@kensio/yulin 1.12.0 → 1.13.0

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-store.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;CACvC;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,0BAA0B,CAAC;CAChD;AAED;;;;;;;;;GASG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,GAAE,iCAAsC,EAE7D;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAWxB;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,kBAAkB,EAAE,CAEvC;IAED;;;;;;OAMG;IACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAErB;IAED;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGlC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGrC;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,GAAG,SAAS,CAErE;IAED;;OAEG;IACH,OAAO,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,CAU5D;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,0BAA0B,GAAG,sBAAsB,CAY1E;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,2BAA2B,CAYxE;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-store.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;CACvC;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IAE/C;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC;CAC7C;AAED;;;;;;;;;GASG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAEnD,YAAY,UAAU,GAAE,iCAAsC,EAG7D;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAWxB;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,kBAAkB,EAAE,CAEvC;IAED;;;;;;OAMG;IACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAErB;IAED;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAGlC;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CASrC;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,GAAG,SAAS,CAErE;IAED;;OAEG;IACH,OAAO,CAAC,UAAU,EAAE,oBAAoB,GAAG,kBAAkB,CAU5D;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,0BAA0B,GAAG,sBAAsB,CAY1E;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,2BAA2B,CAYxE;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.js

@@ -1,4 +1,5 @@
 import { SimCognitoNotAuthorizedException, SimCognitoResourceNotFoundException, } from "../error/sim-cognito.error.js";
+import { SimCognitoDomainRegistry } from "../registry/sim-cognito-domain-registry.js";
 import { SimCognitoUserPoolRegistry } from "../registry/sim-cognito-user-pool-registry.js";
 /**
  * The user pools of one simulated Cognito scope.
@@ -13,8 +14,10 @@ import { SimCognitoUserPoolRegistry } from "../registry/sim-cognito-user-pool-re
 export class SimCognitoUserPoolStore {
     pools = new Map();
     registry;
+    domains;
     constructor(properties = {}) {
         this.registry = properties.registry ?? new SimCognitoUserPoolRegistry();
+        this.domains = properties.domains ?? new SimCognitoDomainRegistry();
     }
     static unexpired(issued, now) {
         if (issued.isExpiredAt(now)) {
@@ -46,11 +49,18 @@ export class SimCognitoUserPoolStore {
         this.registry.register(pool);
     }
     /**
-     * Forget a deleted pool.
+     * Forget a deleted pool, and with it the domain it was served on.
+     *
+     * Deleting a pool takes its domain with it on real Cognito, which is what
+     * frees the domain string for another pool.
      */
     remove(pool) {
         this.pools.delete(pool.id);
         this.registry.deregister(pool);
+        const { domain } = pool.auth;
+        if (domain !== undefined) {
+            this.domains.deregister(domain);
+        }
     }
     /**
      * Find a pool by id.

package/dist/service/cognito/user-pool/sim-cognito-user-pool-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-store.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AA2B3F;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAuB;IACjB,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC9C,QAAQ,CAA6B;IAEtD,YAAY,UAAU,GAAsC,EAAE;QAC5D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,IAAI,0BAA0B,EAAE,CAAC;IAC1E,CAAC;IAEO,MAAM,CAAC,SAAS,CACtB,MAA6B,EAC7B,GAAS;QAET,IAAI,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,gCAAgC,CAAC,2BAA2B,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAwB;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAwB;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAAgC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,UAAgC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,aAAa,UAAU,kBAAkB,CAC1C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAoC;QAChD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAEzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,cAAc,QAAQ,kBAAkB,CACzC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAa,EAAE,GAAS;QACzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAEhD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,gCAAgC,CACxC,gCAAgC,CACjC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-store.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAiC3F;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAuB;IACjB,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC9C,QAAQ,CAA6B;IACrC,OAAO,CAA2B;IAEnD,YAAY,UAAU,GAAsC,EAAE;QAC5D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,IAAI,0BAA0B,EAAE,CAAC;QACxE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,IAAI,wBAAwB,EAAE,CAAC;IACtE,CAAC;IAEO,MAAM,CAAC,SAAS,CACtB,MAA6B,EAC7B,GAAS;QAET,IAAI,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,gCAAgC,CAAC,2BAA2B,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAwB;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAwB;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAE7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAAgC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,UAAgC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,aAAa,UAAU,kBAAkB,CAC1C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAoC;QAChD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAEzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,cAAc,QAAQ,kBAAkB,CACzC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAa,EAAE,GAAS;QACzC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAEhD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,gCAAgC,CACxC,gCAAgC,CACjC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.d.ts

@@ -14,5 +14,10 @@ export declare class SimCognitoAccessToken {
      * The claims this token is signed with.
      */
     claims(): SimCognitoTokenClaims;
+    /**
+     * The `scope` claim, which is a space separated list however many scopes
+     * the sign-in was granted.
+     */
+    private scope;
 }
 //# sourceMappingURL=sim-cognito-access-token.d.ts.map

