@kensio/yulin 1.12.0 → 1.12.1

package/dist/service/cognito/sim-cognito-federation.js

@@ -0,0 +1,99 @@
+import { SimCognitoUserDirectory, } from "./sim-cognito-user-directory.js";
+/**
+ * The federated half of simulated Cognito: the domain a pool is signed in at,
+ * the external identity providers it federates to, and the OAuth endpoints
+ * that domain serves.
+ *
+ * The domain and provider operations are ordinary SDK commands.
+ * `hostedAuthorize`, `hostedToken` and `hostedSignOut` are not: they are the
+ * three endpoints a browser and an application's own server reach over HTTP,
+ * and the serving layer is what turns a request into one of them. They are
+ * here because they belong to this service's state, and because a test that
+ * wants to drive a sign-in without an HTTP round trip can call them directly.
+ */
+export class SimCognitoFederation extends SimCognitoUserDirectory {
+    constructor(properties) {
+        super(properties);
+    }
+    /**
+     * Handle a CreateUserPoolDomain Command from the SDK.
+     */
+    async createUserPoolDomain(command, options) {
+        await this.background.sequence();
+        return this.commands.domains.create(command, options);
+    }
+    /**
+     * Handle a DescribeUserPoolDomain Command from the SDK.
+     */
+    async describeUserPoolDomain(command, options) {
+        await this.background.sequence();
+        return this.commands.domains.describe(command, options);
+    }
+    /**
+     * Handle a DeleteUserPoolDomain Command from the SDK.
+     */
+    async deleteUserPoolDomain(command, options) {
+        await this.background.sequence();
+        return this.commands.domains.delete(command, options);
+    }
+    /**
+     * Handle a CreateIdentityProvider Command from the SDK.
+     */
+    async createIdentityProvider(command, options) {
+        await this.background.sequence();
+        return this.commands.identityProviders.create(command, options);
+    }
+    /**
+     * Handle a DescribeIdentityProvider Command from the SDK.
+     */
+    async describeIdentityProvider(command, options) {
+        await this.background.sequence();
+        return this.commands.identityProviders.describe(command, options);
+    }
+    /**
+     * Handle an UpdateIdentityProvider Command from the SDK.
+     */
+    async updateIdentityProvider(command, options) {
+        await this.background.sequence();
+        return this.commands.identityProviders.update(command, options);
+    }
+    /**
+     * Handle a DeleteIdentityProvider Command from the SDK.
+     */
+    async deleteIdentityProvider(command, options) {
+        await this.background.sequence();
+        return this.commands.identityProviders.delete(command, options);
+    }
+    /**
+     * Handle a ListIdentityProviders Command from the SDK.
+     */
+    async listIdentityProviders(command, options) {
+        await this.background.sequence();
+        return this.commands.identityProviders.list(command, options);
+    }
+    /**
+     * Handle a request to a pool's `/oauth2/authorize` endpoint.
+     *
+     * The answer is where the browser goes next, which for a request that signs
+     * a user in is the app client's callback URL carrying an authorization code.
+     */
+    async hostedAuthorize(pool, input) {
+        await this.background.sequence();
+        return this.commands.hosted.authorize.handle(pool, input);
+    }
+    /**
+     * Handle a request to a pool's `/oauth2/token` endpoint.
+     */
+    async hostedToken(pool, input) {
+        await this.background.sequence();
+        return await this.commands.hosted.token.handle(pool, input);
+    }
+    /**
+     * Handle a request to a pool's `/logout` endpoint.
+     */
+    async hostedSignOut(pool, input) {
+        await this.background.sequence();
+        return this.commands.hosted.logout.handle(pool, input);
+    }
+}
+//# sourceMappingURL=sim-cognito-federation.js.map

package/dist/service/cognito/sim-cognito-federation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-federation.js","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-federation.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AAUzC;;;;;;;;;;;GAWG;AACH,MAAM,OAAgB,oBAAqB,SAAQ,uBAAuB;IACxE,YAAsB,UAA0C;QAC9D,KAAK,CAAC,UAAU,CAAC,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D,EAC1D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D,EAC1D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAA8D,EAC9D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CACzB,OAA2D,EAC3D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CACnB,IAAwB,EACxB,KAA+B;QAE/B,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,IAAwB,EACxB,KAA2B;QAE3B,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,IAAwB,EACxB,KAA4B;QAE5B,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/service/cognito/sim-cognito-identity-provider.d.ts

