@kensio/yulin 1.14.2 → 1.15.0

package/dist/service/cognito/user-pool/sim-cognito-user-pool.d.ts

@@ -10,7 +10,7 @@ import type { SimCognitoName } from "./sim-cognito-name.js";
 import type { SimCognitoUserPoolArn } from "./sim-cognito-user-pool-arn.js";
 import { type SimCognitoUserPoolId } from "./sim-cognito-user-pool-id.js";
 import type { SimCognitoUserPoolSettings } from "./sim-cognito-user-pool-settings.js";
-import { SimCognitoSigningKey, type SimCognitoJwks } from "./token/sim-cognito-signing-key.js";
+import type { SimCognitoJwks, SimCognitoSigningKey } from "./token/sim-cognito-signing-key.js";
 import type { SimCognitoUser } from "./user/sim-cognito-user.js";
 import { type SimCognitoUsername } from "./user/sim-cognito-username.js";
 interface SimCognitoUserPoolProperties {
@@ -47,6 +47,7 @@ export declare class SimCognitoUserPool {
     private readonly clientStore;
     private readonly userStore;
     private readonly groupStore;
+    private readonly keys;
     constructor(properties: SimCognitoUserPoolProperties);
     /**
      * The settings this pool applies: its password policy, its deletion
@@ -67,22 +68,9 @@ export declare class SimCognitoUserPool {
     get issuerUrl(): string;
     /** The name this pool is known by where a scheme would be wrong. */
     get providerName(): string;
-    /**
-     * The key this pool signs its tokens with, generated on first use.
-     *
-     * The key belongs to the pool, as it does on real Cognito, so a token from
-     * one pool does not carry a signature another pool's JWKS can verify.
-     */
+    /** The key this pool signs its tokens with, generated on first use. */
     get signingKey(): SimCognitoSigningKey;
-    /**
-     * The public keys this pool publishes, in the shape its JWKS endpoint
-     * serves.
-     *
-     * A verifier configured for this pool takes this document and verifies the
-     * pool's tokens with nothing else needed. Real Cognito publishes two keys
-     * and rotates between them, and this publishes one, so code assuming a
-     * single entry passes here and is still wrong against real AWS.
-     */
+    /** The public keys this pool publishes, as its JWKS endpoint serves them. */
     jwks(): SimCognitoJwks;
     /**
      * When the pool's settings last changed.
@@ -147,11 +135,17 @@ export declare class SimCognitoUserPool {
     /**
      * The confirmation code a user of this pool has outstanding, if it has one.
      *
-     * This is the simulator's own accessor, for a test that signed a user up:
-     * nothing here delivers a message for one to read the code from. Real
-     * Cognito reports a code to nobody, so this is a deliberate divergence.
+     * This and `softwareTokenCode` are the simulator's own accessors, for a test
+     * that has nowhere else to read a code from: nothing here delivers a message
+     * or holds the user's phone. Real Cognito reports either code to nobody.
      */
     confirmationCode(username: string): string | undefined;
+    /**
+     * The code a user's authenticator app is showing now, for a user that has
+     * been given a software token secret. A test that would rather compute the
+     * code itself can do so from the `SecretCode`, which is a real shared secret.
+     */
+    softwareTokenCode(username: string): string | undefined;
     /** Every message this pool would have sent, oldest first. */
     sentMessages(): readonly SimCognitoSentMessage[];
     /**

package/dist/service/cognito/user-pool/sim-cognito-user-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAE9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,gCAAgC,CAAC;AAExC,UAAU,4BAA4B;IACpC,QAAQ,CAAC,EAAE,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;;IAC7B,SAAgB,EAAE,EAAE,oBAAoB,CAAC;IACzC,SAAgB,GAAG,EAAE,qBAAqB,CAAC;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC;;OAEG;IACH,SAAgB,IAAI,qBAA4B;IAEhD;;;;OAIG;IACH,SAAgB,QAAQ,6BAAoC;IAE5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IAMzD,YAAY,UAAU,EAAE,4BAA4B,EAQnD;IAED;;;;OAIG;IACH,IAAI,QAAQ,IAAI,0BAA0B,CAEzC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,QAAQ,EAAE,0BAA0B,GAAG,IAAI,CAGjD;IAED,0DAA0D;IAC1D,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,oEAAoE;IACpE,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;;;OAKG;IACH,IAAI,UAAU,IAAI,oBAAoB,CAIrC;IAED;;;;;;;;OAQG;IACH,IAAI,IAAI,cAAc,CAErB;IAED;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,SAAS,wBAAwB,EAAE,CAEjD;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,CAE3B;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEnD;IAED;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAEjE;IAED;;OAEG;IACH,aAAa,CACX,QAAQ,EAAE,0BAA0B,GACnC,wBAAwB,CAE1B;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,SAAS,cAAc,EAAE,CAErC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAElC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAIrC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAErD;IAED;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,cAAc,CAExD;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGrD;IAED,6DAA6D;IAC7D,YAAY,IAAI,SAAS,qBAAqB,EAAE,CAE/C;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,SAAS,eAAe,EAAE,CAEvC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAErC;IAED;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAExC;IAED;;OAEG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAExD;IAED;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,mBAAmB,GAAG,eAAe,CAE5D;IAED;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,eAAe,EAAE,CAErD;CACF"}
+{"version":3,"file":"sim-cognito-user-pool.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAE9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,gCAAgC,CAAC;AAExC,UAAU,4BAA4B;IACpC,QAAQ,CAAC,EAAE,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;;IAC7B,SAAgB,EAAE,EAAE,oBAAoB,CAAC;IACzC,SAAgB,GAAG,EAAE,qBAAqB,CAAC;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC;;OAEG;IACH,SAAgB,IAAI,qBAA4B;IAEhD;;;;OAIG;IACH,SAAgB,QAAQ,6BAAoC;IAE5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IAKjD,YAAY,UAAU,EAAE,4BAA4B,EAQnD;IAED;;;;OAIG;IACH,IAAI,QAAQ,IAAI,0BAA0B,CAEzC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,QAAQ,EAAE,0BAA0B,GAAG,IAAI,CAGjD;IAED,0DAA0D;IAC1D,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,oEAAoE;IACpE,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,uEAAuE;IACvE,IAAI,UAAU,IAAI,oBAAoB,CAErC;IAED,6EAA6E;IAC7E,IAAI,IAAI,cAAc,CAErB;IAED;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,SAAS,wBAAwB,EAAE,CAEjD;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,CAE3B;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEnD;IAED;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAEjE;IAED;;OAEG;IACH,aAAa,CACX,QAAQ,EAAE,0BAA0B,GACnC,wBAAwB,CAE1B;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,SAAS,cAAc,EAAE,CAErC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAElC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAIrC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAErD;IAED;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,cAAc,CAExD;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGrD;IAED;;;;OAIG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAItD;IAED,6DAA6D;IAC7D,YAAY,IAAI,SAAS,qBAAqB,EAAE,CAE/C;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,SAAS,eAAe,EAAE,CAEvC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAErC;IAED;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAExC;IAED;;OAEG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAExD;IAED;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,mBAAmB,GAAG,eAAe,CAE5D;IAED;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,eAAe,EAAE,CAErD;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool.js

