@kensio/yulin 1.18.1 → 1.19.0

package/dist/service/cognito/user-pool/mfa/sim-cognito-web-authn-configuration.js

@@ -0,0 +1,73 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+const userVerificationValues = [
+    "required",
+    "preferred",
+];
+const relyingPartyIdLength = { least: 1, most: 127 };
+/**
+ * The passkey configuration of one simulated user pool.
+ *
+ * Two values, both of which decide what a passkey means rather than how a
+ * sign-in runs. The relying party ID is the name a passkey is registered
+ * against, and it authenticates for that name and the hosts under it. The user
+ * verification preference decides whether an authenticator that checks nobody
+ * may register at all, and `required` is what makes a passkey count towards
+ * MFA on real Cognito.
+ *
+ * They arrive through `SetUserPoolMfaConfig` rather than `CreateUserPool`,
+ * which is why an `AWS::Cognito::UserPool` Resource carrying
+ * `WebAuthnRelyingPartyID` is deployed in two calls here as it is on real
+ * CloudFormation.
+ *
+ * `StartWebAuthnRegistration` reads both, and a pool that names no relying
+ * party has nothing to register a passkey against.
+ */
+export class SimCognitoWebAuthnConfiguration {
+    relyingPartyId;
+    userVerification;
+    constructor(configuration) {
+        this.relyingPartyId = SimCognitoWebAuthnConfiguration.relyingPartyIn(configuration.RelyingPartyId);
+        this.userVerification = SimCognitoWebAuthnConfiguration.verificationIn(configuration.UserVerification);
+    }
+    /**
+     * A relying party ID is a domain, and Cognito takes one of between one and
+     * 127 characters. A pool configured with an empty one would register
+     * passkeys against nothing.
+     */
+    static relyingPartyIn(requested) {
+        if (requested === undefined) {
+            return undefined;
+        }
+        if (requested.length < relyingPartyIdLength.least ||
+            requested.length > relyingPartyIdLength.most) {
+            throw new SimCognitoInvalidParameterException("WebAuthnConfiguration RelyingPartyId must be between " +
+                `${String(relyingPartyIdLength.least)} and ` +
+                `${String(relyingPartyIdLength.most)} characters long`);
+        }
+        return requested;
+    }
+    static verificationIn(requested) {
+        if (requested === undefined) {
+            return undefined;
+        }
+        if (!userVerificationValues.includes(requested)) {
+            throw new SimCognitoInvalidParameterException(`WebAuthnConfiguration UserVerification '${requested}' is not a ` +
+                `Cognito user verification preference: use one of ${userVerificationValues.join(" or ")}`);
+        }
+        return requested;
+    }
+    /**
+     * The configuration as `GetUserPoolMfaConfig` reports it.
+     */
+    toOutput() {
+        return {
+            ...(this.relyingPartyId !== undefined && {
+                RelyingPartyId: this.relyingPartyId,
+            }),
+            ...(this.userVerification !== undefined && {
+                UserVerification: this.userVerification,
+            }),
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-web-authn-configuration.js.map

package/dist/service/cognito/user-pool/mfa/sim-cognito-web-authn-configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-configuration.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/mfa/sim-cognito-web-authn-configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAevF,MAAM,sBAAsB,GAAkD;IAC5E,UAAU;IACV,WAAW;CACZ,CAAC;AAEF,MAAM,oBAAoB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAErD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,+BAA+B;IAC1B,cAAc,CAAqB;IACnC,gBAAgB,CAElB;IAEd,YAAY,aAAkD;QAC5D,IAAI,CAAC,cAAc,GAAG,+BAA+B,CAAC,cAAc,CAClE,aAAa,CAAC,cAAc,CAC7B,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,+BAA+B,CAAC,cAAc,CACpE,aAAa,CAAC,gBAAgB,CAC/B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,cAAc,CAC3B,SAA6B;QAE7B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IACE,SAAS,CAAC,MAAM,GAAG,oBAAoB,CAAC,KAAK;YAC7C,SAAS,CAAC,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAC5C,CAAC;YACD,MAAM,IAAI,mCAAmC,CAC3C,uDAAuD;gBACrD,GAAG,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO;gBAC5C,GAAG,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,CACzD,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,cAAc,CAC3B,SAA6B;QAE7B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IACE,CAAC,sBAAsB,CAAC,QAAQ,CAC9B,SAA+C,CAChD,EACD,CAAC;YACD,MAAM,IAAI,mCAAmC,CAC3C,2CAA2C,SAAS,aAAa;gBAC/D,oDAAoD,sBAAsB,CAAC,IAAI,CAC7E,MAAM,CACP,EAAE,CACN,CAAC;QACJ,CAAC;QAED,OAAO,SAA+C,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI;gBACvC,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI;gBACzC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;aACxC,CAAC;SACH,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-password-policy.d.ts

@@ -1,3 +1,4 @@
+import type { SimCognitoSignInPolicyType } from "./sim-cognito-sign-in-policy.js";
 /**
  * A user pool password policy, in the shape Cognito reports it.
