@aws-amplify/auth 6.7.1-unstable.ab33a03.0 → 6.8.0

package/dist/esm/client/flows/userAuth/handleSelectChallengeWithPasswordSRP.mjs

@@ -0,0 +1,81 @@
+import { AuthAction } from '@aws-amplify/core/internals/utils';
+import '@aws-amplify/core/internals/aws-client-utils/composers';
+import '@aws-amplify/core/internals/aws-client-utils';
+import '../../../foundation/factories/serviceClients/cognitoIdentityProvider/shared/handler/cognitoUserPoolTransferHandler.mjs';
+import '../../../foundation/factories/serviceClients/cognitoIdentityProvider/constants.mjs';
+import '../../../common/AuthErrorStrings.mjs';
+import '../../../errors/types/validation.mjs';
+import '../../../providers/cognito/types/errors.mjs';
+import { createRespondToAuthChallengeClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider/createRespondToAuthChallengeClient.mjs';
+import { createCognitoUserPoolEndpointResolver } from '../../../providers/cognito/factories/createCognitoUserPoolEndpointResolver.mjs';
+import { getRegionFromUserPoolId } from '../../../foundation/parsers/regionParsers.mjs';
+import { getAuthUserAgentValue } from '../../../utils/getAuthUserAgentValue.mjs';
+import { getAuthenticationHelper } from '../../../providers/cognito/utils/srp/getAuthenticationHelper.mjs';
+import '../../../providers/cognito/utils/srp/constants.mjs';
+import '@aws-crypto/sha256-js';
+import { getUserContextData } from '../../../providers/cognito/utils/userContextData.mjs';
+import { setActiveSignInUsername, retryOnResourceNotFoundException, handlePasswordVerifierChallenge } from '../../../providers/cognito/utils/signInHelpers.mjs';
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Handles the SELECT_CHALLENGE response specifically for Password SRP authentication.
+ * This function combines the SELECT_CHALLENGE flow with Password SRP protocol.
+ *
+ * @param {string} username - The username for authentication
+ * @param {string} password - The user's password
+ * @param {ClientMetadata} [clientMetadata] - Optional metadata to be sent with auth requests
+ * @param {CognitoUserPoolConfig} config - Cognito User Pool configuration
+ * @param {string} session - The current authentication session token
+ * @param {AuthTokenOrchestrator} tokenOrchestrator - Token orchestrator for managing auth tokens
+ *
+ * @returns {Promise<RespondToAuthChallengeCommandOutput>} The challenge response
+ */
+async function handleSelectChallengeWithPasswordSRP(username, password, clientMetadata, config, session, tokenOrchestrator) {
+    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+    const userPoolName = userPoolId.split('_')[1] || '';
+    const authenticationHelper = await getAuthenticationHelper(userPoolName);
+    const authParameters = {
+        ANSWER: 'PASSWORD_SRP',
+        USERNAME: username,
+        SRP_A: authenticationHelper.A.toString(16),
+    };
+    const userContextData = getUserContextData({
+        username,
+        userPoolId,
+        userPoolClientId,
+    });
+    const respondToAuthChallenge = createRespondToAuthChallengeClient({
+        endpointResolver: createCognitoUserPoolEndpointResolver({
+            endpointOverride: userPoolEndpoint,
+        }),
+    });
+    const response = await respondToAuthChallenge({
+        region: getRegionFromUserPoolId(userPoolId),
+        userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+    }, {
+        ChallengeName: 'SELECT_CHALLENGE',
+        ChallengeResponses: authParameters,
+        ClientId: userPoolClientId,
+        ClientMetadata: clientMetadata,
+        Session: session,
+        UserContextData: userContextData,
+    });
+    const activeUsername = response.ChallengeParameters?.USERNAME ?? username;
+    setActiveSignInUsername(activeUsername);
+    if (response.ChallengeName === 'PASSWORD_VERIFIER') {
+        return retryOnResourceNotFoundException(handlePasswordVerifierChallenge, [
+            password,
+            response.ChallengeParameters,
+            clientMetadata,
+            response.Session,
+            authenticationHelper,
+            config,
+            tokenOrchestrator,
+        ], activeUsername, tokenOrchestrator);
+    }
+    return response;
+}
+
+export { handleSelectChallengeWithPasswordSRP };
+//# sourceMappingURL=handleSelectChallengeWithPasswordSRP.mjs.map

package/dist/esm/client/flows/userAuth/handleSelectChallengeWithPasswordSRP.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleSelectChallengeWithPasswordSRP.mjs","sources":["../../../../../src/client/flows/userAuth/handleSelectChallengeWithPasswordSRP.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { AuthAction } from '@aws-amplify/core/internals/utils';\nimport { createRespondToAuthChallengeClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';\nimport { createCognitoUserPoolEndpointResolver } from '../../../providers/cognito/factories';\nimport { getRegionFromUserPoolId } from '../../../foundation/parsers';\nimport { getAuthUserAgentValue } from '../../../utils';\nimport { getAuthenticationHelper } from '../../../providers/cognito/utils/srp';\nimport { getUserContextData } from '../../../providers/cognito/utils/userContextData';\nimport { handlePasswordVerifierChallenge, retryOnResourceNotFoundException, setActiveSignInUsername, } from '../../../providers/cognito/utils/signInHelpers';\n/**\n * Handles the SELECT_CHALLENGE response specifically for Password SRP authentication.\n * This function combines the SELECT_CHALLENGE flow with Password SRP protocol.\n *\n * @param {string} username - The username for authentication\n * @param {string} password - The user's password\n * @param {ClientMetadata} [clientMetadata] - Optional metadata to be sent with auth requests\n * @param {CognitoUserPoolConfig} config - Cognito User Pool configuration\n * @param {string} session - The current authentication session token\n * @param {AuthTokenOrchestrator} tokenOrchestrator - Token orchestrator for managing auth tokens\n *\n * @returns {Promise<RespondToAuthChallengeCommandOutput>} The challenge response\n */\nexport async function handleSelectChallengeWithPasswordSRP(username, password, clientMetadata, config, session, tokenOrchestrator) {\n    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;\n    const userPoolName = userPoolId.split('_')[1] || '';\n    const authenticationHelper = await getAuthenticationHelper(userPoolName);\n    const authParameters = {\n        ANSWER: 'PASSWORD_SRP',\n        USERNAME: username,\n        SRP_A: authenticationHelper.A.toString(16),\n    };\n    const userContextData = getUserContextData({\n        username,\n        userPoolId,\n        userPoolClientId,\n    });\n    const respondToAuthChallenge = createRespondToAuthChallengeClient({\n        endpointResolver: createCognitoUserPoolEndpointResolver({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const response = await respondToAuthChallenge({\n        region: getRegionFromUserPoolId(userPoolId),\n        userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),\n    }, {\n        ChallengeName: 'SELECT_CHALLENGE',\n        ChallengeResponses: authParameters,\n        ClientId: userPoolClientId,\n        ClientMetadata: clientMetadata,\n        Session: session,\n        UserContextData: userContextData,\n    });\n    const activeUsername = response.ChallengeParameters?.USERNAME ?? username;\n    setActiveSignInUsername(activeUsername);\n    if (response.ChallengeName === 'PASSWORD_VERIFIER') {\n        return retryOnResourceNotFoundException(handlePasswordVerifierChallenge, [\n            password,\n            response.ChallengeParameters,\n            clientMetadata,\n            response.Session,\n            authenticationHelper,\n            config,\n            tokenOrchestrator,\n        ], activeUsername, tokenOrchestrator);\n    }\n    return response;\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AACA;AASA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,oCAAoC,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE;AACnI,IAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;AACtE,IAAI,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxD,IAAI,MAAM,oBAAoB,GAAG,MAAM,uBAAuB,CAAC,YAAY,CAAC,CAAC;AAC7E,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,EAAE,cAAc;AAC9B,QAAQ,QAAQ,EAAE,QAAQ;AAC1B,QAAQ,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClD,KAAK,CAAC;AACN,IAAI,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAC/C,QAAQ,QAAQ;AAChB,QAAQ,UAAU;AAClB,QAAQ,gBAAgB;AACxB,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AACtE,QAAQ,gBAAgB,EAAE,qCAAqC,CAAC;AAChE,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC;AAClD,QAAQ,MAAM,EAAE,uBAAuB,CAAC,UAAU,CAAC;AACnD,QAAQ,cAAc,EAAE,qBAAqB,CAAC,UAAU,CAAC,aAAa,CAAC;AACvE,KAAK,EAAE;AACP,QAAQ,aAAa,EAAE,kBAAkB;AACzC,QAAQ,kBAAkB,EAAE,cAAc;AAC1C,QAAQ,QAAQ,EAAE,gBAAgB;AAClC,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,OAAO,EAAE,OAAO;AACxB,QAAQ,eAAe,EAAE,eAAe;AACxC,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,cAAc,GAAG,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,IAAI,QAAQ,CAAC;AAC9E,IAAI,uBAAuB,CAAC,cAAc,CAAC,CAAC;AAC5C,IAAI,IAAI,QAAQ,CAAC,aAAa,KAAK,mBAAmB,EAAE;AACxD,QAAQ,OAAO,gCAAgC,CAAC,+BAA+B,EAAE;AACjF,YAAY,QAAQ;AACpB,YAAY,QAAQ,CAAC,mBAAmB;AACxC,YAAY,cAAc;AAC1B,YAAY,QAAQ,CAAC,OAAO;AAC5B,YAAY,oBAAoB;AAChC,YAAY,MAAM;AAClB,YAAY,iBAAiB;AAC7B,SAAS,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;AAC9C,KAAK;AACL,IAAI,OAAO,QAAQ,CAAC;AACpB;;;;"}