@@ -3,7 +3,7 @@ import { SimCognitoUserPoolClientStore } from "./client/sim-cognito-user-pool-cl
 import { SimCognitoGroupStore } from "./group/sim-cognito-group-store.js";
 import { SimCognitoSentMessageStore } from "./message/sim-cognito-sent-message-store.js";
 import { simCognitoUserPoolIssuerUrl, simCognitoUserPoolProviderName, } from "./sim-cognito-user-pool-id.js";
-import { SimCognitoSigningKey, } from "./token/sim-cognito-signing-key.js";
+import { SimCognitoPoolKeys } from "./token/sim-cognito-pool-keys.js";
 import { SimCognitoUserStore } from "./user/sim-cognito-user-store.js";
 import { requireSimCognitoUsername, } from "./user/sim-cognito-username.js";
 /**
@@ -32,9 +32,9 @@ export class SimCognitoUserPool {
     clientStore = new SimCognitoUserPoolClientStore();
     userStore = new SimCognitoUserStore();
     groupStore = new SimCognitoGroupStore();
+    keys = new SimCognitoPoolKeys();
     #settings;
     #modifiedDate;
-    #signingKey;
     constructor(properties) {
         this.id = properties.id;
         this.arn = properties.arn;
@@ -72,27 +72,13 @@ export class SimCognitoUserPool {
     get providerName() {
         return simCognitoUserPoolProviderName(this.id);
     }
-    /**
-     * The key this pool signs its tokens with, generated on first use.
-     *
-     * The key belongs to the pool, as it does on real Cognito, so a token from
-     * one pool does not carry a signature another pool's JWKS can verify.
-     */
+    /** The key this pool signs its tokens with, generated on first use. */
     get signingKey() {
-        this.#signingKey ??= SimCognitoSigningKey.generate();
-        return this.#signingKey;
+        return this.keys.signingKey;
     }
-    /**
-     * The public keys this pool publishes, in the shape its JWKS endpoint
-     * serves.
-     *
-     * A verifier configured for this pool takes this document and verifies the
-     * pool's tokens with nothing else needed. Real Cognito publishes two keys
-     * and rotates between them, and this publishes one, so code assuming a
-     * single entry passes here and is still wrong against real AWS.
-     */
+    /** The public keys this pool publishes, as its JWKS endpoint serves them. */
     jwks() {
-        return { keys: [this.signingKey.publicJwk()] };
+        return this.keys.jwks();
     }
     /**
      * When the pool's settings last changed.
@@ -185,14 +171,22 @@ export class SimCognitoUserPool {
     /**
      * The confirmation code a user of this pool has outstanding, if it has one.
      *
-     * This is the simulator's own accessor, for a test that signed a user up:
-     * nothing here delivers a message for one to read the code from. Real
-     * Cognito reports a code to nobody, so this is a deliberate divergence.
+     * This and `softwareTokenCode` are the simulator's own accessors, for a test
+     * that has nowhere else to read a code from: nothing here delivers a message
+     * or holds the user's phone. Real Cognito reports either code to nobody.
      */
     confirmationCode(username) {
         return this.requireUser(requireSimCognitoUsername(username))
             .confirmationCode;
     }
+    /**
+     * The code a user's authenticator app is showing now, for a user that has
+     * been given a software token secret. A test that would rather compute the
+     * code itself can do so from the `SecretCode`, which is a real shared secret.
+     */
+    softwareTokenCode(username) {
+        return this.requireUser(requireSimCognitoUsername(username)).mfa.codeAt(this.clock.now());
+    }
     /** Every message this pool would have sent, oldest first. */
     sentMessages() {
         return this.messages.all;