@@ -4,8 +4,11 @@ import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-sco
 import { type SimIamInterServiceAuthZ } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimCognitoCfnResourceFactory } from "./cfn/sim-cfn-cognito-resource-factory.js";
 import type * as simCognitoCommands from "./command/sim-cognito-command.types.js";
+import { SimCognitoDomainRegistry } from "./registry/sim-cognito-domain-registry.js";
 import { SimCognitoUserPoolRegistry } from "./registry/sim-cognito-user-pool-registry.js";
-import { type SimCognitoIdentityProviderRequestOptions, SimCognitoUserDirectory } from "./sim-cognito-user-directory.js";
+import { SimCognitoFederation } from "./sim-cognito-federation.js";
+import type { SimCognitoIdentityProviderRequestOptions } from "./sim-cognito-user-directory.js";
+import type { SimCognitoUserPoolDomain } from "./user-pool/domain/sim-cognito-user-pool-domain.js";
 import type { SimCognitoUserPool } from "./user-pool/sim-cognito-user-pool.js";
 import { type SimCognitoTriggerFunctions } from "./user-pool/trigger/sim-cognito-trigger-functions.js";
 export type { SimCognitoIdentityProviderRequestOptions } from "./sim-cognito-user-directory.js";
@@ -19,6 +22,13 @@ interface SimCognitoIdentityProviderProperties {
      * layer, whichever scope created it.
      */
     readonly userPoolRegistry?: SimCognitoUserPoolRegistry;
+    /**
+     * Where every hosted domain in the simulation is indexed. A domain is unique
+     * across the whole of AWS rather than within one Account, and a request to
+     * one carries a hostname that says nothing about which Account owns the pool
+     * behind it.
+     */
+    readonly domainRegistry?: SimCognitoDomainRegistry;
     /**
      * The Lambda functions a pool's triggers can reach, which is the whole
      * simulation rather than this scope: a `LambdaConfig` names a function by
@@ -41,12 +51,21 @@ interface SimCognitoIdentityProviderProperties {
  * Only user pools are simulated. Cognito identity pools, which hand out AWS
  * credentials, are a different service and are not simulated at all.
  */
-export declare class SimCognitoIdentityProvider extends SimCognitoUserDirectory {
+export declare class SimCognitoIdentityProvider extends SimCognitoFederation {
     private readonly pools;
     private readonly userPoolRegistry;
+    private readonly domainRegistry;
     private readonly sdkRouter;
     private readonly cfnFactory;
     constructor(properties?: SimCognitoIdentityProviderProperties);
+    /**
+     * Find a hosted domain by the domain string it was created with, in
+     * whichever Account and Region created it.
+     *
+     * A request to a hosted endpoint carries a hostname and nothing else, so
+     * this is what the serving layer resolves it with.
+     */
+    findUserPoolDomainInAnyAccount(domainValue: string): SimCognitoUserPoolDomain | undefined;
     /**
      * Find a user pool by id, in whichever Account and Region created it.
      *

