@kensio/yulin 0.42.0 → 0.44.0

package/dist/service/cognito/user-pool/token/sim-cognito-token-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-claims.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-claims.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;AAEvE;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAC1C,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CACrC,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAMD;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAE7D,YAAY,UAAU,EAAE,+BAA+B,EAEtD;IAED;;OAEG;IACH,KAAK,IAAI,qBAAqB,CAY7B;IAED,OAAO,CAAC,UAAU;CAUnB"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-claims.js

@@ -0,0 +1,41 @@
+function epochSeconds(instant) {
+    return Math.floor(instant.getTime() / 1000);
+}
+/**
+ * The claims a simulated id token and access token share.
+ *
+ * `sub` is the same on both, as it is on real Cognito, so code keying on it
+ * gets the same user whichever token it read. `cognito:groups` is on both too,
+ * in precedence order, and is left out entirely when the user is in no groups
+ * rather than reported as an empty list.
+ */
+export class SimCognitoSharedTokenClaims {
+    properties;
+    constructor(properties) {
+        this.properties = properties;
+    }
+    /**
+     * The claims every token from this pool carries.
+     */
+    build() {
+        const { pool, user, issuedAt, expiresAt, tokenId } = this.properties;
+        return {
+            sub: user.sub,
+            iss: pool.issuerUrl,
+            auth_time: epochSeconds(issuedAt),
+            iat: epochSeconds(issuedAt),
+            exp: epochSeconds(expiresAt),
+            jti: tokenId,
+            ...this.groupClaim(),
+        };
+    }
+    groupClaim() {
+        const { pool, user } = this.properties;
+        const groups = pool.groupsOf(user.username).map((group) => group.name);
+        if (groups.length === 0) {
+            return {};
+        }
+        return { "cognito:groups": groups };
+    }
+}
+//# sourceMappingURL=sim-cognito-token-claims.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-token-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-claims.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-claims.ts"],"names":[],"mappings":"AA2BA,SAAS,YAAY,CAAC,OAAa;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACrB,UAAU,CAAkC;IAE7D,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAErE,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC;YACjC,GAAG,EAAE,YAAY,CAAC,QAAQ,CAAC;YAC3B,GAAG,EAAE,YAAY,CAAC,SAAS,CAAC;YAC5B,GAAG,EAAE,OAAO;YACZ,GAAG,IAAI,CAAC,UAAU,EAAE;SACrB,CAAC;IACJ,CAAC;IAEO,UAAU;QAChB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEvE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.d.ts

@@ -0,0 +1,62 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPoolClient } from "../client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../user/sim-cognito-user.js";
+/**
+ * The tokens one authentication produced.
+ *
+ * `refreshToken` is absent from a token refresh, because real Cognito answers
+ * `REFRESH_TOKEN_AUTH` with a new access and id token and no new refresh
+ * token.
+ */
+export interface SimCognitoIssuedTokens {
+    readonly idToken: string;
+    readonly accessToken: string;
+    readonly refreshToken?: string | undefined;
+    readonly expiresIn: number;
+}
+interface SimCognitoTokenIssuerProperties {
+    readonly clock: SimClock;
+}
+interface SimCognitoIssueTokensProperties {
+    readonly pool: SimCognitoUserPool;
+    readonly client: SimCognitoUserPoolClient;
+    readonly user: SimCognitoUser;
+}
+/**
+ * Issues the tokens a successful authentication answers with.
+ *
+ * Every timestamp comes from the simulation's clock rather than from
+ * `new Date()`, so advancing simulated time expires a token that was valid
+ * before it, and a test can exercise the expiry handling it would otherwise
+ * have to wait an hour for.
+ *
+ * What it issues is remembered on the pool, because the pool is what a refresh
+ * or a sign-out presents a token back to.
+ */
+export declare class SimCognitoTokenIssuer {
+    private readonly clock;
+    constructor(properties: SimCognitoTokenIssuerProperties);
+    private static expiryOf;
+    /**
+     * Sign an id token and an access token for a user, and mint a refresh
+     * token to go with them.
+     *
+     * The two JWTs last as long as the app client says, which is an hour each
+     * unless the client was created with its own validity, and the refresh token
+     * lasts the thirty days real Cognito gives one by default.
+     */
+    issue(properties: SimCognitoIssueTokensProperties): SimCognitoIssuedTokens;
+    /**
+     * Sign a fresh id token and access token for a user that presented a refresh
+     * token.
+     *
+     * No new refresh token comes with them, as none does on real Cognito with
+     * refresh token rotation off, so the caller keeps using the one it has until
+     * that expires.
+     */
+    reissue(properties: SimCognitoIssueTokensProperties): SimCognitoIssuedTokens;
+    private signTokens;
+}
+export {};
+//# sourceMappingURL=sim-cognito-token-issuer.d.ts.map