package/dist/service/cognito/user-pool/sim-cognito-user-pool.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAG/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAGzF,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAE/B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,oBAAoB,GAErB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EACL,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AAUxC;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACb,EAAE,CAAuB;IACzB,GAAG,CAAwB;IAC3B,IAAI,CAAS;IACb,YAAY,CAAO;IAEnC;;OAEG;IACa,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAEhD;;;;OAIG;IACa,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3C,KAAK,CAAW;IAChB,WAAW,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAClD,SAAS,GAAG,IAAI,mBAAmB,EAAE,CAAC;IACtC,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAEzD,SAAS,CAA6B;IACtC,aAAa,CAAO;IACpB,WAAW,CAAmC;IAE9C,YAAY,UAAwC;QAClD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,QAAoC;QACzC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACxC,CAAC;IAED,0DAA0D;IAC1D,IAAI,SAAS;QACX,OAAO,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,oEAAoE;IACpE,IAAI,YAAY;QACd,OAAO,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,IAAI,UAAU;QACZ,IAAI,CAAC,WAAW,KAAK,oBAAoB,CAAC,QAAQ,EAAE,CAAC;QAErD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI;QACF,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAgC;QAC3C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,aAAa,CACX,QAAoC;QAEpC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAoB;QAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,IAAoB;QAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAA4B;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,WAAW,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;aACzD,gBAAgB,CAAC;IACtB,CAAC;IAED,6DAA6D;IAC7D,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAsB;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAsB;QAChC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,SAAiB;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,SAA8B;QACzC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAG/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAGzF,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAE/B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAMtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EACL,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AAUxC;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACb,EAAE,CAAuB;IACzB,GAAG,CAAwB;IAC3B,IAAI,CAAS;IACb,YAAY,CAAO;IAEnC;;OAEG;IACa,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAEhD;;;;OAIG;IACa,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3C,KAAK,CAAW;IAChB,WAAW,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAClD,SAAS,GAAG,IAAI,mBAAmB,EAAE,CAAC;IACtC,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACxC,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAEjD,SAAS,CAA6B;IACtC,aAAa,CAAO;IAEpB,YAAY,UAAwC;QAClD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,QAAoC;QACzC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACxC,CAAC;IAED,0DAA0D;IAC1D,IAAI,SAAS;QACX,OAAO,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,oEAAoE;IACpE,IAAI,YAAY;QACd,OAAO,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,uEAAuE;IACvE,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;IAC9B,CAAC;IAED,6EAA6E;IAC7E,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAgC;QAC3C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,aAAa,CACX,QAAoC;QAEpC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAoB;QAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,IAAoB;QAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAA4B;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,WAAW,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;aACzD,gBAAgB,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,WAAW,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CACrE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAsB;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAsB;QAChC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,SAAiB;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,SAA8B;QACzC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.d.ts

@@ -1,4 +1,14 @@
 import { type SimCognitoTokenClaims, type SimCognitoTokenClaimsProperties } from "./sim-cognito-token-claims.js";
+/**
+ * The scope an access token from an authentication flow in the API carries.
+ *
+ * Real Cognito issues this scope for sign-in through the user pool API, which
+ * asks for no scopes of its own. A sign-in through the hosted endpoints asks
+ * for scopes, and those are what its access token carries instead. It is also
+ * the scope an operation a user performs on itself needs, which is why a
+ * hosted sign-in that never asked for it cannot perform one.
+ */
+export declare const simCognitoUserPoolAdminScope = "aws.cognito.signin.user.admin";
 /**
  * The claims of a simulated access token.
  *

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-access-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,+BAA+B,CAAC;AAWvC;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,IAAI,qBAAqB,CAU9B;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;CASd"}
+{"version":3,"file":"sim-cognito-access-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,kCAAkC,CAAC;AAE5E;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;OAEG;IACH,MAAM,IAAI,qBAAqB,CAU9B;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK;CASd"}

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.js

@@ -4,9 +4,11 @@ import { SimCognitoSharedTokenClaims, } from "./sim-cognito-token-claims.js";
  *
  * Real Cognito issues this scope for sign-in through the user pool API, which
  * asks for no scopes of its own. A sign-in through the hosted endpoints asks
- * for scopes, and those are what its access token carries instead.
+ * for scopes, and those are what its access token carries instead. It is also
+ * the scope an operation a user performs on itself needs, which is why a
+ * hosted sign-in that never asked for it cannot perform one.
  */
-const userPoolAdminScope = "aws.cognito.signin.user.admin";
+export const simCognitoUserPoolAdminScope = "aws.cognito.signin.user.admin";
 /**
  * The claims of a simulated access token.
  *
@@ -41,7 +43,7 @@ export class SimCognitoAccessToken {
     scope() {
         const { scopes } = this.properties;
         if (scopes === undefined) {
-            return userPoolAdminScope;
+            return simCognitoUserPoolAdminScope;
         }
         return scopes.join(" ");
     }

package/dist/service/cognito/user-pool/token/sim-cognito-access-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-access-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACf,UAAU,CAAkC;IAC5C,MAAM,CAA8B;IAErD,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEzC,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK;QACX,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-access-token.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-access-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAG5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACf,UAAU,CAAkC;IAC5C,MAAM,CAA8B;IAErD,YAAY,UAA2C;QACrD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEzC,OAAO;YACL,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK;QACX,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAEnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,4BAA4B,CAAC;QACtC,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-pool-keys.d.ts