package/dist/service/cognito/sim-cognito-identity-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-identity-provider.d.ts","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,KAAK,KAAK,kBAAkB,MAAM,wCAAwC,CAAC;AAElF,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAE1F,OAAO,EACL,KAAK,wCAAwC,EAC7C,uBAAuB,EACxB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAM/E,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,sDAAsD,CAAC;AAE9D,YAAY,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAEhG,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAE1C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAEvD;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,0BAA2B,SAAQ,uBAAuB;IACrE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAExB;IAEH,YAAY,UAAU,GAAE,oCAAyC,EAuBhE;IAED;;;;;;;OAOG;IACH,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAE3E;IAED;;;;;OAKG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAE/D;IAED;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAE/C;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,kBAAkB,CAAC,wBAAwB,EACpD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAG5D;IAED;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,kBAAkB,CAAC,0BAA0B,EACtD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAG9D;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,kBAAkB,CAAC,wBAAwB,EACpD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAG5D;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,kBAAkB,CAAC,wBAAwB,EACpD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAG5D;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,kBAAkB,CAAC,uBAAuB,EACnD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAG3D;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,EAC1D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,EAC5D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,EAC1D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,EAC1D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,mBAAmB,CACvB,OAAO,EAAE,kBAAkB,CAAC,6BAA6B,EACzD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,mCAAmC,CAAC,CAGjE;IAED;;OAEG;IACH,kBAAkB,IAAI,4BAA4B,CAEjD;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}
+{"version":3,"file":"sim-cognito-identity-provider.d.ts","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,KAAK,KAAK,kBAAkB,MAAM,wCAAwC,CAAC;AAElF,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAE1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAChG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAM/E,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,sDAAsD,CAAC;AAE9D,YAAY,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAEhG,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAE1C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAEvD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAEnD;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,0BAA2B,SAAQ,oBAAoB;IAClE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAExB;IAEH,YAAY,UAAU,GAAE,oCAAyC,EA6BhE;IAED;;;;;;OAMG;IACH,8BAA8B,CAC5B,WAAW,EAAE,MAAM,GAClB,wBAAwB,GAAG,SAAS,CAEtC;IAED;;;;;;;OAOG;IACH,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAE3E;IAED;;;;;OAKG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAE/D;IAED;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAE/C;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,kBAAkB,CAAC,wBAAwB,EACpD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAG5D;IAED;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,kBAAkB,CAAC,0BAA0B,EACtD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAG9D;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,kBAAkB,CAAC,wBAAwB,EACpD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAG5D;IAED;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,kBAAkB,CAAC,wBAAwB,EACpD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAG5D;IAED;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,kBAAkB,CAAC,uBAAuB,EACnD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAG3D;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,EAC1D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,EAC5D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,EAC1D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,EAC1D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,mBAAmB,CACvB,OAAO,EAAE,kBAAkB,CAAC,6BAA6B,EACzD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,mCAAmC,CAAC,CAGjE;IAED;;OAEG;IACH,kBAAkB,IAAI,4BAA4B,CAEjD;IAED;;OAEG;IACH,gBAAgB,IAAI,mBAAmB,CAEtC;CACF"}

