@kensio/yulin 0.41.0 → 0.43.0

package/dist/service/cognito/user-pool/client/sim-cognito-explicit-auth-flows.js

@@ -0,0 +1,77 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The authentication flows Cognito has replaced, kept for app clients made
+ * before the `ALLOW_` prefixed values existed.
+ */
+const legacyAuthFlows = [
+    "ADMIN_NO_SRP_AUTH",
+    "CUSTOM_AUTH_FLOW_ONLY",
+    "USER_PASSWORD_AUTH",
+];
+const currentAuthFlows = [
+    "ALLOW_ADMIN_USER_PASSWORD_AUTH",
+    "ALLOW_CUSTOM_AUTH",
+    "ALLOW_REFRESH_TOKEN_AUTH",
+    "ALLOW_USER_AUTH",
+    "ALLOW_USER_PASSWORD_AUTH",
+    "ALLOW_USER_SRP_AUTH",
+];
+/**
+ * The flows an app client supports when its request named none.
+ *
+ * Sign-in with a username and password is deliberately not among them, which
+ * is why `USER_PASSWORD_AUTH` fails on a client nobody configured.
+ */
+const defaultAuthFlows = [
+    "ALLOW_REFRESH_TOKEN_AUTH",
+    "ALLOW_USER_SRP_AUTH",
+    "ALLOW_CUSTOM_AUTH",
+];
+/**
+ * The authentication flows one simulated app client supports.
+ *
+ * This is the setting that decides whether an authentication request reaches
+ * the pool at all, so the values are validated rather than stored as written:
+ * a typo in a flow name would otherwise turn into a puzzling sign-in failure
+ * much later.
+ */
+export class SimCognitoExplicitAuthFlows {
+    values;
+    constructor(requested) {
+        if (requested === undefined || requested.length === 0) {
+            this.values = defaultAuthFlows;
+            return;
+        }
+        for (const flow of requested) {
+            SimCognitoExplicitAuthFlows.requireKnown(flow);
+        }
+        SimCognitoExplicitAuthFlows.refuseMixedGenerations(requested);
+        this.values = [...requested];
+    }
+    static requireKnown(flow) {
+        if (legacyAuthFlows.includes(flow) || currentAuthFlows.includes(flow)) {
+            return;
+        }
+        throw new SimCognitoInvalidParameterException(`ExplicitAuthFlows '${flow}' is not a Cognito authentication flow: ` +
+            `use one of ${currentAuthFlows.join(", ")}`);
+    }
+    /**
+     * Refuse a request naming both a legacy flow and an `ALLOW_` prefixed one,
+     * as real Cognito refuses it.
+     */
+    static refuseMixedGenerations(requested) {
+        const hasLegacy = requested.some((flow) => legacyAuthFlows.includes(flow));
+        const hasCurrent = requested.some((flow) => currentAuthFlows.includes(flow));
+        if (hasLegacy && hasCurrent) {
+            throw new SimCognitoInvalidParameterException("ExplicitAuthFlows cannot mix the legacy flows " +
+                `(${legacyAuthFlows.join(", ")}) with the ALLOW_ prefixed ones`);
+        }
+    }
+    /**
+     * Whether the client supports an authentication flow.
+     */
+    allows(flow) {
+        return this.values.includes(flow);
+    }
+}
+//# sourceMappingURL=sim-cognito-explicit-auth-flows.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-explicit-auth-flows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-explicit-auth-flows.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-explicit-auth-flows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;;GAGG;AACH,MAAM,eAAe,GAAsB;IACzC,mBAAmB;IACnB,uBAAuB;IACvB,oBAAoB;CACrB,CAAC;AAEF,MAAM,gBAAgB,GAAsB;IAC1C,gCAAgC;IAChC,mBAAmB;IACnB,0BAA0B;IAC1B,iBAAiB;IACjB,0BAA0B;IAC1B,qBAAqB;CACtB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,gBAAgB,GAAsB;IAC1C,0BAA0B;IAC1B,qBAAqB;IACrB,mBAAmB;CACpB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACtB,MAAM,CAAoB;IAE1C,YAAY,SAAwC;QAClD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,2BAA2B,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QAED,2BAA2B,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAE9D,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;IAC/B,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,IAAY;QACtC,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,sBAAsB,IAAI,0CAA0C;YAClE,cAAc,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,sBAAsB,CAAC,SAA4B;QAChE,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACzC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAChC,CAAC;QAEF,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,mCAAmC,CAC3C,gDAAgD;gBAC9C,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAY;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-prevent-user-existence-errors.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Whether an app client hides that a username does not exist.
+ *
+ * Real Cognito answers a sign-in naming an unknown user with
+ * `UserNotFoundException` under `LEGACY` and with the same
+ * `NotAuthorizedException` a wrong password gets under `ENABLED`. Which one a
+ * pool gives depends on this setting, so it is honoured rather than picked:
+ * a test asserting the generic error against a client that actually leaks
+ * existence is asserting the wrong thing.
+ *
+ * The API default is `LEGACY`, and a client created in the Cognito console
+ * gets `ENABLED`, so a client created here without the setting behaves the way
+ * a client created by an SDK call or a CloudFormation template does.
+ */
+export declare class SimCognitoPreventUserExistenceErrors {
+    readonly value: string;
+    constructor(requested: string | undefined);
+    /**
+     * Whether a sign-in naming an unknown user is refused as a wrong password
+     * rather than reported missing.
+     */
+    get hidesUserExistence(): boolean;
+}
+//# sourceMappingURL=sim-cognito-prevent-user-existence-errors.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-prevent-user-existence-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-prevent-user-existence-errors.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-prevent-user-existence-errors.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;GAaG;AACH,qBAAa,oCAAoC;IAC/C,SAAgB,KAAK,EAAE,MAAM,CAAC;IAE9B,YAAY,SAAS,EAAE,MAAM,GAAG,SAAS,EAcxC;IAED;;;OAGG;IACH,IAAI,kBAAkB,IAAI,OAAO,CAEhC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-prevent-user-existence-errors.js