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-issuer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAalE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,+BAA+B,EAEtD;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,EAAE,+BAA+B,GAAG,sBAAsB,CAmBzE;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU,EAAE,+BAA+B,GAAG,sBAAsB,CAE3E;IAED,OAAO,CAAC,UAAU;CA8CnB"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.js

@@ -0,0 +1,95 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { SimCognitoIssuedToken } from "../auth/sim-cognito-issued-token.js";
+import { SimCognitoAccessToken } from "./sim-cognito-access-token.js";
+import { SimCognitoIdToken } from "./sim-cognito-id-token.js";
+/**
+ * How many bytes a refresh token carries.
+ *
+ * A real refresh token is an opaque string rather than a JWT, so this is one
+ * too. What it means is held on the pool that issued it, which is where
+ * `REFRESH_TOKEN_AUTH` looks it up.
+ */
+const refreshTokenBytes = 48;
+/**
+ * Issues the tokens a successful authentication answers with.
+ *
+ * Every timestamp comes from the simulation's clock rather than from
+ * `new Date()`, so advancing simulated time expires a token that was valid
+ * before it, and a test can exercise the expiry handling it would otherwise
+ * have to wait an hour for.
+ *
+ * What it issues is remembered on the pool, because the pool is what a refresh
+ * or a sign-out presents a token back to.
+ */
+export class SimCognitoTokenIssuer {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    static expiryOf(issuedAt, seconds) {
+        return new Date(issuedAt.getTime() + seconds * 1000);
+    }
+    /**
+     * Sign an id token and an access token for a user, and mint a refresh
+     * token to go with them.
+     *
+     * The two JWTs last as long as the app client says, which is an hour each
+     * unless the client was created with its own validity, and the refresh token
+     * lasts the thirty days real Cognito gives one by default.
+     */
+    issue(properties) {
+        const { pool, client, user } = properties;
+        const issuedAt = this.clock.now();
+        const refreshToken = randomBytes(refreshTokenBytes).toString("base64url");
+        pool.auth.addRefreshToken(new SimCognitoIssuedToken({
+            value: refreshToken,
+            username: user.username,
+            clientId: client.id,
+            issuedAt,
+            expiresAt: SimCognitoTokenIssuer.expiryOf(issuedAt, client.tokenValidity.refreshToken.seconds),
+        }));
+        return { ...this.signTokens(properties, issuedAt), refreshToken };
+    }
+    /**
+     * Sign a fresh id token and access token for a user that presented a refresh
+     * token.
+     *
+     * No new refresh token comes with them, as none does on real Cognito with
+     * refresh token rotation off, so the caller keeps using the one it has until
+     * that expires.
+     */
+    reissue(properties) {
+        return this.signTokens(properties, this.clock.now());
+    }
+    signTokens(properties, issuedAt) {
+        const { pool, client, user } = properties;
+        const accessTokenSeconds = client.tokenValidity.accessToken.seconds;
+        const accessTokenExpiresAt = SimCognitoTokenIssuer.expiryOf(issuedAt, accessTokenSeconds);
+        const idToken = new SimCognitoIdToken({
+            ...properties,
+            issuedAt,
+            expiresAt: SimCognitoTokenIssuer.expiryOf(issuedAt, client.tokenValidity.idToken.seconds),
+            tokenId: randomUUID(),
+        });
+        const accessToken = new SimCognitoAccessToken({
+            ...properties,
+            issuedAt,
+            expiresAt: accessTokenExpiresAt,
+            tokenId: randomUUID(),
+        });
+        const signedAccessToken = pool.signingKey.sign(accessToken.claims());
+        pool.auth.addAccessToken(new SimCognitoIssuedToken({
+            value: signedAccessToken,
+            username: user.username,
+            clientId: client.id,
+            issuedAt,
+            expiresAt: accessTokenExpiresAt,
+        }));
+        return {
+            idToken: pool.signingKey.sign(idToken.claims()),
+            accessToken: signedAccessToken,
+            expiresIn: accessTokenSeconds,
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-token-issuer.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-token-issuer.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAI5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AA0B7B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAW;IAEjC,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,QAAc,EAAE,OAAe;QACrD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAA2C;QAC/C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1E,IAAI,CAAC,IAAI,CAAC,eAAe,CACvB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAC1C;SACF,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IACpE,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,UAA2C;QACjD,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IACvD,CAAC;IAEO,UAAU,CAChB,UAA2C,EAC3C,QAAc;QAEd,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC;QACpE,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,QAAQ,CACzD,QAAQ,EACR,kBAAkB,CACnB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACpC,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CACrC;YACD,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC;YAC5C,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC,IAAI,CAAC,cAAc,CACtB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,oBAAoB;SAChC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC/C,WAAW,EAAE,iBAAiB;YAC9B,SAAS,EAAE,kBAAkB;SAC9B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-attributes.d.ts