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-access-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,+BAA+B,CAAC;AAWvC;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,IAAI,qBAAqB,CAU9B;CACF"}
+{"version":3,"file":"sim-cognito-access-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,+BAA+B,CAAC;AAWvC;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,IAAI,qBAAqB,CAU9B;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;CASd"}

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.js

@@ -1,10 +1,10 @@
 import { SimCognitoSharedTokenClaims, } from "./sim-cognito-token-claims.js";
 /**
- * The scope an access token from an admin authentication flow carries.
+ * The scope an access token from an authentication flow in the API carries.
  *
- * Real Cognito issues this scope for sign-in through the user pool API. The
- * scopes a resource server defines reach a token through the hosted UI and
- * client credentials flows, neither of which is simulated.
+ * Real Cognito issues this scope for sign-in through the user pool API, which
+ * asks for no scopes of its own. A sign-in through the hosted endpoints asks
+ * for scopes, and those are what its access token carries instead.
  */
 const userPoolAdminScope = "aws.cognito.signin.user.admin";
 /**
@@ -30,9 +30,20 @@ export class SimCognitoAccessToken {
             ...this.shared.build(),
             client_id: client.id,
             token_use: "access",
-            scope: userPoolAdminScope,
+            scope: this.scope(),
             username: user.username,
         };
     }
+    /**
+     * The `scope` claim, which is a space separated list however many scopes
+     * the sign-in was granted.
+     */
+    scope() {
+        const { scopes } = this.properties;
+        if (scopes === undefined) {
+            return userPoolAdminScope;
+        }
+        return scopes.join(" ");
+    }
 }
 //# sourceMappingURL=sim-cognito-access-token.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-access-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACf,UAAU,CAAkC;IAC5C,MAAM,CAA8B;IAErD,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEzC,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-access-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACf,UAAU,CAAkC;IAC5C,MAAM,CAA8B;IAErD,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEzC,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK;QACX,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.d.ts

@@ -15,6 +15,13 @@ export declare class SimCognitoIdToken {
      * The claims this token is signed with.
      */
     claims(): SimCognitoTokenClaims;
+    /**
+     * Where a federated user came from, which real Cognito reports in the id
+     * token as an array rather than as the JSON string the user attribute holds.
+     *
+     * A user of the pool's own has no such claim at all.
+     */
+    private identityClaims;
     /**
      * The user's attributes, as an id token carries them.
      *

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-id-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-id-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,IAAI,qBAAqB,CAU9B;IAED;;;;;OAKG;IACH,OAAO,CAAC,eAAe;CAGxB"}
+{"version":3,"file":"sim-cognito-id-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-id-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,IAAI,qBAAqB,CAW9B;IAED;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;CAGxB"}

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.js

@@ -22,11 +22,25 @@ export class SimCognitoIdToken {
         return {
             ...this.shared.build(),
             ...this.attributeClaims(),
+            ...this.identityClaims(),
             aud: client.id,
             token_use: "id",
             "cognito:username": user.username,
         };
     }
+    /**
+     * Where a federated user came from, which real Cognito reports in the id
+     * token as an array rather than as the JSON string the user attribute holds.
+     *
+     * A user of the pool's own has no such claim at all.
+     */
+    identityClaims() {
+        const identity = this.properties.user.identity;
+        if (identity === undefined) {
+            return {};
+        }
+        return { identities: [identity.toClaim()] };
+    }
     /**
      * The user's attributes, as an id token carries them.
      *

package/dist/service/cognito/user-pool/token/sim-cognito-id-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-id-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-id-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAkC;IAC5C,MAAM,CAA8B;IAErD,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEzC,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,GAAG,IAAI,CAAC,eAAe,EAAE;YACzB,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,SAAS,EAAE,IAAI;YACf,kBAAkB,EAAE,IAAI,CAAC,QAAQ;SAClC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,eAAe;QACrB,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-id-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-id-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAkC;IAC5C,MAAM,CAA8B;IAErD,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEzC,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,GAAG,IAAI,CAAC,eAAe,EAAE;YACzB,GAAG,IAAI,CAAC,cAAc,EAAE;YACxB,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,SAAS,EAAE,IAAI;YACf,kBAAkB,EAAE,IAAI,CAAC,QAAQ;SAClC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,cAAc;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;QAE/C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACK,eAAe;QACrB,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-claims.d.ts

@@ -1,7 +1,8 @@
 import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
 import type { SimCognitoUserPoolClient } from "../client/sim-cognito-user-pool-client.js";
+import type { SimCognitoIdentityClaim } from "../idp/sim-cognito-federated-identity.js";
 import type { SimCognitoUser } from "../user/sim-cognito-user.js";
-export type SimCognitoClaimValue = string | number | readonly string[];
+export type SimCognitoClaimValue = string | number | readonly string[] | readonly SimCognitoIdentityClaim[];
 /**
  * The claims of one token, in the shape they are signed in.
  */
@@ -16,6 +17,14 @@ export interface SimCognitoTokenClaimsProperties {
      * A fresh id for this token, which becomes its `jti` claim.
      */
     readonly tokenId: string;
+    /**
+     * The scopes the sign-in was granted, which an access token carries.
+     *
+     * A sign-in through the API is granted the one scope that authorizes the
+     * pool's own self-service operations, and one through the hosted endpoints
+     * is granted what the authorize request asked its app client for.
+     */
+    readonly scopes?: readonly string[] | undefined;
 }
 /**
  * The claims a simulated id token and access token share.

