@kensio/yulin 1.14.2 → 1.15.1

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-creator.js

@@ -27,7 +27,23 @@ export class SimCfnCognitoUserPoolCreator {
         });
         const userPoolId = created.UserPool?.Id;
         assertDefined(userPoolId, `sim Cognito user pool id after CloudFormation creation for ${resource.logicalId}`);
+        await this.setMfaConfig(poolProperties, userPoolId);
         return this.cognito.userPool(userPoolId);
     }
+    /**
+     * Configure the pool's MFA, where the template asked for any.
+     *
+     * This is the second call real CloudFormation makes for a pool declaring
+     * `MfaConfiguration` or `EnabledMfas`, rather than a property of the
+     * creation, so a stack that deploys here needs the same
+     * `cognito-idp:SetUserPoolMfaConfig` permission it needs on real AWS.
+     */
+    async setMfaConfig(poolProperties, userPoolId) {
+        const input = poolProperties.setUserPoolMfaConfigInput(userPoolId);
+        if (input === undefined) {
+            return;
+        }
+        await this.cognito.setUserPoolMfaConfig({ input });
+    }
 }
 //# sourceMappingURL=sim-cfn-cognito-user-pool-creator.js.map

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-creator.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-cognito-user-pool-creator.js","sourceRoot":"","sources":["../../../../../src/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-creator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAKvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAM5F;;;;;;;;GAQG;AACH,MAAM,OAAO,4BAA4B;IACtB,OAAO,CAA6B;IAErD,YAAY,UAAkD;QAC5D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,IAAI,+BAA+B,CAAC;YACzD,QAAQ;YACR,UAAU;SACX,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAChD,KAAK,EAAE,cAAc,CAAC,mBAAmB,EAAE;SAC5C,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QACxC,aAAa,CACX,UAAU,EACV,8DAA8D,QAAQ,CAAC,SAAS,EAAE,CACnF,CAAC;QAEF,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-cognito-user-pool-creator.js","sourceRoot":"","sources":["../../../../../src/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-creator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAKvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAM5F;;;;;;;;GAQG;AACH,MAAM,OAAO,4BAA4B;IACtB,OAAO,CAA6B;IAErD,YAAY,UAAkD;QAC5D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,cAAc,GAAG,IAAI,+BAA+B,CAAC;YACzD,QAAQ;YACR,UAAU;SACX,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAChD,KAAK,EAAE,cAAc,CAAC,mBAAmB,EAAE;SAC5C,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QACxC,aAAa,CACX,UAAU,EACV,8DAA8D,QAAQ,CAAC,SAAS,EAAE,CACnF,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAEpD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,YAAY,CACxB,cAA+C,EAC/C,UAAkB;QAElB,MAAM,KAAK,GAAG,cAAc,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC;QAEnE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;CACF"}

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-mfa.d.ts

@@ -0,0 +1,45 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimSetUserPoolMfaConfigCommandInput } from "../../command/user-pool/user-pool-mfa.command.js";
+import type { SimCfnCognitoPropertyParser } from "../sim-cfn-cognito-property-parser.js";
+interface SimCfnCognitoUserPoolMfaProperties {
+    readonly resource: SimCfnResource;
+    readonly propertyParser: SimCfnCognitoPropertyParser;
+}
+/**
+ * Reads the MFA properties of an AWS::Cognito::UserPool Resource into the
+ * SetUserPoolMfaConfig input they are deployed with.
+ *
+ * Neither reaches `CreateUserPool`. Real CloudFormation configures a pool's
+ * MFA in a second call once the pool exists, which is why a stack deploying
+ * one needs `cognito-idp:SetUserPoolMfaConfig` as well as
+ * `cognito-idp:CreateUserPool`.
+ *
+ * `EnabledMfas` is a CloudFormation property with no equivalent on the Cognito
+ * API, which names each factor by its own configuration instead. Turning the
+ * list into those configurations is what lets `SetUserPoolMfaConfig` decide
+ * which of them are simulated, so the two factors this simulation cannot
+ * deliver a message for are refused in one place rather than two.
+ */
+export declare class SimCfnCognitoUserPoolMfa {
+    private readonly resource;
+    private readonly propertyParser;
+    constructor(properties: SimCfnCognitoUserPoolMfaProperties);
+    /**
+     * The call the pool's MFA is configured in, or nothing where the template
+     * says nothing about MFA. A template asking for none makes no such call,
+     * here or on real AWS.
+     */
+    parse(userPoolId: string, properties: SimCfnTemplateValueRecord): SimSetUserPoolMfaConfigCommandInput | undefined;
+    /**
+     * The factors the template asks for, or nothing where it names none.
+     */
+    private factors;
+    /**
+     * Refuse a factor name Cognito does not have, before the pool is created
+     * with a factor list that means nothing.
+     */
+    private requireKnownFactors;
+}
+export {};
+//# sourceMappingURL=sim-cfn-cognito-user-pool-mfa.d.ts.map