package/dist/service/cognito/sim-cognito-identity-provider.js

@@ -3,9 +3,10 @@ import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-s
 import { SimIamAllowAllAuth, } from "../iam/authorize/sim-iam-inter-service-auth-z.js";
 import { SimCognitoCfnResourceFactory } from "./cfn/sim-cfn-cognito-resource-factory.js";
 import { SimCognitoCommands } from "./command/sim-cognito-commands.js";
+import { SimCognitoDomainRegistry } from "./registry/sim-cognito-domain-registry.js";
 import { SimCognitoUserPoolRegistry } from "./registry/sim-cognito-user-pool-registry.js";
 import { SimCognitoSdkCommandRouter } from "./sdk/sim-cognito-sdk-command-router.js";
-import { SimCognitoUserDirectory, } from "./sim-cognito-user-directory.js";
+import { SimCognitoFederation } from "./sim-cognito-federation.js";
 import { requireSimCognitoUserPoolId, } from "./user-pool/sim-cognito-user-pool-id.js";
 import { SimCognitoUserPoolStore } from "./user-pool/sim-cognito-user-pool-store.js";
 import { SimCognitoNoTriggerFunctions, } from "./user-pool/trigger/sim-cognito-trigger-functions.js";
@@ -24,28 +25,44 @@ import { SimCognitoNoTriggerFunctions, } from "./user-pool/trigger/sim-cognito-t
  * Only user pools are simulated. Cognito identity pools, which hand out AWS
  * credentials, are a different service and are not simulated at all.
  */
-export class SimCognitoIdentityProvider extends SimCognitoUserDirectory {
+export class SimCognitoIdentityProvider extends SimCognitoFederation {
     pools;
     userPoolRegistry;
+    domainRegistry;
     sdkRouter = new SimCognitoSdkCommandRouter(this);
     cfnFactory = new SimCognitoCfnResourceFactory({
         cognito: this,
     });
     constructor(properties = {}) {
-        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), userPoolRegistry = new SimCognitoUserPoolRegistry(), triggerFunctions = new SimCognitoNoTriggerFunctions(), } = properties;
-        const pools = new SimCognitoUserPoolStore({ registry: userPoolRegistry });
+        const { accountRegionScope = simAwsAccountRegionScopeFactory.make(), iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), userPoolRegistry = new SimCognitoUserPoolRegistry(), domainRegistry = new SimCognitoDomainRegistry(), triggerFunctions = new SimCognitoNoTriggerFunctions(), } = properties;
+        const pools = new SimCognitoUserPoolStore({
+            registry: userPoolRegistry,
+            domains: domainRegistry,
+        });
         super({
             commands: new SimCognitoCommands({
                 accountRegionScope,
                 iam,
                 clock: background,
                 pools,
+                domains: domainRegistry,
                 triggerFunctions,
             }),
             background,
         });
         this.pools = pools;
         this.userPoolRegistry = userPoolRegistry;
+        this.domainRegistry = domainRegistry;
+    }
+    /**
+     * Find a hosted domain by the domain string it was created with, in
+     * whichever Account and Region created it.
+     *
+     * A request to a hosted endpoint carries a hostname and nothing else, so
+     * this is what the serving layer resolves it with.
+     */
+    findUserPoolDomainInAnyAccount(domainValue) {
+        return this.domainRegistry.find(domainValue);
     }
     /**
      * Find a user pool by id, in whichever Account and Region created it.

package/dist/service/cognito/sim-cognito-identity-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-identity-provider.js","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAEzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAEL,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EACL,2BAA2B,GAE5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EACL,4BAA4B,GAE7B,MAAM,sDAAsD,CAAC;AAwB9D;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,0BAA2B,SAAQ,uBAAuB;IACpD,KAAK,CAA0B;IAC/B,gBAAgB,CAA6B;IAC7C,SAAS,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACjD,UAAU,GAAG,IAAI,4BAA4B,CAAC;QAC7D,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,YAAY,UAAU,GAAyC,EAAE;QAC/D,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,gBAAgB,GAAG,IAAI,0BAA0B,EAAE,EACnD,gBAAgB,GAAG,IAAI,4BAA4B,EAAE,GACtD,GAAG,UAAU,CAAC;QACf,MAAM,KAAK,GAAG,IAAI,uBAAuB,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAE1E,KAAK,CAAC;YACJ,QAAQ,EAAE,IAAI,kBAAkB,CAAC;gBAC/B,kBAAkB;gBAClB,GAAG;gBACH,KAAK,EAAE,UAAU;gBACjB,KAAK;gBACL,gBAAgB;aACjB,CAAC;YACF,UAAU;SACX,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;IAED;;;;;;;OAOG;IACH,wBAAwB,CAAC,UAAkB;QACzC,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,UAAkB;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAkC,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,UAAkB;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAoD,EACpD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAsD,EACtD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAoD,EACpD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAoD,EACpD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,OAAmD,EACnD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D,EAC1D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D,EAC1D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D,EAC1D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAyD,EACzD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-identity-provider.js","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EACL,kBAAkB,GAEnB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAEzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAKnE,OAAO,EACL,2BAA2B,GAE5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EACL,4BAA4B,GAE7B,MAAM,sDAAsD,CAAC;AAgC9D;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,0BAA2B,SAAQ,oBAAoB;IACjD,KAAK,CAA0B;IAC/B,gBAAgB,CAA6B;IAC7C,cAAc,CAA2B;IACzC,SAAS,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACjD,UAAU,GAAG,IAAI,4BAA4B,CAAC;QAC7D,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,YAAY,UAAU,GAAyC,EAAE;QAC/D,MAAM,EACJ,kBAAkB,GAAG,+BAA+B,CAAC,IAAI,EAAE,EAC3D,GAAG,GAAG,IAAI,kBAAkB,EAAE,EAC9B,UAAU,GAAG,IAAI,eAAe,EAAE,EAClC,gBAAgB,GAAG,IAAI,0BAA0B,EAAE,EACnD,cAAc,GAAG,IAAI,wBAAwB,EAAE,EAC/C,gBAAgB,GAAG,IAAI,4BAA4B,EAAE,GACtD,GAAG,UAAU,CAAC;QACf,MAAM,KAAK,GAAG,IAAI,uBAAuB,CAAC;YACxC,QAAQ,EAAE,gBAAgB;YAC1B,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;QAEH,KAAK,CAAC;YACJ,QAAQ,EAAE,IAAI,kBAAkB,CAAC;gBAC/B,kBAAkB;gBAClB,GAAG;gBACH,KAAK,EAAE,UAAU;gBACjB,KAAK;gBACL,OAAO,EAAE,cAAc;gBACvB,gBAAgB;aACjB,CAAC;YACF,UAAU;SACX,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,8BAA8B,CAC5B,WAAmB;QAEnB,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,wBAAwB,CAAC,UAAkB;QACzC,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,UAAkB;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAkC,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,UAAkB;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAoD,EACpD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAsD,EACtD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAoD,EACpD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAoD,EACpD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,OAAmD,EACnD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D,EAC1D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D,EAC1D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D,EAC1D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAyD,EACzD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-authorization-code-store.d.ts