@@ -0,0 +1,27 @@
+import { SimCognitoSigningKey, type SimCognitoJwks } from "./sim-cognito-signing-key.js";
+/**
+ * The key pair one simulated user pool signs its tokens with.
+ *
+ * The key belongs to the pool, as it does on real Cognito, so a token from one
+ * pool does not carry a signature another pool's JWKS can verify. It is
+ * generated the first time the pool signs or publishes anything rather than
+ * when the pool is created, because 2048-bit generation takes long enough to
+ * notice and most pools in a suite never sign a token at all.
+ */
+export declare class SimCognitoPoolKeys {
+    #private;
+    /**
+     * The key this pool signs with, generated on first use.
+     */
+    get signingKey(): SimCognitoSigningKey;
+    /**
+     * The public keys this pool publishes, in the shape its JWKS endpoint serves.
+     *
+     * A verifier configured for this pool takes this document and verifies the
+     * pool's tokens with nothing else needed. Real Cognito publishes two keys and
+     * rotates between them, and this publishes one, so code assuming a single
+     * entry passes here and is still wrong against real AWS.
+     */
+    jwks(): SimCognitoJwks;
+}
+//# sourceMappingURL=sim-cognito-pool-keys.d.ts.map

package/dist/service/cognito/user-pool/token/sim-cognito-pool-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-pool-keys.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-pool-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAC;AAEtC;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;;IAG7B;;OAEG;IACH,IAAI,UAAU,IAAI,oBAAoB,CAIrC;IAED;;;;;;;OAOG;IACH,IAAI,IAAI,cAAc,CAErB;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-pool-keys.js

@@ -0,0 +1,32 @@
+import { SimCognitoSigningKey, } from "./sim-cognito-signing-key.js";
+/**
+ * The key pair one simulated user pool signs its tokens with.
+ *
+ * The key belongs to the pool, as it does on real Cognito, so a token from one
+ * pool does not carry a signature another pool's JWKS can verify. It is
+ * generated the first time the pool signs or publishes anything rather than
+ * when the pool is created, because 2048-bit generation takes long enough to
+ * notice and most pools in a suite never sign a token at all.
+ */
+export class SimCognitoPoolKeys {
+    #signingKey;
+    /**
+     * The key this pool signs with, generated on first use.
+     */
+    get signingKey() {
+        this.#signingKey ??= SimCognitoSigningKey.generate();
+        return this.#signingKey;
+    }
+    /**
+     * The public keys this pool publishes, in the shape its JWKS endpoint serves.
+     *
+     * A verifier configured for this pool takes this document and verifies the
+     * pool's tokens with nothing else needed. Real Cognito publishes two keys and
+     * rotates between them, and this publishes one, so code assuming a single
+     * entry passes here and is still wrong against real AWS.
+     */
+    jwks() {
+        return { keys: [this.signingKey.publicJwk()] };
+    }
+}
+//# sourceMappingURL=sim-cognito-pool-keys.js.map

package/dist/service/cognito/user-pool/token/sim-cognito-pool-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-pool-keys.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-pool-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IAC7B,WAAW,CAAmC;IAE9C;;OAEG;IACH,IAAI,UAAU;QACZ,IAAI,CAAC,WAAW,KAAK,oBAAoB,CAAC,QAAQ,EAAE,CAAC;QAErD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACH,IAAI;QACF,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-token-issuer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAclE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAE7C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAEvE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB;;;;;;;;;;;OAWG;IACG,KAAK,CACT,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAuBjC;IAED;;;;;;;OAOG;IACG,OAAO,CACX,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAEjC;YAEa,UAAU;YAqDV,cAAc;CAY7B"}
+{"version":3,"file":"sim-cognito-token-issuer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAclE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAE7C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAEvE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB;;;;;;;;;;;OAWG;IACG,KAAK,CACT,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAuBjC;IAED;;;;;;;OAOG;IACG,OAAO,CACX,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAEjC;YAEa,UAAU;YAyDV,cAAc;CAY7B"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.js

@@ -103,6 +103,10 @@ export class SimCognitoTokenIssuer {
             clientId: client.id,
             issuedAt,
             expiresAt: accessTokenExpiresAt,
+            // The pool records what the token carries, because an operation a user
+            // performs on itself is refused unless the scope allows it, and the
+            // record is what the pool reads rather than the signed claims.
+            scopes: properties.scopes,
         }));
         return {
             idToken: pool.signingKey.sign(claimsOverride.applyTo(idToken.claims())),

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-token-issuer.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAM5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AA6C7B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAW;IAChB,QAAQ,CAA6B;IAEtD,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,QAAc,EAAE,OAAe;QACrD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CACT,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1E,IAAI,CAAC,IAAI,CAAC,eAAe,CACvB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAC1C;YACD,sEAAsE;YACtE,iCAAiC;YACjC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,UAA2C;QAE3C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,UAA2C,EAC3C,QAAc;QAEd,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC;QACpE,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,QAAQ,CACzD,QAAQ,EACR,kBAAkB,CACnB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACpC,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CACrC;YACD,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC;YAC5C,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,4EAA4E;QAC5E,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAC5C,cAAc,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CACnD,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,cAAc,CACtB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,oBAAoB;SAChC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,WAAW,EAAE,iBAAiB;YAC9B,SAAS,EAAE,kBAAkB;SAC9B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,UAAU,CAAC;QAEpE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,EAAE;YACtD,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-token-issuer.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAM5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AA6C7B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAW;IAChB,QAAQ,CAA6B;IAEtD,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,QAAc,EAAE,OAAe;QACrD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CACT,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1E,IAAI,CAAC,IAAI,CAAC,eAAe,CACvB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAC1C;YACD,sEAAsE;YACtE,iCAAiC;YACjC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,UAA2C;QAE3C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,UAA2C,EAC3C,QAAc;QAEd,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC;QACpE,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,QAAQ,CACzD,QAAQ,EACR,kBAAkB,CACnB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACpC,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CACrC;YACD,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC;YAC5C,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,4EAA4E;QAC5E,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAC5C,cAAc,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CACnD,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,cAAc,CACtB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,uEAAuE;YACvE,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CACH,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,WAAW,EAAE,iBAAiB;YAC9B,SAAS,EAAE,kBAAkB;SAC9B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,UAAU,CAAC;QAEpE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,EAAE;YACtD,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.d.ts