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-mfa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cognito-user-pool-mfa.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-mfa.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAEV,yBAAyB,EAC1B,MAAM,kEAAkE,CAAC;AAC1E,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AAC5G,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAezF,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,2BAA2B,CAAC;CACtD;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D,YAAY,UAAU,EAAE,kCAAkC,EAGzD;IAED;;;;OAIG;IACH,KAAK,CACH,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,yBAAyB,GACpC,mCAAmC,GAAG,SAAS,CAiBjD;IAED;;OAEG;IACH,OAAO,CAAC,OAAO;IAwBf;;;OAGG;IACH,OAAO,CAAC,mBAAmB;CAW5B"}

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-mfa.js

@@ -0,0 +1,73 @@
+/**
+ * The second factors CloudFormation can name in `EnabledMfas`.
+ */
+const enabledMfaValues = ["SMS_MFA", "SOFTWARE_TOKEN_MFA", "EMAIL_OTP"];
+/**
+ * Reads the MFA properties of an AWS::Cognito::UserPool Resource into the
+ * SetUserPoolMfaConfig input they are deployed with.
+ *
+ * Neither reaches `CreateUserPool`. Real CloudFormation configures a pool's
+ * MFA in a second call once the pool exists, which is why a stack deploying
+ * one needs `cognito-idp:SetUserPoolMfaConfig` as well as
+ * `cognito-idp:CreateUserPool`.
+ *
+ * `EnabledMfas` is a CloudFormation property with no equivalent on the Cognito
+ * API, which names each factor by its own configuration instead. Turning the
+ * list into those configurations is what lets `SetUserPoolMfaConfig` decide
+ * which of them are simulated, so the two factors this simulation cannot
+ * deliver a message for are refused in one place rather than two.
+ */
+export class SimCfnCognitoUserPoolMfa {
+    resource;
+    propertyParser;
+    constructor(properties) {
+        this.resource = properties.resource;
+        this.propertyParser = properties.propertyParser;
+    }
+    /**
+     * The call the pool's MFA is configured in, or nothing where the template
+     * says nothing about MFA. A template asking for none makes no such call,
+     * here or on real AWS.
+     */
+    parse(userPoolId, properties) {
+        const configuration = this.propertyParser.optionalString(this.resource, properties["MfaConfiguration"], "MfaConfiguration");
+        const factors = this.factors(properties["EnabledMfas"]);
+        if (configuration === undefined && Object.keys(factors).length === 0) {
+            return undefined;
+        }
+        return {
+            UserPoolId: userPoolId,
+            ...(configuration !== undefined && { MfaConfiguration: configuration }),
+            ...factors,
+        };
+    }
+    /**
+     * The factors the template asks for, or nothing where it names none.
+     */
+    factors(value) {
+        const names = this.propertyParser.optionalStringArray(this.resource, value, "EnabledMfas");
+        if (names === undefined) {
+            return {};
+        }
+        this.requireKnownFactors(names);
+        return {
+            ...(names.includes("SOFTWARE_TOKEN_MFA") && {
+                SoftwareTokenMfaConfiguration: { Enabled: true },
+            }),
+            ...(names.includes("SMS_MFA") && { SmsMfaConfiguration: {} }),
+            ...(names.includes("EMAIL_OTP") && { EmailMfaConfiguration: {} }),
+        };
+    }
+    /**
+     * Refuse a factor name Cognito does not have, before the pool is created
+     * with a factor list that means nothing.
+     */
+    requireKnownFactors(names) {
+        for (const [index, name] of names.entries()) {
+            if (!enabledMfaValues.includes(name)) {
+                throw this.propertyParser.invalidPropertyError(this.resource, `EnabledMfas[${String(index)}]`, `one of ${enabledMfaValues.join(", ")}`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-cfn-cognito-user-pool-mfa.js.map

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-mfa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cognito-user-pool-mfa.js","sourceRoot":"","sources":["../../../../../src/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-mfa.ts"],"names":[],"mappings":"AAQA;;GAEG;AACH,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;AAexE;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,wBAAwB;IAClB,QAAQ,CAAiB;IACzB,cAAc,CAA8B;IAE7D,YAAY,UAA8C;QACxD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,KAAK,CACH,UAAkB,EAClB,UAAqC;QAErC,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CACtD,IAAI,CAAC,QAAQ,EACb,UAAU,CAAC,kBAAkB,CAAC,EAC9B,kBAAkB,CACnB,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;QAExD,IAAI,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,UAAU,EAAE,UAAU;YACtB,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;YACvE,GAAG,OAAO;SACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,OAAO,CACb,KAAsC;QAEtC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,mBAAmB,CACnD,IAAI,CAAC,QAAQ,EACb,KAAK,EACL,aAAa,CACd,CAAC;QAEF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAEhC,OAAO;YACL,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI;gBAC1C,6BAA6B,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;aACjD,CAAC;YACF,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;SAClE,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,mBAAmB,CAAC,KAAwB;QAClD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAC5C,IAAI,CAAC,QAAQ,EACb,eAAe,MAAM,CAAC,KAAK,CAAC,GAAG,EAC/B,UAAU,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-properties.d.ts