@@ -0,0 +1,46 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The setting that leaks whether a username exists, which is the API default.
+ */
+const legacy = "LEGACY";
+/**
+ * The setting that hides it, which the console applies to a new app client.
+ */
+const enabled = "ENABLED";
+const settings = [legacy, enabled];
+/**
+ * Whether an app client hides that a username does not exist.
+ *
+ * Real Cognito answers a sign-in naming an unknown user with
+ * `UserNotFoundException` under `LEGACY` and with the same
+ * `NotAuthorizedException` a wrong password gets under `ENABLED`. Which one a
+ * pool gives depends on this setting, so it is honoured rather than picked:
+ * a test asserting the generic error against a client that actually leaks
+ * existence is asserting the wrong thing.
+ *
+ * The API default is `LEGACY`, and a client created in the Cognito console
+ * gets `ENABLED`, so a client created here without the setting behaves the way
+ * a client created by an SDK call or a CloudFormation template does.
+ */
+export class SimCognitoPreventUserExistenceErrors {
+    value;
+    constructor(requested) {
+        if (requested === undefined) {
+            this.value = legacy;
+            return;
+        }
+        if (!settings.includes(requested)) {
+            throw new SimCognitoInvalidParameterException(`PreventUserExistenceErrors '${requested}' is not a Cognito setting: ` +
+                `use one of ${settings.join(", ")}`);
+        }
+        this.value = requested;
+    }
+    /**
+     * Whether a sign-in naming an unknown user is refused as a wrong password
+     * rather than reported missing.
+     */
+    get hidesUserExistence() {
+        return this.value === enabled;
+    }
+}
+//# sourceMappingURL=sim-cognito-prevent-user-existence-errors.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-prevent-user-existence-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-prevent-user-existence-errors.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-prevent-user-existence-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;GAEG;AACH,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB;;GAEG;AACH,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B,MAAM,QAAQ,GAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEtD;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,oCAAoC;IAC/B,KAAK,CAAS;IAE9B,YAAY,SAA6B;QACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,mCAAmC,CAC3C,+BAA+B,SAAS,8BAA8B;gBACpE,cAAc,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC;IAChC,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-refresh-token-lifetime.d.ts