@@ -0,0 +1,28 @@
+import type { SimCognitoAuthorizationCode } from "./sim-cognito-authorization-code.js";
+/**
+ * The authorization codes one simulated user pool has issued and not yet been
+ * given back.
+ *
+ * A code is forgotten as soon as it is redeemed, which is what makes a second
+ * request carrying the same code fail the way it does on real Cognito.
+ */
+export declare class SimCognitoAuthorizationCodeStore {
+    private readonly codes;
+    /**
+     * Remember a code an authorize request handed to a browser.
+     *
+     * A code nobody redeemed is dropped once it has run out, so a simulation
+     * left running does not hold every abandoned sign-in.
+     */
+    add(code: SimCognitoAuthorizationCode): void;
+    /**
+     * Take the code a token request carries, if this pool still holds it.
+     *
+     * Redeeming spends the code, whether or not the rest of the request turns
+     * out to be right: real Cognito treats a code as used once it has been
+     * presented, so a failed exchange cannot be retried with the same one.
+     */
+    spend(value: string | undefined, now: Date): SimCognitoAuthorizationCode | undefined;
+    private forgetExpired;
+}
+//# sourceMappingURL=sim-cognito-authorization-code-store.d.ts.map

package/dist/service/cognito/user-pool/auth/sim-cognito-authorization-code-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-authorization-code-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-authorization-code-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAEvF;;;;;;GAMG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkD;IAExE;;;;;OAKG;IACH,GAAG,CAAC,IAAI,EAAE,2BAA2B,GAAG,IAAI,CAG3C;IAED;;;;;;OAMG;IACH,KAAK,CACH,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,2BAA2B,GAAG,SAAS,CAkBzC;IAED,OAAO,CAAC,aAAa;CAWtB"}

package/dist/service/cognito/user-pool/auth/sim-cognito-authorization-code-store.js