@@ -1,5 +1,6 @@
 import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
 import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimSetUserPoolMfaConfigCommandInput } from "../../command/user-pool/user-pool-mfa.command.js";
 import type { SimCreateUserPoolCommandInput } from "../../command/user-pool/user-pool.command.js";
 interface SimCfnCognitoUserPoolPropertiesProperties {
     readonly resource: SimCfnResource;
@@ -25,6 +26,12 @@ export declare class SimCfnCognitoUserPoolProperties {
      * and it is the one property whose name differs between them.
      */
     createUserPoolInput(): SimCreateUserPoolCommandInput;
+    /**
+     * The SetUserPoolMfaConfig input this Resource asks for, or nothing where
+     * the template says nothing about MFA. That call is a second one after the
+     * pool exists, as it is on real CloudFormation.
+     */
+    setUserPoolMfaConfigInput(userPoolId: string): SimSetUserPoolMfaConfigCommandInput | undefined;
     /**
      * The pool's name, generated from the stack and the logical ID when the
      * template names none, as real CloudFormation generates one.
@@ -33,9 +40,8 @@ export declare class SimCfnCognitoUserPoolProperties {
     /**
      * A property carried as an object, passed on to CreateUserPool as written.
      *
-     * The keys inside are not checked here. CreateUserPool compares the whole
-     * object against the one value it accepts, which refuses an unknown key
-     * along with everything else that differs.
+     * The keys inside are not checked here. CreateUserPool reads them itself, a
+     * key at a time, so the value is judged in one place rather than two.
      */
     private record;
     private string;

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-properties.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-cognito-user-pool-properties.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-properties.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAEV,yBAAyB,EAC1B,MAAM,kEAAkE,CAAC;AAC1E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AA+ClG,UAAU,yCAAyC;IACjD,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG5B;IAEH,YAAY,UAAU,EAAE,yCAAyC,EAKhE;IAED;;;;;OAKG;IACH,mBAAmB,IAAI,6BAA6B,CAqDnD;IAED;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAahB;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,MAAM;CAMf"}
+{"version":3,"file":"sim-cfn-cognito-user-pool-properties.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-properties.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAEV,yBAAyB,EAC1B,MAAM,kEAAkE,CAAC;AAC1E,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,kDAAkD,CAAC;AAC5G,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAkElG,UAAU,yCAAyC;IACjD,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG5B;IAEH,YAAY,UAAU,EAAE,yCAAyC,EAKhE;IAED;;;;;OAKG;IACH,mBAAmB,IAAI,6BAA6B,CAqDnD;IAED;;;;OAIG;IACH,yBAAyB,CACvB,UAAU,EAAE,MAAM,GACjB,mCAAmC,GAAG,SAAS,CAKjD;IAED;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAahB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,MAAM;CAMf"}