package/dist/esm/client/flows/userAuth/handleUserAuthFlow.d.ts

@@ -0,0 +1,27 @@
+import { CognitoUserPoolConfig } from '@aws-amplify/core';
+import { AuthTokenOrchestrator } from '../../../providers/cognito/tokenProvider/types';
+import { AuthFactorType } from '../../../providers/cognito/types/models';
+export interface HandleUserAuthFlowInput {
+    username: string;
+    config: CognitoUserPoolConfig;
+    tokenOrchestrator: AuthTokenOrchestrator;
+    clientMetadata?: Record<string, string>;
+    preferredChallenge?: AuthFactorType;
+    password?: string;
+    session?: string;
+}
+/**
+ * Handles user authentication flow with configurable challenge preferences.
+ * Supports AuthFactorType challenges through the USER_AUTH flow.
+ *
+ * @param {HandleUserAuthFlowInput} params - Authentication flow parameters
+ * @param {string} params.username - The username for authentication
+ * @param {Record<string, string>} [params.clientMetadata] - Optional metadata to pass to authentication service
+ * @param {CognitoUserPoolConfig} params.config - Cognito User Pool configuration
+ * @param {AuthTokenOrchestrator} params.tokenOrchestrator - Manages authentication tokens and device tracking
+ * @param {AuthFactorType} [params.preferredChallenge] - Optional preferred authentication method
+ * @param {string} [params.password] - Required when preferredChallenge is 'PASSWORD' or 'PASSWORD_SRP'
+ *
+ * @returns {Promise<InitiateAuthCommandOutput>} The authentication response from Cognito
+ */
+export declare function handleUserAuthFlow({ username, clientMetadata, config, tokenOrchestrator, preferredChallenge, password, session, }: HandleUserAuthFlowInput): Promise<import("../../../foundation/factories/serviceClients/cognitoIdentityProvider/types").RespondToAuthChallengeCommandOutput>;

package/dist/esm/client/flows/userAuth/handleUserAuthFlow.mjs

@@ -0,0 +1,88 @@
+import { AuthAction } from '@aws-amplify/core/internals/utils';
+import { getUserContextData } from '../../../providers/cognito/utils/userContextData.mjs';
+import { createInitiateAuthClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider/createInitiateAuthClient.mjs';
+import '@aws-amplify/core/internals/aws-client-utils/composers';
+import '../../../foundation/factories/serviceClients/cognitoIdentityProvider/shared/handler/cognitoUserPoolTransferHandler.mjs';
+import '@aws-amplify/core/internals/aws-client-utils';
+import '../../../foundation/factories/serviceClients/cognitoIdentityProvider/constants.mjs';
+import '../../../common/AuthErrorStrings.mjs';
+import { AuthValidationErrorCode } from '../../../errors/types/validation.mjs';
+import '../../../providers/cognito/types/errors.mjs';
+import { createCognitoUserPoolEndpointResolver } from '../../../providers/cognito/factories/createCognitoUserPoolEndpointResolver.mjs';
+import { getRegionFromUserPoolId } from '../../../foundation/parsers/regionParsers.mjs';
+import { getAuthUserAgentValue } from '../../../utils/getAuthUserAgentValue.mjs';
+import { handlePasswordSRP } from '../shared/handlePasswordSRP.mjs';
+import { assertValidationError } from '../../../errors/utils/assertValidationError.mjs';
+import { setActiveSignInUsername } from '../../../providers/cognito/utils/signInHelpers.mjs';
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Handles user authentication flow with configurable challenge preferences.
+ * Supports AuthFactorType challenges through the USER_AUTH flow.
+ *
+ * @param {HandleUserAuthFlowInput} params - Authentication flow parameters
+ * @param {string} params.username - The username for authentication
+ * @param {Record<string, string>} [params.clientMetadata] - Optional metadata to pass to authentication service
+ * @param {CognitoUserPoolConfig} params.config - Cognito User Pool configuration
+ * @param {AuthTokenOrchestrator} params.tokenOrchestrator - Manages authentication tokens and device tracking
+ * @param {AuthFactorType} [params.preferredChallenge] - Optional preferred authentication method
+ * @param {string} [params.password] - Required when preferredChallenge is 'PASSWORD' or 'PASSWORD_SRP'
+ *
+ * @returns {Promise<InitiateAuthCommandOutput>} The authentication response from Cognito
+ */
+async function handleUserAuthFlow({ username, clientMetadata, config, tokenOrchestrator, preferredChallenge, password, session, }) {
+    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;
+    const UserContextData = getUserContextData({
+        username,
+        userPoolId,
+        userPoolClientId,
+    });
+    const authParameters = { USERNAME: username };
+    if (preferredChallenge) {
+        if (preferredChallenge === 'PASSWORD_SRP') {
+            assertValidationError(!!password, AuthValidationErrorCode.EmptySignInPassword);
+            return handlePasswordSRP({
+                username,
+                password,
+                clientMetadata,
+                config,
+                tokenOrchestrator,
+                authFlow: 'USER_AUTH',
+                preferredChallenge,
+            });
+        }
+        if (preferredChallenge === 'PASSWORD') {
+            assertValidationError(!!password, AuthValidationErrorCode.EmptySignInPassword);
+            authParameters.PASSWORD = password;
+        }
+        authParameters.PREFERRED_CHALLENGE = preferredChallenge;
+    }
+    const jsonReq = {
+        AuthFlow: 'USER_AUTH',
+        AuthParameters: authParameters,
+        ClientMetadata: clientMetadata,
+        ClientId: userPoolClientId,
+        UserContextData,
+    };
+    if (session) {
+        jsonReq.Session = session;
+    }
+    const initiateAuth = createInitiateAuthClient({
+        endpointResolver: createCognitoUserPoolEndpointResolver({
+            endpointOverride: userPoolEndpoint,
+        }),
+    });
+    const response = await initiateAuth({
+        region: getRegionFromUserPoolId(userPoolId),
+        userAgentValue: getAuthUserAgentValue(AuthAction.SignIn),
+    }, jsonReq);
+    // Set the active username immediately after successful authentication attempt
+    // If a user starts a new sign-in while another sign-in is incomplete,
+    // this ensures we're tracking the correct user for subsequent auth challenges.
+    setActiveSignInUsername(username);
+    return response;
+}
+
+export { handleUserAuthFlow };
+//# sourceMappingURL=handleUserAuthFlow.mjs.map