@@ -0,0 +1,52 @@
+/**
+ * The authorization codes one simulated user pool has issued and not yet been
+ * given back.
+ *
+ * A code is forgotten as soon as it is redeemed, which is what makes a second
+ * request carrying the same code fail the way it does on real Cognito.
+ */
+export class SimCognitoAuthorizationCodeStore {
+    codes = new Map();
+    /**
+     * Remember a code an authorize request handed to a browser.
+     *
+     * A code nobody redeemed is dropped once it has run out, so a simulation
+     * left running does not hold every abandoned sign-in.
+     */
+    add(code) {
+        this.forgetExpired(code.issuedAt);
+        this.codes.set(code.value, code);
+    }
+    /**
+     * Take the code a token request carries, if this pool still holds it.
+     *
+     * Redeeming spends the code, whether or not the rest of the request turns
+     * out to be right: real Cognito treats a code as used once it has been
+     * presented, so a failed exchange cannot be retried with the same one.
+     */
+    spend(value, now) {
+        if (value === undefined) {
+            return undefined;
+        }
+        const code = this.codes.get(value);
+        if (code === undefined) {
+            return undefined;
+        }
+        this.codes.delete(value);
+        if (code.isExpiredAt(now)) {
+            return undefined;
+        }
+        return code;
+    }
+    forgetExpired(now) {
+        const expired = this.codes
+            .values()
+            .filter((code) => code.isExpiredAt(now))
+            .map((code) => code.value)
+            .toArray();
+        for (const value of expired) {
+            this.codes.delete(value);
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-authorization-code-store.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-authorization-code-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-authorization-code-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-authorization-code-store.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,OAAO,gCAAgC;IAC1B,KAAK,GAAG,IAAI,GAAG,EAAuC,CAAC;IAExE;;;;;OAKG;IACH,GAAG,CAAC,IAAiC;QACnC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CACH,KAAyB,EACzB,GAAS;QAET,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEzB,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa,CAAC,GAAS;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK;aACvB,MAAM,EAAE;aACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;aACvC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;aACzB,OAAO,EAAE,CAAC;QAEb,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-authorization-code.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The only PKCE method real Cognito supports.
+ */
+export declare const simCognitoCodeChallengeMethod = "S256";
+interface SimCognitoAuthorizationCodeProperties {
+    readonly username: string;
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly scopes: readonly string[];
+    readonly issuedAt: Date;
+    /**
+     * The PKCE challenge the authorize request carried, which the token request
+     * has to produce the verifier for.
+     */
+    readonly codeChallenge?: string | undefined;
+}
+/**
+ * One authorization code, which is what an authorization code grant carries
+ * from the browser to the application's own server.
+ *
+ * The code is opaque, single use and tied to the app client and redirect URI
+ * it was issued for. Everything the token endpoint needs to answer with tokens
+ * is here, because the code is all that request carries.
+ */
+export declare class SimCognitoAuthorizationCode {
+    readonly value: string;
+    readonly username: string;
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly scopes: readonly string[];
+    readonly issuedAt: Date;
+    private readonly codeChallenge;
+    constructor(properties: SimCognitoAuthorizationCodeProperties);
+    /**
+     * Whether this code has run out by a given moment.
+     */
+    isExpiredAt(now: Date): boolean;
+    /**
+     * Whether a token request presents the verifier this code was issued for.
+     *
+     * A code issued without a challenge needs no verifier, and one issued with a
+     * challenge is only redeemed by the verifier it was derived from. Real
+     * Cognito supports the `S256` method alone, so the verifier is hashed rather
+     * than compared as it stands.
+     */
+    matchesVerifier(codeVerifier: string | undefined): boolean;
+    /**
+     * Whether the token request names the redirect URI this code was issued for.
+     */
+    isForRedirect(redirectUri: string | undefined): boolean;
+    /**
+     * Whether this code was issued to an app client.
+     */
+    isFor(clientId: string): boolean;
+}
+export {};
+//# sourceMappingURL=sim-cognito-authorization-code.d.ts.map

package/dist/service/cognito/user-pool/auth/sim-cognito-authorization-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-authorization-code.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-authorization-code.ts"],"names":[],"mappings":"AASA;;GAEG;AACH,eAAO,MAAM,6BAA6B,SAAS,CAAC;AAEpD,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAExB;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAE/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IAEnD,YAAY,UAAU,EAAE,qCAAqC,EAQ5D;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAI9B;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAazD;IAED;;OAEG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEtD;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/B;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-authorization-code.js