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-properties.js

@@ -1,31 +1,48 @@
 import { SimCfnCognitoGeneratedName } from "../sim-cfn-cognito-generated-name.js";
 import { SimCfnCognitoPropertyParser } from "../sim-cfn-cognito-property-parser.js";
+import { SimCfnCognitoAccountRecovery } from "./sim-cfn-cognito-account-recovery.js";
 import { SimCfnCognitoAdminCreateUserConfig } from "./sim-cfn-cognito-admin-create-user-config.js";
+import { SimCfnCognitoUserPoolMfa } from "./sim-cfn-cognito-user-pool-mfa.js";
+import { SimCfnCognitoUserPoolSchema } from "./sim-cfn-cognito-user-pool-schema.js";
 import { SimCfnCognitoPolicies } from "./sim-cfn-cognito-policies.js";
 /**
  * The AWS::Cognito::UserPool properties this simulation deploys.
  *
- * `MfaConfiguration` and `UserPoolTier` are here because CreateUserPool
- * accepts each at its AWS default and refuses it otherwise, in words that say
- * why. A CDK stack states both routinely, and a pool created without either
- * would be reported as behaving differently when it does not.
+ * `MfaConfiguration` and `EnabledMfas` are here because a pool records what it
+ * was asked for and reports it back. They do not reach CreateUserPool: real
+ * CloudFormation sets a pool's MFA in a SetUserPoolMfaConfig call after the
+ * pool exists, and this deploys them the same way.
+ *
+ * `UserPoolTier` is here because CreateUserPool accepts it at its AWS default
+ * and refuses it otherwise, in words that say why. A CDK stack states it
+ * routinely, and a pool created without it would be reported as behaving
+ * differently when it does not.
  *
  * `AdminCreateUserConfig` and `AutoVerifiedAttributes` are the two a
  * `selfSignUpEnabled` CDK pool turns on, and both are acted on: the first
  * decides whether `SignUp` is allowed at all, and the second decides which
  * attributes confirming a sign-up marks as verified.
  *
+ * `Schema` is here because the pool holds the attributes it declares. A CDK
+ * `UserPool` emits one for its `customAttributes` and for any
+ * `standardAttributes` entry, so a stack keying its own data on a `custom:`
+ * attribute deploys and the sign-up it was built for works.
+ *
  * `LambdaConfig` is here because the pool runs the triggers it names.
  * CreateUserPool reads it a key at a time, so a template asking for a trigger
  * this simulation fires deploys and one asking for a trigger it does not fails
  * the stack, rather than the two being decided together.
  *
- * The five from `AccountRecoverySetting` down are here because a CDK
+ * `AccountRecoverySetting` is here because the pool records the mechanisms it
+ * names and reports them back. Nothing here starts a recovery, so a template
+ * declaring email-only recovery deploys, and CreateUserPool refuses a setting
+ * outside the shape Cognito states for it.
+ *
+ * The four from `EmailVerificationMessage` down are here because a CDK
  * `UserPool` construct emits them when it was asked for nothing in
- * particular. Each configures message delivery, verification wording or
- * account recovery, none of which is simulated, so CreateUserPool accepts each
- * at the one value that asks for nothing this simulation does not already do
- * and refuses it at every other.
+ * particular. They are the wording of the messages the pool records, and
+ * `VerificationMessageTemplate` is refused where it asks for verification by
+ * following a link.
  */
 const simulatedProperties = [
     "UserPoolName",
@@ -33,9 +50,11 @@ const simulatedProperties = [
     "DeletionProtection",
     "LambdaConfig",
     "MfaConfiguration",
+    "EnabledMfas",
     "UserPoolTier",
     "AdminCreateUserConfig",
     "AutoVerifiedAttributes",
+    "Schema",
     "AccountRecoverySetting",
     "EmailVerificationMessage",
     "EmailVerificationSubject",
@@ -77,20 +96,37 @@ export class SimCfnCognitoUserPoolProperties {
             }).parse(this.properties["Policies"]),
             DeletionProtection: this.string(this.properties["DeletionProtection"], "DeletionProtection"),
             LambdaConfig: this.record(this.properties["LambdaConfig"], "LambdaConfig"),
-            MfaConfiguration: this.string(this.properties["MfaConfiguration"], "MfaConfiguration"),
             UserPoolTier: this.string(this.properties["UserPoolTier"], "UserPoolTier"),
-            AccountRecoverySetting: this.record(this.properties["AccountRecoverySetting"], "AccountRecoverySetting"),
+            AccountRecoverySetting: new SimCfnCognitoAccountRecovery({
+                resource: this.resource,
+                propertyParser: this.propertyParser,
+            }).parse(this.properties["AccountRecoverySetting"]),
             AdminCreateUserConfig: new SimCfnCognitoAdminCreateUserConfig({
                 resource: this.resource,
                 propertyParser: this.propertyParser,
             }).parse(this.properties["AdminCreateUserConfig"]),
             AutoVerifiedAttributes: this.propertyParser.optionalStringArray(this.resource, this.properties["AutoVerifiedAttributes"], "AutoVerifiedAttributes"),
+            Schema: new SimCfnCognitoUserPoolSchema({
+                resource: this.resource,
+                propertyParser: this.propertyParser,
+            }).parse(this.properties["Schema"]),
             VerificationMessageTemplate: this.record(this.properties["VerificationMessageTemplate"], "VerificationMessageTemplate"),
             EmailVerificationMessage: this.string(this.properties["EmailVerificationMessage"], "EmailVerificationMessage"),
             EmailVerificationSubject: this.string(this.properties["EmailVerificationSubject"], "EmailVerificationSubject"),
             SmsVerificationMessage: this.string(this.properties["SmsVerificationMessage"], "SmsVerificationMessage"),
         };
     }
+    /**
+     * The SetUserPoolMfaConfig input this Resource asks for, or nothing where
+     * the template says nothing about MFA. That call is a second one after the
+     * pool exists, as it is on real CloudFormation.
+     */
+    setUserPoolMfaConfigInput(userPoolId) {
+        return new SimCfnCognitoUserPoolMfa({
+            resource: this.resource,
+            propertyParser: this.propertyParser,
+        }).parse(userPoolId, this.properties);
+    }
     /**
      * The pool's name, generated from the stack and the logical ID when the
      * template names none, as real CloudFormation generates one.
@@ -108,9 +144,8 @@ export class SimCfnCognitoUserPoolProperties {
     /**
      * A property carried as an object, passed on to CreateUserPool as written.
      *
-     * The keys inside are not checked here. CreateUserPool compares the whole
-     * object against the one value it accepts, which refuses an unknown key
-     * along with everything else that differs.
+     * The keys inside are not checked here. CreateUserPool reads them itself, a
+     * key at a time, so the value is judged in one place rather than two.
      */
     record(value, label) {
         return this.propertyParser.optionalRecord(this.resource, value, label);

