
+    serviceWriter() {
+        return this.#commands.serviceWriter;
+    }
     /**
      * Every alarm in this scope, in the order each was created.
      *

package/dist/service/cloudwatch/write/sim-cloudwatch-service-writer.d.ts

@@ -0,0 +1,58 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import { type SimCloudWatchDimensionInput } from "../metric/sim-cloudwatch-dimension.js";
+import type { SimCloudWatchMetricStore } from "../metric/sim-cloudwatch-metric-store.js";
+import type { SimCloudWatchUnit } from "../metric/sim-cloudwatch-unit.js";
+/**
+ * One observation of a metric AWS publishes.
+ *
+ * The dimensions are written the way an SDK command writes them, with a
+ * capital `Name` and `Value`, because a test seeding a datapoint reaches for
+ * the same shape it passes to `PutMetricData` and `PutMetricAlarm`.
+ */
+export interface SimCloudWatchServiceDatum {
+    readonly namespace: string;
+    readonly metricName: string;
+    readonly dimensions: readonly SimCloudWatchDimensionInput[];
+    readonly value: number;
+    readonly unit?: SimCloudWatchUnit | undefined;
+    /**
+     * When the observation was made. The simulation's clock stamps one that
+     * arrives without it.
+     */
+    readonly timestamp?: number | undefined;
+}
+interface SimCloudWatchServiceWriterProperties {
+    readonly metrics: SimCloudWatchMetricStore;
+    readonly clock: SimClock;
+}
+/**
+ * How a metric AWS publishes reaches the store.
+ *
+ * This is not the CloudWatch API. A simulated service counting its own work is
+ * the account's own machinery rather than a caller making a request, so
+ * nothing here authorizes one. Real CloudWatch does not put Lambda's own
+ * `Invocations` through `PutMetricData` either.
+ *
+ * The reserved namespace rule is the point of the separation. `PutMetricData`
+ * refuses a namespace beginning `AWS/`, exactly as an account does, and the
+ * services whose metrics those are reach the store through here instead.
+ *
+ * A test reaches it too, through `cloudWatch().serviceWriter()`, to stand up a
+ * datapoint for a metric nothing in the simulation publishes. That is how an
+ * alarm on one is driven to a state change.
+ */
+export declare class SimCloudWatchServiceWriter {
+    #private;
+    constructor(properties: SimCloudWatchServiceWriterProperties);
+    /**
+     * Record one observation of each metric given.
+     *
+     * A whole batch goes in together so one invocation's metrics land at the
+     * same instant, whatever the clock does next.
+     *
+     * Dimensions are read the way a command reads them, which is what keys a
+     * seeded datapoint to the same metric a query and an alarm look for.
+     */
+    publish(data: readonly SimCloudWatchServiceDatum[]): void;
+}
+export {};

package/dist/service/cloudwatch/write/sim-cloudwatch-service-writer.js

@@ -0,0 +1,53 @@
+import { requiredSimCloudWatchDimensions, } from "../metric/sim-cloudwatch-dimension.js";
+/**
+ * How a metric AWS publishes reaches the store.
+ *
+ * This is not the CloudWatch API. A simulated service counting its own work is
+ * the account's own machinery rather than a caller making a request, so
+ * nothing here authorizes one. Real CloudWatch does not put Lambda's own
+ * `Invocations` through `PutMetricData` either.
+ *
+ * The reserved namespace rule is the point of the separation. `PutMetricData`
+ * refuses a namespace beginning `AWS/`, exactly as an account does, and the
+ * services whose metrics those are reach the store through here instead.
+ *
+ * A test reaches it too, through `cloudWatch().serviceWriter()`, to stand up a
+ * datapoint for a metric nothing in the simulation publishes. That is how an
+ * alarm on one is driven to a state change.
+ */
+export class SimCloudWatchServiceWriter {
+    #metrics;
+    #clock;
+    constructor(properties) {
+        this.#metrics = properties.metrics;
+        this.#clock = properties.clock;
+    }
+    /**
+     * Record one observation of each metric given.
+     *
+     * A whole batch goes in together so one invocation's metrics land at the
+     * same instant, whatever the clock does next.
+     *
+     * Dimensions are read the way a command reads them, which is what keys a
+     * seeded datapoint to the same metric a query and an alarm look for.
+     */
+    publish(data) {
+        const now = this.#clock.now().getTime();
+        for (const datum of data) {
+            this.#metrics
+                .ensure({
+                namespace: datum.namespace,
+                metricName: datum.metricName,
+                dimensions: requiredSimCloudWatchDimensions(datum.dimensions),
+            })
+                .record({
+                timestamp: datum.timestamp ?? now,
+                sampleCount: 1,
+                sum: datum.value,
+                minimum: datum.value,
+                maximum: datum.value,
+                unit: datum.unit,
+            });
+        }
+    }
+}