package/dist/service/cognito/user-pool/token/sim-cognito-token-claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-token-claims.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;AAEvE;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAC1C,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CACrC,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAMD;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAE7D,YAAY,UAAU,EAAE,+BAA+B,EAEtD;IAED;;OAEG;IACH,KAAK,IAAI,qBAAqB,CAY7B;IAED,OAAO,CAAC,UAAU;CAUnB"}
+{"version":3,"file":"sim-cognito-token-claims.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAC5B,MAAM,GACN,MAAM,GACN,SAAS,MAAM,EAAE,GACjB,SAAS,uBAAuB,EAAE,CAAC;AAEvC;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAC1C,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CACrC,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAMD;;;;;;;GAOG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAE7D,YAAY,UAAU,EAAE,+BAA+B,EAEtD;IAED;;OAEG;IACH,KAAK,IAAI,qBAAqB,CAY7B;IAED,OAAO,CAAC,UAAU;CAUnB"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-claims.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-token-claims.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-claims.ts"],"names":[],"mappings":"AAyBA,SAAS,YAAY,CAAC,OAAa;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACrB,UAAU,CAAkC;IAE7D,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAErE,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC;YACjC,GAAG,EAAE,YAAY,CAAC,QAAQ,CAAC;YAC3B,GAAG,EAAE,YAAY,CAAC,SAAS,CAAC;YAC5B,GAAG,EAAE,OAAO;YACZ,GAAG,IAAI,CAAC,UAAU,EAAE;SACrB,CAAC;IACJ,CAAC;IAEO,UAAU;QAChB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEvE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-token-claims.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-claims.ts"],"names":[],"mappings":"AAuCA,SAAS,YAAY,CAAC,OAAa;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IACrB,UAAU,CAAkC;IAE7D,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAErE,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC;YACjC,GAAG,EAAE,YAAY,CAAC,QAAQ,CAAC;YAC3B,GAAG,EAAE,YAAY,CAAC,SAAS,CAAC;YAC5B,GAAG,EAAE,OAAO;YACZ,GAAG,IAAI,CAAC,UAAU,EAAE;SACrB,CAAC;IACJ,CAAC;IAEO,UAAU;QAChB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEvE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.d.ts

@@ -35,6 +35,11 @@ interface SimCognitoIssueTokensProperties {
      * from a challenge response and from nowhere else, as on real Cognito.
      */
     readonly clientMetadata?: Readonly<Record<string, string>> | undefined;
+    /**
+     * The scopes a hosted sign-in was granted, which reach the access token's
+     * `scope` claim. A sign-in through the API grants none of its own.
+     */
+    readonly scopes?: readonly string[] | undefined;
 }
 /**
  * Issues the tokens a successful authentication answers with.

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-token-issuer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAclE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAE7C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB;;;;;;;;;;;OAWG;IACG,KAAK,CACT,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAoBjC;IAED;;;;;;;OAOG;IACG,OAAO,CACX,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAEjC;YAEa,UAAU;YAqDV,cAAc;CAY7B"}
+{"version":3,"file":"sim-cognito-token-issuer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAclE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAE7C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAEvE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB;;;;;;;;;;;OAWG;IACG,KAAK,CACT,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAuBjC;IAED;;;;;;;OAOG;IACG,OAAO,CACX,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAEjC;YAEa,UAAU;YAqDV,cAAc;CAY7B"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.js

@@ -59,6 +59,9 @@ export class SimCognitoTokenIssuer {
             clientId: client.id,
             issuedAt,
             expiresAt: SimCognitoTokenIssuer.expiryOf(issuedAt, client.tokenValidity.refreshToken.seconds),
+            // A hosted sign-in was granted scopes, and the tokens a refresh hands
+            // out later carry the same ones.
+            scopes: properties.scopes,
         }));
         return { ...signed, refreshToken };
     }