@@ -0,0 +1,13 @@
+import { SimCognitoTokenLifetime } from "./sim-cognito-token-lifetime.js";
+/**
+ * Build an app client's refresh token lifetime.
+ *
+ * This is the one lifetime with a rule of its own: Cognito substitutes thirty
+ * days both for an absent validity and for a zero. The substituted default is
+ * thirty days whatever unit the request named, so the unit is left out along
+ * with the value it would have counted. It is still checked first, because
+ * real Cognito refuses a unit it does not have whether or not the unit ends
+ * up counting anything.
+ */
+export declare function makeSimCognitoRefreshTokenLifetime(requested: number | undefined, unit: string | undefined): SimCognitoTokenLifetime;
+//# sourceMappingURL=sim-cognito-refresh-token-lifetime.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-refresh-token-lifetime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-refresh-token-lifetime.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-refresh-token-lifetime.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,EACxB,MAAM,iCAAiC,CAAC;AAMzC;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,uBAAuB,CAoBzB"}

package/dist/service/cognito/user-pool/client/sim-cognito-refresh-token-lifetime.js

@@ -0,0 +1,28 @@
+import { requireCognitoTokenValidityUnit, SimCognitoTokenLifetime, } from "./sim-cognito-token-lifetime.js";
+import { defaultRefreshTokenValidityDays, refreshTokenLifetimeSpec, } from "./sim-cognito-token-lifetime-specs.js";
+/**
+ * Build an app client's refresh token lifetime.
+ *
+ * This is the one lifetime with a rule of its own: Cognito substitutes thirty
+ * days both for an absent validity and for a zero. The substituted default is
+ * thirty days whatever unit the request named, so the unit is left out along
+ * with the value it would have counted. It is still checked first, because
+ * real Cognito refuses a unit it does not have whether or not the unit ends
+ * up counting anything.
+ */
+export function makeSimCognitoRefreshTokenLifetime(requested, unit) {
+    requireCognitoTokenValidityUnit(refreshTokenLifetimeSpec.field, unit, refreshTokenLifetimeSpec.defaultUnit);
+    if (requested === undefined || requested === 0) {
+        return new SimCognitoTokenLifetime({
+            ...refreshTokenLifetimeSpec,
+            validity: defaultRefreshTokenValidityDays,
+            unit: undefined,
+        });
+    }
+    return new SimCognitoTokenLifetime({
+        ...refreshTokenLifetimeSpec,
+        validity: requested,
+        unit,
+    });
+}
+//# sourceMappingURL=sim-cognito-refresh-token-lifetime.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-refresh-token-lifetime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-refresh-token-lifetime.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-refresh-token-lifetime.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,uCAAuC,CAAC;AAE/C;;;;;;;;;GASG;AACH,MAAM,UAAU,kCAAkC,CAChD,SAA6B,EAC7B,IAAwB;IAExB,+BAA+B,CAC7B,wBAAwB,CAAC,KAAK,EAC9B,IAAI,EACJ,wBAAwB,CAAC,WAAW,CACrC,CAAC;IAEF,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,uBAAuB,CAAC;YACjC,GAAG,wBAAwB;YAC3B,QAAQ,EAAE,+BAA+B;YACzC,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,uBAAuB,CAAC;QACjC,GAAG,wBAAwB;QAC3B,QAAQ,EAAE,SAAS;QACnB,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime-specs.d.ts

@@ -0,0 +1,29 @@
+import type { SimCognitoTokenLifetimeProperties } from "./sim-cognito-token-lifetime.js";
+/**
+ * What Cognito allows one kind of token, apart from the validity a request
+ * asks for.
+ */
+type SimCognitoTokenLifetimeSpec = Omit<SimCognitoTokenLifetimeProperties, "validity" | "unit">;
+/**
+ * The number of days a refresh token lasts when the request says nothing.
+ *
+ * Cognito reports this default on the client rather than leaving the field
+ * out, and it overwrites a requested `0` with it.
+ */
+export declare const defaultRefreshTokenValidityDays = 30;
+/**
+ * Access tokens are counted in hours, last an hour by default, and may last
+ * between five minutes and a day.
+ */
+export declare const accessTokenLifetimeSpec: SimCognitoTokenLifetimeSpec;
+/**
+ * ID tokens follow the same rules as access tokens.
+ */
+export declare const idTokenLifetimeSpec: SimCognitoTokenLifetimeSpec;
+/**
+ * Refresh tokens are counted in days, last thirty by default, and may last
+ * between an hour and ten years.
+ */
+export declare const refreshTokenLifetimeSpec: SimCognitoTokenLifetimeSpec;
+export {};
+//# sourceMappingURL=sim-cognito-token-lifetime-specs.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime-specs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-lifetime-specs.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-token-lifetime-specs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAEzF;;;GAGG;AACH,KAAK,2BAA2B,GAAG,IAAI,CACrC,iCAAiC,EACjC,UAAU,GAAG,MAAM,CACpB,CAAC;AAOF;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,2BAMrC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,2BAGjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,2BAMtC,CAAC"}