package/dist/service/cognito/command/auth/sim-cognito-admin-respond-to-challenge.d.ts

@@ -1,8 +1,10 @@
 import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
 import type { SimCognitoChallengeResponses } from "./sim-cognito-challenge-responses.js";
 import type { SimAdminRespondToAuthChallengeCommand, SimAdminRespondToAuthChallengeCommandOutput } from "./auth.command.js";
 interface SimCognitoAdminRespondToChallengeProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly authResolver: SimCognitoAuthResolver;
     readonly responses: SimCognitoChallengeResponses;
 }
@@ -17,6 +19,7 @@ interface SimCognitoCommandOptions {
  * pool.
  */
 export declare class SimCognitoAdminRespondToChallenge {
+    private readonly poolMetrics;
     private readonly authResolver;
     private readonly responses;
     private readonly unsimulatedOptions;

package/dist/service/cognito/command/auth/sim-cognito-admin-respond-to-challenge.js

@@ -1,3 +1,4 @@
+import { countedSimCognitoAuth } from "../../metric/sim-cognito-counted-request.js";
 import { SimCognitoAuthParameters } from "./sim-cognito-auth-parameters.js";
 import { SimCognitoUnsimulatedAuthOptions } from "./sim-cognito-unsimulated-auth-options.js";
 /**
@@ -8,10 +9,12 @@ import { SimCognitoUnsimulatedAuthOptions } from "./sim-cognito-unsimulated-auth
  * pool.
  */
 export class SimCognitoAdminRespondToChallenge {
+    poolMetrics;
     authResolver;
     responses;
     unsimulatedOptions = new SimCognitoUnsimulatedAuthOptions();
     constructor(properties) {
+        this.poolMetrics = properties.poolMetrics;
         this.authResolver = properties.authResolver;
         this.responses = properties.responses;
     }
@@ -22,12 +25,15 @@ export class SimCognitoAdminRespondToChallenge {
         const { input } = command;
         const { pool, client } = this.authResolver.poolClient("cognito-idp:AdminRespondToAuthChallenge", input, options);
         this.unsimulatedOptions.refuseInAdminResponse(input);
-        return await this.responses.handle(input.ChallengeName, {
+        // Counted here rather than in the shared responder, so that a response
+        // counts as the one request it is, the way `RespondToAuthChallenge`
+        // counts its own.
+        return await countedSimCognitoAuth(this.poolMetrics, "SignIn", { pool, client }, async () => await this.responses.handle(input.ChallengeName, {
             pool,
             client,
             parameters: new SimCognitoAuthParameters("ChallengeResponses", input.ChallengeResponses),
             session: input.Session,
             clientMetadata: input.ClientMetadata,
-        });
+        }));
     }
 }