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-token-issuer.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAM5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAuC7B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAW;IAChB,QAAQ,CAA6B;IAEtD,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,QAAc,EAAE,OAAe;QACrD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CACT,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1E,IAAI,CAAC,IAAI,CAAC,eAAe,CACvB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAC1C;SACF,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,UAA2C;QAE3C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,UAA2C,EAC3C,QAAc;QAEd,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC;QACpE,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,QAAQ,CACzD,QAAQ,EACR,kBAAkB,CACnB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACpC,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CACrC;YACD,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC;YAC5C,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,4EAA4E;QAC5E,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAC5C,cAAc,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CACnD,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,cAAc,CACtB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,oBAAoB;SAChC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,WAAW,EAAE,iBAAiB;YAC9B,SAAS,EAAE,kBAAkB;SAC9B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,UAAU,CAAC;QAEpE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,EAAE;YACtD,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-token-issuer.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAM5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AA6C7B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAW;IAChB,QAAQ,CAA6B;IAEtD,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,QAAc,EAAE,OAAe;QACrD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CACT,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1E,IAAI,CAAC,IAAI,CAAC,eAAe,CACvB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAC1C;YACD,sEAAsE;YACtE,iCAAiC;YACjC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,UAA2C;QAE3C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,UAA2C,EAC3C,QAAc;QAEd,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC;QACpE,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,QAAQ,CACzD,QAAQ,EACR,kBAAkB,CACnB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACpC,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CACrC;YACD,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC;YAC5C,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,4EAA4E;QAC5E,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAC5C,cAAc,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CACnD,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,cAAc,CACtB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,oBAAoB;SAChC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,WAAW,EAAE,iBAAiB;YAC9B,SAAS,EAAE,kBAAkB;SAC9B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,UAAU,CAAC;QAEpE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,EAAE;YACtD,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-standard-attributes.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Whether an attribute name is one every pool's schema holds.
+ *
+ * An identity provider's attribute mapping is checked with this when the
+ * provider is created, so a mapping onto an attribute no pool here has is
+ * refused where it was written rather than during a sign-in much later.
+ */
+export declare function isSimCognitoStandardAttribute(name: string): boolean;
+//# sourceMappingURL=sim-cognito-standard-attributes.d.ts.map

package/dist/service/cognito/user-pool/user/sim-cognito-standard-attributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-standard-attributes.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-standard-attributes.ts"],"names":[],"mappings":"AA6BA;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnE"}

package/dist/service/cognito/user-pool/user/sim-cognito-standard-attributes.js

@@ -0,0 +1,39 @@
+/**
+ * The standard attributes every Cognito pool's schema holds.
+ *
+ * These are the OpenID Connect claims, plus the two verification flags. A pool
+ * here has no custom attributes, because `CreateUserPool` refuses a `Schema`
+ * of its own.
+ */
+const standardAttributeNames = new Set([
+    "address",
+    "birthdate",
+    "email",
+    "email_verified",
+    "family_name",
+    "gender",
+    "given_name",
+    "locale",
+    "middle_name",
+    "name",
+    "nickname",
+    "phone_number",
+    "phone_number_verified",
+    "picture",
+    "preferred_username",
+    "profile",
+    "updated_at",
+    "website",
+    "zoneinfo",
+]);
+/**
+ * Whether an attribute name is one every pool's schema holds.
+ *
+ * An identity provider's attribute mapping is checked with this when the
+ * provider is created, so a mapping onto an attribute no pool here has is
+ * refused where it was written rather than during a sign-in much later.
+ */
+export function isSimCognitoStandardAttribute(name) {
+    return standardAttributeNames.has(name);
+}
+//# sourceMappingURL=sim-cognito-standard-attributes.js.map

package/dist/service/cognito/user-pool/user/sim-cognito-standard-attributes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-standard-attributes.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-standard-attributes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,SAAS;IACT,WAAW;IACX,OAAO;IACP,gBAAgB;IAChB,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,aAAa;IACb,MAAM;IACN,UAAU;IACV,cAAc;IACd,uBAAuB;IACvB,SAAS;IACT,oBAAoB;IACpB,SAAS;IACT,YAAY;IACZ,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAY;IACxD,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-attributes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-attributes.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-attributes.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAiCD;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IAEpD,YAAY,SAAS,CAAC,EAAE,SAAS,uBAAuB,EAAE,EAEzD;IAED,OAAO,CAAC,MAAM,CAAC,WAAW;IAyB1B,OAAO,CAAC,MAAM,CAAC,YAAY;IAiB3B;;OAEG;IACH,IAAI,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAExC;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,SAAS,uBAAuB,EAAE,CAKhD;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAMrC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,IAAI,CAa3D;CACF"}
+{"version":3,"file":"sim-cognito-user-attributes.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-attributes.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAID;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IAEpD,YAAY,SAAS,CAAC,EAAE,SAAS,uBAAuB,EAAE,EAEzD;IAED,OAAO,CAAC,MAAM,CAAC,WAAW;IAyB1B,OAAO,CAAC,MAAM,CAAC,YAAY;IAiB3B;;OAEG;IACH,IAAI,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAExC;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,SAAS,uBAAuB,EAAE,CAKhD;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAMrC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,IAAI,CAa3D;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-attributes.js

@@ -1,32 +1,5 @@
 import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
-/**
- * The standard attributes every Cognito pool's schema holds.
- *
- * These are the OpenID Connect claims, plus the two verification flags. A pool
- * here has no custom attributes, because `CreateUserPool` refuses a `Schema`
- * of its own.
- */
-const standardAttributeNames = new Set([
-    "address",
-    "birthdate",
-    "email",
-    "email_verified",
-    "family_name",
-    "gender",
-    "given_name",
-    "locale",
-    "middle_name",
-    "name",
-    "nickname",
-    "phone_number",
-    "phone_number_verified",
-    "picture",
-    "preferred_username",
-    "profile",
-    "updated_at",
-    "website",
-    "zoneinfo",
-]);
+import { isSimCognitoStandardAttribute } from "./sim-cognito-standard-attributes.js";
 const maxAttributeValueLength = 2048;
 /**
  * The attributes held on one simulated user.
@@ -53,7 +26,7 @@ export class SimCognitoUserAttributes {
             throw new SimCognitoInvalidParameterException("User attribute 'sub' is read-only: Cognito allocates a user's sub " +
                 "when the user is created, and a request cannot set it");
         }
-        if (!standardAttributeNames.has(name)) {
+        if (!isSimCognitoStandardAttribute(name)) {
             throw new SimCognitoInvalidParameterException(`User attribute '${name}' is not in the pool's schema: a pool here ` +
                 `holds the standard attributes only, because CreateUserPool ` +
                 `refuses a Schema of its own, so custom attributes cannot exist`);