  *
@@ -12,15 +13,6 @@ export interface SimCognitoPasswordPolicyType {
     readonly PasswordHistorySize?: number | undefined;
     readonly TemporaryPasswordValidityDays?: number | undefined;
 }
-/**
- * The sign-in policy of a user pool, which chooses the first factor a user
- * may authenticate with.
- *
- * https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SignInPolicyType.html
- */
-export interface SimCognitoSignInPolicyType {
-    readonly AllowedFirstAuthFactors?: readonly string[] | undefined;
-}
 /**
  * The policies of a user pool, as Cognito groups them.
  *

package/dist/service/cognito/user-pool/sim-cognito-password-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-password-policy.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-password-policy.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7D;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;CAChE;AAKD;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,aAAa,EAAE,MAAM,CAAC;IACtC,SAAgB,iBAAiB,EAAE,OAAO,CAAC;IAC3C,SAAgB,iBAAiB,EAAE,OAAO,CAAC;IAC3C,SAAgB,eAAe,EAAE,OAAO,CAAC;IACzC,SAAgB,eAAe,EAAE,OAAO,CAAC;IACzC,SAAgB,6BAA6B,EAAE,MAAM,CAAC;IAEtD,YAAY,MAAM,GAAE,4BAAiC,EAepD;IAED,OAAO,CAAC,MAAM,CAAC,aAAa;IAmB5B;;OAEG;IACH,QAAQ,IAAI,4BAA4B,CASvC;CACF"}
+{"version":3,"file":"sim-cognito-password-policy.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-password-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAElF;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7D;AAED;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,0BAA0B,GAAG,SAAS,CAAC;CAChE;AAKD;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,aAAa,EAAE,MAAM,CAAC;IACtC,SAAgB,iBAAiB,EAAE,OAAO,CAAC;IAC3C,SAAgB,iBAAiB,EAAE,OAAO,CAAC;IAC3C,SAAgB,eAAe,EAAE,OAAO,CAAC;IACzC,SAAgB,eAAe,EAAE,OAAO,CAAC;IACzC,SAAgB,6BAA6B,EAAE,MAAM,CAAC;IAEtD,YAAY,MAAM,GAAE,4BAAiC,EAepD;IAED,OAAO,CAAC,MAAM,CAAC,aAAa;IAmB5B;;OAEG;IACH,QAAQ,IAAI,4BAA4B,CASvC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-password-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-password-policy.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-password-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAqCpF,MAAM,kBAAkB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAClD,MAAM,kCAAkC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IACnB,aAAa,CAAS;IACtB,iBAAiB,CAAU;IAC3B,iBAAiB,CAAU;IAC3B,eAAe,CAAU;IACzB,eAAe,CAAU;IACzB,6BAA6B,CAAS;IAEtD,YAAY,MAAM,GAAiC,EAAE;QACnD,IAAI,CAAC,aAAa,GAAG,wBAAwB,CAAC,aAAa,CACzD,eAAe,EACf,MAAM,CAAC,aAAa,IAAI,CAAC,EACzB,kBAAkB,CACnB,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC;QACzD,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC;QACzD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,6BAA6B,GAAG,wBAAwB,CAAC,aAAa,CACzE,+BAA+B,EAC/B,MAAM,CAAC,6BAA6B,IAAI,CAAC,EACzC,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,aAAa,CAC1B,KAAa,EACb,KAAa,EACb,KAAwD;QAExD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;YAC5B,KAAK,GAAG,KAAK,CAAC,KAAK;YACnB,KAAK,GAAG,KAAK,CAAC,IAAI,EAClB,CAAC;YACD,MAAM,IAAI,mCAAmC,CAC3C,kBAAkB,KAAK,kCAAkC;gBACvD,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB;YACxC,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;SAClE,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-password-policy.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-password-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AA4BpF,MAAM,kBAAkB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAClD,MAAM,kCAAkC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IACnB,aAAa,CAAS;IACtB,iBAAiB,CAAU;IAC3B,iBAAiB,CAAU;IAC3B,eAAe,CAAU;IACzB,eAAe,CAAU;IACzB,6BAA6B,CAAS;IAEtD,YAAY,MAAM,GAAiC,EAAE;QACnD,IAAI,CAAC,aAAa,GAAG,wBAAwB,CAAC,aAAa,CACzD,eAAe,EACf,MAAM,CAAC,aAAa,IAAI,CAAC,EACzB,kBAAkB,CACnB,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC;QACzD,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC;QACzD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;QACrD,IAAI,CAAC,6BAA6B,GAAG,wBAAwB,CAAC,aAAa,CACzE,+BAA+B,EAC/B,MAAM,CAAC,6BAA6B,IAAI,CAAC,EACzC,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,aAAa,CAC1B,KAAa,EACb,KAAa,EACb,KAAwD;QAExD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;YAC5B,KAAK,GAAG,KAAK,CAAC,KAAK;YACnB,KAAK,GAAG,KAAK,CAAC,IAAI,EAClB,CAAC;YACD,MAAM,IAAI,mCAAmC,CAC3C,kBAAkB,KAAK,kCAAkC;gBACvD,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB;YACxC,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;SAClE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-sign-in-policy.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The sign-in policy of a user pool, which chooses the factors a user may
+ * authenticate with first.