@@ -74,6 +74,10 @@ export declare class SimCognitoTriggerOccasion {
      * The invitation an admin-created user is sent.
      */
     static readonly customMessageAdminCreateUser: SimCognitoTriggerOccasion;
+    /**
+     * The code a sign-in challenged for a second factor is sent.
+     */
+    static readonly customMessageAuthentication: SimCognitoTriggerOccasion;
     readonly trigger: SimCognitoTriggerName;
     readonly source: string;
     private constructor();

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-trigger-occasion.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;;;;;;;;;;GAWG;AACH,qBAAa,yBAAyB;IACpC;;OAEG;IACH,gBAAuB,MAAM,4BAG3B;IAEF;;;;;;OAMG;IACH,gBAAuB,eAAe,4BAGpC;IAEF;;;;;;OAMG;IACH,gBAAuB,aAAa,4BAGlC;IAEF;;OAEG;IACH,gBAAuB,iBAAiB,4BAGtC;IAEF;;OAEG;IACH,gBAAuB,kBAAkB,4BAGvC;IAEF;;OAEG;IACH,gBAAuB,eAAe,4BAGpC;IAEF;;;;;;;OAOG;IACH,gBAAuB,0BAA0B,4BAI7C;IAEJ;;;;;;OAMG;IACH,gBAAuB,sBAAsB,4BAG3C;IAEF;;OAEG;IACH,gBAAuB,mBAAmB,4BAGxC;IAEF;;OAEG;IACH,gBAAuB,uBAAuB,4BAC+B;IAE7E;;OAEG;IACH,gBAAuB,4BAA4B,4BAI/C;IAEJ,SAAgB,OAAO,EAAE,qBAAqB,CAAC;IAC/C,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B,OAAO,eAGN;IAED;;;;;;OAMG;IACH,MAAM,CAAC,aAAa,CAClB,QAAQ,EAAE,yBAAyB,GAClC,yBAAyB,CAY3B;CACF"}
+{"version":3,"file":"sim-cognito-trigger-occasion.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;;;;;;;;;;GAWG;AACH,qBAAa,yBAAyB;IACpC;;OAEG;IACH,gBAAuB,MAAM,4BAG3B;IAEF;;;;;;OAMG;IACH,gBAAuB,eAAe,4BAGpC;IAEF;;;;;;OAMG;IACH,gBAAuB,aAAa,4BAGlC;IAEF;;OAEG;IACH,gBAAuB,iBAAiB,4BAGtC;IAEF;;OAEG;IACH,gBAAuB,kBAAkB,4BAGvC;IAEF;;OAEG;IACH,gBAAuB,eAAe,4BAGpC;IAEF;;;;;;;OAOG;IACH,gBAAuB,0BAA0B,4BAI7C;IAEJ;;;;;;OAMG;IACH,gBAAuB,sBAAsB,4BAG3C;IAEF;;OAEG;IACH,gBAAuB,mBAAmB,4BAGxC;IAEF;;OAEG;IACH,gBAAuB,uBAAuB,4BAC+B;IAE7E;;OAEG;IACH,gBAAuB,4BAA4B,4BAI/C;IAEJ;;OAEG;IACH,gBAAuB,2BAA2B,4BAI9C;IAEJ,SAAgB,OAAO,EAAE,qBAAqB,CAAC;IAC/C,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B,OAAO,eAGN;IAED;;;;;;OAMG;IACH,MAAM,CAAC,aAAa,CAClB,QAAQ,EAAE,yBAAyB,GAClC,yBAAyB,CAe3B;CACF"}

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.js

@@ -72,6 +72,10 @@ export class SimCognitoTriggerOccasion {
      * The invitation an admin-created user is sent.
      */
     static customMessageAdminCreateUser = new SimCognitoTriggerOccasion("CustomMessage", "CustomMessage_AdminCreateUser");
+    /**
+     * The code a sign-in challenged for a second factor is sent.
+     */
+    static customMessageAuthentication = new SimCognitoTriggerOccasion("CustomMessage", "CustomMessage_Authentication");
     trigger;
     source;
     constructor(trigger, source) {
@@ -96,6 +100,9 @@ export class SimCognitoTriggerOccasion {
             case "AdminCreateUser": {
                 return this.customMessageAdminCreateUser;
             }
+            case "Authentication": {
+                return this.customMessageAuthentication;
+            }
         }
     }
 }