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-properties.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-cognito-user-pool-properties.js","sourceRoot":"","sources":["../../../../../src/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-properties.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EAAE,kCAAkC,EAAE,MAAM,+CAA+C,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,mBAAmB,GAAG;IAC1B,cAAc;IACd,UAAU;IACV,oBAAoB;IACpB,cAAc;IACd,kBAAkB;IAClB,cAAc;IACd,uBAAuB;IACvB,wBAAwB;IACxB,wBAAwB;IACxB,0BAA0B;IAC1B,0BAA0B;IAC1B,wBAAwB;IACxB,6BAA6B;CAC9B,CAAC;AAOF;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IACzB,QAAQ,CAAiB;IACzB,UAAU,CAA4B;IACtC,cAAc,GAAG,IAAI,2BAA2B,CAAC;QAChE,YAAY,EAAE,wBAAwB;QACtC,SAAS,EAAE,mBAAmB;KAC/B,CAAC,CAAC;IAEH,YAAY,UAAqD;QAC/D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QAExC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACxE,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QACjB,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;YACzB,QAAQ,EAAE,IAAI,qBAAqB,CAAC;gBAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACrC,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAC7B,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,EACrC,oBAAoB,CACrB;YACD,YAAY,EAAE,IAAI,CAAC,MAAM,CACvB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAC/B,cAAc,CACf;YACD,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAC3B,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EACnC,kBAAkB,CACnB;YACD,YAAY,EAAE,IAAI,CAAC,MAAM,CACvB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAC/B,cAAc,CACf;YACD,sBAAsB,EAAE,IAAI,CAAC,MAAM,CACjC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EACzC,wBAAwB,CACzB;YACD,qBAAqB,EAAE,IAAI,kCAAkC,CAAC;gBAC5D,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;YAClD,sBAAsB,EAAE,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAC7D,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EACzC,wBAAwB,CACzB;YACD,2BAA2B,EAAE,IAAI,CAAC,MAAM,CACtC,IAAI,CAAC,UAAU,CAAC,6BAA6B,CAAC,EAC9C,6BAA6B,CAC9B;YACD,wBAAwB,EAAE,IAAI,CAAC,MAAM,CACnC,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAC3C,0BAA0B,CAC3B;YACD,wBAAwB,EAAE,IAAI,CAAC,MAAM,CACnC,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAC3C,0BAA0B,CAC3B;YACD,sBAAsB,EAAE,IAAI,CAAC,MAAM,CACjC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EACzC,wBAAwB,CACzB;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,QAAQ;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,CAAC;QAE3E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,0BAA0B,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;YAClC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;SACnC,CAAC,CAAC,KAAK,CAAC;IACX,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CACZ,KAAsC,EACtC,KAAa;QAEb,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;IAEO,MAAM,CACZ,KAAsC,EACtC,KAAa;QAEb,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-cognito-user-pool-properties.js","sourceRoot":"","sources":["../../../../../src/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-properties.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,kCAAkC,EAAE,MAAM,+CAA+C,CAAC;AACnG,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,mBAAmB,GAAG;IAC1B,cAAc;IACd,UAAU;IACV,oBAAoB;IACpB,cAAc;IACd,kBAAkB;IAClB,aAAa;IACb,cAAc;IACd,uBAAuB;IACvB,wBAAwB;IACxB,QAAQ;IACR,wBAAwB;IACxB,0BAA0B;IAC1B,0BAA0B;IAC1B,wBAAwB;IACxB,6BAA6B;CAC9B,CAAC;AAOF;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IACzB,QAAQ,CAAiB;IACzB,UAAU,CAA4B;IACtC,cAAc,GAAG,IAAI,2BAA2B,CAAC;QAChE,YAAY,EAAE,wBAAwB;QACtC,SAAS,EAAE,mBAAmB;KAC/B,CAAC,CAAC;IAEH,YAAY,UAAqD;QAC/D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QAExC,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACxE,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QACjB,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;YACzB,QAAQ,EAAE,IAAI,qBAAqB,CAAC;gBAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACrC,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAC7B,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,EACrC,oBAAoB,CACrB;YACD,YAAY,EAAE,IAAI,CAAC,MAAM,CACvB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAC/B,cAAc,CACf;YACD,YAAY,EAAE,IAAI,CAAC,MAAM,CACvB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAC/B,cAAc,CACf;YACD,sBAAsB,EAAE,IAAI,4BAA4B,CAAC;gBACvD,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;YACnD,qBAAqB,EAAE,IAAI,kCAAkC,CAAC;gBAC5D,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;YAClD,sBAAsB,EAAE,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAC7D,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EACzC,wBAAwB,CACzB;YACD,MAAM,EAAE,IAAI,2BAA2B,CAAC;gBACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACnC,2BAA2B,EAAE,IAAI,CAAC,MAAM,CACtC,IAAI,CAAC,UAAU,CAAC,6BAA6B,CAAC,EAC9C,6BAA6B,CAC9B;YACD,wBAAwB,EAAE,IAAI,CAAC,MAAM,CACnC,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAC3C,0BAA0B,CAC3B;YACD,wBAAwB,EAAE,IAAI,CAAC,MAAM,CACnC,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAC3C,0BAA0B,CAC3B;YACD,sBAAsB,EAAE,IAAI,CAAC,MAAM,CACjC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EACzC,wBAAwB,CACzB;SACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,yBAAyB,CACvB,UAAkB;QAElB,OAAO,IAAI,wBAAwB,CAAC;YAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACK,QAAQ;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,CAAC;QAE3E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,0BAA0B,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;YAClC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;SACnC,CAAC,CAAC,KAAK,CAAC;IACX,CAAC;IAED;;;;;OAKG;IACK,MAAM,CACZ,KAAsC,EACtC,KAAa;QAEb,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;IAEO,MAAM,CACZ,KAAsC,EACtC,KAAa;QAEb,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;CACF"}