+ *
+ * https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SignInPolicyType.html
+ */
+export interface SimCognitoSignInPolicyType {
+    readonly AllowedFirstAuthFactors?: readonly string[] | undefined;
+}
+/**
+ * A factor a user pool can offer at the first authentication prompt.
+ *
+ * `PASSWORD` covers both the plain-password and the SRP flows, which is what
+ * AWS says about the value.
+ */
+export type SimCognitoFirstAuthFactor = "PASSWORD" | "EMAIL_OTP" | "SMS_OTP" | "WEB_AUTHN";
+/**
+ * The factors one simulated user pool allows at the first prompt.
+ *
+ * A pool created without a sign-in policy allows a password and says nothing
+ * about it, which is how real Cognito reports one. A pool created with a
+ * policy carries the factors it named, and reports them back under `Policies`.
+ *
+ * A `USER_AUTH` sign-in reads these to decide what it can offer, and answers
+ * with the ones this user could actually present. `PASSWORD` and `WEB_AUTHN`
+ * are presented here. A code sent by email or by text is not, and a sign-in
+ * choosing one is refused in words that say what could not be done.
+ *
+ * The validation is real Cognito's. The four factor names are the ones it
+ * accepts, a list may name five of them at most, and a policy offering
+ * passkeys and nothing else is refused because AWS states that `WEB_AUTHN`
+ * "must be accompanied by at least one other option".
+ */
+export declare class SimCognitoSignInPolicy {
+    #private;
+    constructor(policy?: SimCognitoSignInPolicyType);
+    private static factorsIn;
+    private static requireCount;
+    private static requireKnown;
+    /**
+     * Refuse a policy offering passkeys and nothing else, as real Cognito
+     * refuses one. A passkey has to be registered from a session that already
+     * exists, so a pool with no other way in would have nobody able to register.
+     *
+     * The companion has to be a different factor, so naming `WEB_AUTHN` twice
+     * leaves the pool as shut as naming it once does.
+     */
+    private static requireCompanionForPasskeys;
+    /**
+     * The factors a sign-in may offer, which is what the policy named or the
+     * password a pool with no policy allows.
+     */
+    get factors(): readonly SimCognitoFirstAuthFactor[];
+    /**
+     * The policy as Cognito reports it on the pool, and nothing where the pool
+     * was created without one.
+     */
+    toOutput(): SimCognitoSignInPolicyType | undefined;
+}
+//# sourceMappingURL=sim-cognito-sign-in-policy.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-sign-in-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-sign-in-policy.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-sign-in-policy.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAClE;AAED;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GACjC,UAAU,GACV,WAAW,GACX,SAAS,GACT,WAAW,CAAC;AAiBhB;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,sBAAsB;;IASjC,YAAY,MAAM,CAAC,EAAE,0BAA0B,EAS9C;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAYxB,OAAO,CAAC,MAAM,CAAC,YAAY;IAgB3B,OAAO,CAAC,MAAM,CAAC,YAAY;IAW3B;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,2BAA2B;IAW1C;;;OAGG;IACH,IAAI,OAAO,IAAI,SAAS,yBAAyB,EAAE,CAElD;IAED;;;OAGG;IACH,QAAQ,IAAI,0BAA0B,GAAG,SAAS,CAMjD;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-sign-in-policy.js

@@ -0,0 +1,100 @@
+import { SimCognitoInvalidParameterException } from "../error/sim-cognito.error.js";
+const firstAuthFactors = [
+    "PASSWORD",
+    "EMAIL_OTP",
+    "SMS_OTP",
+    "WEB_AUTHN",
+];
+const mostFactors = 5;
+/**
+ * What a pool allows at the first prompt when its policy named nothing, which
+ * is what real Cognito falls back to.
+ */
+const defaultFactors = ["PASSWORD"];
+/**
+ * The factors one simulated user pool allows at the first prompt.
+ *
+ * A pool created without a sign-in policy allows a password and says nothing
+ * about it, which is how real Cognito reports one. A pool created with a
+ * policy carries the factors it named, and reports them back under `Policies`.