package/dist/esm/client/flows/userAuth/handleUserAuthFlow.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleUserAuthFlow.mjs","sources":["../../../../../src/client/flows/userAuth/handleUserAuthFlow.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { AuthAction } from '@aws-amplify/core/internals/utils';\nimport { getUserContextData } from '../../../providers/cognito/utils/userContextData';\nimport { createInitiateAuthClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';\nimport { createCognitoUserPoolEndpointResolver } from '../../../providers/cognito/factories';\nimport { getRegionFromUserPoolId } from '../../../foundation/parsers';\nimport { getAuthUserAgentValue } from '../../../utils';\nimport { handlePasswordSRP } from '../shared/handlePasswordSRP';\nimport { assertValidationError } from '../../../errors/utils/assertValidationError';\nimport { AuthValidationErrorCode } from '../../../errors/types/validation';\nimport { setActiveSignInUsername } from '../../../providers/cognito/utils/signInHelpers';\n/**\n * Handles user authentication flow with configurable challenge preferences.\n * Supports AuthFactorType challenges through the USER_AUTH flow.\n *\n * @param {HandleUserAuthFlowInput} params - Authentication flow parameters\n * @param {string} params.username - The username for authentication\n * @param {Record<string, string>} [params.clientMetadata] - Optional metadata to pass to authentication service\n * @param {CognitoUserPoolConfig} params.config - Cognito User Pool configuration\n * @param {AuthTokenOrchestrator} params.tokenOrchestrator - Manages authentication tokens and device tracking\n * @param {AuthFactorType} [params.preferredChallenge] - Optional preferred authentication method\n * @param {string} [params.password] - Required when preferredChallenge is 'PASSWORD' or 'PASSWORD_SRP'\n *\n * @returns {Promise<InitiateAuthCommandOutput>} The authentication response from Cognito\n */\nexport async function handleUserAuthFlow({ username, clientMetadata, config, tokenOrchestrator, preferredChallenge, password, session, }) {\n    const { userPoolId, userPoolClientId, userPoolEndpoint } = config;\n    const UserContextData = getUserContextData({\n        username,\n        userPoolId,\n        userPoolClientId,\n    });\n    const authParameters = { USERNAME: username };\n    if (preferredChallenge) {\n        if (preferredChallenge === 'PASSWORD_SRP') {\n            assertValidationError(!!password, AuthValidationErrorCode.EmptySignInPassword);\n            return handlePasswordSRP({\n                username,\n                password,\n                clientMetadata,\n                config,\n                tokenOrchestrator,\n                authFlow: 'USER_AUTH',\n                preferredChallenge,\n            });\n        }\n        if (preferredChallenge === 'PASSWORD') {\n            assertValidationError(!!password, AuthValidationErrorCode.EmptySignInPassword);\n            authParameters.PASSWORD = password;\n        }\n        authParameters.PREFERRED_CHALLENGE = preferredChallenge;\n    }\n    const jsonReq = {\n        AuthFlow: 'USER_AUTH',\n        AuthParameters: authParameters,\n        ClientMetadata: clientMetadata,\n        ClientId: userPoolClientId,\n        UserContextData,\n    };\n    if (session) {\n        jsonReq.Session = session;\n    }\n    const initiateAuth = createInitiateAuthClient({\n        endpointResolver: createCognitoUserPoolEndpointResolver({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const response = await initiateAuth({\n        region: getRegionFromUserPoolId(userPoolId),\n        userAgentValue: getAuthUserAgentValue(AuthAction.SignIn),\n    }, jsonReq);\n    // Set the active username immediately after successful authentication attempt\n    // If a user starts a new sign-in while another sign-in is incomplete,\n    // this ensures we're tracking the correct user for subsequent auth challenges.\n    setActiveSignInUsername(username);\n    return response;\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;AACA;AAWA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,kBAAkB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,GAAG,EAAE;AAC1I,IAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;AACtE,IAAI,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAC/C,QAAQ,QAAQ;AAChB,QAAQ,UAAU;AAClB,QAAQ,gBAAgB;AACxB,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,cAAc,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAClD,IAAI,IAAI,kBAAkB,EAAE;AAC5B,QAAQ,IAAI,kBAAkB,KAAK,cAAc,EAAE;AACnD,YAAY,qBAAqB,CAAC,CAAC,CAAC,QAAQ,EAAE,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;AAC3F,YAAY,OAAO,iBAAiB,CAAC;AACrC,gBAAgB,QAAQ;AACxB,gBAAgB,QAAQ;AACxB,gBAAgB,cAAc;AAC9B,gBAAgB,MAAM;AACtB,gBAAgB,iBAAiB;AACjC,gBAAgB,QAAQ,EAAE,WAAW;AACrC,gBAAgB,kBAAkB;AAClC,aAAa,CAAC,CAAC;AACf,SAAS;AACT,QAAQ,IAAI,kBAAkB,KAAK,UAAU,EAAE;AAC/C,YAAY,qBAAqB,CAAC,CAAC,CAAC,QAAQ,EAAE,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;AAC3F,YAAY,cAAc,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAC/C,SAAS;AACT,QAAQ,cAAc,CAAC,mBAAmB,GAAG,kBAAkB,CAAC;AAChE,KAAK;AACL,IAAI,MAAM,OAAO,GAAG;AACpB,QAAQ,QAAQ,EAAE,WAAW;AAC7B,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,cAAc,EAAE,cAAc;AACtC,QAAQ,QAAQ,EAAE,gBAAgB;AAClC,QAAQ,eAAe;AACvB,KAAK,CAAC;AACN,IAAI,IAAI,OAAO,EAAE;AACjB,QAAQ,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;AAClC,KAAK;AACL,IAAI,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAClD,QAAQ,gBAAgB,EAAE,qCAAqC,CAAC;AAChE,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC;AACxC,QAAQ,MAAM,EAAE,uBAAuB,CAAC,UAAU,CAAC;AACnD,QAAQ,cAAc,EAAE,qBAAqB,CAAC,UAAU,CAAC,MAAM,CAAC;AAChE,KAAK,EAAE,OAAO,CAAC,CAAC;AAChB;AACA;AACA;AACA,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AACtC,IAAI,OAAO,QAAQ,CAAC;AACpB;;;;"}

package/dist/esm/client/flows/userAuth/handleWebAuthnSignInResult.d.ts

@@ -0,0 +1,3 @@
+import { ChallengeParameters } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider/types';
+import { AuthSignInOutput } from '../../../types';
+export declare function handleWebAuthnSignInResult(challengeParameters: ChallengeParameters): Promise<AuthSignInOutput>;