@@ -0,0 +1,44 @@
+/**
+ * One user attribute, in the shape Cognito reads and reports it.
+ *
+ * https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AttributeType.html
+ */
+export interface SimCognitoAttributeType {
+    readonly Name?: string | undefined;
+    readonly Value?: string | undefined;
+}
+/**
+ * The attributes held on one simulated user.
+ *
+ * Attribute names are checked against the pool's schema rather than stored as
+ * written, because real Cognito refuses an attribute its schema does not hold.
+ * A pool created here has the standard schema and nothing else, so a
+ * `custom:` attribute is refused the same way it would be on a real pool
+ * created without it.
+ *
+ * `sub` is not among them. Cognito allocates it, and a request setting it is
+ * refused, so it lives on the user rather than in its attributes.
+ */
+export declare class SimCognitoUserAttributes {
+    private readonly byName;
+    constructor(requested?: readonly SimCognitoAttributeType[]);
+    private static requireName;
+    private static requireValue;
+    /**
+     * The attributes by name, in the order they were first set.
+     */
+    get values(): ReadonlyMap<string, string>;
+    /**
+     * The attributes, in the order they were first set.
+     */
+    get entries(): readonly SimCognitoAttributeType[];
+    /**
+     * Apply requested attributes over the ones already held.
+     *
+     * An update names only the attributes it changes, as `AdminUpdateUserAttributes`
+     * does on real Cognito: an attribute the request says nothing about keeps its
+     * value rather than being cleared.
+     */
+    update(requested?: readonly SimCognitoAttributeType[]): void;
+}
+//# sourceMappingURL=sim-cognito-user-attributes.d.ts.map

package/dist/service/cognito/user-pool/user/sim-cognito-user-attributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-attributes.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-attributes.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAiCD;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IAEpD,YAAY,SAAS,CAAC,EAAE,SAAS,uBAAuB,EAAE,EAEzD;IAED,OAAO,CAAC,MAAM,CAAC,WAAW;IAyB1B,OAAO,CAAC,MAAM,CAAC,YAAY;IAiB3B;;OAEG;IACH,IAAI,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAExC;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,SAAS,uBAAuB,EAAE,CAKhD;IAED;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,IAAI,CAa3D;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-attributes.js