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-schema.d.ts

@@ -0,0 +1,27 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValue } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimCognitoSchemaAttributeType } from "../../user-pool/schema/sim-cognito-schema-attribute.js";
+import type { SimCfnCognitoPropertyParser } from "../sim-cfn-cognito-property-parser.js";
+interface SimCfnCognitoUserPoolSchemaProperties {
+    readonly resource: SimCfnResource;
+    readonly propertyParser: SimCfnCognitoPropertyParser;
+}
+/**
+ * Reads the `Schema` property of an AWS::Cognito::UserPool Resource into the
+ * attribute declarations CreateUserPool takes.
+ *
+ * This is what a CDK `UserPool` emits for its `customAttributes`, and for a
+ * `standardAttributes` entry saying an attribute is required.
+ */
+export declare class SimCfnCognitoUserPoolSchema {
+    private readonly resource;
+    private readonly propertyParser;
+    private readonly attribute;
+    constructor(properties: SimCfnCognitoUserPoolSchemaProperties);
+    /**
+     * The attributes the template declares, or undefined where it declares none.
+     */
+    parse(value: SimCfnTemplateValue | undefined): readonly SimCognitoSchemaAttributeType[] | undefined;
+}
+export {};
+//# sourceMappingURL=sim-cfn-cognito-user-pool-schema.d.ts.map

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cognito-user-pool-schema.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AAC5G,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAGzF,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,2BAA2B,CAAC;CACtD;AAED;;;;;;GAMG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAC7D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+B;IAEzD,YAAY,UAAU,EAAE,qCAAqC,EAI5D;IAED;;OAEG;IACH,KAAK,CACH,KAAK,EAAE,mBAAmB,GAAG,SAAS,GACrC,SAAS,6BAA6B,EAAE,GAAG,SAAS,CActD;CACF"}

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-schema.js

@@ -0,0 +1,31 @@
+import { SimCfnCognitoSchemaAttribute } from "./sim-cfn-cognito-schema-attribute.js";
+/**
+ * Reads the `Schema` property of an AWS::Cognito::UserPool Resource into the
+ * attribute declarations CreateUserPool takes.
+ *
+ * This is what a CDK `UserPool` emits for its `customAttributes`, and for a
+ * `standardAttributes` entry saying an attribute is required.
+ */
+export class SimCfnCognitoUserPoolSchema {
+    resource;
+    propertyParser;
+    attribute;
+    constructor(properties) {
+        this.resource = properties.resource;
+        this.propertyParser = properties.propertyParser;
+        this.attribute = new SimCfnCognitoSchemaAttribute(properties);
+    }
+    /**
+     * The attributes the template declares, or undefined where it declares none.
+     */
+    parse(value) {
+        if (value === undefined) {
+            return undefined;
+        }
+        if (!Array.isArray(value)) {
+            throw this.propertyParser.invalidPropertyError(this.resource, "Schema", "a list of attribute declarations");
+        }
+        return value.map((entry, index) => this.attribute.parse(entry, index));
+    }
+}
+//# sourceMappingURL=sim-cfn-cognito-user-pool-schema.js.map

package/dist/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-cognito-user-pool-schema.js","sourceRoot":"","sources":["../../../../../src/service/cognito/cfn/user-pool/sim-cfn-cognito-user-pool-schema.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAOrF;;;;;;GAMG;AACH,MAAM,OAAO,2BAA2B;IACrB,QAAQ,CAAiB;IACzB,cAAc,CAA8B;IAC5C,SAAS,CAA+B;IAEzD,YAAY,UAAiD;QAC3D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,SAAS,GAAG,IAAI,4BAA4B,CAAC,UAAU,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,KAAK,CACH,KAAsC;QAEtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAC5C,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,kCAAkC,CACnC,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-admin-respond-to-challenge.d.ts

@@ -1,10 +1,10 @@
 import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
-import type { SimCognitoNewPasswordResponse } from "./sim-cognito-new-password-response.js";
+import type { SimCognitoChallengeResponses } from "./sim-cognito-challenge-responses.js";
 import type { SimAdminRespondToAuthChallengeCommand, SimAdminRespondToAuthChallengeCommandOutput } from "./auth.command.js";
 interface SimCognitoAdminRespondToChallengeProperties {
     readonly authResolver: SimCognitoAuthResolver;
-    readonly newPassword: SimCognitoNewPasswordResponse;
+    readonly responses: SimCognitoChallengeResponses;
 }
 interface SimCognitoCommandOptions {
     readonly caller?: SimAwsCaller;
@@ -12,12 +12,13 @@ interface SimCognitoCommandOptions {
 /**
  * The AdminRespondToAuthChallenge command.
  *
- * Only `NEW_PASSWORD_REQUIRED` is answered, and the caller needs the
- * `cognito-idp:AdminRespondToAuthChallenge` permission on the pool.
+ * `NEW_PASSWORD_REQUIRED` and the two MFA challenges are answered, and the
+ * caller needs the `cognito-idp:AdminRespondToAuthChallenge` permission on the
+ * pool.
  */
 export declare class SimCognitoAdminRespondToChallenge {
     private readonly authResolver;
-    private readonly newPassword;
+    private readonly responses;
     private readonly unsimulatedOptions;
     constructor(properties: SimCognitoAdminRespondToChallengeProperties);
     /**