+ *
+ * A `USER_AUTH` sign-in reads these to decide what it can offer, and answers
+ * with the ones this user could actually present. `PASSWORD` and `WEB_AUTHN`
+ * are presented here. A code sent by email or by text is not, and a sign-in
+ * choosing one is refused in words that say what could not be done.
+ *
+ * The validation is real Cognito's. The four factor names are the ones it
+ * accepts, a list may name five of them at most, and a policy offering
+ * passkeys and nothing else is refused because AWS states that `WEB_AUTHN`
+ * "must be accompanied by at least one other option".
+ */
+export class SimCognitoSignInPolicy {
+    /**
+     * The factors the policy named, in the order it named them, and nothing
+     * where the pool was created without a policy at all.
+     */
+    #allowedFirstAuthFactors;
+    constructor(policy) {
+        const requested = policy?.AllowedFirstAuthFactors;
+        if (requested === undefined) {
+            this.#allowedFirstAuthFactors = undefined;
+            return;
+        }
+        this.#allowedFirstAuthFactors = SimCognitoSignInPolicy.factorsIn(requested);
+    }
+    static factorsIn(requested) {
+        this.requireCount(requested);
+        const factors = requested.map((factor) => this.requireKnown(factor));
+        this.requireCompanionForPasskeys(factors);
+        return factors;
+    }
+    static requireCount(requested) {
+        if (requested.length === 0) {
+            throw new SimCognitoInvalidParameterException("SignInPolicy AllowedFirstAuthFactors must name at least one factor: " +
+                `use one or more of ${firstAuthFactors.join(", ")}`);
+        }
+        if (requested.length > mostFactors) {
+            throw new SimCognitoInvalidParameterException("SignInPolicy AllowedFirstAuthFactors must name no more than " +
+                `${String(mostFactors)} factors`);
+        }
+    }
+    static requireKnown(factor) {
+        if (!firstAuthFactors.includes(factor)) {
+            throw new SimCognitoInvalidParameterException(`SignInPolicy AllowedFirstAuthFactors '${factor}' is not a Cognito ` +
+                `first authentication factor: use one of ${firstAuthFactors.join(", ")}`);
+        }
+        return factor;
+    }
+    /**
+     * Refuse a policy offering passkeys and nothing else, as real Cognito
+     * refuses one. A passkey has to be registered from a session that already
+     * exists, so a pool with no other way in would have nobody able to register.
+     *
+     * The companion has to be a different factor, so naming `WEB_AUTHN` twice
+     * leaves the pool as shut as naming it once does.
+     */
+    static requireCompanionForPasskeys(factors) {
+        if (factors.every((factor) => factor === "WEB_AUTHN")) {
+            throw new SimCognitoInvalidParameterException("SignInPolicy AllowedFirstAuthFactors WEB_AUTHN has to be " +
+                "accompanied by at least one other factor");
+        }
+    }
+    /**
+     * The factors a sign-in may offer, which is what the policy named or the
+     * password a pool with no policy allows.
+     */
+    get factors() {
+        return this.#allowedFirstAuthFactors ?? defaultFactors;
+    }
+    /**
+     * The policy as Cognito reports it on the pool, and nothing where the pool
+     * was created without one.
+     */
+    toOutput() {
+        if (this.#allowedFirstAuthFactors === undefined) {
+            return undefined;
+        }
+        return { AllowedFirstAuthFactors: [...this.#allowedFirstAuthFactors] };
+    }
+}
+//# sourceMappingURL=sim-cognito-sign-in-policy.js.map

package/dist/service/cognito/user-pool/sim-cognito-sign-in-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-sign-in-policy.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-sign-in-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAwBpF,MAAM,gBAAgB,GAAyC;IAC7D,UAAU;IACV,WAAW;IACX,SAAS;IACT,WAAW;CACZ,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB;;;GAGG;AACH,MAAM,cAAc,GAAyC,CAAC,UAAU,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,sBAAsB;IACjC;;;OAGG;IACM,wBAAwB,CAEnB;IAEd,YAAY,MAAmC;QAC7C,MAAM,SAAS,GAAG,MAAM,EAAE,uBAAuB,CAAC;QAElD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,wBAAwB,GAAG,SAAS,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,wBAAwB,GAAG,sBAAsB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9E,CAAC;IAEO,MAAM,CAAC,SAAS,CACtB,SAA4B;QAE5B,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAE7B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QAErE,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAE1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,SAA4B;QACtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,mCAAmC,CAC3C,sEAAsE;gBACpE,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtD,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAmC,CAC3C,8DAA8D;gBAC5D,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,MAAc;QACxC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAmC,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,mCAAmC,CAC3C,yCAAyC,MAAM,qBAAqB;gBAClE,2CAA2C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO,MAAmC,CAAC;IAC7C,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,2BAA2B,CACxC,OAA6C;QAE7C,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,mCAAmC,CAC3C,2DAA2D;gBACzD,0CAA0C,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,wBAAwB,IAAI,cAAc,CAAC;IACzD,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,IAAI,IAAI,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;YAChD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,uBAAuB,EAAE,CAAC,GAAG,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC;IACzE,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-settings.d.ts

@@ -7,6 +7,7 @@ import { SimCognitoPasswordPolicy, type SimCognitoUserPoolPoliciesType } from ".