@@ -0,0 +1,105 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The standard attributes every Cognito pool's schema holds.
+ *
+ * These are the OpenID Connect claims, plus the two verification flags. A pool
+ * here has no custom attributes, because `CreateUserPool` refuses a `Schema`
+ * of its own.
+ */
+const standardAttributeNames = new Set([
+    "address",
+    "birthdate",
+    "email",
+    "email_verified",
+    "family_name",
+    "gender",
+    "given_name",
+    "locale",
+    "middle_name",
+    "name",
+    "nickname",
+    "phone_number",
+    "phone_number_verified",
+    "picture",
+    "preferred_username",
+    "profile",
+    "updated_at",
+    "website",
+    "zoneinfo",
+]);
+const maxAttributeValueLength = 2048;
+/**
+ * The attributes held on one simulated user.
+ *
+ * Attribute names are checked against the pool's schema rather than stored as
+ * written, because real Cognito refuses an attribute its schema does not hold.
+ * A pool created here has the standard schema and nothing else, so a
+ * `custom:` attribute is refused the same way it would be on a real pool
+ * created without it.
+ *
+ * `sub` is not among them. Cognito allocates it, and a request setting it is
+ * refused, so it lives on the user rather than in its attributes.
+ */
+export class SimCognitoUserAttributes {
+    byName = new Map();
+    constructor(requested) {
+        this.update(requested);
+    }
+    static requireName(name) {
+        if (name === undefined || name === "") {
+            throw new SimCognitoInvalidParameterException("A user attribute needs a Name saying which attribute it sets");
+        }
+        if (name === "sub") {
+            throw new SimCognitoInvalidParameterException("User attribute 'sub' is read-only: Cognito allocates a user's sub " +
+                "when the user is created, and a request cannot set it");
+        }
+        if (!standardAttributeNames.has(name)) {
+            throw new SimCognitoInvalidParameterException(`User attribute '${name}' is not in the pool's schema: a pool here ` +
+                `holds the standard attributes only, because CreateUserPool ` +
+                `refuses a Schema of its own, so custom attributes cannot exist`);
+        }
+        return name;
+    }
+    static requireValue(name, value) {
+        if (value === undefined) {
+            throw new SimCognitoInvalidParameterException(`User attribute '${name}' needs a Value`);
+        }
+        if (value.length > maxAttributeValueLength) {
+            throw new SimCognitoInvalidParameterException(`User attribute '${name}' is longer than the ` +
+                `${String(maxAttributeValueLength)} characters Cognito allows`);
+        }
+        return value;
+    }
+    /**
+     * The attributes by name, in the order they were first set.
+     */
+    get values() {
+        return this.byName;
+    }
+    /**
+     * The attributes, in the order they were first set.
+     */
+    get entries() {
+        return this.byName
+            .entries()
+            .map(([name, value]) => ({ Name: name, Value: value }))
+            .toArray();
+    }
+    /**
+     * Apply requested attributes over the ones already held.
+     *
+     * An update names only the attributes it changes, as `AdminUpdateUserAttributes`
+     * does on real Cognito: an attribute the request says nothing about keeps its
+     * value rather than being cleared.
+     */
+    update(requested) {
+        if (requested === undefined) {
+            return;
+        }
+        for (const attribute of requested) {
+            const name = SimCognitoUserAttributes.requireName(attribute.Name);
+            this.byName.set(name, SimCognitoUserAttributes.requireValue(name, attribute.Value));
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-user-attributes.js.map

package/dist/service/cognito/user-pool/user/sim-cognito-user-attributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-attributes.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-attributes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAYvF;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,SAAS;IACT,WAAW;IACX,OAAO;IACP,gBAAgB;IAChB,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,aAAa;IACb,MAAM;IACN,UAAU;IACV,cAAc;IACd,uBAAuB;IACvB,SAAS;IACT,oBAAoB;IACpB,SAAS;IACT,YAAY;IACZ,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IAClB,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,YAAY,SAA8C;QACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAEO,MAAM,CAAC,WAAW,CAAC,IAAwB;QACjD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,mCAAmC,CAC3C,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mCAAmC,CAC3C,oEAAoE;gBAClE,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,IAAI,6CAA6C;gBAClE,6DAA6D;gBAC7D,gEAAgE,CACnE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,IAAY,EAAE,KAAyB;QACjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,IAAI,iBAAiB,CACzC,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAC3C,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,IAAI,uBAAuB;gBAC5C,GAAG,MAAM,CAAC,uBAAuB,CAAC,4BAA4B,CACjE,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM;aACf,OAAO,EAAE;aACT,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACtD,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,SAA8C;QACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,wBAAwB,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAElE,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,IAAI,EACJ,wBAAwB,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-factory.d.ts