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime-specs.js

@@ -0,0 +1,41 @@
+const oneHourSeconds = 60 * 60;
+const oneDaySeconds = 24 * oneHourSeconds;
+const fiveMinutesSeconds = 5 * 60;
+const tenYearsSeconds = 315_360_000;
+/**
+ * The number of days a refresh token lasts when the request says nothing.
+ *
+ * Cognito reports this default on the client rather than leaving the field
+ * out, and it overwrites a requested `0` with it.
+ */
+export const defaultRefreshTokenValidityDays = 30;
+/**
+ * Access tokens are counted in hours, last an hour by default, and may last
+ * between five minutes and a day.
+ */
+export const accessTokenLifetimeSpec = {
+    field: "AccessTokenValidity",
+    defaultUnit: "hours",
+    defaultSeconds: oneHourSeconds,
+    leastSeconds: fiveMinutesSeconds,
+    mostSeconds: oneDaySeconds,
+};
+/**
+ * ID tokens follow the same rules as access tokens.
+ */
+export const idTokenLifetimeSpec = {
+    ...accessTokenLifetimeSpec,
+    field: "IdTokenValidity",
+};
+/**
+ * Refresh tokens are counted in days, last thirty by default, and may last
+ * between an hour and ten years.
+ */
+export const refreshTokenLifetimeSpec = {
+    field: "RefreshTokenValidity",
+    defaultUnit: "days",
+    defaultSeconds: defaultRefreshTokenValidityDays * oneDaySeconds,
+    leastSeconds: oneHourSeconds,
+    mostSeconds: tenYearsSeconds,
+};
+//# sourceMappingURL=sim-cognito-token-lifetime-specs.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime-specs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-lifetime-specs.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-token-lifetime-specs.ts"],"names":[],"mappings":"AAWA,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,CAAC;AAC/B,MAAM,aAAa,GAAG,EAAE,GAAG,cAAc,CAAC;AAC1C,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,CAAC;AAClC,MAAM,eAAe,GAAG,WAAW,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAgC;IAClE,KAAK,EAAE,qBAAqB;IAC5B,WAAW,EAAE,OAAO;IACpB,cAAc,EAAE,cAAc;IAC9B,YAAY,EAAE,kBAAkB;IAChC,WAAW,EAAE,aAAa;CAC3B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAgC;IAC9D,GAAG,uBAAuB;IAC1B,KAAK,EAAE,iBAAiB;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAgC;IACnE,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,MAAM;IACnB,cAAc,EAAE,+BAA+B,GAAG,aAAa;IAC/D,YAAY,EAAE,cAAc;IAC5B,WAAW,EAAE,eAAe;CAC7B,CAAC"}