 import { SimCognitoVerificationMessages, type SimCognitoVerificationMessagesType } from "./message/sim-cognito-verification-messages.js";
 import type { SimCognitoSchemaAttributeType } from "./schema/sim-cognito-schema-attribute.js";
 import { SimCognitoUserPoolSchema } from "./schema/sim-cognito-user-pool-schema.js";
+import { SimCognitoSignInPolicy } from "./sim-cognito-sign-in-policy.js";
 import { SimCognitoUsernameAttributes } from "./sim-cognito-username-attributes.js";
 import { SimCognitoLambdaConfig } from "./trigger/sim-cognito-lambda-config.js";
 /**
@@ -51,7 +52,8 @@ interface SimCognitoUserPoolSettingsProperties {
 }
 /**
  * The settings of one simulated user pool that a request can change: the
- * password policy, the deletion protection, whether users may sign themselves
+ * password policy, the factors it allows at the first prompt, the deletion
+ * protection, whether users may sign themselves
  * up, what confirming a sign-up verifies, the Lambda triggers the pool runs,
  * whether it asks for a second factor, how it recovers an account and what its
  * messages say.
@@ -73,6 +75,14 @@ interface SimCognitoUserPoolSettingsProperties {
 export declare class SimCognitoUserPoolSettings {
     #private;
     readonly passwordPolicy: SimCognitoPasswordPolicy;
+    /**
+     * The factors the pool allows at the first authentication prompt.
+     *
+     * A pool created without a `SignInPolicy` allows a password and reports no
+     * policy, as real Cognito reports one. A `USER_AUTH` sign-in offers the
+     * factors this names, narrowed to the ones the user could present.
+     */
+    readonly signInPolicy: SimCognitoSignInPolicy;
     readonly deletionProtection: SimCognitoDeletionProtection;
     readonly adminCreateUserConfig: SimCognitoAdminCreateUserConfig;
     readonly autoVerifiedAttributes: SimCognitoAutoVerifiedAttributes;

package/dist/service/cognito/user-pool/sim-cognito-user-pool-settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-settings.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,KAAK,oCAAoC,EAC1C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,+BAA+B,EAC/B,KAAK,mCAAmC,EACzC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAEpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EACL,wBAAwB,EACxB,KAAK,8BAA8B,EACpC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACxC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,WAAW,+BAAgC,SAAQ,kCAAkC;IACzF,QAAQ,CAAC,sBAAsB,CAAC,EAC5B,oCAAoC,GACpC,SAAS,CAAC;IACd,QAAQ,CAAC,QAAQ,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,qBAAqB,CAAC,EAC3B,mCAAmC,GACnC,SAAS,CAAC;IACd,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3C;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,6BAA6B,EAAE,GAAG,SAAS,CAAC;IAEvE;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC7D;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;IAEhD;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,0BAA0B;;IACrC,SAAgB,cAAc,EAAE,wBAAwB,CAAC;IACzD,SAAgB,kBAAkB,EAAE,4BAA4B,CAAC;IACjE,SAAgB,qBAAqB,EAAE,+BAA+B,CAAC;IACvE,SAAgB,sBAAsB,EAAE,gCAAgC,CAAC;IAEzE;;OAEG;IACH,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IAErD;;;;;;;;;OASG;IACH,SAAgB,GAAG,EAAE,qBAAqB,CAAC;IAE3C;;OAEG;IACH,SAAgB,oBAAoB,EAAE,8BAA8B,CAAC;IAErE;;;OAGG;IACH,SAAgB,eAAe,EAAE,yBAAyB,CAAC;IAK3D,YAAY,UAAU,EAAE,oCAAoC,EA+B3D;IAED;;;OAGG;IACH,IAAI,MAAM,IAAI,wBAAwB,CAErC;IAED;;;;OAIG;IACH,IAAI,kBAAkB,IAAI,4BAA4B,CAErD;IAED;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,0BAA0B,GAAG,IAAI,CAGjE;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-settings.