package/dist/service/cognito/user-pool/user/sim-cognito-user-attributes.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-attributes.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-attributes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAYvF;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,SAAS;IACT,WAAW;IACX,OAAO;IACP,gBAAgB;IAChB,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,aAAa;IACb,MAAM;IACN,UAAU;IACV,cAAc;IACd,uBAAuB;IACvB,SAAS;IACT,oBAAoB;IACpB,SAAS;IACT,YAAY;IACZ,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IAClB,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,YAAY,SAA8C;QACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAEO,MAAM,CAAC,WAAW,CAAC,IAAwB;QACjD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,mCAAmC,CAC3C,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mCAAmC,CAC3C,oEAAoE;gBAClE,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,IAAI,6CAA6C;gBAClE,6DAA6D;gBAC7D,gEAAgE,CACnE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,IAAY,EAAE,KAAyB;QACjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,IAAI,iBAAiB,CACzC,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAC3C,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,IAAI,uBAAuB;gBAC5C,GAAG,MAAM,CAAC,uBAAuB,CAAC,4BAA4B,CACjE,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM;aACf,OAAO,EAAE;aACT,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACtD,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAwB;QAC7B,IAAI,CAAC,MAAM,CACT,KAAK;aACF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aACvC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,SAA8C;QACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,wBAAwB,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAElE,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,IAAI,EACJ,wBAAwB,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-attributes.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-attributes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAYrF,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IAClB,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,YAAY,SAA8C;QACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IAEO,MAAM,CAAC,WAAW,CAAC,IAAwB;QACjD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,mCAAmC,CAC3C,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,mCAAmC,CAC3C,oEAAoE;gBAClE,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,IAAI,6CAA6C;gBAClE,6DAA6D;gBAC7D,gEAAgE,CACnE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,IAAY,EAAE,KAAyB;QACjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,IAAI,iBAAiB,CACzC,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YAC3C,MAAM,IAAI,mCAAmC,CAC3C,mBAAmB,IAAI,uBAAuB;gBAC5C,GAAG,MAAM,CAAC,uBAAuB,CAAC,4BAA4B,CACjE,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM;aACf,OAAO,EAAE;aACT,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACtD,OAAO,EAAE,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAwB;QAC7B,IAAI,CAAC,MAAM,CACT,KAAK;aACF,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aACvC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,SAA8C;QACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,wBAAwB,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAElE,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,IAAI,EACJ,wBAAwB,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-factory.d.ts

@@ -1,4 +1,5 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoFederatedIdentity } from "../idp/sim-cognito-federated-identity.js";
 import type { SimCognitoPasswordPolicy } from "../sim-cognito-password-policy.js";
 import { type SimCognitoAttributeType } from "./sim-cognito-user-attributes.js";
 import { SimCognitoUser } from "./sim-cognito-user.js";
@@ -17,6 +18,12 @@ interface SimCognitoMakeUserProperties {
     /** The policy the pool holds its users' passwords to. */
     readonly passwordPolicy: SimCognitoPasswordPolicy;
 }
+interface SimCognitoFederatedUserProperties {
+    readonly username: SimCognitoUsername;
+    readonly attributes?: readonly SimCognitoAttributeType[] | undefined;
+    /** Which provider signed the user in, and which subject it signed in as. */
+    readonly identity: SimCognitoFederatedIdentity;
+}
 interface SimCognitoSignUpUserProperties {
     readonly username: SimCognitoUsername;
     readonly attributes?: readonly SimCognitoAttributeType[] | undefined;
@@ -51,6 +58,14 @@ export declare class SimCognitoUserFactory {
      * therefore fails here rather than in a deployment.
      */
     make(properties: SimCognitoMakeUserProperties): SimCognitoUser;
+    /**
+     * Make a user for an external subject an identity provider signed in.
+     *
+     * The user has no password at all, because its password is at the provider:
+     * real Cognito leaves a federated user in `EXTERNAL_PROVIDER`, where the
+     * pool's own sign-in flows refuse it.
+     */
+    federated(properties: SimCognitoFederatedUserProperties): SimCognitoUser;
     /**
      * Make a user that signed itself up, waiting to be confirmed.
      *