package/dist/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-trigger-occasion.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,yBAAyB;IACpC;;OAEG;IACI,MAAM,CAAU,MAAM,GAAG,IAAI,yBAAyB,CAC3D,WAAW,EACX,kBAAkB,CACnB,CAAC;IAEF;;;;;;OAMG;IACI,MAAM,CAAU,eAAe,GAAG,IAAI,yBAAyB,CACpE,WAAW,EACX,2BAA2B,CAC5B,CAAC;IAEF;;;;;;OAMG;IACI,MAAM,CAAU,aAAa,GAAG,IAAI,yBAAyB,CAClE,kBAAkB,EAClB,gCAAgC,CACjC,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,iBAAiB,GAAG,IAAI,yBAAyB,CACtE,mBAAmB,EACnB,kCAAkC,CACnC,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,kBAAkB,GAAG,IAAI,yBAAyB,CACvE,oBAAoB,EACpB,mCAAmC,CACpC,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,eAAe,GAAG,IAAI,yBAAyB,CACpE,oBAAoB,EACpB,gCAAgC,CACjC,CAAC;IAEF;;;;;;;OAOG;IACI,MAAM,CAAU,0BAA0B,GAC/C,IAAI,yBAAyB,CAC3B,oBAAoB,EACpB,sCAAsC,CACvC,CAAC;IAEJ;;;;;;OAMG;IACI,MAAM,CAAU,sBAAsB,GAAG,IAAI,yBAAyB,CAC3E,oBAAoB,EACpB,+BAA+B,CAChC,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,mBAAmB,GAAG,IAAI,yBAAyB,CACxE,eAAe,EACf,sBAAsB,CACvB,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,uBAAuB,GAC5C,IAAI,yBAAyB,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IAE7E;;OAEG;IACI,MAAM,CAAU,4BAA4B,GACjD,IAAI,yBAAyB,CAC3B,eAAe,EACf,+BAA+B,CAChC,CAAC;IAEY,OAAO,CAAwB;IAC/B,MAAM,CAAS;IAE/B,YAAoB,OAA8B,EAAE,MAAc;QAChE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,aAAa,CAClB,QAAmC;QAEnC,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC,mBAAmB,CAAC;YAClC,CAAC;YACD,KAAK,YAAY,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC,uBAAuB,CAAC;YACtC,CAAC;YACD,KAAK,iBAAiB,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC,4BAA4B,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-trigger-occasion.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/trigger/sim-cognito-trigger-occasion.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,yBAAyB;IACpC;;OAEG;IACI,MAAM,CAAU,MAAM,GAAG,IAAI,yBAAyB,CAC3D,WAAW,EACX,kBAAkB,CACnB,CAAC;IAEF;;;;;;OAMG;IACI,MAAM,CAAU,eAAe,GAAG,IAAI,yBAAyB,CACpE,WAAW,EACX,2BAA2B,CAC5B,CAAC;IAEF;;;;;;OAMG;IACI,MAAM,CAAU,aAAa,GAAG,IAAI,yBAAyB,CAClE,kBAAkB,EAClB,gCAAgC,CACjC,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,iBAAiB,GAAG,IAAI,yBAAyB,CACtE,mBAAmB,EACnB,kCAAkC,CACnC,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,kBAAkB,GAAG,IAAI,yBAAyB,CACvE,oBAAoB,EACpB,mCAAmC,CACpC,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,eAAe,GAAG,IAAI,yBAAyB,CACpE,oBAAoB,EACpB,gCAAgC,CACjC,CAAC;IAEF;;;;;;;OAOG;IACI,MAAM,CAAU,0BAA0B,GAC/C,IAAI,yBAAyB,CAC3B,oBAAoB,EACpB,sCAAsC,CACvC,CAAC;IAEJ;;;;;;OAMG;IACI,MAAM,CAAU,sBAAsB,GAAG,IAAI,yBAAyB,CAC3E,oBAAoB,EACpB,+BAA+B,CAChC,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,mBAAmB,GAAG,IAAI,yBAAyB,CACxE,eAAe,EACf,sBAAsB,CACvB,CAAC;IAEF;;OAEG;IACI,MAAM,CAAU,uBAAuB,GAC5C,IAAI,yBAAyB,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IAE7E;;OAEG;IACI,MAAM,CAAU,4BAA4B,GACjD,IAAI,yBAAyB,CAC3B,eAAe,EACf,+BAA+B,CAChC,CAAC;IAEJ;;OAEG;IACI,MAAM,CAAU,2BAA2B,GAChD,IAAI,yBAAyB,CAC3B,eAAe,EACf,8BAA8B,CAC/B,CAAC;IAEY,OAAO,CAAwB;IAC/B,MAAM,CAAS;IAE/B,YAAoB,OAA8B,EAAE,MAAc;QAChE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,aAAa,CAClB,QAAmC;QAEnC,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC,mBAAmB,CAAC;YAClC,CAAC;YACD,KAAK,YAAY,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC,uBAAuB,CAAC;YACtC,CAAC;YACD,KAAK,iBAAiB,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC,4BAA4B,CAAC;YAC3C,CAAC;YACD,KAAK,gBAAgB,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC,2BAA2B,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-mfa-factors.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The second factor sent as a text message.
+ */
+export declare const simCognitoSmsMfa = "SMS_MFA";
+/**
+ * The second factor an authenticator app computes.
+ */
+export declare const simCognitoSoftwareTokenMfa = "SOFTWARE_TOKEN_MFA";
+/**
+ * What a request says about one of a user's factors.
+ *
+ * https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SMSMfaSettingsType.html
+ */
+export interface SimCognitoMfaSettingsType {
+    readonly Enabled?: boolean | undefined;
+    readonly PreferredMfa?: boolean | undefined;
+}
+/**
+ * The factor settings `SetUserMFAPreference` and `AdminSetUserMFAPreference`
+ * carry.
+ */
+export interface SimCognitoMfaPreferenceType {
+    readonly SMSMfaSettings?: SimCognitoMfaSettingsType | undefined;
+    readonly SoftwareTokenMfaSettings?: SimCognitoMfaSettingsType | undefined;
+}
+/**
+ * One factor of a request, paired with the name it is enabled under.
+ */
+export type SimCognitoRequestedFactor = readonly [
+    string,
+    SimCognitoMfaSettingsType | undefined
+];
+/**
+ * The factors a request names, in the order they are reported in.
+ */
+export declare function simCognitoRequestedFactors(requested: SimCognitoMfaPreferenceType): readonly SimCognitoRequestedFactor[];
+/**
+ * Refuse a request preferring two factors, and one preferring a factor it is
+ * not also enabling.
+ *
+ * A user has one preferred factor at most, which is what `PreferredMfaSetting`
+ * reports, so a request naming two is refused rather than silently keeping
+ * whichever was applied last.
+ */
+export declare function requireSimCognitoPreference(factors: readonly SimCognitoRequestedFactor[]): void;
+/**
+ * Refuse enabling a factor a user has nothing to be challenged with.
+ *
+ * A code has to be sent somewhere, and a software token has to be one the
+ * user's app has been shown to hold. Real Cognito refuses both the same way.
+ */
+export declare function requireSimCognitoFactorAvailable(name: string, attributes: ReadonlyMap<string, string>, hasSoftwareToken: boolean): void;
+//# sourceMappingURL=sim-cognito-mfa-factors.d.ts.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-mfa-factors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-factors.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-mfa-factors.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,gBAAgB,YAAY,CAAC;AAE1C;;GAEG;AACH,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7C;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;CAC3E;AAED;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,SAAS;IAC/C,MAAM;IACN,yBAAyB,GAAG,SAAS;CACtC,CAAC;AAEF;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,2BAA2B,GACrC,SAAS,yBAAyB,EAAE,CAKtC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,SAAS,yBAAyB,EAAE,GAC5C,IAAI,CAqBN;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EACvC,gBAAgB,EAAE,OAAO,GACxB,IAAI,CAeN"}