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,KAAK,oCAAoC,EAC1C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,+BAA+B,EAC/B,KAAK,mCAAmC,EACzC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAEpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EACL,wBAAwB,EACxB,KAAK,8BAA8B,EACpC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACxC,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AAC9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,WAAW,+BAAgC,SAAQ,kCAAkC;IACzF,QAAQ,CAAC,sBAAsB,CAAC,EAC5B,oCAAoC,GACpC,SAAS,CAAC;IACd,QAAQ,CAAC,QAAQ,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,qBAAqB,CAAC,EAC3B,mCAAmC,GACnC,SAAS,CAAC;IACd,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3C;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,6BAA6B,EAAE,GAAG,SAAS,CAAC;IAEvE;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC7D;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC;IAEhD;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,0BAA0B;;IACrC,SAAgB,cAAc,EAAE,wBAAwB,CAAC;IAEzD;;;;;;OAMG;IACH,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IAErD,SAAgB,kBAAkB,EAAE,4BAA4B,CAAC;IACjE,SAAgB,qBAAqB,EAAE,+BAA+B,CAAC;IACvE,SAAgB,sBAAsB,EAAE,gCAAgC,CAAC;IAEzE;;OAEG;IACH,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IAErD;;;;;;;;;OASG;IACH,SAAgB,GAAG,EAAE,qBAAqB,CAAC;IAE3C;;OAEG;IACH,SAAgB,oBAAoB,EAAE,8BAA8B,CAAC;IAErE;;;OAGG;IACH,SAAgB,eAAe,EAAE,yBAAyB,CAAC;IAK3D,YAAY,UAAU,EAAE,oCAAoC,EAkC3D;IAED;;;OAGG;IACH,IAAI,MAAM,IAAI,wBAAwB,CAErC;IAED;;;;OAIG;IACH,IAAI,kBAAkB,IAAI,4BAA4B,CAErD;IAED;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,0BAA0B,GAAG,IAAI,CAGjE;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool-settings.js

@@ -7,11 +7,13 @@ import { SimCognitoUserPoolMfa } from "./mfa/sim-cognito-user-pool-mfa.js";
 import { SimCognitoPasswordPolicy, } from "./sim-cognito-password-policy.js";
 import { SimCognitoVerificationMessages, } from "./message/sim-cognito-verification-messages.js";
 import { SimCognitoUserPoolSchema } from "./schema/sim-cognito-user-pool-schema.js";
+import { SimCognitoSignInPolicy } from "./sim-cognito-sign-in-policy.js";
 import { SimCognitoUsernameAttributes } from "./sim-cognito-username-attributes.js";
 import { SimCognitoLambdaConfig } from "./trigger/sim-cognito-lambda-config.js";
 /**
  * The settings of one simulated user pool that a request can change: the
- * password policy, the deletion protection, whether users may sign themselves
+ * password policy, the factors it allows at the first prompt, the deletion
+ * protection, whether users may sign themselves
  * up, what confirming a sign-up verifies, the Lambda triggers the pool runs,
  * whether it asks for a second factor, how it recovers an account and what its
  * messages say.
@@ -32,6 +34,14 @@ import { SimCognitoLambdaConfig } from "./trigger/sim-cognito-lambda-config.js";
  */
 export class SimCognitoUserPoolSettings {
     passwordPolicy;
+    /**
+     * The factors the pool allows at the first authentication prompt.
+     *
+     * A pool created without a `SignInPolicy` allows a password and reports no
+     * policy, as real Cognito reports one. A `USER_AUTH` sign-in offers the
+     * factors this names, narrowed to the ones the user could present.
+     */
+    signInPolicy;
     deletionProtection;
     adminCreateUserConfig;
     autoVerifiedAttributes;
@@ -64,6 +74,7 @@ export class SimCognitoUserPoolSettings {
     constructor(properties) {
         const { input, operation } = properties;
         this.passwordPolicy = new SimCognitoPasswordPolicy(input.Policies?.PasswordPolicy);
+        this.signInPolicy = new SimCognitoSignInPolicy(input.Policies?.SignInPolicy);
         this.deletionProtection = new SimCognitoDeletionProtection(input.DeletionProtection);
         this.adminCreateUserConfig = new SimCognitoAdminCreateUserConfig(input.AdminCreateUserConfig);
         this.autoVerifiedAttributes = new SimCognitoAutoVerifiedAttributes(input.AutoVerifiedAttributes);

package/dist/service/cognito/user-pool/sim-cognito-user-pool-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-settings.