package/dist/service/cognito/user-pool/user/sim-cognito-user-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-factory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,CAAC;IAErE;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEhD,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;CACnD;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,CAAC;IAErE;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;CACnD;AAED;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,+BAA+B,EAEtD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAc1B;;;;;;OAMG;IACH,IAAI,CAAC,UAAU,EAAE,4BAA4B,GAAG,cAAc,CAY7D;IAED;;;;;OAKG;IACH,MAAM,CAAC,UAAU,EAAE,8BAA8B,GAAG,cAAc,CAgBjE;CACF"}
+{"version":3,"file":"sim-cognito-user-factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-factory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAE5F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,4BAA4B;IACpC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,CAAC;IAErE;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEhD,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;CACnD;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,CAAC;IAErE,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;CAChD;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,CAAC;IAErE;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;CACnD;AAED;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,+BAA+B,EAEtD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAc1B;;;;;;OAMG;IACH,IAAI,CAAC,UAAU,EAAE,4BAA4B,GAAG,cAAc,CAY7D;IAED;;;;;;OAMG;IACH,SAAS,CAAC,UAAU,EAAE,iCAAiC,GAAG,cAAc,CASvE;IAED;;;;;OAKG;IACH,MAAM,CAAC,UAAU,EAAE,8BAA8B,GAAG,cAAc,CAgBjE;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-factory.js

@@ -41,6 +41,23 @@ export class SimCognitoUserFactory {
             clock: this.clock,
         });
     }
+    /**
+     * Make a user for an external subject an identity provider signed in.
+     *
+     * The user has no password at all, because its password is at the provider:
+     * real Cognito leaves a federated user in `EXTERNAL_PROVIDER`, where the
+     * pool's own sign-in flows refuse it.
+     */
+    federated(properties) {
+        return new SimCognitoUser({
+            username: properties.username,
+            sub: randomUUID(),
+            attributes: new SimCognitoUserAttributes(properties.attributes),
+            status: SimCognitoUserStatus.externalProvider,
+            identity: properties.identity,
+            clock: this.clock,
+        });
+    }
     /**
      * Make a user that signed itself up, waiting to be confirmed.
      *

package/dist/service/cognito/user-pool/user/sim-cognito-user-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-factory.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,EAEL,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAoCpE;;GAEG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAW;IAEjC,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,WAAW,CACxB,KAAa,EACb,KAAyB,EACzB,MAAgC;QAEhC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,sBAAsB,CAC/B,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAC1D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,UAAwC;QAC3C,OAAO,IAAI,cAAc,CAAC;YACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,GAAG,EAAE,UAAU,EAAE;YACjB,UAAU,EAAE,IAAI,wBAAwB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC/D,QAAQ,EAAE,qBAAqB,CAAC,WAAW,CACzC,mBAAmB,EACnB,UAAU,CAAC,iBAAiB,EAC5B,UAAU,CAAC,cAAc,CAC1B;YACD,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,UAA0C;QAC/C,OAAO,IAAI,cAAc,CAAC;YACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,GAAG,EAAE,UAAU,EAAE;YACjB,UAAU,EAAE,IAAI,wBAAwB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC/D,oEAAoE;YACpE,8BAA8B;YAC9B,QAAQ,EAAE,IAAI,sBAAsB,CAClC,IAAI,uBAAuB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,OAAO,CAC5D,UAAU,EACV,UAAU,CAAC,QAAQ,CACpB,CACF;YACD,MAAM,EAAE,oBAAoB,CAAC,WAAW;YACxC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-factory.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,EAEL,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AA4CpE;;GAEG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAW;IAEjC,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,WAAW,CACxB,KAAa,EACb,KAAyB,EACzB,MAAgC;QAEhC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,sBAAsB,CAC/B,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAC1D,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,UAAwC;QAC3C,OAAO,IAAI,cAAc,CAAC;YACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,GAAG,EAAE,UAAU,EAAE;YACjB,UAAU,EAAE,IAAI,wBAAwB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC/D,QAAQ,EAAE,qBAAqB,CAAC,WAAW,CACzC,mBAAmB,EACnB,UAAU,CAAC,iBAAiB,EAC5B,UAAU,CAAC,cAAc,CAC1B;YACD,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,UAA6C;QACrD,OAAO,IAAI,cAAc,CAAC;YACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,GAAG,EAAE,UAAU,EAAE;YACjB,UAAU,EAAE,IAAI,wBAAwB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC/D,MAAM,EAAE,oBAAoB,CAAC,gBAAgB;YAC7C,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,UAA0C;QAC/C,OAAO,IAAI,cAAc,CAAC;YACxB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,GAAG,EAAE,UAAU,EAAE;YACjB,UAAU,EAAE,IAAI,wBAAwB,CAAC,UAAU,CAAC,UAAU,CAAC;YAC/D,oEAAoE;YACpE,8BAA8B;YAC9B,QAAQ,EAAE,IAAI,sBAAsB,CAClC,IAAI,uBAAuB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,OAAO,CAC5D,UAAU,EACV,UAAU,CAAC,QAAQ,CACpB,CACF;YACD,MAAM,EAAE,oBAAoB,CAAC,WAAW;YACxC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-status.d.ts