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime.d.ts

@@ -0,0 +1,49 @@
+export type SimCognitoTokenValidityUnit = "seconds" | "minutes" | "hours" | "days";
+/**
+ * What one token lifetime is made of: the validity a request asked for, the
+ * unit it is counted in, and what Cognito allows for that kind of token.
+ */
+export interface SimCognitoTokenLifetimeProperties {
+    /**
+     * The request input the validity came from, such as `AccessTokenValidity`.
+     */
+    readonly field: string;
+    readonly validity: number | undefined;
+    readonly unit: string | undefined;
+    readonly defaultUnit: SimCognitoTokenValidityUnit;
+    readonly defaultSeconds: number;
+    readonly leastSeconds: number;
+    readonly mostSeconds: number;
+}
+/**
+ * How long one kind of token from an app client lasts.
+ *
+ * A validity is a number in a unit, and the two arrive in separate request
+ * inputs, so the same `1` means an hour for an access token and a day for a
+ * refresh token. Resolving both into seconds in one place is what stops the
+ * pairing being got wrong somewhere later.
+ */
+export declare class SimCognitoTokenLifetime {
+    /**
+     * The validity as the request wrote it, which is what Cognito reports back.
+     */
+    readonly validity: number | undefined;
+    /**
+     * The unit the validity is counted in, defaulted as Cognito defaults it.
+     */
+    readonly unit: SimCognitoTokenValidityUnit;
+    /**
+     * How long the token lasts, in seconds.
+     */
+    readonly seconds: number;
+    constructor(properties: SimCognitoTokenLifetimeProperties);
+}
+/**
+ * Read a requested token validity unit, or refuse one Cognito does not have.
+ *
+ * This is separate from the lifetime it belongs to because a unit is refused
+ * whether or not the validity counted in it is used. A request naming a unit
+ * and no validity still fails on real Cognito, so it fails here.
+ */
+export declare function requireCognitoTokenValidityUnit(field: string, unit: string | undefined, fallback: SimCognitoTokenValidityUnit): SimCognitoTokenValidityUnit;
+//# sourceMappingURL=sim-cognito-token-lifetime.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-lifetime.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-token-lifetime.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,2BAA2B,GACrC,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;AAS3C;;;GAGG;AACH,MAAM,WAAW,iCAAiC;IAChD;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAC;IAClD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC;;OAEG;IACH,SAAgB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAE7C;;OAEG;IACH,SAAgB,IAAI,EAAE,2BAA2B,CAAC;IAElD;;OAEG;IACH,SAAgB,OAAO,EAAE,MAAM,CAAC;IAEhC,YAAY,UAAU,EAAE,iCAAiC,EAiCxD;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,QAAQ,EAAE,2BAA2B,GACpC,2BAA2B,CAa7B"}

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime.js

@@ -0,0 +1,66 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+const secondsPerUnit = {
+    seconds: 1,
+    minutes: 60,
+    hours: 60 * 60,
+    days: 24 * 60 * 60,
+};
+/**
+ * How long one kind of token from an app client lasts.
+ *
+ * A validity is a number in a unit, and the two arrive in separate request
+ * inputs, so the same `1` means an hour for an access token and a day for a
+ * refresh token. Resolving both into seconds in one place is what stops the
+ * pairing being got wrong somewhere later.
+ */
+export class SimCognitoTokenLifetime {
+    /**
+     * The validity as the request wrote it, which is what Cognito reports back.
+     */
+    validity;
+    /**
+     * The unit the validity is counted in, defaulted as Cognito defaults it.
+     */
+    unit;
+    /**
+     * How long the token lasts, in seconds.
+     */
+    seconds;
+    constructor(properties) {
+        const { field, validity, defaultSeconds, leastSeconds, mostSeconds } = properties;
+        this.unit = requireCognitoTokenValidityUnit(field, properties.unit, properties.defaultUnit);
+        this.validity = validity;
+        if (validity === undefined) {
+            this.seconds = defaultSeconds;
+            return;
+        }
+        if (!Number.isSafeInteger(validity) || validity < 0) {
+            throw new SimCognitoInvalidParameterException(`${field} must be a whole number of ${this.unit}`);
+        }
+        const seconds = validity * secondsPerUnit[this.unit];
+        if (seconds < leastSeconds || seconds > mostSeconds) {
+            throw new SimCognitoInvalidParameterException(`${field} of ${String(validity)} ${this.unit} is outside the range ` +
+                `Cognito allows: between ${String(leastSeconds)} and ` +
+                `${String(mostSeconds)} seconds`);
+        }
+        this.seconds = seconds;
+    }
+}
+/**
+ * Read a requested token validity unit, or refuse one Cognito does not have.
+ *
+ * This is separate from the lifetime it belongs to because a unit is refused
+ * whether or not the validity counted in it is used. A request naming a unit
+ * and no validity still fails on real Cognito, so it fails here.
+ */
+export function requireCognitoTokenValidityUnit(field, unit, fallback) {
+    if (unit === undefined) {
+        return fallback;
+    }
+    if (!Object.hasOwn(secondsPerUnit, unit)) {
+        throw new SimCognitoInvalidParameterException(`TokenValidityUnits for ${field} is '${unit}', which is not a ` +
+            `Cognito token validity unit: use seconds, minutes, hours or days`);
+    }
+    return unit;
+}
+//# sourceMappingURL=sim-cognito-token-lifetime.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-token-lifetime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-lifetime.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-token-lifetime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAKvF,MAAM,cAAc,GAA0D;IAC5E,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,EAAE,GAAG,EAAE;IACd,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;CACnB,CAAC;AAmBF;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IAClC;;OAEG;IACa,QAAQ,CAAqB;IAE7C;;OAEG;IACa,IAAI,CAA8B;IAElD;;OAEG;IACa,OAAO,CAAS;IAEhC,YAAY,UAA6C;QACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,GAClE,UAAU,CAAC;QAEb,IAAI,CAAC,IAAI,GAAG,+BAA+B,CACzC,KAAK,EACL,UAAU,CAAC,IAAI,EACf,UAAU,CAAC,WAAW,CACvB,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,8BAA8B,IAAI,CAAC,IAAI,EAAE,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAErD,IAAI,OAAO,GAAG,YAAY,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;YACpD,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,wBAAwB;gBAClE,2BAA2B,MAAM,CAAC,YAAY,CAAC,OAAO;gBACtD,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CACnC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAAa,EACb,IAAwB,EACxB,QAAqC;IAErC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,mCAAmC,CAC3C,0BAA0B,KAAK,QAAQ,IAAI,oBAAoB;YAC7D,kEAAkE,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,IAAmC,CAAC;AAC7C,CAAC"}