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,+BAA+B,GAEhC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EACL,wBAAwB,GAEzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8BAA8B,GAE/B,MAAM,gDAAgD,CAAC;AAExD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAmDhF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,0BAA0B;IACrB,cAAc,CAA2B;IACzC,kBAAkB,CAA+B;IACjD,qBAAqB,CAAkC;IACvD,sBAAsB,CAAmC;IAEzE;;OAEG;IACa,YAAY,CAAyB;IAErD;;;;;;;;;OASG;IACa,GAAG,CAAwB;IAE3C;;OAEG;IACa,oBAAoB,CAAiC;IAErE;;;OAGG;IACa,eAAe,CAA4B;IAE3D,OAAO,CAA2B;IAClC,mBAAmB,CAA+B;IAElD,YAAY,UAAgD;QAC1D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;QAExC,IAAI,CAAC,cAAc,GAAG,IAAI,wBAAwB,CAChD,KAAK,CAAC,QAAQ,EAAE,cAAc,CAC/B,CAAC;QACF,IAAI,CAAC,kBAAkB,GAAG,IAAI,4BAA4B,CACxD,KAAK,CAAC,kBAAkB,CACzB,CAAC;QACF,IAAI,CAAC,qBAAqB,GAAG,IAAI,+BAA+B,CAC9D,KAAK,CAAC,qBAAqB,CAC5B,CAAC;QACF,IAAI,CAAC,sBAAsB,GAAG,IAAI,gCAAgC,CAChE,KAAK,CAAC,sBAAsB,CAC7B,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAC5C,KAAK,CAAC,YAAY,EAClB,SAAS,CACV,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,IAAI,qBAAqB,CAClC,IAAI,0BAA0B,CAAC,KAAK,CAAC,gBAAgB,CAAC,CACvD,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,IAAI,8BAA8B,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,eAAe,GAAG,IAAI,yBAAyB,CAClD,KAAK,CAAC,sBAAsB,EAC5B,SAAS,CACV,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,mBAAmB,GAAG,IAAI,4BAA4B,CACzD,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAoC;QACzD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;IACzD,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-settings.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,+BAA+B,GAEhC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EACL,wBAAwB,GAEzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8BAA8B,GAE/B,MAAM,gDAAgD,CAAC;AAExD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAmDhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,0BAA0B;IACrB,cAAc,CAA2B;IAEzD;;;;;;OAMG;IACa,YAAY,CAAyB;IAErC,kBAAkB,CAA+B;IACjD,qBAAqB,CAAkC;IACvD,sBAAsB,CAAmC;IAEzE;;OAEG;IACa,YAAY,CAAyB;IAErD;;;;;;;;;OASG;IACa,GAAG,CAAwB;IAE3C;;OAEG;IACa,oBAAoB,CAAiC;IAErE;;;OAGG;IACa,eAAe,CAA4B;IAE3D,OAAO,CAA2B;IAClC,mBAAmB,CAA+B;IAElD,YAAY,UAAgD;QAC1D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;QAExC,IAAI,CAAC,cAAc,GAAG,IAAI,wBAAwB,CAChD,KAAK,CAAC,QAAQ,EAAE,cAAc,CAC/B,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAC5C,KAAK,CAAC,QAAQ,EAAE,YAAY,CAC7B,CAAC;QACF,IAAI,CAAC,kBAAkB,GAAG,IAAI,4BAA4B,CACxD,KAAK,CAAC,kBAAkB,CACzB,CAAC;QACF,IAAI,CAAC,qBAAqB,GAAG,IAAI,+BAA+B,CAC9D,KAAK,CAAC,qBAAqB,CAC5B,CAAC;QACF,IAAI,CAAC,sBAAsB,GAAG,IAAI,gCAAgC,CAChE,KAAK,CAAC,sBAAsB,CAC7B,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAC5C,KAAK,CAAC,YAAY,EAClB,SAAS,CACV,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,IAAI,qBAAqB,CAClC,IAAI,0BAA0B,CAAC,KAAK,CAAC,gBAAgB,CAAC,CACvD,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,IAAI,8BAA8B,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,eAAe,GAAG,IAAI,yBAAyB,CAClD,KAAK,CAAC,sBAAsB,EAC5B,SAAS,CACV,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,mBAAmB,GAAG,IAAI,4BAA4B,CACzD,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAoC;QACzD,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;IACzD,CAAC;CACF"}

package/dist/service/cognito/user-pool/sim-cognito-user-pool.d.ts

@@ -12,6 +12,7 @@ import { type SimCognitoUserPoolId } from "./sim-cognito-user-pool-id.js";
 import type { SimCognitoUserPoolSettings } from "./sim-cognito-user-pool-settings.js";
 import type { SimCognitoJwks, SimCognitoSigningKey } from "./token/sim-cognito-signing-key.js";
 import type { SimCognitoUser } from "./user/sim-cognito-user.js";
+import type { SimCognitoWebAuthnCredentialDocument } from "./user/web-authn/sim-cognito-web-authn-document.js";
 import { type SimCognitoUsername } from "./user/sim-cognito-username.js";
 interface SimCognitoUserPoolProperties {
     readonly id: SimCognitoUserPoolId;
@@ -58,10 +59,9 @@ export declare class SimCognitoUserPool {
     /**
      * Replace this pool's settings with the ones an update asked for.
      *
-     * `UpdateUserPool` replaces rather than merges, as real Cognito does: the
-     * settings object is built from the update's own request, so a setting the
-     * request left out goes back to the default `CreateUserPool` would have
-     * given it rather than staying as it was.
+     * `UpdateUserPool` replaces rather than merges, as real Cognito does, so a
+     * setting the request left out goes back to the default `CreateUserPool`
+     * would have given it rather than staying as it was.