@@ -0,0 +1,34 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { type SimCognitoAttributeType } from "./sim-cognito-user-attributes.js";
+import { SimCognitoUser } from "./sim-cognito-user.js";
+import type { SimCognitoUsername } from "./sim-cognito-username.js";
+interface SimCognitoUserFactoryProperties {
+    readonly clock: SimClock;
+}
+interface SimCognitoMakeUserProperties {
+    readonly username: SimCognitoUsername;
+    readonly attributes?: readonly SimCognitoAttributeType[] | undefined;
+    /**
+     * The password the user starts with, already checked against the pool's
+     * policy. A user made without one has no password at all.
+     */
+    readonly temporaryPassword?: string | undefined;
+}
+/**
+ * Builds simulated users, including the `sub` Cognito allocates.
+ */
+export declare class SimCognitoUserFactory {
+    private readonly clock;
+    constructor(properties: SimCognitoUserFactoryProperties);
+    private static passwordFor;
+    /**
+     * Make a new user for a pool.
+     *
+     * The `sub` is a fresh UUID rather than anything derived from the username,
+     * as it is on real Cognito. Code that treats the two as interchangeable
+     * therefore fails here rather than in a deployment.
+     */
+    make(properties: SimCognitoMakeUserProperties): SimCognitoUser;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-factory.d.ts.map

package/dist/service/cognito/user-pool/user/sim-cognito-user-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-factory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,CAAC;IACrE;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjD;AAED;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,+BAA+B,EAEtD;IAED,OAAO,CAAC,MAAM,CAAC,WAAW;IAU1B;;;;;;OAMG;IACH,IAAI,CAAC,UAAU,EAAE,4BAA4B,GAAG,cAAc,CAQ7D;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-factory.js

@@ -0,0 +1,36 @@
+import { randomUUID } from "node:crypto";
+import { SimCognitoUserAttributes, } from "./sim-cognito-user-attributes.js";
+import { SimCognitoUser } from "./sim-cognito-user.js";
+import { SimCognitoUserPassword } from "./sim-cognito-user-password.js";
+/**
+ * Builds simulated users, including the `sub` Cognito allocates.
+ */
+export class SimCognitoUserFactory {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    static passwordFor(temporaryPassword) {
+        if (temporaryPassword === undefined) {
+            return undefined;
+        }
+        return new SimCognitoUserPassword(temporaryPassword);
+    }
+    /**
+     * Make a new user for a pool.
+     *
+     * The `sub` is a fresh UUID rather than anything derived from the username,
+     * as it is on real Cognito. Code that treats the two as interchangeable
+     * therefore fails here rather than in a deployment.
+     */
+    make(properties) {
+        return new SimCognitoUser({
+            username: properties.username,
+            sub: randomUUID(),
+            attributes: new SimCognitoUserAttributes(properties.attributes),
+            password: SimCognitoUserFactory.passwordFor(properties.temporaryPassword),
+            clock: this.clock,
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-user-factory.js.map

package/dist/service/cognito/user-pool/user/sim-cognito-user-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-factory.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAEL,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAiBxE;;GAEG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAW;IAEjC,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAEO,MAAM,CAAC,WAAW,CACxB,iBAAqC;QAErC,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,UAAwC;QAC3C,OAAO,IAAI,cAAc,CAAC;YACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,GAAG,EAAE,UAAU,EAAE;YACjB,UAAU,EAAE,IAAI,wBAAwB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC/D,QAAQ,EAAE,qBAAqB,CAAC,WAAW,CAAC,UAAU,CAAC,iBAAiB,CAAC;YACzE,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-password.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The password one simulated user can authenticate with.
+ *
+ * The value is held rather than hashed, and nothing exposes it: a caller can
+ * only ask whether a candidate matches. That is a modelling choice rather than
+ * a security boundary, as it is for simulated KMS key material, since this all
+ * runs in one process and anything sharing that process can reach the object.
+ */
+export declare class SimCognitoUserPassword {
+    private readonly value;
+    constructor(value: string);
+    /**
+     * Whether a candidate password is this one.
+     */
+    matches(candidate: string | undefined): boolean;
+}
+//# sourceMappingURL=sim-cognito-user-password.d.ts.map

package/dist/service/cognito/user-pool/user/sim-cognito-user-password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-password.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-password.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAE/B,YAAY,KAAK,EAAE,MAAM,EAExB;IAED;;OAEG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE9C;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-password.js