package/dist/service/cognito/user-pool/client/sim-cognito-token-validity.d.ts

@@ -0,0 +1,41 @@
+import { SimCognitoTokenLifetime } from "./sim-cognito-token-lifetime.js";
+/**
+ * The units an app client's token validities are counted in.
+ *
+ * https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_TokenValidityUnitsType.html
+ */
+export interface SimCognitoTokenValidityUnitsType {
+    readonly AccessToken?: string | undefined;
+    readonly IdToken?: string | undefined;
+    readonly RefreshToken?: string | undefined;
+}
+/**
+ * The token lifetime inputs of a CreateUserPoolClient request.
+ */
+export interface SimCognitoTokenValidityInput {
+    readonly AccessTokenValidity?: number | undefined;
+    readonly IdTokenValidity?: number | undefined;
+    readonly RefreshTokenValidity?: number | undefined;
+    readonly TokenValidityUnits?: SimCognitoTokenValidityUnitsType | undefined;
+}
+/**
+ * How long each kind of token from one simulated app client lasts.
+ *
+ * Access and ID tokens last an hour unless the request says otherwise, and
+ * refresh tokens last thirty days. Those are the values real Cognito applies,
+ * and the hour is the one that catches people out: an access token outliving
+ * a test is a test that never sees expiry handling run.
+ */
+export declare class SimCognitoTokenValidity {
+    readonly accessToken: SimCognitoTokenLifetime;
+    readonly idToken: SimCognitoTokenLifetime;
+    readonly refreshToken: SimCognitoTokenLifetime;
+    private readonly requestedUnits;
+    constructor(input?: SimCognitoTokenValidityInput);
+    /**
+     * The units as Cognito reports them, which is only when the request set
+     * them.
+     */
+    unitsOutput(): SimCognitoTokenValidityUnitsType | undefined;
+}
+//# sourceMappingURL=sim-cognito-token-validity.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-token-validity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-validity.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-token-validity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAM1E;;;;GAIG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gCAAgC,GAAG,SAAS,CAAC;CAC5E;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC,SAAgB,WAAW,EAAE,uBAAuB,CAAC;IACrD,SAAgB,OAAO,EAAE,uBAAuB,CAAC;IACjD,SAAgB,YAAY,EAAE,uBAAuB,CAAC;IAEtD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA+C;IAE9E,YAAY,KAAK,GAAE,4BAAiC,EAkBnD;IAED;;;OAGG;IACH,WAAW,IAAI,gCAAgC,GAAG,SAAS,CAE1D;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-token-validity.js