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-mfa-factors.js

@@ -0,0 +1,58 @@
+import { SimCognitoInvalidParameterException } from "../../../error/sim-cognito.error.js";
+/**
+ * The second factor sent as a text message.
+ */
+export const simCognitoSmsMfa = "SMS_MFA";
+/**
+ * The second factor an authenticator app computes.
+ */
+export const simCognitoSoftwareTokenMfa = "SOFTWARE_TOKEN_MFA";
+/**
+ * The factors a request names, in the order they are reported in.
+ */
+export function simCognitoRequestedFactors(requested) {
+    return [
+        [simCognitoSmsMfa, requested.SMSMfaSettings],
+        [simCognitoSoftwareTokenMfa, requested.SoftwareTokenMfaSettings],
+    ];
+}
+/**
+ * Refuse a request preferring two factors, and one preferring a factor it is
+ * not also enabling.
+ *
+ * A user has one preferred factor at most, which is what `PreferredMfaSetting`
+ * reports, so a request naming two is refused rather than silently keeping
+ * whichever was applied last.
+ */
+export function requireSimCognitoPreference(factors) {
+    const preferred = factors.filter(([, settings]) => settings?.PreferredMfa === true);
+    if (preferred.length > 1) {
+        throw new SimCognitoInvalidParameterException(`Only one MFA factor can be preferred: this request prefers ${preferred
+            .map(([name]) => name)
+            .join(" and ")}`);
+    }
+    for (const [name, settings] of preferred) {
+        if (settings?.Enabled !== true) {
+            throw new SimCognitoInvalidParameterException(`${name} cannot be the preferred factor while it is not enabled: ` +
+                `set Enabled as well as PreferredMfa`);
+        }
+    }
+}
+/**
+ * Refuse enabling a factor a user has nothing to be challenged with.
+ *
+ * A code has to be sent somewhere, and a software token has to be one the
+ * user's app has been shown to hold. Real Cognito refuses both the same way.
+ */
+export function requireSimCognitoFactorAvailable(name, attributes, hasSoftwareToken) {
+    if (name === simCognitoSmsMfa && !attributes.has("phone_number")) {
+        throw new SimCognitoInvalidParameterException(`${simCognitoSmsMfa} cannot be enabled for a user with no ` +
+            `phone_number attribute: there is nowhere to send the code`);
+    }
+    if (name === simCognitoSoftwareTokenMfa && !hasSoftwareToken) {
+        throw new SimCognitoInvalidParameterException(`${simCognitoSoftwareTokenMfa} cannot be enabled for a user that has ` +
+            `not verified a software token: call AssociateSoftwareToken and ` +
+            `VerifySoftwareToken first`);
+    }
+}
+//# sourceMappingURL=sim-cognito-mfa-factors.js.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-mfa-factors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-mfa-factors.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-mfa-factors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAE1F;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAE1C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AA6B/D;;GAEG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAsC;IAEtC,OAAO;QACL,CAAC,gBAAgB,EAAE,SAAS,CAAC,cAAc,CAAC;QAC5C,CAAC,0BAA0B,EAAE,SAAS,CAAC,wBAAwB,CAAC;KACjE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAA6C;IAE7C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAClD,CAAC;IAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,mCAAmC,CAC3C,8DAA8D,SAAS;aACpE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;aACrB,IAAI,CAAC,OAAO,CAAC,EAAE,CACnB,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;QACzC,IAAI,QAAQ,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,mCAAmC,CAC3C,GAAG,IAAI,2DAA2D;gBAChE,qCAAqC,CACxC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,IAAY,EACZ,UAAuC,EACvC,gBAAyB;IAEzB,IAAI,IAAI,KAAK,gBAAgB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,mCAAmC,CAC3C,GAAG,gBAAgB,wCAAwC;YACzD,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,0BAA0B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC7D,MAAM,IAAI,mCAAmC,CAC3C,GAAG,0BAA0B,yCAAyC;YACpE,iEAAiE;YACjE,2BAA2B,CAC9B,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-software-token.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The shared secret one user registers an authenticator app with.
+ *
+ * `AssociateSoftwareToken` issues one and hands back its `SecretCode`, which
+ * is the value real Cognito puts in the `otpauth://` URL behind a QR code.
+ * The secret is a real one: the codes it produces are genuine RFC 6238
+ * time-based one-time passwords, so an authenticator library given this
+ * `SecretCode` produces codes `VerifySoftwareToken` accepts.
+ *
+ * A secret is provisional until it is verified. `AssociateSoftwareToken`
+ * issues a fresh one each time it is called, as real Cognito does, so a user
+ * part way through registering an app and starting again has one secret rather
+ * than two.
+ */
+export declare class SimCognitoSoftwareToken {
+    /**
+     * The secret as a caller is given it, in unpadded base32.
+     */
+    readonly secretCode: string;
+    private readonly secret;
+    private constructor();
+    /**
+     * Issue a fresh shared secret.
+     */
+    static issue(): SimCognitoSoftwareToken;
+    /**
+     * The code an authenticator app holding this secret shows at a moment.
+     *
+     * Real Cognito never reports this, and neither would an app: the code is
+     * what the user reads off its own device. A pool reports it through
+     * `SimCognitoUserPool.softwareTokenCode` for the same reason it reports a
+     * confirmation code, because nothing here is holding the user's phone.
+     */
+    codeAt(now: Date): string;
+    /**
+     * Whether a candidate is a code this secret produces around a moment.
+     */
+    matches(candidate: string | undefined, now: Date): boolean;
+}
+//# sourceMappingURL=sim-cognito-software-token.d.ts.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-software-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-software-token.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-software-token.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;GAaG;AACH,qBAAa,uBAAuB;IAClC;;OAEG;IACH,SAAgB,UAAU,EAAE,MAAM,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC,OAAO,eAGN;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAEtC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,EAAE,IAAI,GAAG,MAAM,CAExB;IAED;;OAEG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAEzD;CACF"}