package/dist/esm/client/flows/userAuth/handleWebAuthnSignInResult.mjs

@@ -0,0 +1,93 @@
+import { Amplify } from '@aws-amplify/core';
+import { assertTokenProviderConfig, AuthAction } from '@aws-amplify/core/internals/utils';
+import { AuthErrorCodes } from '../../../common/AuthErrorStrings.mjs';
+import '@aws-amplify/core/internals/aws-client-utils/composers';
+import '@aws-amplify/core/internals/aws-client-utils';
+import { AuthError } from '../../../errors/AuthError.mjs';
+import '../../../foundation/factories/serviceClients/cognitoIdentityProvider/shared/handler/cognitoUserPoolTransferHandler.mjs';
+import '../../../foundation/factories/serviceClients/cognitoIdentityProvider/constants.mjs';
+import '../../../errors/types/validation.mjs';
+import '../../../providers/cognito/types/errors.mjs';
+import { createRespondToAuthChallengeClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider/createRespondToAuthChallengeClient.mjs';
+import { getRegionFromUserPoolId } from '../../../foundation/parsers/regionParsers.mjs';
+import { createCognitoUserPoolEndpointResolver } from '../../../providers/cognito/factories/createCognitoUserPoolEndpointResolver.mjs';
+import { cacheCognitoTokens } from '../../../providers/cognito/tokenProvider/cacheTokens.mjs';
+import { dispatchSignedInHubEvent } from '../../../providers/cognito/utils/dispatchSignedInHubEvent.mjs';
+import { getNewDeviceMetadata, getSignInResult } from '../../../providers/cognito/utils/signInHelpers.mjs';
+import '../../utils/store/autoSignInStore.mjs';
+import { signInStore, setActiveSignInState, cleanActiveSignInState } from '../../utils/store/signInStore.mjs';
+import { getAuthUserAgentValue } from '../../../utils/getAuthUserAgentValue.mjs';
+import { assertPasskeyError, PasskeyErrorCode } from '../../utils/passkey/errors.mjs';
+import { getPasskey } from '../../utils/passkey/getPasskey.mjs';
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+async function handleWebAuthnSignInResult(challengeParameters) {
+    const authConfig = Amplify.getConfig().Auth?.Cognito;
+    assertTokenProviderConfig(authConfig);
+    const { username, signInSession, signInDetails, challengeName } = signInStore.getState();
+    if (challengeName !== 'WEB_AUTHN' || !username) {
+        throw new AuthError({
+            name: AuthErrorCodes.SignInException,
+            message: 'Unable to proceed due to invalid sign in state.',
+        });
+    }
+    const { CREDENTIAL_REQUEST_OPTIONS: credentialRequestOptions } = challengeParameters;
+    assertPasskeyError(!!credentialRequestOptions, PasskeyErrorCode.InvalidPasskeyAuthenticationOptions);
+    const cred = await getPasskey(JSON.parse(credentialRequestOptions));
+    const respondToAuthChallenge = createRespondToAuthChallengeClient({
+        endpointResolver: createCognitoUserPoolEndpointResolver({
+            endpointOverride: authConfig.userPoolEndpoint,
+        }),
+    });
+    const { ChallengeName: nextChallengeName, ChallengeParameters: nextChallengeParameters, AuthenticationResult: authenticationResult, Session: nextSession, } = await respondToAuthChallenge({
+        region: getRegionFromUserPoolId(authConfig.userPoolId),
+        userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),
+    }, {
+        ChallengeName: 'WEB_AUTHN',
+        ChallengeResponses: {
+            USERNAME: username,
+            CREDENTIAL: JSON.stringify(cred),
+        },
+        ClientId: authConfig.userPoolClientId,
+        Session: signInSession,
+    });
+    setActiveSignInState({
+        signInSession: nextSession,
+        username,
+        challengeName: nextChallengeName,
+        signInDetails,
+    });
+    if (authenticationResult) {
+        await cacheCognitoTokens({
+            ...authenticationResult,
+            username,
+            NewDeviceMetadata: await getNewDeviceMetadata({
+                userPoolId: authConfig.userPoolId,
+                userPoolEndpoint: authConfig.userPoolEndpoint,
+                newDeviceMetadata: authenticationResult.NewDeviceMetadata,
+                accessToken: authenticationResult.AccessToken,
+            }),
+            signInDetails,
+        });
+        cleanActiveSignInState();
+        await dispatchSignedInHubEvent();
+        return {
+            isSignedIn: true,
+            nextStep: { signInStep: 'DONE' },
+        };
+    }
+    if (nextChallengeName === 'WEB_AUTHN') {
+        throw new AuthError({
+            name: AuthErrorCodes.SignInException,
+            message: 'Sequential WEB_AUTHN challenges returned from underlying service cannot be handled.',
+        });
+    }
+    return getSignInResult({
+        challengeName: nextChallengeName,
+        challengeParameters: nextChallengeParameters,
+    });
+}
+
+export { handleWebAuthnSignInResult };
+//# sourceMappingURL=handleWebAuthnSignInResult.mjs.map

package/dist/esm/client/flows/userAuth/handleWebAuthnSignInResult.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleWebAuthnSignInResult.mjs","sources":["../../../../../src/client/flows/userAuth/handleWebAuthnSignInResult.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { Amplify } from '@aws-amplify/core';\nimport { AuthAction, assertTokenProviderConfig, } from '@aws-amplify/core/internals/utils';\nimport { AuthErrorCodes } from '../../../common/AuthErrorStrings';\nimport { createRespondToAuthChallengeClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';\nimport { getRegionFromUserPoolId } from '../../../foundation/parsers';\nimport { createCognitoUserPoolEndpointResolver } from '../../../providers/cognito/factories';\nimport { cacheCognitoTokens } from '../../../providers/cognito/tokenProvider/cacheTokens';\nimport { dispatchSignedInHubEvent } from '../../../providers/cognito/utils/dispatchSignedInHubEvent';\nimport { getNewDeviceMetadata, getSignInResult, } from '../../../providers/cognito/utils/signInHelpers';\nimport { cleanActiveSignInState, setActiveSignInState, signInStore, } from '../../../client/utils/store';\nimport { getAuthUserAgentValue } from '../../../utils';\nimport { getPasskey } from '../../utils/passkey';\nimport { PasskeyErrorCode, assertPasskeyError, } from '../../utils/passkey/errors';\nimport { AuthError } from '../../../errors/AuthError';\nexport async function handleWebAuthnSignInResult(challengeParameters) {\n    const authConfig = Amplify.getConfig().Auth?.Cognito;\n    assertTokenProviderConfig(authConfig);\n    const { username, signInSession, signInDetails, challengeName } = signInStore.getState();\n    if (challengeName !== 'WEB_AUTHN' || !username) {\n        throw new AuthError({\n            name: AuthErrorCodes.SignInException,\n            message: 'Unable to proceed due to invalid sign in state.',\n        });\n    }\n    const { CREDENTIAL_REQUEST_OPTIONS: credentialRequestOptions } = challengeParameters;\n    assertPasskeyError(!!credentialRequestOptions, PasskeyErrorCode.InvalidPasskeyAuthenticationOptions);\n    const cred = await getPasskey(JSON.parse(credentialRequestOptions));\n    const respondToAuthChallenge = createRespondToAuthChallengeClient({\n        endpointResolver: createCognitoUserPoolEndpointResolver({\n            endpointOverride: authConfig.userPoolEndpoint,\n        }),\n    });\n    const { ChallengeName: nextChallengeName, ChallengeParameters: nextChallengeParameters, AuthenticationResult: authenticationResult, Session: nextSession, } = await respondToAuthChallenge({\n        region: getRegionFromUserPoolId(authConfig.userPoolId),\n        userAgentValue: getAuthUserAgentValue(AuthAction.ConfirmSignIn),\n    }, {\n        ChallengeName: 'WEB_AUTHN',\n        ChallengeResponses: {\n            USERNAME: username,\n            CREDENTIAL: JSON.stringify(cred),\n        },\n        ClientId: authConfig.userPoolClientId,\n        Session: signInSession,\n    });\n    setActiveSignInState({\n        signInSession: nextSession,\n        username,\n        challengeName: nextChallengeName,\n        signInDetails,\n    });\n    if (authenticationResult) {\n        await cacheCognitoTokens({\n            ...authenticationResult,\n            username,\n            NewDeviceMetadata: await getNewDeviceMetadata({\n                userPoolId: authConfig.userPoolId,\n                userPoolEndpoint: authConfig.userPoolEndpoint,\n                newDeviceMetadata: authenticationResult.NewDeviceMetadata,\n                accessToken: authenticationResult.AccessToken,\n            }),\n            signInDetails,\n        });\n        cleanActiveSignInState();\n        await dispatchSignedInHubEvent();\n        return {\n            isSignedIn: true,\n            nextStep: { signInStep: 'DONE' },\n        };\n    }\n    if (nextChallengeName === 'WEB_AUTHN') {\n        throw new AuthError({\n            name: AuthErrorCodes.SignInException,\n            message: 'Sequential WEB_AUTHN challenges returned from underlying service cannot be handled.',\n        });\n    }\n    return getSignInResult({\n        challengeName: nextChallengeName,\n        challengeParameters: nextChallengeParameters,\n    });\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;AACA;AAeO,eAAe,0BAA0B,CAAC,mBAAmB,EAAE;AACtE,IAAI,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;AACzD,IAAI,yBAAyB,CAAC,UAAU,CAAC,CAAC;AAC1C,IAAI,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;AAC7F,IAAI,IAAI,aAAa,KAAK,WAAW,IAAI,CAAC,QAAQ,EAAE;AACpD,QAAQ,MAAM,IAAI,SAAS,CAAC;AAC5B,YAAY,IAAI,EAAE,cAAc,CAAC,eAAe;AAChD,YAAY,OAAO,EAAE,iDAAiD;AACtE,SAAS,CAAC,CAAC;AACX,KAAK;AACL,IAAI,MAAM,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,GAAG,mBAAmB,CAAC;AACzF,IAAI,kBAAkB,CAAC,CAAC,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,mCAAmC,CAAC,CAAC;AACzG,IAAI,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;AACxE,IAAI,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AACtE,QAAQ,gBAAgB,EAAE,qCAAqC,CAAC;AAChE,YAAY,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;AACzD,SAAS,CAAC;AACV,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,OAAO,EAAE,WAAW,GAAG,GAAG,MAAM,sBAAsB,CAAC;AAC/L,QAAQ,MAAM,EAAE,uBAAuB,CAAC,UAAU,CAAC,UAAU,CAAC;AAC9D,QAAQ,cAAc,EAAE,qBAAqB,CAAC,UAAU,CAAC,aAAa,CAAC;AACvE,KAAK,EAAE;AACP,QAAQ,aAAa,EAAE,WAAW;AAClC,QAAQ,kBAAkB,EAAE;AAC5B,YAAY,QAAQ,EAAE,QAAQ;AAC9B,YAAY,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;AAC5C,SAAS;AACT,QAAQ,QAAQ,EAAE,UAAU,CAAC,gBAAgB;AAC7C,QAAQ,OAAO,EAAE,aAAa;AAC9B,KAAK,CAAC,CAAC;AACP,IAAI,oBAAoB,CAAC;AACzB,QAAQ,aAAa,EAAE,WAAW;AAClC,QAAQ,QAAQ;AAChB,QAAQ,aAAa,EAAE,iBAAiB;AACxC,QAAQ,aAAa;AACrB,KAAK,CAAC,CAAC;AACP,IAAI,IAAI,oBAAoB,EAAE;AAC9B,QAAQ,MAAM,kBAAkB,CAAC;AACjC,YAAY,GAAG,oBAAoB;AACnC,YAAY,QAAQ;AACpB,YAAY,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,gBAAgB,UAAU,EAAE,UAAU,CAAC,UAAU;AACjD,gBAAgB,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;AAC7D,gBAAgB,iBAAiB,EAAE,oBAAoB,CAAC,iBAAiB;AACzE,gBAAgB,WAAW,EAAE,oBAAoB,CAAC,WAAW;AAC7D,aAAa,CAAC;AACd,YAAY,aAAa;AACzB,SAAS,CAAC,CAAC;AACX,QAAQ,sBAAsB,EAAE,CAAC;AACjC,QAAQ,MAAM,wBAAwB,EAAE,CAAC;AACzC,QAAQ,OAAO;AACf,YAAY,UAAU,EAAE,IAAI;AAC5B,YAAY,QAAQ,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;AAC5C,SAAS,CAAC;AACV,KAAK;AACL,IAAI,IAAI,iBAAiB,KAAK,WAAW,EAAE;AAC3C,QAAQ,MAAM,IAAI,SAAS,CAAC;AAC5B,YAAY,IAAI,EAAE,cAAc,CAAC,eAAe;AAChD,YAAY,OAAO,EAAE,qFAAqF;AAC1G,SAAS,CAAC,CAAC;AACX,KAAK;AACL,IAAI,OAAO,eAAe,CAAC;AAC3B,QAAQ,aAAa,EAAE,iBAAiB;AACxC,QAAQ,mBAAmB,EAAE,uBAAuB;AACpD,KAAK,CAAC,CAAC;AACP;;;;"}