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.d.ts

@@ -6,6 +6,7 @@ import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cog
 import type { SimCognitoRequestResolver } from "../sim-cognito-request-resolver.js";
 import { SimCognitoAdminInitiateAuth } from "./sim-cognito-admin-initiate-auth.js";
 import { SimCognitoAdminRespondToChallenge } from "./sim-cognito-admin-respond-to-challenge.js";
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import { SimCognitoGetTokensFromRefreshToken } from "./sim-cognito-get-tokens-from-refresh-token.js";
 import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
 import type { SimCognitoFirstFactorChallenge } from "./sim-cognito-first-factor-challenge.js";
@@ -34,6 +35,8 @@ interface SimCognitoAuthCommandsProperties {
      * a passkey presented at either answers the same kind of challenge.
      */
     readonly firstFactor: SimCognitoFirstFactorChallenge;
+    /** What counts this pool's requests into `AWS/Cognito`. */
+    readonly poolMetrics: SimCognitoPoolMetrics;
 }
 /**
  * The authentication command handlers of one simulated Cognito scope.

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.js

@@ -57,6 +57,7 @@ export class SimCognitoAuthCommands {
             triggers,
         });
         const flowRunner = new SimCognitoAuthFlowRunner({
+            poolMetrics: properties.poolMetrics,
             passwordSignIn,
             refreshSignIn: new SimCognitoRefreshSignIn({ refreshedTokens, clock }),
             userAuthSignIn: new SimCognitoUserAuthSignIn({
@@ -86,6 +87,7 @@ export class SimCognitoAuthCommands {
             flowRunner,
         });
         this.adminRespondToChallenge = new SimCognitoAdminRespondToChallenge({
+            poolMetrics: properties.poolMetrics,
             authResolver,
             responses,
         });
@@ -94,10 +96,12 @@ export class SimCognitoAuthCommands {
             flowRunner,
         });
         this.respondToChallenge = new SimCognitoRespondToChallenge({
+            poolMetrics: properties.poolMetrics,
             authResolver,
             responses,
         });
         this.getTokensFromRefreshToken = new SimCognitoGetTokensFromRefreshToken({
+            poolMetrics: properties.poolMetrics,
             authResolver,
             refreshedTokens,
             clock,

package/dist/service/cognito/command/auth/sim-cognito-auth-flow-runner.d.ts

@@ -1,9 +1,11 @@
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimCognitoAuthFlow } from "./sim-cognito-auth-flow.js";
 import type { SimCognitoPasswordSignIn, SimCognitoAuthRequest } from "./sim-cognito-password-sign-in.js";
 import type { SimCognitoRefreshSignIn } from "./sim-cognito-refresh-sign-in.js";
 import type { SimCognitoUserAuthSignIn } from "./sim-cognito-user-auth-sign-in.js";
 import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
 interface SimCognitoAuthFlowRunnerProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly passwordSignIn: SimCognitoPasswordSignIn;
     readonly refreshSignIn: SimCognitoRefreshSignIn;
     readonly userAuthSignIn: SimCognitoUserAuthSignIn;
@@ -21,13 +23,21 @@ interface SimCognitoAuthFlowRunnerProperties {
  * issues tokens.
  */
 export declare class SimCognitoAuthFlowRunner {
+    private readonly poolMetrics;
     private readonly passwordSignIn;
     private readonly refreshSignIn;
     private readonly userAuthSignIn;
     constructor(properties: SimCognitoAuthFlowRunnerProperties);
     /**
-     * Run a flow the app client is configured for.
+     * Run a flow the app client is configured for, and count the request.
+     *
+     * Real Cognito keeps a token refresh out of `SignInSuccesses` and counts it
+     * under `TokenRefreshSuccesses` instead, so which metric a request lands in
+     * follows the flow it ran. A request answered with a challenge issued no
+     * tokens and counts as a 0, and so does one the pool refused outright. The
+     * response that finishes a challenged sign-in is counted where it completes.
      */
     run(flow: SimCognitoAuthFlow, request: SimCognitoAuthRequest): Promise<SimCognitoAuthenticationOutput>;
+    private ran;
 }
 export {};