@@ -0,0 +1,21 @@
+/**
+ * The password one simulated user can authenticate with.
+ *
+ * The value is held rather than hashed, and nothing exposes it: a caller can
+ * only ask whether a candidate matches. That is a modelling choice rather than
+ * a security boundary, as it is for simulated KMS key material, since this all
+ * runs in one process and anything sharing that process can reach the object.
+ */
+export class SimCognitoUserPassword {
+    value;
+    constructor(value) {
+        this.value = value;
+    }
+    /**
+     * Whether a candidate password is this one.
+     */
+    matches(candidate) {
+        return candidate === this.value;
+    }
+}
+//# sourceMappingURL=sim-cognito-user-password.js.map

package/dist/service/cognito/user-pool/user/sim-cognito-user-password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-password.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-password.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IAChB,KAAK,CAAS;IAE/B,YAAY,KAAa;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,SAA6B;QACnC,OAAO,SAAS,KAAK,IAAI,CAAC,KAAK,CAAC;IAClC,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-status.d.ts

@@ -0,0 +1,39 @@
+export type SimCognitoUserStatusValue = "FORCE_CHANGE_PASSWORD" | "CONFIRMED";
+/**
+ * The status of one simulated user.
+ *
+ * Only the two statuses this simulation can reach are modelled. A user created
+ * by `AdminCreateUser` starts in `FORCE_CHANGE_PASSWORD`, which is what stops
+ * it signing in normally on real Cognito, and reaches `CONFIRMED` when an
+ * admin sets a permanent password on it. The other real statuses
+ * (`UNCONFIRMED`, `RESET_REQUIRED`, `EXTERNAL_PROVIDER` and the rest) belong
+ * to sign-up, password resets and federation, none of which are simulated.
+ */
+export declare class SimCognitoUserStatus {
+    /**
+     * The status a user created by an admin starts in.
+     */
+    static readonly forceChangePassword: SimCognitoUserStatus;
+    /**
+     * The status a user with a password of its own reaches.
+     */
+    static readonly confirmed: SimCognitoUserStatus;
+    readonly value: SimCognitoUserStatusValue;
+    private constructor();
+    /**
+     * The status a user reaches when an admin sets a password on it.
+     *
+     * A permanent password is the user's own, so the user is confirmed and can
+     * sign in with it. A temporary one leaves the user having to replace it,
+     * which is the same place `AdminCreateUser` leaves a new user.
+     */
+    static afterPasswordSet(permanent: boolean | undefined): SimCognitoUserStatus;
+    /**
+     * Whether the user has to replace its password before it can sign in.
+     *
+     * This is what turns an authentication into the `NEW_PASSWORD_REQUIRED`
+     * challenge rather than into tokens.
+     */
+    get mustChangePassword(): boolean;
+}
+//# sourceMappingURL=sim-cognito-user-status.d.ts.map

package/dist/service/cognito/user-pool/user/sim-cognito-user-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-status.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-status.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,yBAAyB,GAAG,uBAAuB,GAAG,WAAW,CAAC;AAE9E;;;;;;;;;GASG;AACH,qBAAa,oBAAoB;IAC/B;;OAEG;IACH,gBAAuB,mBAAmB,uBAExC;IAEF;;OAEG;IACH,gBAAuB,SAAS,uBAAyC;IAEzE,SAAgB,KAAK,EAAE,yBAAyB,CAAC;IAEjD,OAAO,eAEN;IAED;;;;;;OAMG;IACH,MAAM,CAAC,gBAAgB,CACrB,SAAS,EAAE,OAAO,GAAG,SAAS,GAC7B,oBAAoB,CAMtB;IAED;;;;;OAKG;IACH,IAAI,kBAAkB,IAAI,OAAO,CAEhC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-status.js