@@ -1,4 +1,4 @@
-export type SimCognitoUserStatusValue = "UNCONFIRMED" | "FORCE_CHANGE_PASSWORD" | "CONFIRMED";
+export type SimCognitoUserStatusValue = "UNCONFIRMED" | "FORCE_CHANGE_PASSWORD" | "CONFIRMED" | "EXTERNAL_PROVIDER";
 /**
  * The status of one simulated user.
  *
@@ -7,9 +7,11 @@ export type SimCognitoUserStatusValue = "UNCONFIRMED" | "FORCE_CHANGE_PASSWORD"
  * stops it signing in normally on real Cognito, and reaches `CONFIRMED` when an
  * admin sets a permanent password on it. A user that signed itself up with
  * `SignUp` starts in `UNCONFIRMED`, which is what stops that one signing in,
- * and reaches `CONFIRMED` through `ConfirmSignUp` or `AdminConfirmSignUp`. The
- * other real statuses (`RESET_REQUIRED`, `EXTERNAL_PROVIDER` and the rest)
- * belong to password resets and federation, neither of which is simulated.
+ * and reaches `CONFIRMED` through `ConfirmSignUp` or `AdminConfirmSignUp`. A
+ * user the pool created for a federated sign-in is `EXTERNAL_PROVIDER` and
+ * stays there, because its password is at the provider rather than in the
+ * pool. `RESET_REQUIRED` and the rest belong to password resets, which are not
+ * simulated.
  */
 export declare class SimCognitoUserStatus {
     /**
@@ -24,6 +26,14 @@ export declare class SimCognitoUserStatus {
      * The status a user with a password of its own reaches.
      */
     static readonly confirmed: SimCognitoUserStatus;
+    /**
+     * The status a user created by a federated sign-in stays in.
+     *
+     * Such a user has no password in the pool, so nothing moves it on: it signs
+     * in at its provider each time, and the pool's own sign-in flows refuse it,
+     * as they do on real Cognito.
+     */
+    static readonly externalProvider: SimCognitoUserStatus;
     readonly value: SimCognitoUserStatusValue;
     private constructor();
     /**

package/dist/service/cognito/user-pool/user/sim-cognito-user-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-status.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-status.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,yBAAyB,GACjC,aAAa,GACb,uBAAuB,GACvB,WAAW,CAAC;AAEhB;;;;;;;;;;;GAWG;AACH,qBAAa,oBAAoB;IAC/B;;OAEG;IACH,gBAAuB,WAAW,uBAA2C;IAE7E;;OAEG;IACH,gBAAuB,mBAAmB,uBAExC;IAEF;;OAEG;IACH,gBAAuB,SAAS,uBAAyC;IAEzE,SAAgB,KAAK,EAAE,yBAAyB,CAAC;IAEjD,OAAO,eAEN;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,gBAAgB,CACrB,SAAS,EAAE,OAAO,GAAG,SAAS,GAC7B,oBAAoB,CAMtB;IAED;;;;;OAKG;IACH,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED;;;;;OAKG;IACH,IAAI,aAAa,IAAI,OAAO,CAE3B;IAED;;;;;;OAMG;IACH,kBAAkB,IAAI,IAAI,CAMzB;IAED;;;;;;OAMG;IACH,iBAAiB,IAAI,IAAI,CAOxB;CACF"}
+{"version":3,"file":"sim-cognito-user-status.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-status.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,yBAAyB,GACjC,aAAa,GACb,uBAAuB,GACvB,WAAW,GACX,mBAAmB,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,qBAAa,oBAAoB;IAC/B;;OAEG;IACH,gBAAuB,WAAW,uBAA2C;IAE7E;;OAEG;IACH,gBAAuB,mBAAmB,uBAExC;IAEF;;OAEG;IACH,gBAAuB,SAAS,uBAAyC;IAEzE;;;;;;OAMG;IACH,gBAAuB,gBAAgB,uBAErC;IAEF,SAAgB,KAAK,EAAE,yBAAyB,CAAC;IAEjD,OAAO,eAEN;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,gBAAgB,CACrB,SAAS,EAAE,OAAO,GAAG,SAAS,GAC7B,oBAAoB,CAMtB;IAED;;;;;OAKG;IACH,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED;;;;;OAKG;IACH,IAAI,aAAa,IAAI,OAAO,CAE3B;IAED;;;;;;OAMG;IACH,kBAAkB,IAAI,IAAI,CAMzB;IAED;;;;;;OAMG;IACH,iBAAiB,IAAI,IAAI,CAOxB;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user-status.js