package/dist/esm/client/utils/index.d.ts

@@ -0,0 +1 @@
+export { registerPasskey } from './passkey';

package/dist/esm/client/utils/index.mjs

@@ -0,0 +1,4 @@
+export { registerPasskey } from './passkey/registerPasskey.mjs';
+import './passkey/errors.mjs';
+import '@aws-amplify/core/internals/utils';
+//# sourceMappingURL=index.mjs.map

package/dist/esm/client/utils/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sources":[],"sourcesContent":[],"names":[],"mappings":";;"}

package/dist/esm/client/utils/passkey/errors.d.ts

@@ -0,0 +1,33 @@
+import { AmplifyError, AmplifyErrorParams, AssertionFunction } from '@aws-amplify/core/internals/utils';
+export declare class PasskeyError extends AmplifyError {
+    constructor(params: AmplifyErrorParams);
+}
+export declare enum PasskeyErrorCode {
+    PasskeyNotSupported = "PasskeyNotSupported",
+    PasskeyAlreadyExists = "PasskeyAlreadyExists",
+    InvalidPasskeyRegistrationOptions = "InvalidPasskeyRegistrationOptions",
+    InvalidPasskeyAuthenticationOptions = "InvalidPasskeyAuthenticationOptions",
+    RelyingPartyMismatch = "RelyingPartyMismatch",
+    PasskeyRegistrationFailed = "PasskeyRegistrationFailed",
+    PasskeyRetrievalFailed = "PasskeyRetrievalFailed",
+    PasskeyRegistrationCanceled = "PasskeyRegistrationCanceled",
+    PasskeyAuthenticationCanceled = "PasskeyAuthenticationCanceled",
+    PasskeyOperationAborted = "PasskeyOperationAborted"
+}
+export declare const assertPasskeyError: AssertionFunction<PasskeyErrorCode>;
+/**
+ * Handle Passkey Authentication Errors
+ * https://w3c.github.io/webauthn/#sctn-get-request-exceptions
+ *
+ * @param err unknown
+ * @returns PasskeyError
+ */
+export declare const handlePasskeyAuthenticationError: (err: unknown) => PasskeyError;
+/**
+ * Handle Passkey Registration Errors
+ * https://w3c.github.io/webauthn/#sctn-create-request-exceptions
+ *
+ * @param err unknown
+ * @returns PasskeyError
+ */
+export declare const handlePasskeyRegistrationError: (err: unknown) => PasskeyError;