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-software-token.js

@@ -0,0 +1,51 @@
+import { randomBytes } from "node:crypto";
+import { simCognitoBase32, simCognitoSecretBytes, simCognitoTotpCode, simCognitoTotpMatches, } from "./sim-cognito-totp.js";
+/**
+ * The shared secret one user registers an authenticator app with.
+ *
+ * `AssociateSoftwareToken` issues one and hands back its `SecretCode`, which
+ * is the value real Cognito puts in the `otpauth://` URL behind a QR code.
+ * The secret is a real one: the codes it produces are genuine RFC 6238
+ * time-based one-time passwords, so an authenticator library given this
+ * `SecretCode` produces codes `VerifySoftwareToken` accepts.
+ *
+ * A secret is provisional until it is verified. `AssociateSoftwareToken`
+ * issues a fresh one each time it is called, as real Cognito does, so a user
+ * part way through registering an app and starting again has one secret rather
+ * than two.
+ */
+export class SimCognitoSoftwareToken {
+    /**
+     * The secret as a caller is given it, in unpadded base32.
+     */
+    secretCode;
+    secret;
+    constructor(secret) {
+        this.secret = secret;
+        this.secretCode = simCognitoBase32(secret);
+    }
+    /**
+     * Issue a fresh shared secret.
+     */
+    static issue() {
+        return new SimCognitoSoftwareToken(randomBytes(simCognitoSecretBytes));
+    }
+    /**
+     * The code an authenticator app holding this secret shows at a moment.
+     *
+     * Real Cognito never reports this, and neither would an app: the code is
+     * what the user reads off its own device. A pool reports it through
+     * `SimCognitoUserPool.softwareTokenCode` for the same reason it reports a
+     * confirmation code, because nothing here is holding the user's phone.
+     */
+    codeAt(now) {
+        return simCognitoTotpCode(this.secret, now);
+    }
+    /**
+     * Whether a candidate is a code this secret produces around a moment.
+     */
+    matches(candidate, now) {
+        return simCognitoTotpMatches(this.secret, candidate, now);
+    }
+}
+//# sourceMappingURL=sim-cognito-software-token.js.map

package/dist/service/cognito/user-pool/user/mfa/sim-cognito-software-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-software-token.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/mfa/sim-cognito-software-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,uBAAuB;IAClC;;OAEG;IACa,UAAU,CAAS;IAElB,MAAM,CAAa;IAEpC,YAAoB,MAAkB;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK;QACV,OAAO,IAAI,uBAAuB,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAS;QACd,OAAO,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,SAA6B,EAAE,GAAS;QAC9C,OAAO,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;CACF"}