@crvouga/mockingbird-service-cognito 1.8.0 → 2.0.0

package/CHANGELOG.md

@@ -1,6 +1,28 @@
 # Changelog — @crvouga/mockingbird-service-cognito
 
-## 1.8.0 (2026-10-02)
+## 2.0.0 (2026-10-04)
+
+### ⚠️ Breaking changes
+
+- isolate internal routes ([5e19b21](https://github.com/crvouga/mockingbird/commit/5e19b21d403acc74b04778a8b545e80bcbdf8d51))
+
+### Features
+
+- add route filtering ([4e59b1d](https://github.com/crvouga/mockingbird/commit/4e59b1d42a76550f844b744f8431a637433a0781))
+- publish agent package indexes ([eca61d3](https://github.com/crvouga/mockingbird/commit/eca61d358b86982cf0b777ae8bd7feaa3663aaa6))
+
+### Fixes and improvements
+
+- honor configured prefixes ([4f569d7](https://github.com/crvouga/mockingbird/commit/4f569d74ca8089f2ed5e33a1abf32b90973f41dd))
+- explain configurable internal paths ([21b47ae](https://github.com/crvouga/mockingbird/commit/21b47ae4d4a096cdf63189aaeaf721ccb369bcf3))
+- parse ISO journal timestamps ([20b39a2](https://github.com/crvouga/mockingbird/commit/20b39a2c738e278533d610dfc91f1cb3ae9b3f1e))
+- harden shared controls ([7822614](https://github.com/crvouga/mockingbird/commit/7822614f6cba0387aeb60ba7320b0379aa1ef690))
+
+### Dependencies
+
+- `@crvouga/mockingbird-service-sqlite`
+
+## 1.8.0 (2026-10-01)
 
 ### Features
 

package/DISCOVERY.md

@@ -0,0 +1,55 @@
+# @crvouga/mockingbird-service-cognito discovery
+
+This is the installed-package index for coding agents and tooling. All relative links resolve
+inside `node_modules/@crvouga/mockingbird-service-cognito/`; no repository checkout is needed to discover the mock's
+supported surface or documented behavior.
+
+## Capability and behavior sources
+
+| Question | Authoritative file | What it contains |
+| --- | --- | --- |
+| Behaviour and integration | [`README.md`](README.md) | Routes, state transitions, auth, webhooks, controls, presets and deliberate omissions. |
+| Exact capabilities | [`SUPPORT.md`](SUPPORT.md) | Supported, unsupported and parity-covered operations or commands, including reasons for gaps. |
+| Wire contract | [`openapi.yaml`](openapi.yaml) | Machine-readable paths, methods, schemas, responses and parity annotations. |
+| Public API | [`dist/index.d.ts`](dist/index.d.ts) | The installed package's exact TypeScript exports and signatures. |
+| Package metadata | [`package.json`](package.json) | Runtime/entry-point claims, vendor links, parity scope/tier and `mockingbird.discovery`. |
+
+Read these together: the contract/capability matrix says *what* is available, while the README
+defines stateful behavior, lifecycle rules, test controls, and intentional oracle differences.
+If prose and an executable surface disagree, report a parity mismatch instead of adding a
+consumer-side workaround.
+
+## Parity and oracle
+
+- Declared parity surface: **User pools and browser auth**.
+- Parity tier: **cold** (the repository controls when live checks run).
+- Oracle: **Live vendor API or sandbox**.
+- Repository command: `bun run parity:service -- cognito`.
+- Evidence model: Run from a Mockingbird checkout; credentials come only from .env.local or GitHub Actions secrets. Missing credentials exit 2.
+
+The npm package contains evidence summaries and the exact contract, not credentials or the
+repository-only parity harness. Self-parity/property and acceptance tests run in the Mockingbird
+repository; live parity is an additional oracle check, not a substitute for the packaged matrix.
+
+## Runtime introspection
+
+- `GET /__admin/health`
+- `GET /__admin`
+- `GET /__admin/state`
+- `GET /__admin/requests`
+- `GET /__admin/metrics`
+- `GET /__admin/faults/presets`
+- `GET /__admin/ui`
+
+For HTTP services, use `x-mockingbird-namespace` (or the documented credential/path carrier) so
+parallel tests do not share state. Admin state, journal, metrics and fault-preset endpoints are
+designed for assertions and diagnosis by consuming test suites.
+
+## Report a mismatch or missing capability
+
+Follow the [agent reporting contract](https://github.com/crvouga/mockingbird/blob/main/docs/REPORTING_ISSUES.md). Include package version,
+operation/command, a minimal redacted request, actual mock result, expected oracle result or vendor
+documentation, and whether the mismatch appears in the matrix. Never include keys, tokens,
+customer data, prompts, PHI, card data, or unredacted recordings.
+
+Service key: `cognito`.

package/README.md

@@ -49,7 +49,7 @@ Responses contain SDK-consumed Cognito fields and AWS-shaped exceptions (`__type
 - `POST /__admin/keys/rotate {"retainPrevious":true}` rotates signing keys with optional overlap.
 - Fault presets: `throttled`, `unavailable`.
 
-The shared runtime supplies reset, clock, snapshots, journals, metrics, faults, branches, and namespace isolation. Select namespaces through `x-mockingbird-namespace`, `/ns/<name>`, or SigV4 access-key mappings.
+The shared runtime supplies reset, clock, snapshots, journals, metrics, faults, branches, and namespace isolation. Select namespaces through `x-mockingbird-namespace`, `/__admin/ns/<name>`, or SigV4 access-key mappings.
 
 ### Deliberately not modelled
 

package/SUPPORT.md

@@ -0,0 +1,13 @@
+# Amazon Cognito Identity Provider (Mockingbird subset) — operation support
+
+Generated from `openapi.yaml`; do not edit by hand.
+
+- operations in spec: **3**
+- supported by the mock: **3**
+- parity enabled: **1**
+
+| operationId | route | mock | parity | notes |
+| --- | --- | --- | --- | --- |
+| `CognitoRpc` | `POST /` | ✅ supported | ⚠️ unsafe (opt-in) |  |
+| `Discovery` | `GET /{poolId}/.well-known/openid-configuration` | ✅ supported | ❌ disabled | Local issuer metadata. |
+| `Jwks` | `GET /{poolId}/.well-known/jwks.json` | ✅ supported | ❌ disabled | Local signing keys. |