package/dist/esm/client/utils/passkey/errors.mjs

@@ -0,0 +1,176 @@
+import { createAssertionFunction, AmplifyError, AmplifyErrorCode } from '@aws-amplify/core/internals/utils';
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+class PasskeyError extends AmplifyError {
+    constructor(params) {
+        super(params);
+        // Hack for making the custom error class work when transpiled to es5
+        // TODO: Delete the following 2 lines after we change the build target to >= es2015
+        this.constructor = PasskeyError;
+        Object.setPrototypeOf(this, PasskeyError.prototype);
+    }
+}
+var PasskeyErrorCode;
+(function (PasskeyErrorCode) {
+    // not supported
+    PasskeyErrorCode["PasskeyNotSupported"] = "PasskeyNotSupported";
+    // duplicate passkey
+    PasskeyErrorCode["PasskeyAlreadyExists"] = "PasskeyAlreadyExists";
+    // misconfigurations
+    PasskeyErrorCode["InvalidPasskeyRegistrationOptions"] = "InvalidPasskeyRegistrationOptions";
+    PasskeyErrorCode["InvalidPasskeyAuthenticationOptions"] = "InvalidPasskeyAuthenticationOptions";
+    PasskeyErrorCode["RelyingPartyMismatch"] = "RelyingPartyMismatch";
+    // failed credential creation / retrieval
+    PasskeyErrorCode["PasskeyRegistrationFailed"] = "PasskeyRegistrationFailed";
+    PasskeyErrorCode["PasskeyRetrievalFailed"] = "PasskeyRetrievalFailed";
+    // cancel / aborts
+    PasskeyErrorCode["PasskeyRegistrationCanceled"] = "PasskeyRegistrationCanceled";
+    PasskeyErrorCode["PasskeyAuthenticationCanceled"] = "PasskeyAuthenticationCanceled";
+    PasskeyErrorCode["PasskeyOperationAborted"] = "PasskeyOperationAborted";
+})(PasskeyErrorCode || (PasskeyErrorCode = {}));
+const notSupportedRecoverySuggestion = 'Passkeys may not be supported on this device. Ensure your application is running in a secure context (HTTPS) and Web Authentication API is supported.';
+const abortOrCancelRecoverySuggestion = 'User may have canceled the ceremony or another interruption has occurred. Check underlying error for details.';
+const misconfigurationRecoverySuggestion = 'Ensure your user pool is configured to support the WEB_AUTHN as an authentication factor.';
+const passkeyErrorMap = {
+    [PasskeyErrorCode.PasskeyNotSupported]: {
+        message: 'Passkeys may not be supported on this device.',
+        recoverySuggestion: notSupportedRecoverySuggestion,
+    },
+    [PasskeyErrorCode.InvalidPasskeyRegistrationOptions]: {
+        message: 'Invalid passkey registration options.',
+        recoverySuggestion: misconfigurationRecoverySuggestion,
+    },
+    [PasskeyErrorCode.InvalidPasskeyAuthenticationOptions]: {
+        message: 'Invalid passkey authentication options.',
+        recoverySuggestion: misconfigurationRecoverySuggestion,
+    },
+    [PasskeyErrorCode.PasskeyRegistrationFailed]: {
+        message: 'Device failed to create passkey.',
+        recoverySuggestion: notSupportedRecoverySuggestion,
+    },
+    [PasskeyErrorCode.PasskeyRetrievalFailed]: {
+        message: 'Device failed to retrieve passkey.',
+        recoverySuggestion: 'Passkeys may not be available on this device. Try an alternative authentication factor like PASSWORD, EMAIL_OTP, or SMS_OTP.',
+    },
+    [PasskeyErrorCode.PasskeyAlreadyExists]: {
+        message: 'Passkey already exists in authenticator.',
+        recoverySuggestion: 'Proceed with existing passkey or try again after deleting the credential.',
+    },
+    [PasskeyErrorCode.PasskeyRegistrationCanceled]: {
+        message: 'Passkey registration ceremony has been canceled.',
+        recoverySuggestion: abortOrCancelRecoverySuggestion,
+    },
+    [PasskeyErrorCode.PasskeyAuthenticationCanceled]: {
+        message: 'Passkey authentication ceremony has been canceled.',
+        recoverySuggestion: abortOrCancelRecoverySuggestion,
+    },
+    [PasskeyErrorCode.PasskeyOperationAborted]: {
+        message: 'Passkey operation has been aborted.',
+        recoverySuggestion: abortOrCancelRecoverySuggestion,
+    },
+    [PasskeyErrorCode.RelyingPartyMismatch]: {
+        message: 'Relying party does not match current domain.',
+        recoverySuggestion: 'Ensure relying party identifier matches current domain.',
+    },
+};
+const assertPasskeyError = createAssertionFunction(passkeyErrorMap, PasskeyError);
+/**
+ * Handle Passkey Authentication Errors
+ * https://w3c.github.io/webauthn/#sctn-get-request-exceptions
+ *
+ * @param err unknown
+ * @returns PasskeyError
+ */
+const handlePasskeyAuthenticationError = (err) => {
+    if (err instanceof PasskeyError) {
+        return err;
+    }
+    if (err instanceof Error) {
+        if (err.name === 'NotAllowedError') {
+            const { message, recoverySuggestion } = passkeyErrorMap[PasskeyErrorCode.PasskeyAuthenticationCanceled];
+            return new PasskeyError({
+                name: PasskeyErrorCode.PasskeyAuthenticationCanceled,
+                message,
+                recoverySuggestion,
+                underlyingError: err,
+            });
+        }
+    }
+    return handlePasskeyError(err);
+};
+/**
+ * Handle Passkey Registration Errors
+ * https://w3c.github.io/webauthn/#sctn-create-request-exceptions
+ *
+ * @param err unknown
+ * @returns PasskeyError
+ */
+const handlePasskeyRegistrationError = (err) => {
+    if (err instanceof PasskeyError) {
+        return err;
+    }
+    if (err instanceof Error) {
+        // Duplicate Passkey
+        if (err.name === 'InvalidStateError') {
+            const { message, recoverySuggestion } = passkeyErrorMap[PasskeyErrorCode.PasskeyAlreadyExists];
+            return new PasskeyError({
+                name: PasskeyErrorCode.PasskeyAlreadyExists,
+                message,
+                recoverySuggestion,
+                underlyingError: err,
+            });
+        }
+        // User Cancels Ceremony / Generic Catch All
+        if (err.name === 'NotAllowedError') {
+            const { message, recoverySuggestion } = passkeyErrorMap[PasskeyErrorCode.PasskeyRegistrationCanceled];
+            return new PasskeyError({
+                name: PasskeyErrorCode.PasskeyRegistrationCanceled,
+                message,
+                recoverySuggestion,
+                underlyingError: err,
+            });
+        }
+    }
+    return handlePasskeyError(err);
+};
+/**
+ * Handles Overlapping Passkey Errors Between Registration & Authentication
+ * https://w3c.github.io/webauthn/#sctn-create-request-exceptions
+ * https://w3c.github.io/webauthn/#sctn-get-request-exceptions
+ *
+ * @param err unknown
+ * @returns PasskeyError
+ */
+const handlePasskeyError = (err) => {
+    if (err instanceof Error) {
+        // Passkey Operation Aborted
+        if (err.name === 'AbortError') {
+            const { message, recoverySuggestion } = passkeyErrorMap[PasskeyErrorCode.PasskeyOperationAborted];
+            return new PasskeyError({
+                name: PasskeyErrorCode.PasskeyOperationAborted,
+                message,
+                recoverySuggestion,
+                underlyingError: err,
+            });
+        }
+        // Relying Party / Domain Mismatch
+        if (err.name === 'SecurityError') {
+            const { message, recoverySuggestion } = passkeyErrorMap[PasskeyErrorCode.RelyingPartyMismatch];
+            return new PasskeyError({
+                name: PasskeyErrorCode.RelyingPartyMismatch,
+                message,
+                recoverySuggestion,
+                underlyingError: err,
+            });
+        }
+    }
+    return new PasskeyError({
+        name: AmplifyErrorCode.Unknown,
+        message: 'An unknown error has occurred.',
+        underlyingError: err,
+    });
+};
+
+export { PasskeyError, PasskeyErrorCode, assertPasskeyError, handlePasskeyAuthenticationError, handlePasskeyRegistrationError };
+//# sourceMappingURL=errors.mjs.map