@@ -7,9 +7,11 @@ import { SimCognitoInvalidParameterException, SimCognitoNotAuthorizedException,
  * stops it signing in normally on real Cognito, and reaches `CONFIRMED` when an
  * admin sets a permanent password on it. A user that signed itself up with
  * `SignUp` starts in `UNCONFIRMED`, which is what stops that one signing in,
- * and reaches `CONFIRMED` through `ConfirmSignUp` or `AdminConfirmSignUp`. The
- * other real statuses (`RESET_REQUIRED`, `EXTERNAL_PROVIDER` and the rest)
- * belong to password resets and federation, neither of which is simulated.
+ * and reaches `CONFIRMED` through `ConfirmSignUp` or `AdminConfirmSignUp`. A
+ * user the pool created for a federated sign-in is `EXTERNAL_PROVIDER` and
+ * stays there, because its password is at the provider rather than in the
+ * pool. `RESET_REQUIRED` and the rest belong to password resets, which are not
+ * simulated.
  */
 export class SimCognitoUserStatus {
     /**
@@ -24,6 +26,14 @@ export class SimCognitoUserStatus {
      * The status a user with a password of its own reaches.
      */
     static confirmed = new SimCognitoUserStatus("CONFIRMED");
+    /**
+     * The status a user created by a federated sign-in stays in.
+     *
+     * Such a user has no password in the pool, so nothing moves it on: it signs
+     * in at its provider each time, and the pool's own sign-in flows refuse it,
+     * as they do on real Cognito.
+     */
+    static externalProvider = new SimCognitoUserStatus("EXTERNAL_PROVIDER");
     value;
     constructor(value) {
         this.value = value;

package/dist/service/cognito/user-pool/user/sim-cognito-user-status.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-status.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-status.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,gCAAgC,GACjC,MAAM,kCAAkC,CAAC;AAO1C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;OAEG;IACI,MAAM,CAAU,WAAW,GAAG,IAAI,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAE7E;;OAEG;IACI,MAAM,CAAU,mBAAmB,GAAG,IAAI,oBAAoB,CACnE,uBAAuB,CACxB,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,SAAS,GAAG,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAEzD,KAAK,CAA4B;IAEjD,YAAoB,KAAgC;QAClD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,gBAAgB,CACrB,SAA8B;QAE9B,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,KAAK,KAAK,uBAAuB,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,KAAK,KAAK,aAAa,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB;QAChB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,gCAAgC,CACxC,+CAA+C,IAAI,CAAC,KAAK,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB;QACf,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,4CAA4C,IAAI,CAAC,KAAK,aAAa;gBACjE,gCAAgC,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-status.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user-status.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,gCAAgC,GACjC,MAAM,kCAAkC,CAAC;AAQ1C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;OAEG;IACI,MAAM,CAAU,WAAW,GAAG,IAAI,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAE7E;;OAEG;IACI,MAAM,CAAU,mBAAmB,GAAG,IAAI,oBAAoB,CACnE,uBAAuB,CACxB,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,SAAS,GAAG,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAEzE;;;;;;OAMG;IACI,MAAM,CAAU,gBAAgB,GAAG,IAAI,oBAAoB,CAChE,mBAAmB,CACpB,CAAC;IAEc,KAAK,CAA4B;IAEjD,YAAoB,KAAgC;QAClD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,gBAAgB,CACrB,SAA8B;QAE9B,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,KAAK,KAAK,uBAAuB,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,KAAK,KAAK,aAAa,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB;QAChB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,gCAAgC,CACxC,+CAA+C,IAAI,CAAC,KAAK,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB;QACf,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,4CAA4C,IAAI,CAAC,KAAK,aAAa;gBACjE,gCAAgC,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user.d.ts

@@ -1,4 +1,5 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoFederatedIdentity } from "../idp/sim-cognito-federated-identity.js";
 import type { SimCognitoAttributeType, SimCognitoUserAttributes } from "./sim-cognito-user-attributes.js";
 import { SimCognitoUserPassword } from "./sim-cognito-user-password.js";
 import { SimCognitoUserStatus } from "./sim-cognito-user-status.js";
@@ -14,6 +15,11 @@ interface SimCognitoUserProperties {
      * `UNCONFIRMED`.
      */
     readonly status?: SimCognitoUserStatus | undefined;
+    /**
+     * Where the user came from, for one the pool is creating because an external
+     * provider signed it in.
+     */
+    readonly identity?: SimCognitoFederatedIdentity | undefined;
     readonly clock: SimClock;
 }
 /**
@@ -35,6 +41,7 @@ export declare class SimCognitoUser {
     private readonly clock;
     private readonly userAttributes;
     private readonly confirmation;
+    private readonly federatedIdentity;
     private userStatus;
     private userPassword;
     private isEnabled;
@@ -64,6 +71,14 @@ export declare class SimCognitoUser {
      * is where most code reads a user's identifier from.
      */
     get attributes(): readonly SimCognitoAttributeType[];
+    /**
+     * Where this user came from, for one the pool created for a federated
+     * sign-in.
+     *
+     * Cognito allocates this in the same way it allocates `sub`, and a request
+     * cannot set it, so it lives on the user rather than among its attributes.
+     */
+    get identity(): SimCognitoFederatedIdentity | undefined;
     /**
      * The user's attributes by name, without the `sub` Cognito allocated.
      *
@@ -144,6 +159,11 @@ export declare class SimCognitoUser {
      * permanent password that took it there.
      */
     private moveTo;
+    /**
+     * The `identities` attribute a federated user reports, which a local user
+     * does not have at all.
+     */
+    private identityAttribute;
     private touch;
 }
 export {};