@@ -0,0 +1,40 @@
+import { makeSimCognitoRefreshTokenLifetime } from "./sim-cognito-refresh-token-lifetime.js";
+import { SimCognitoTokenLifetime } from "./sim-cognito-token-lifetime.js";
+import { accessTokenLifetimeSpec, idTokenLifetimeSpec, } from "./sim-cognito-token-lifetime-specs.js";
+/**
+ * How long each kind of token from one simulated app client lasts.
+ *
+ * Access and ID tokens last an hour unless the request says otherwise, and
+ * refresh tokens last thirty days. Those are the values real Cognito applies,
+ * and the hour is the one that catches people out: an access token outliving
+ * a test is a test that never sees expiry handling run.
+ */
+export class SimCognitoTokenValidity {
+    accessToken;
+    idToken;
+    refreshToken;
+    requestedUnits;
+    constructor(input = {}) {
+        const units = input.TokenValidityUnits;
+        this.requestedUnits = units;
+        this.accessToken = new SimCognitoTokenLifetime({
+            ...accessTokenLifetimeSpec,
+            validity: input.AccessTokenValidity,
+            unit: units?.AccessToken,
+        });
+        this.idToken = new SimCognitoTokenLifetime({
+            ...idTokenLifetimeSpec,
+            validity: input.IdTokenValidity,
+            unit: units?.IdToken,
+        });
+        this.refreshToken = makeSimCognitoRefreshTokenLifetime(input.RefreshTokenValidity, units?.RefreshToken);
+    }
+    /**
+     * The units as Cognito reports them, which is only when the request set
+     * them.
+     */
+    unitsOutput() {
+        return this.requestedUnits;
+    }
+}
+//# sourceMappingURL=sim-cognito-token-validity.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-token-validity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-validity.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-token-validity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EACL,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAuB/C;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IAClB,WAAW,CAA0B;IACrC,OAAO,CAA0B;IACjC,YAAY,CAA0B;IAErC,cAAc,CAA+C;IAE9E,YAAY,KAAK,GAAiC,EAAE;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,kBAAkB,CAAC;QAEvC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,IAAI,uBAAuB,CAAC;YAC7C,GAAG,uBAAuB;YAC1B,QAAQ,EAAE,KAAK,CAAC,mBAAmB;YACnC,IAAI,EAAE,KAAK,EAAE,WAAW;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,uBAAuB,CAAC;YACzC,GAAG,mBAAmB;YACtB,QAAQ,EAAE,KAAK,CAAC,eAAe;YAC/B,IAAI,EAAE,KAAK,EAAE,OAAO;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,kCAAkC,CACpD,KAAK,CAAC,oBAAoB,EAC1B,KAAK,EAAE,YAAY,CACpB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-factory.d.ts

@@ -0,0 +1,33 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
+import { type SimCognitoTokenValidityInput } from "./sim-cognito-token-validity.js";
+import { SimCognitoUserPoolClient } from "./sim-cognito-user-pool-client.js";
+interface SimCognitoUserPoolClientFactoryProperties {
+    readonly clock: SimClock;
+}
+interface SimCognitoMakeUserPoolClientProperties {
+    readonly pool: SimCognitoUserPool;
+    readonly name: string | undefined;
+    readonly generateSecret?: boolean | undefined;
+    readonly explicitAuthFlows?: readonly string[] | undefined;
+    readonly preventUserExistenceErrors?: string | undefined;
+    readonly tokenValidity: SimCognitoTokenValidityInput;
+}
+/**
+ * Builds simulated app clients, including their id and their secret.
+ */
+export declare class SimCognitoUserPoolClientFactory {
+    private readonly clock;
+    constructor(properties: SimCognitoUserPoolClientFactoryProperties);
+    /**
+     * Make a new app client for a pool.
+     *
+     * A secret is generated only for a request that asked for one, because
+     * whether a client has a secret changes what its application has to send:
+     * Cognito wants a `SECRET_HASH` on requests from a client that has one.
+     */
+    make(properties: SimCognitoMakeUserPoolClientProperties): SimCognitoUserPoolClient;
+    private secretFor;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-pool-client-factory.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-client-factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAItE,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAG7E,UAAU,yCAAyC;IACjD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,aAAa,EAAE,4BAA4B,CAAC;CACtD;AAED;;GAEG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,yCAAyC,EAEhE;IAED;;;;;;OAMG;IACH,IAAI,CACF,UAAU,EAAE,sCAAsC,GACjD,wBAAwB,CAoB1B;IAED,OAAO,CAAC,SAAS;CAOlB"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-factory.js