package/dist/service/cognito/command/auth/sim-cognito-admin-respond-to-challenge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-admin-respond-to-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-admin-respond-to-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAE1E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,OAAO,KAAK,EACV,qCAAqC,EACrC,2CAA2C,EAC5C,MAAM,mBAAmB,CAAC;AAE3B,UAAU,2CAA2C;IACnD,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;CACrD;AAED,UAAU,wBAAwB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;GAKG;AACH,qBAAa,iCAAiC;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA0C;IAE7E,YAAY,UAAU,EAAE,2CAA2C,EAGlE;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,qCAAqC,EAC9C,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,2CAA2C,CAAC,CAqBtD;CACF"}
+{"version":3,"file":"sim-cognito-admin-respond-to-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-admin-respond-to-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAE1E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAEzF,OAAO,KAAK,EACV,qCAAqC,EACrC,2CAA2C,EAC5C,MAAM,mBAAmB,CAAC;AAE3B,UAAU,2CAA2C;IACnD,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,4BAA4B,CAAC;CAClD;AAED,UAAU,wBAAwB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,iCAAiC;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+B;IACzD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA0C;IAE7E,YAAY,UAAU,EAAE,2CAA2C,EAGlE;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,qCAAqC,EAC9C,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,2CAA2C,CAAC,CAmBtD;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-admin-respond-to-challenge.js

@@ -1,19 +1,19 @@
 import { SimCognitoAuthParameters } from "./sim-cognito-auth-parameters.js";
-import { requireSimCognitoNewPasswordChallenge } from "./sim-cognito-auth-challenge.js";
 import { SimCognitoUnsimulatedAuthOptions } from "./sim-cognito-unsimulated-auth-options.js";
 /**
  * The AdminRespondToAuthChallenge command.
  *
- * Only `NEW_PASSWORD_REQUIRED` is answered, and the caller needs the
- * `cognito-idp:AdminRespondToAuthChallenge` permission on the pool.
+ * `NEW_PASSWORD_REQUIRED` and the two MFA challenges are answered, and the
+ * caller needs the `cognito-idp:AdminRespondToAuthChallenge` permission on the
+ * pool.
  */
 export class SimCognitoAdminRespondToChallenge {
     authResolver;
-    newPassword;
+    responses;
     unsimulatedOptions = new SimCognitoUnsimulatedAuthOptions();
     constructor(properties) {
         this.authResolver = properties.authResolver;
-        this.newPassword = properties.newPassword;
+        this.responses = properties.responses;
     }
     /**
      * Answer a challenge.
@@ -22,8 +22,7 @@ export class SimCognitoAdminRespondToChallenge {
         const { input } = command;
         const { pool, client } = this.authResolver.poolClient("cognito-idp:AdminRespondToAuthChallenge", input, options);
         this.unsimulatedOptions.refuseInAdminResponse(input);
-        requireSimCognitoNewPasswordChallenge(input.ChallengeName);
-        return await this.newPassword.handle({
+        return await this.responses.handle(input.ChallengeName, {
             pool,
             client,
             parameters: new SimCognitoAuthParameters("ChallengeResponses", input.ChallengeResponses),

package/dist/service/cognito/command/auth/sim-cognito-admin-respond-to-challenge.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-admin-respond-to-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-admin-respond-to-challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,EAAE,qCAAqC,EAAE,MAAM,iCAAiC,CAAC;AAExF,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAe7F;;;;;GAKG;AACH,MAAM,OAAO,iCAAiC;IAC3B,YAAY,CAAyB;IACrC,WAAW,CAAgC;IAC3C,kBAAkB,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAE7E,YAAY,UAAuD;QACjE,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAA8C,EAC9C,OAAkC;QAElC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CACnD,yCAAyC,EACzC,KAAK,EACL,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACrD,qCAAqC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAE3D,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YACnC,IAAI;YACJ,MAAM;YACN,UAAU,EAAE,IAAI,wBAAwB,CACtC,oBAAoB,EACpB,KAAK,CAAC,kBAAkB,CACzB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-admin-respond-to-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-admin-respond-to-challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAG5E,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAe7F;;;;;;GAMG;AACH,MAAM,OAAO,iCAAiC;IAC3B,YAAY,CAAyB;IACrC,SAAS,CAA+B;IACxC,kBAAkB,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAE7E,YAAY,UAAuD;QACjE,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAA8C,EAC9C,OAAkC;QAElC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CACnD,yCAAyC,EACzC,KAAK,EACL,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE;YACtD,IAAI;YACJ,MAAM;YACN,UAAU,EAAE,IAAI,wBAAwB,CACtC,oBAAoB,EACpB,KAAK,CAAC,kBAAkB,CACzB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-challenge.d.ts

@@ -1,12 +1,13 @@
 /**
- * The challenge this simulation can answer.
+ * The challenge a user with a temporary password is answered with.
  */
 export declare const newPasswordRequiredChallenge = "NEW_PASSWORD_REQUIRED";
 /**
  * Refuse a challenge this simulation cannot answer.
  *
- * MFA and custom authentication challenges are refused rather than answered as
- * this one, because what a caller has to send back is different for each.
+ * `MFA_SETUP` and the custom authentication challenges are refused rather than
+ * answered as one of these, because what a caller has to send back is
+ * different for each.
  */
-export declare function requireSimCognitoNewPasswordChallenge(challengeName: string | undefined): void;
+export declare function requireSimCognitoChallengeName(challengeName: string | undefined): string;
 //# sourceMappingURL=sim-cognito-auth-challenge.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-auth-challenge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-challenge.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,4BAA4B,0BAA0B,CAAC;AAEpE;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,IAAI,CAUN"}
+{"version":3,"file":"sim-cognito-auth-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-challenge.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,eAAO,MAAM,4BAA4B,0BAA0B,CAAC;AAgBpE;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,MAAM,CAaR"}