package/dist/esm/client/utils/passkey/errors.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.mjs","sources":["../../../../../src/client/utils/passkey/errors.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { AmplifyError, AmplifyErrorCode, createAssertionFunction, } from '@aws-amplify/core/internals/utils';\nexport class PasskeyError extends AmplifyError {\n    constructor(params) {\n        super(params);\n        // Hack for making the custom error class work when transpiled to es5\n        // TODO: Delete the following 2 lines after we change the build target to >= es2015\n        this.constructor = PasskeyError;\n        Object.setPrototypeOf(this, PasskeyError.prototype);\n    }\n}\nexport var PasskeyErrorCode;\n(function (PasskeyErrorCode) {\n    // not supported\n    PasskeyErrorCode[\"PasskeyNotSupported\"] = \"PasskeyNotSupported\";\n    // duplicate passkey\n    PasskeyErrorCode[\"PasskeyAlreadyExists\"] = \"PasskeyAlreadyExists\";\n    // misconfigurations\n    PasskeyErrorCode[\"InvalidPasskeyRegistrationOptions\"] = \"InvalidPasskeyRegistrationOptions\";\n    PasskeyErrorCode[\"InvalidPasskeyAuthenticationOptions\"] = \"InvalidPasskeyAuthenticationOptions\";\n    PasskeyErrorCode[\"RelyingPartyMismatch\"] = \"RelyingPartyMismatch\";\n    // failed credential creation / retrieval\n    PasskeyErrorCode[\"PasskeyRegistrationFailed\"] = \"PasskeyRegistrationFailed\";\n    PasskeyErrorCode[\"PasskeyRetrievalFailed\"] = \"PasskeyRetrievalFailed\";\n    // cancel / aborts\n    PasskeyErrorCode[\"PasskeyRegistrationCanceled\"] = \"PasskeyRegistrationCanceled\";\n    PasskeyErrorCode[\"PasskeyAuthenticationCanceled\"] = \"PasskeyAuthenticationCanceled\";\n    PasskeyErrorCode[\"PasskeyOperationAborted\"] = \"PasskeyOperationAborted\";\n})(PasskeyErrorCode || (PasskeyErrorCode = {}));\nconst notSupportedRecoverySuggestion = 'Passkeys may not be supported on this device. Ensure your application is running in a secure context (HTTPS) and Web Authentication API is supported.';\nconst abortOrCancelRecoverySuggestion = 'User may have canceled the ceremony or another interruption has occurred. Check underlying error for details.';\nconst misconfigurationRecoverySuggestion = 'Ensure your user pool is configured to support the WEB_AUTHN as an authentication factor.';\nconst passkeyErrorMap = {\n    [PasskeyErrorCode.PasskeyNotSupported]: {\n        message: 'Passkeys may not be supported on this device.',\n        recoverySuggestion: notSupportedRecoverySuggestion,\n    },\n    [PasskeyErrorCode.InvalidPasskeyRegistrationOptions]: {\n        message: 'Invalid passkey registration options.',\n        recoverySuggestion: misconfigurationRecoverySuggestion,\n    },\n    [PasskeyErrorCode.InvalidPasskeyAuthenticationOptions]: {\n        message: 'Invalid passkey authentication options.',\n        recoverySuggestion: misconfigurationRecoverySuggestion,\n    },\n    [PasskeyErrorCode.PasskeyRegistrationFailed]: {\n        message: 'Device failed to create passkey.',\n        recoverySuggestion: notSupportedRecoverySuggestion,\n    },\n    [PasskeyErrorCode.PasskeyRetrievalFailed]: {\n        message: 'Device failed to retrieve passkey.',\n        recoverySuggestion: 'Passkeys may not be available on this device. Try an alternative authentication factor like PASSWORD, EMAIL_OTP, or SMS_OTP.',\n    },\n    [PasskeyErrorCode.PasskeyAlreadyExists]: {\n        message: 'Passkey already exists in authenticator.',\n        recoverySuggestion: 'Proceed with existing passkey or try again after deleting the credential.',\n    },\n    [PasskeyErrorCode.PasskeyRegistrationCanceled]: {\n        message: 'Passkey registration ceremony has been canceled.',\n        recoverySuggestion: abortOrCancelRecoverySuggestion,\n    },\n    [PasskeyErrorCode.PasskeyAuthenticationCanceled]: {\n        message: 'Passkey authentication ceremony has been canceled.',\n        recoverySuggestion: abortOrCancelRecoverySuggestion,\n    },\n    [PasskeyErrorCode.PasskeyOperationAborted]: {\n        message: 'Passkey operation has been aborted.',\n        recoverySuggestion: abortOrCancelRecoverySuggestion,\n    },\n    [PasskeyErrorCode.RelyingPartyMismatch]: {\n        message: 'Relying party does not match current domain.',\n        recoverySuggestion: 'Ensure relying party identifier matches current domain.',\n    },\n};\nexport const assertPasskeyError = createAssertionFunction(passkeyErrorMap, PasskeyError);\n/**\n * Handle Passkey Authentication Errors\n * https://w3c.github.io/webauthn/#sctn-get-request-exceptions\n *\n * @param err unknown\n * @returns PasskeyError\n */\nexport const handlePasskeyAuthenticationError = (err) => {\n    if (err instanceof PasskeyError) {\n        return err;\n    }\n    if (err instanceof Error) {\n        if (err.name === 'NotAllowedError') {\n            const { message, recoverySuggestion } = passkeyErrorMap[PasskeyErrorCode.PasskeyAuthenticationCanceled];\n            return new PasskeyError({\n                name: PasskeyErrorCode.PasskeyAuthenticationCanceled,\n                message,\n                recoverySuggestion,\n                underlyingError: err,\n            });\n        }\n    }\n    return handlePasskeyError(err);\n};\n/**\n * Handle Passkey Registration Errors\n * https://w3c.github.io/webauthn/#sctn-create-request-exceptions\n *\n * @param err unknown\n * @returns PasskeyError\n */\nexport const handlePasskeyRegistrationError = (err) => {\n    if (err instanceof PasskeyError) {\n        return err;\n    }\n    if (err instanceof Error) {\n        // Duplicate Passkey\n        if (err.name === 'InvalidStateError') {\n            const { message, recoverySuggestion } = passkeyErrorMap[PasskeyErrorCode.PasskeyAlreadyExists];\n            return new PasskeyError({\n                name: PasskeyErrorCode.PasskeyAlreadyExists,\n                message,\n                recoverySuggestion,\n                underlyingError: err,\n            });\n        }\n        // User Cancels Ceremony / Generic Catch All\n        if (err.name === 'NotAllowedError') {\n            const { message, recoverySuggestion } = passkeyErrorMap[PasskeyErrorCode.PasskeyRegistrationCanceled];\n            return new PasskeyError({\n                name: PasskeyErrorCode.PasskeyRegistrationCanceled,\n                message,\n                recoverySuggestion,\n                underlyingError: err,\n            });\n        }\n    }\n    return handlePasskeyError(err);\n};\n/**\n * Handles Overlapping Passkey Errors Between Registration & Authentication\n * https://w3c.github.io/webauthn/#sctn-create-request-exceptions\n * https://w3c.github.io/webauthn/#sctn-get-request-exceptions\n *\n * @param err unknown\n * @returns PasskeyError\n */\nconst handlePasskeyError = (err) => {\n    if (err instanceof Error) {\n        // Passkey Operation Aborted\n        if (err.name === 'AbortError') {\n            const { message, recoverySuggestion } = passkeyErrorMap[PasskeyErrorCode.PasskeyOperationAborted];\n            return new PasskeyError({\n                name: PasskeyErrorCode.PasskeyOperationAborted,\n                message,\n                recoverySuggestion,\n                underlyingError: err,\n            });\n        }\n        // Relying Party / Domain Mismatch\n        if (err.name === 'SecurityError') {\n            const { message, recoverySuggestion } = passkeyErrorMap[PasskeyErrorCode.RelyingPartyMismatch];\n            return new PasskeyError({\n                name: PasskeyErrorCode.RelyingPartyMismatch,\n                message,\n                recoverySuggestion,\n                underlyingError: err,\n            });\n        }\n    }\n    return new PasskeyError({\n        name: AmplifyErrorCode.Unknown,\n        message: 'An unknown error has occurred.',\n        underlyingError: err,\n    });\n};\n"],"names":[],"mappings":";;AAAA;AACA;AAEO,MAAM,YAAY,SAAS,YAAY,CAAC;AAC/C,IAAI,WAAW,CAAC,MAAM,EAAE;AACxB,QAAQ,KAAK,CAAC,MAAM,CAAC,CAAC;AACtB;AACA;AACA,QAAQ,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC;AACxC,QAAQ,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;AAC5D,KAAK;AACL,CAAC;AACS,IAAC,iBAAiB;AAC5B,CAAC,UAAU,gBAAgB,EAAE;AAC7B;AACA,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,GAAG,qBAAqB,CAAC;AACpE;AACA,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;AACtE;AACA,IAAI,gBAAgB,CAAC,mCAAmC,CAAC,GAAG,mCAAmC,CAAC;AAChG,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,GAAG,qCAAqC,CAAC;AACpG,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;AACtE;AACA,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,GAAG,2BAA2B,CAAC;AAChF,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,GAAG,wBAAwB,CAAC;AAC1E;AACA,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,GAAG,6BAA6B,CAAC;AACpF,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,GAAG,+BAA+B,CAAC;AACxF,IAAI,gBAAgB,CAAC,yBAAyB,CAAC,GAAG,yBAAyB,CAAC;AAC5E,CAAC,EAAE,gBAAgB,KAAK,gBAAgB,GAAG,EAAE,CAAC,CAAC,CAAC;AAChD,MAAM,8BAA8B,GAAG,uJAAuJ,CAAC;AAC/L,MAAM,+BAA+B,GAAG,+GAA+G,CAAC;AACxJ,MAAM,kCAAkC,GAAG,2FAA2F,CAAC;AACvI,MAAM,eAAe,GAAG;AACxB,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,GAAG;AAC5C,QAAQ,OAAO,EAAE,+CAA+C;AAChE,QAAQ,kBAAkB,EAAE,8BAA8B;AAC1D,KAAK;AACL,IAAI,CAAC,gBAAgB,CAAC,iCAAiC,GAAG;AAC1D,QAAQ,OAAO,EAAE,uCAAuC;AACxD,QAAQ,kBAAkB,EAAE,kCAAkC;AAC9D,KAAK;AACL,IAAI,CAAC,gBAAgB,CAAC,mCAAmC,GAAG;AAC5D,QAAQ,OAAO,EAAE,yCAAyC;AAC1D,QAAQ,kBAAkB,EAAE,kCAAkC;AAC9D,KAAK;AACL,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,GAAG;AAClD,QAAQ,OAAO,EAAE,kCAAkC;AACnD,QAAQ,kBAAkB,EAAE,8BAA8B;AAC1D,KAAK;AACL,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,GAAG;AAC/C,QAAQ,OAAO,EAAE,oCAAoC;AACrD,QAAQ,kBAAkB,EAAE,8HAA8H;AAC1J,KAAK;AACL,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,GAAG;AAC7C,QAAQ,OAAO,EAAE,0CAA0C;AAC3D,QAAQ,kBAAkB,EAAE,2EAA2E;AACvG,KAAK;AACL,IAAI,CAAC,gBAAgB,CAAC,2BAA2B,GAAG;AACpD,QAAQ,OAAO,EAAE,kDAAkD;AACnE,QAAQ,kBAAkB,EAAE,+BAA+B;AAC3D,KAAK;AACL,IAAI,CAAC,gBAAgB,CAAC,6BAA6B,GAAG;AACtD,QAAQ,OAAO,EAAE,oDAAoD;AACrE,QAAQ,kBAAkB,EAAE,+BAA+B;AAC3D,KAAK;AACL,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,GAAG;AAChD,QAAQ,OAAO,EAAE,qCAAqC;AACtD,QAAQ,kBAAkB,EAAE,+BAA+B;AAC3D,KAAK;AACL,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,GAAG;AAC7C,QAAQ,OAAO,EAAE,8CAA8C;AAC/D,QAAQ,kBAAkB,EAAE,yDAAyD;AACrF,KAAK;AACL,CAAC,CAAC;AACU,MAAC,kBAAkB,GAAG,uBAAuB,CAAC,eAAe,EAAE,YAAY,EAAE;AACzF;AACA;AACA;AACA;AACA;AACA;AACA;AACY,MAAC,gCAAgC,GAAG,CAAC,GAAG,KAAK;AACzD,IAAI,IAAI,GAAG,YAAY,YAAY,EAAE;AACrC,QAAQ,OAAO,GAAG,CAAC;AACnB,KAAK;AACL,IAAI,IAAI,GAAG,YAAY,KAAK,EAAE;AAC9B,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE;AAC5C,YAAY,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,eAAe,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,CAAC;AACpH,YAAY,OAAO,IAAI,YAAY,CAAC;AACpC,gBAAgB,IAAI,EAAE,gBAAgB,CAAC,6BAA6B;AACpE,gBAAgB,OAAO;AACvB,gBAAgB,kBAAkB;AAClC,gBAAgB,eAAe,EAAE,GAAG;AACpC,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK;AACL,IAAI,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACnC,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACY,MAAC,8BAA8B,GAAG,CAAC,GAAG,KAAK;AACvD,IAAI,IAAI,GAAG,YAAY,YAAY,EAAE;AACrC,QAAQ,OAAO,GAAG,CAAC;AACnB,KAAK;AACL,IAAI,IAAI,GAAG,YAAY,KAAK,EAAE;AAC9B;AACA,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE;AAC9C,YAAY,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,eAAe,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;AAC3G,YAAY,OAAO,IAAI,YAAY,CAAC;AACpC,gBAAgB,IAAI,EAAE,gBAAgB,CAAC,oBAAoB;AAC3D,gBAAgB,OAAO;AACvB,gBAAgB,kBAAkB;AAClC,gBAAgB,eAAe,EAAE,GAAG;AACpC,aAAa,CAAC,CAAC;AACf,SAAS;AACT;AACA,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE;AAC5C,YAAY,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,eAAe,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;AAClH,YAAY,OAAO,IAAI,YAAY,CAAC;AACpC,gBAAgB,IAAI,EAAE,gBAAgB,CAAC,2BAA2B;AAClE,gBAAgB,OAAO;AACvB,gBAAgB,kBAAkB;AAClC,gBAAgB,eAAe,EAAE,GAAG;AACpC,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK;AACL,IAAI,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACnC,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAM,kBAAkB,GAAG,CAAC,GAAG,KAAK;AACpC,IAAI,IAAI,GAAG,YAAY,KAAK,EAAE;AAC9B;AACA,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE;AACvC,YAAY,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,eAAe,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;AAC9G,YAAY,OAAO,IAAI,YAAY,CAAC;AACpC,gBAAgB,IAAI,EAAE,gBAAgB,CAAC,uBAAuB;AAC9D,gBAAgB,OAAO;AACvB,gBAAgB,kBAAkB;AAClC,gBAAgB,eAAe,EAAE,GAAG;AACpC,aAAa,CAAC,CAAC;AACf,SAAS;AACT;AACA,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE;AAC1C,YAAY,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,eAAe,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;AAC3G,YAAY,OAAO,IAAI,YAAY,CAAC;AACpC,gBAAgB,IAAI,EAAE,gBAAgB,CAAC,oBAAoB;AAC3D,gBAAgB,OAAO;AACvB,gBAAgB,kBAAkB;AAClC,gBAAgB,eAAe,EAAE,GAAG;AACpC,aAAa,CAAC,CAAC;AACf,SAAS;AACT,KAAK;AACL,IAAI,OAAO,IAAI,YAAY,CAAC;AAC5B,QAAQ,IAAI,EAAE,gBAAgB,CAAC,OAAO;AACtC,QAAQ,OAAO,EAAE,gCAAgC;AACjD,QAAQ,eAAe,EAAE,GAAG;AAC5B,KAAK,CAAC,CAAC;AACP,CAAC;;;;"}