package/dist/service/cognito/command/auth/sim-cognito-auth-flow-runner.js

@@ -1,3 +1,4 @@
+import { countedSimCognitoAuth } from "../../metric/sim-cognito-counted-request.js";
 /**
  * Runs whichever flow a request resolved to.
  *
@@ -11,18 +12,29 @@
  * issues tokens.
  */
 export class SimCognitoAuthFlowRunner {
+    poolMetrics;
     passwordSignIn;
     refreshSignIn;
     userAuthSignIn;
     constructor(properties) {
+        this.poolMetrics = properties.poolMetrics;
         this.passwordSignIn = properties.passwordSignIn;
         this.refreshSignIn = properties.refreshSignIn;
         this.userAuthSignIn = properties.userAuthSignIn;
     }
     /**
-     * Run a flow the app client is configured for.
+     * Run a flow the app client is configured for, and count the request.
+     *
+     * Real Cognito keeps a token refresh out of `SignInSuccesses` and counts it
+     * under `TokenRefreshSuccesses` instead, so which metric a request lands in
+     * follows the flow it ran. A request answered with a challenge issued no
+     * tokens and counts as a 0, and so does one the pool refused outright. The
+     * response that finishes a challenged sign-in is counted where it completes.
      */
     async run(flow, request) {
+        return await countedSimCognitoAuth(this.poolMetrics, flow.exchangesRefreshToken ? "TokenRefresh" : "SignIn", request, async () => await this.ran(flow, request));
+    }
+    async ran(flow, request) {
         if (flow.exchangesRefreshToken) {
             return await this.refreshSignIn.handle(request);
         }

package/dist/service/cognito/command/auth/sim-cognito-auth-resolver.d.ts

@@ -1,11 +1,13 @@
 import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoClientInPool, SimCognitoUserPoolStore } from "../../user-pool/sim-cognito-user-pool-store.js";
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimCognitoRequestResolver } from "../sim-cognito-request-resolver.js";
 import type { SimCognitoAuthParameters } from "./sim-cognito-auth-parameters.js";
 interface SimCognitoAuthResolverProperties {
     readonly resolver: SimCognitoRequestResolver;
     readonly pools: SimCognitoUserPoolStore;
+    readonly poolMetrics: SimCognitoPoolMetrics;
 }
 interface SimCognitoCommandOptions {
     readonly caller?: SimAwsCaller;
@@ -29,6 +31,7 @@ export type SimCognitoAuthenticatingClient = SimCognitoClientInPool;
 export declare class SimCognitoAuthResolver {
     private readonly resolver;
     private readonly pools;
+    private readonly poolMetrics;
     constructor(properties: SimCognitoAuthResolverProperties);
     /**
      * Resolve the pool and app client an admin request names, once the caller

package/dist/service/cognito/command/auth/sim-cognito-auth-resolver.js

@@ -1,5 +1,6 @@
 import { requireSimCognitoSecretHash } from "../../user-pool/auth/sim-cognito-secret-hash.js";
 import { requireSimCognitoUserPoolClientId } from "../../user-pool/client/sim-cognito-user-pool-client-id.js";
+import { simCognitoInvalidClientDimension } from "../../metric/sim-cognito-metrics.js";
 /**
  * Resolves what an authentication request names before the flow itself runs.
  *
@@ -10,9 +11,11 @@ import { requireSimCognitoUserPoolClientId } from "../../user-pool/client/sim-co
 export class SimCognitoAuthResolver {
     resolver;
     pools;
+    poolMetrics;
     constructor(properties) {
         this.resolver = properties.resolver;
         this.pools = properties.pools;
+        this.poolMetrics = properties.poolMetrics;
     }
     /**
      * Resolve the pool and app client an admin request names, once the caller
@@ -23,10 +26,19 @@ export class SimCognitoAuthResolver {
      */
     poolClient(action, input, options) {
         const pool = this.resolver.pool(action, input.UserPoolId, options);
-        return {
-            pool,
-            client: pool.requireClient(requireSimCognitoUserPoolClientId(input.ClientId)),
-        };
+        try {
+            return {
+                pool,
+                client: pool.requireClient(requireSimCognitoUserPoolClientId(input.ClientId)),
+            };
+        }
+        catch (error) {
+            // Real Cognito counts a request naming an app client the pool has none
+            // of, reporting a fixed name in the client's place rather than the id
+            // the request gave. The request still fails.
+            this.poolMetrics.count("SignIn", pool.id, simCognitoInvalidClientDimension, false);
+            throw error;
+        }
     }
     /**
      * Resolve the pool and app client a client-side request names, which is by

package/dist/service/cognito/command/auth/sim-cognito-get-tokens-from-refresh-token.d.ts