package/dist/service/cognito/command/auth/sim-cognito-auth-challenge.js

@@ -1,20 +1,36 @@
 import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+import { simCognitoSmsMfa, simCognitoSoftwareTokenMfa, } from "../../user-pool/user/mfa/sim-cognito-mfa-factors.js";
 /**
- * The challenge this simulation can answer.
+ * The challenge a user with a temporary password is answered with.
  */
 export const newPasswordRequiredChallenge = "NEW_PASSWORD_REQUIRED";
+/**
+ * The challenges this simulation issues and can be answered with.
+ *
+ * The two MFA challenges are named after the factors they are for, which is
+ * how Cognito names them: a user registered for a software token is
+ * challenged with `SOFTWARE_TOKEN_MFA` and answers with a
+ * `SOFTWARE_TOKEN_MFA_CODE`.
+ */
+const answerableChallenges = [
+    newPasswordRequiredChallenge,
+    simCognitoSmsMfa,
+    simCognitoSoftwareTokenMfa,
+];
 /**
  * Refuse a challenge this simulation cannot answer.
  *
- * MFA and custom authentication challenges are refused rather than answered as
- * this one, because what a caller has to send back is different for each.
+ * `MFA_SETUP` and the custom authentication challenges are refused rather than
+ * answered as one of these, because what a caller has to send back is
+ * different for each.
  */
-export function requireSimCognitoNewPasswordChallenge(challengeName) {
-    if (challengeName === newPasswordRequiredChallenge) {
-        return;
+export function requireSimCognitoChallengeName(challengeName) {
+    if (challengeName !== undefined &&
+        answerableChallenges.includes(challengeName)) {
+        return challengeName;
     }
     throw new SimCognitoInvalidParameterException(`ChallengeName '${String(challengeName)}' is not simulated: ` +
-        `${newPasswordRequiredChallenge} is the only challenge this ` +
+        `${answerableChallenges.join(", ")} are the challenges this ` +
         `simulation issues.`);
 }
 //# sourceMappingURL=sim-cognito-auth-challenge.js.map

package/dist/service/cognito/command/auth/sim-cognito-auth-challenge.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAuB,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,aAAiC;IAEjC,IAAI,aAAa,KAAK,4BAA4B,EAAE,CAAC;QACnD,OAAO;IACT,CAAC;IAED,MAAM,IAAI,mCAAmC,CAC3C,kBAAkB,MAAM,CAAC,aAAa,CAAC,sBAAsB;QAC3D,GAAG,4BAA4B,8BAA8B;QAC7D,oBAAoB,CACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sim-cognito-auth-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,qDAAqD,CAAC;AAE7D;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAuB,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAsB;IAC9C,4BAA4B;IAC5B,gBAAgB;IAChB,0BAA0B;CAC3B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,aAAiC;IAEjC,IACE,aAAa,KAAK,SAAS;QAC3B,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC5C,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,IAAI,mCAAmC,CAC3C,kBAAkB,MAAM,CAAC,aAAa,CAAC,sBAAsB;QAC3D,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;QAC7D,oBAAoB,CACvB,CAAC;AACJ,CAAC"}

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.d.ts

@@ -1,4 +1,5 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoPoolMessenger } from "../../user-pool/message/sim-cognito-pool-messenger.js";
 import type { SimCognitoUserPoolStore } from "../../user-pool/sim-cognito-user-pool-store.js";
 import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
 import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
@@ -20,6 +21,12 @@ interface SimCognitoAuthCommandsProperties {
      * pool's hosted endpoints so both hand out the same thing.
      */
     readonly tokenIssuer: SimCognitoTokenIssuer;
+    /**
+     * What records the message a pool would have texted an MFA code in, shared
+     * with the sign-up and user commands so every message a pool sends is
+     * recorded the same way.
+     */
+    readonly messenger: SimCognitoPoolMessenger;
 }
 /**
  * The authentication command handlers of one simulated Cognito scope.

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAC5G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAEhG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAKxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAE9C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED;;;;;;;;;;GAUG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,uBAAuB,EAAE,iCAAiC,CAAC;IAC3E,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,kBAAkB,EAAE,4BAA4B,CAAC;IACjE,SAAgB,OAAO,EAAE,yBAAyB,CAAC;IAEnD,YAAY,UAAU,EAAE,gCAAgC,EAoCvD;CACF"}
+{"version":3,"file":"sim-cognito-auth-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AACrG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAC5G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAEhG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAOxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAErF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAE9C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAE5C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;;;;;;;;;GAUG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,uBAAuB,EAAE,iCAAiC,CAAC;IAC3E,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,kBAAkB,EAAE,4BAA4B,CAAC;IACjE,SAAgB,OAAO,EAAE,yBAAyB,CAAC;IAEnD,YAAY,UAAU,EAAE,gCAAgC,EAqDvD;CACF"}