package/dist/esm/client/utils/passkey/getIsPasskeySupported.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Determines if passkey is supported in current context
+ * Will return false if executed in non-secure context
+ * @returns boolean
+ */
+export declare const getIsPasskeySupported: () => boolean;

package/dist/esm/client/utils/passkey/getIsPasskeySupported.mjs

@@ -0,0 +1,18 @@
+import { isBrowser } from '@aws-amplify/core/internals/utils';
+
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Determines if passkey is supported in current context
+ * Will return false if executed in non-secure context
+ * @returns boolean
+ */
+const getIsPasskeySupported = () => {
+    return (isBrowser() &&
+        window.isSecureContext &&
+        'credentials' in navigator &&
+        typeof window.PublicKeyCredential === 'function');
+};
+
+export { getIsPasskeySupported };
+//# sourceMappingURL=getIsPasskeySupported.mjs.map

package/dist/esm/client/utils/passkey/getIsPasskeySupported.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getIsPasskeySupported.mjs","sources":["../../../../../src/client/utils/passkey/getIsPasskeySupported.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { isBrowser } from '@aws-amplify/core/internals/utils';\n/**\n * Determines if passkey is supported in current context\n * Will return false if executed in non-secure context\n * @returns boolean\n */\nexport const getIsPasskeySupported = () => {\n    return (isBrowser() &&\n        window.isSecureContext &&\n        'credentials' in navigator &&\n        typeof window.PublicKeyCredential === 'function');\n};\n"],"names":[],"mappings":";;AAAA;AACA;AAEA;AACA;AACA;AACA;AACA;AACY,MAAC,qBAAqB,GAAG,MAAM;AAC3C,IAAI,QAAQ,SAAS,EAAE;AACvB,QAAQ,MAAM,CAAC,eAAe;AAC9B,QAAQ,aAAa,IAAI,SAAS;AAClC,QAAQ,OAAO,MAAM,CAAC,mBAAmB,KAAK,UAAU,EAAE;AAC1D;;;;"}

package/dist/esm/client/utils/passkey/getIsPasskeySupported.native.d.ts

@@ -0,0 +1 @@
+export declare const getIsPasskeySupported: () => never;