@@ -0,0 +1,75 @@
+import { createHash, randomUUID } from "node:crypto";
+/**
+ * How long an authorization code lasts.
+ *
+ * Real Cognito gives one five minutes, and nothing configures that.
+ */
+const codeMinutes = 5;
+/**
+ * The only PKCE method real Cognito supports.
+ */
+export const simCognitoCodeChallengeMethod = "S256";
+/**
+ * One authorization code, which is what an authorization code grant carries
+ * from the browser to the application's own server.
+ *
+ * The code is opaque, single use and tied to the app client and redirect URI
+ * it was issued for. Everything the token endpoint needs to answer with tokens
+ * is here, because the code is all that request carries.
+ */
+export class SimCognitoAuthorizationCode {
+    value;
+    username;
+    clientId;
+    redirectUri;
+    scopes;
+    issuedAt;
+    codeChallenge;
+    constructor(properties) {
+        this.value = randomUUID();
+        this.username = properties.username;
+        this.clientId = properties.clientId;
+        this.redirectUri = properties.redirectUri;
+        this.scopes = properties.scopes;
+        this.issuedAt = properties.issuedAt;
+        this.codeChallenge = properties.codeChallenge;
+    }
+    /**
+     * Whether this code has run out by a given moment.
+     */
+    isExpiredAt(now) {
+        const expiresAt = new Date(this.issuedAt.getTime() + codeMinutes * 60_000);
+        return now.getTime() >= expiresAt.getTime();
+    }
+    /**
+     * Whether a token request presents the verifier this code was issued for.
+     *
+     * A code issued without a challenge needs no verifier, and one issued with a
+     * challenge is only redeemed by the verifier it was derived from. Real
+     * Cognito supports the `S256` method alone, so the verifier is hashed rather
+     * than compared as it stands.
+     */
+    matchesVerifier(codeVerifier) {
+        if (this.codeChallenge === undefined) {
+            return true;
+        }
+        if (codeVerifier === undefined) {
+            return false;
+        }
+        return (createHash("sha256").update(codeVerifier).digest("base64url") ===
+            this.codeChallenge);
+    }
+    /**
+     * Whether the token request names the redirect URI this code was issued for.
+     */
+    isForRedirect(redirectUri) {
+        return this.redirectUri === redirectUri;
+    }
+    /**
+     * Whether this code was issued to an app client.
+     */
+    isFor(clientId) {
+        return this.clientId === clientId;
+    }
+}
+//# sourceMappingURL=sim-cognito-authorization-code.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-authorization-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-authorization-code.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-authorization-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAgBpD;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACtB,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,WAAW,CAAS;IACpB,MAAM,CAAoB;IAC1B,QAAQ,CAAO;IAEd,aAAa,CAAqB;IAEnD,YAAY,UAAiD;QAC3D,IAAI,CAAC,KAAK,GAAG,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,WAAW,GAAG,MAAM,CAAC,CAAC;QAE3E,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,YAAgC;QAC9C,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CACL,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7D,IAAI,CAAC,aAAa,CACnB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,WAA+B;QAC3C,OAAO,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.d.ts

@@ -39,6 +39,14 @@ export declare class SimCognitoIssuedTokenStore {
      * same way, as they do on real Cognito.
      */
     requireRefreshToken(request: SimCognitoRefreshTokenRequest): SimCognitoIssuedToken;
+    /**
+     * Find a refresh token this pool issued and still holds.
+     *
+     * The hosted token endpoint reads one this way rather than through
+     * `requireRefreshToken`, because its refusal is an OAuth error rather than
+     * the API exception a `REFRESH_TOKEN_AUTH` request is answered with.
+     */
+    findRefreshToken(value: string | undefined): SimCognitoIssuedToken | undefined;
     /**
      * Find an access token this pool issued and still honours.
      *

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4C;IAC1E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IAEzE;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAe1B;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKlD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKjD;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAYvB;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMjC;CACF"}
+{"version":3,"file":"sim-cognito-issued-token-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4C;IAC1E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IAEzE;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAe1B;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKlD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKjD;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAYvB;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,qBAAqB,GAAG,SAAS,CAMnC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMjC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.js

@@ -55,6 +55,19 @@ export class SimCognitoIssuedTokenStore {
         }
         return issued;
     }
+    /**
+     * Find a refresh token this pool issued and still holds.
+     *
+     * The hosted token endpoint reads one this way rather than through
+     * `requireRefreshToken`, because its refusal is an OAuth error rather than
+     * the API exception a `REFRESH_TOKEN_AUTH` request is answered with.
+     */
+    findRefreshToken(value) {
+        if (value === undefined) {
+            return undefined;
+        }
+        return this.refreshTokens.get(value);
+    }
     /**
      * Find an access token this pool issued and still honours.
      *