@@ -0,0 +1,47 @@
+/**
+ * The status of one simulated user.
+ *
+ * Only the two statuses this simulation can reach are modelled. A user created
+ * by `AdminCreateUser` starts in `FORCE_CHANGE_PASSWORD`, which is what stops
+ * it signing in normally on real Cognito, and reaches `CONFIRMED` when an
+ * admin sets a permanent password on it. The other real statuses
+ * (`UNCONFIRMED`, `RESET_REQUIRED`, `EXTERNAL_PROVIDER` and the rest) belong
+ * to sign-up, password resets and federation, none of which are simulated.
+ */
+export class SimCognitoUserStatus {
+    /**
+     * The status a user created by an admin starts in.
+     */
+    static forceChangePassword = new SimCognitoUserStatus("FORCE_CHANGE_PASSWORD");
+    /**
+     * The status a user with a password of its own reaches.
+     */
+    static confirmed = new SimCognitoUserStatus("CONFIRMED");
+    value;
+    constructor(value) {
+        this.value = value;
+    }
+    /**
+     * The status a user reaches when an admin sets a password on it.
+     *
+     * A permanent password is the user's own, so the user is confirmed and can
+     * sign in with it. A temporary one leaves the user having to replace it,
+     * which is the same place `AdminCreateUser` leaves a new user.
+     */
+    static afterPasswordSet(permanent) {
+        if (permanent === true) {
+            return this.confirmed;
+        }
+        return this.forceChangePassword;
+    }
+    /**
+     * Whether the user has to replace its password before it can sign in.
+     *
+     * This is what turns an authentication into the `NEW_PASSWORD_REQUIRED`
+     * challenge rather than into tokens.
+     */
+    get mustChangePassword() {
+        return this.value === "FORCE_CHANGE_PASSWORD";
+    }
+}
+//# sourceMappingURL=sim-cognito-user-status.js.map

package/dist/service/cognito/user-pool/user/sim-cognito-user-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-status.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-status.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;OAEG;IACI,MAAM,CAAU,mBAAmB,GAAG,IAAI,oBAAoB,CACnE,uBAAuB,CACxB,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,SAAS,GAAG,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAEzD,KAAK,CAA4B;IAEjD,YAAoB,KAAgC;QAClD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,gBAAgB,CACrB,SAA8B;QAE9B,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,KAAK,KAAK,uBAAuB,CAAC;IAChD,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-store.d.ts

@@ -0,0 +1,46 @@
+import type { SimCognitoUser } from "./sim-cognito-user.js";
+import type { SimCognitoUsername } from "./sim-cognito-username.js";
+/**
+ * The users of one simulated user pool.
+ *
+ * Users are keyed by username, which is what every admin operation names one
+ * by. Usernames are case sensitive here, as they are on a pool created without
+ * a `UsernameConfiguration`, which this simulation refuses.
+ */
+export declare class SimCognitoUserStore {
+    private readonly users;
+    /**
+     * Every user in this pool, in creation order.
+     */
+    get all(): readonly SimCognitoUser[];
+    /**
+     * How many users the pool holds.
+     */
+    get count(): number;
+    /**
+     * Store a newly created user, refusing a username the pool already holds.
+     */
+    add(user: SimCognitoUser): void;
+    /**
+     * Forget a deleted user.
+     */
+    remove(user: SimCognitoUser): void;
+    /**
+     * Find a user by username.
+     */
+    find(username: string): SimCognitoUser | undefined;
+    /**
+     * Resolve a user by username, or refuse.
+     */
+    require(username: SimCognitoUsername): SimCognitoUser;
+    /**
+     * Say why a username reached no user.
+     *
+     * A value that is some user's `sub` gets its own message. Real Cognito
+     * accepts a `sub` where an admin operation asks for a username, and this
+     * simulation resolves users by username only, so the refusal explains
+     * itself rather than looking like the user was never created.
+     */
+    private missingMessage;
+}
+//# sourceMappingURL=sim-cognito-user-store.d.ts.map