@@ -1,8 +1,10 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
 import type { SimCognitoRefreshedTokens } from "./sim-cognito-refreshed-tokens.js";
 import type { SimGetTokensFromRefreshTokenCommand, SimGetTokensFromRefreshTokenCommandOutput } from "./auth.command.js";
 interface SimCognitoGetTokensFromRefreshTokenProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly authResolver: SimCognitoAuthResolver;
     readonly refreshedTokens: SimCognitoRefreshedTokens;
     readonly clock: SimClock;
@@ -21,6 +23,7 @@ interface SimCognitoGetTokensFromRefreshTokenProperties {
  * than a hash computed over a username it does not have.
  */
 export declare class SimCognitoGetTokensFromRefreshToken {
+    private readonly poolMetrics;
     private readonly authResolver;
     private readonly refreshedTokens;
     private readonly clock;
@@ -28,7 +31,11 @@ export declare class SimCognitoGetTokensFromRefreshToken {
     constructor(properties: SimCognitoGetTokensFromRefreshTokenProperties);
     /**
      * Renew a session from the refresh token it holds.
+     *
+     * Real Cognito counts this under `TokenRefreshSuccesses`, the same metric an
+     * `InitiateAuth` running `REFRESH_TOKEN_AUTH` lands in.
      */
     handle(command: SimGetTokensFromRefreshTokenCommand): Promise<SimGetTokensFromRefreshTokenCommandOutput>;
+    private renewed;
 }
 export {};

package/dist/service/cognito/command/auth/sim-cognito-get-tokens-from-refresh-token.js

@@ -1,5 +1,6 @@
 import { requireSimCognitoRefreshTokenInput } from "../../user-pool/auth/sim-cognito-refresh-token-input.js";
 import { requireSimCognitoClientSecret } from "../../user-pool/client/sim-cognito-client-secret.js";
+import { countedSimCognitoAuth } from "../../metric/sim-cognito-counted-request.js";
 import { SimCognitoUnsimulatedInput } from "../sim-cognito-unsimulated-input.js";
 /**
  * The GetTokensFromRefreshToken command.
@@ -15,21 +16,30 @@ import { SimCognitoUnsimulatedInput } from "../sim-cognito-unsimulated-input.js"
  * than a hash computed over a username it does not have.
  */
 export class SimCognitoGetTokensFromRefreshToken {
+    poolMetrics;
     authResolver;
     refreshedTokens;
     clock;
     unsimulated = new SimCognitoUnsimulatedInput("GetTokensFromRefreshToken");
     constructor(properties) {
+        this.poolMetrics = properties.poolMetrics;
         this.authResolver = properties.authResolver;
         this.refreshedTokens = properties.refreshedTokens;
         this.clock = properties.clock;
     }
     /**
      * Renew a session from the refresh token it holds.
+     *
+     * Real Cognito counts this under `TokenRefreshSuccesses`, the same metric an
+     * `InitiateAuth` running `REFRESH_TOKEN_AUTH` lands in.
      */
     async handle(command) {
         const { input } = command;
-        const { pool, client } = this.authResolver.client(input.ClientId);
+        const scope = this.authResolver.client(input.ClientId);
+        return await countedSimCognitoAuth(this.poolMetrics, "TokenRefresh", scope, async () => await this.renewed(command, scope));
+    }
+    async renewed(command, { pool, client }) {
+        const { input } = command;
         this.unsimulated.refuse("DeviceKey", input.DeviceKey, "device remembering, which signs a known device in without its second factor");
         requireSimCognitoClientSecret(client, input.ClientSecret);
         const refreshToken = pool.auth.requireRefreshToken({