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAYpF;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACpB,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IACzD,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzE;;;OAGG;IACK,MAAM,CAAC,WAAW,CACxB,MAA0C,EAC1C,KAAiD;QAEjD,MAAM,MAAM,GAAG,MAAM;aAClB,MAAM,EAAE;aACR,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7B,OAAO,EAAE,CAAC;QAEb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACpE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAErD,IAAI,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,gCAAgC,CAAC,wBAAwB,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,CAAC,4BAA4B,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAgB;QACzB,MAAM,MAAM,GAAG,CAAC,MAA6B,EAAW,EAAE,CACxD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAE/B,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACnE,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-issued-token-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAYpF;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACpB,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IACzD,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzE;;;OAGG;IACK,MAAM,CAAC,WAAW,CACxB,MAA0C,EAC1C,KAAiD;QAEjD,MAAM,MAAM,GAAG,MAAM;aAClB,MAAM,EAAE;aACR,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7B,OAAO,EAAE,CAAC;QAEb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACpE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAErD,IAAI,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,gCAAgC,CAAC,wBAAwB,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,CAAC,4BAA4B,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,KAAyB;QAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAgB;QACzB,MAAM,MAAM,GAAG,CAAC,MAA6B,EAAW,EAAE,CACxD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAE/B,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACnE,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.d.ts

@@ -4,6 +4,11 @@ interface SimCognitoIssuedTokenProperties {
     readonly clientId: string;
     readonly issuedAt: Date;
     readonly expiresAt: Date;
+    /**
+     * The scopes the sign-in this token came from was granted, which a refresh
+     * gives the tokens it hands out next.
+     */
+    readonly scopes?: readonly string[] | undefined;
 }
 /**
  * One token a pool has issued, as the pool remembers it.
@@ -20,6 +25,11 @@ export declare class SimCognitoIssuedToken {
     readonly clientId: string;
     readonly issuedAt: Date;
     readonly expiresAt: Date;
+    /**
+     * The scopes the sign-in was granted, which a token from the API carries
+     * none of: the scope of one of those is settled where the token is signed.
+     */
+    readonly scopes: readonly string[];
     constructor(properties: SimCognitoIssuedTokenProperties);
     /**
      * Whether this token has run out by a given moment.

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAAA,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAC/B,SAAgB,SAAS,EAAE,IAAI,CAAC;IAEhC,YAAY,UAAU,EAAE,+BAA+B,EAMtD;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE9B;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/B;CACF"}
+{"version":3,"file":"sim-cognito-issued-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAAA,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAC/B,SAAgB,SAAS,EAAE,IAAI,CAAC;IAEhC;;;OAGG;IACH,SAAgB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,YAAY,UAAU,EAAE,+BAA+B,EAOtD;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE9B;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/B;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.js

@@ -13,12 +13,18 @@ export class SimCognitoIssuedToken {
     clientId;
     issuedAt;
     expiresAt;
+    /**
+     * The scopes the sign-in was granted, which a token from the API carries
+     * none of: the scope of one of those is settled where the token is signed.
+     */
+    scopes;
     constructor(properties) {
         this.value = properties.value;
         this.username = properties.username;
         this.clientId = properties.clientId;
         this.issuedAt = properties.issuedAt;
         this.expiresAt = properties.expiresAt;
+        this.scopes = properties.scopes ?? [];
     }
     /**
      * Whether this token has run out by a given moment.

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAQA;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,QAAQ,CAAO;IACf,SAAS,CAAO;IAEhC,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-issued-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token.ts"],"names":[],"mappings":"AAcA;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAS;IACd,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,QAAQ,CAAO;IACf,SAAS,CAAO;IAEhC;;;OAGG;IACa,MAAM,CAAoB;IAE1C,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpC,CAAC;CACF"}