@@ -0,0 +1,46 @@
+import { SimCognitoName } from "../sim-cognito-name.js";
+import { makeSimCognitoClientSecret } from "./sim-cognito-client-secret.js";
+import { SimCognitoExplicitAuthFlows } from "./sim-cognito-explicit-auth-flows.js";
+import { SimCognitoPreventUserExistenceErrors } from "./sim-cognito-prevent-user-existence-errors.js";
+import { SimCognitoTokenValidity, } from "./sim-cognito-token-validity.js";
+import { SimCognitoUserPoolClient } from "./sim-cognito-user-pool-client.js";
+import { makeSimCognitoUserPoolClientId } from "./sim-cognito-user-pool-client-id.js";
+/**
+ * Builds simulated app clients, including their id and their secret.
+ */
+export class SimCognitoUserPoolClientFactory {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    /**
+     * Make a new app client for a pool.
+     *
+     * A secret is generated only for a request that asked for one, because
+     * whether a client has a secret changes what its application has to send:
+     * Cognito wants a `SECRET_HASH` on requests from a client that has one.
+     */
+    make(properties) {
+        const { pool } = properties;
+        return new SimCognitoUserPoolClient({
+            id: makeSimCognitoUserPoolClientId(pool.clientIds),
+            userPoolId: pool.id,
+            name: new SimCognitoName({
+                field: "ClientName",
+                value: properties.name,
+            }),
+            secret: this.secretFor(properties.generateSecret),
+            explicitAuthFlows: new SimCognitoExplicitAuthFlows(properties.explicitAuthFlows),
+            preventUserExistenceErrors: new SimCognitoPreventUserExistenceErrors(properties.preventUserExistenceErrors),
+            tokenValidity: new SimCognitoTokenValidity(properties.tokenValidity),
+            createdDate: this.clock.now(),
+        });
+    }
+    secretFor(generateSecret) {
+        if (generateSecret !== true) {
+            return undefined;
+        }
+        return makeSimCognitoClientSecret();
+    }
+}
+//# sourceMappingURL=sim-cognito-user-pool-client-factory.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-client-factory.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AACtG,OAAO,EACL,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAetF;;GAEG;AACH,MAAM,OAAO,+BAA+B;IACzB,KAAK,CAAW;IAEjC,YAAY,UAAqD;QAC/D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CACF,UAAkD;QAElD,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAE5B,OAAO,IAAI,wBAAwB,CAAC;YAClC,EAAE,EAAE,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC;YAClD,UAAU,EAAE,IAAI,CAAC,EAAE;YACnB,IAAI,EAAE,IAAI,cAAc,CAAC;gBACvB,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,UAAU,CAAC,IAAI;aACvB,CAAC;YACF,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC;YACjD,iBAAiB,EAAE,IAAI,2BAA2B,CAChD,UAAU,CAAC,iBAAiB,CAC7B;YACD,0BAA0B,EAAE,IAAI,oCAAoC,CAClE,UAAU,CAAC,0BAA0B,CACtC;YACD,aAAa,EAAE,IAAI,uBAAuB,CAAC,UAAU,CAAC,aAAa,CAAC;YACpE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,cAAmC;QACnD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,0BAA0B,EAAE,CAAC;IACtC,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-id.d.ts

@@ -0,0 +1,11 @@
+import type { Brand } from "../../../../util/brand.type.js";
+export type SimCognitoUserPoolClientId = Brand<string, "SimCognitoUserPoolClientId">;
+/**
+ * Allocate an app client id.
+ */
+export declare function makeSimCognitoUserPoolClientId(existing?: Set<string>): SimCognitoUserPoolClientId;
+/**
+ * Read a requested app client id, or refuse a malformed one.
+ */
+export declare function requireSimCognitoUserPoolClientId(value: string | undefined): SimCognitoUserPoolClientId;
+//# sourceMappingURL=sim-cognito-user-pool-client-id.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-pool-client-id.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-id.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAG5D,MAAM,MAAM,0BAA0B,GAAG,KAAK,CAC5C,MAAM,EACN,4BAA4B,CAC7B,CAAC;AAYF;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,cAAoB,GAC3B,0BAA0B,CAc5B;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,0BAA0B,CAc5B"}