      */
     update(settings: SimCognitoUserPoolSettings): void;
     /** The URL a token from this pool names as its issuer. */
@@ -73,105 +73,84 @@ export declare class SimCognitoUserPool {
     /** The public keys this pool publishes, as its JWKS endpoint serves them. */
     jwks(): SimCognitoJwks;
     /**
-     * When the pool's settings last changed.
-     *
-     * A pool that no `UpdateUserPool` request has reached reports its creation
-     * date, as a real one does.
+     * When the pool's settings last changed, which is its creation date until
+     * an `UpdateUserPool` request reaches it.
      */
     get lastModifiedDate(): Date;
-    /**
-     * Every app client of this pool, in creation order.
-     */
+    /** Every app client of this pool, in creation order. */
     get clients(): readonly SimCognitoUserPoolClient[];
-    /**
-     * The app client ids already in use in this pool.
-     */
+    /** The app client ids already in use in this pool. */
     get clientIds(): Set<string>;
-    /**
-     * Store a newly created app client.
-     */
+    /** Store a newly created app client. */
     addClient(client: SimCognitoUserPoolClient): void;
-    /**
-     * Forget a deleted app client.
-     */
+    /** Forget a deleted app client. */
     removeClient(client: SimCognitoUserPoolClient): void;
-    /**
-     * Find an app client of this pool by id.
-     */
+    /** Find an app client of this pool by id. */
     findClient(clientId: string): SimCognitoUserPoolClient | undefined;
-    /**
-     * Resolve an app client of this pool by id, or refuse.
-     */
+    /** Resolve an app client of this pool by id, or refuse. */
     requireClient(clientId: SimCognitoUserPoolClientId): SimCognitoUserPoolClient;
-    /**
-     * Every user in this pool, in creation order.
-     */
+    /** Every user in this pool, in creation order. */
     get users(): readonly SimCognitoUser[];
-    /**
-     * How many users this pool holds.
-     */
+    /** How many users this pool holds. */
     get userCount(): number;
-    /**
-     * Store a newly created user, refusing a username already in this pool.
-     */
+    /** Store a newly created user, refusing a username already in this pool. */
     addUser(user: SimCognitoUser): void;
     /**
      * Forget a deleted user, take them out of every group, and forget the
-     * tokens they hold.
-     *
-     * A group holding a user that no longer exists would answer `ListUsersInGroup`
-     * with a member this pool cannot describe, and a refresh token outliving its
-     * user would sign in someone the pool cannot describe either.
+     * tokens they hold. A group holding a user that no longer exists, or a
+     * refresh token outliving one, would reach a user this pool cannot
+     * describe.
      */
     removeUser(user: SimCognitoUser): void;
-    /**
-     * Find a user of this pool by username.
-     */
+    /** Find a user of this pool by username. */
     findUser(username: string): SimCognitoUser | undefined;
-    /**
-     * Resolve a user of this pool by username, or refuse.
-     */
+    /** Resolve a user of this pool by username, or refuse. */
     requireUser(username: SimCognitoUsername): SimCognitoUser;
     /**
      * The confirmation code a user of this pool has outstanding, if it has one.
      *
-     * This and `softwareTokenCode` are the simulator's own accessors, for a test
-     * that has nowhere else to read a code from: nothing here delivers a message
-     * or holds the user's phone. Real Cognito reports either code to nobody.
+     * This, `softwareTokenCode` and `webAuthnCredential` are the simulator's own
+     * accessors, for a test with nowhere else to read a secret from: nothing
+     * here delivers a message, holds the user's phone or runs a browser. Real
+     * Cognito reports none of them to anybody.
      */
     confirmationCode(username: string): string | undefined;
     /**
-     * The code a user's authenticator app is showing now, for a user that has
-     * been given a software token secret. A test that would rather compute the
-     * code itself can do so from the `SecretCode`, which is a real shared secret.
+     * The code a user's authenticator app is showing now. A test that would
+     * rather compute it can do so from the `SecretCode`, which is a real shared
+     * secret.
      */
     softwareTokenCode(username: string): string | undefined;
-    /** Every message this pool would have sent, oldest first. */
-    sentMessages(): readonly SimCognitoSentMessage[];
     /**
-     * Every group in this pool, in creation order.
+     * The credential a user's authenticator would have created for the passkey
+     * registration it has been given options for, which is what
+     * `CompleteWebAuthnRegistration` takes as its `Credential`.
      */
-    get groups(): readonly SimCognitoGroup[];
+    webAuthnCredential(username: string): SimCognitoWebAuthnCredentialDocument;
     /**
-     * Store a newly created group, refusing a name already in this pool.
+     * The credential a user's authenticator would have presented for the
+     * `WEB_AUTHN` challenge a session was issued with.
+     *
+     * The session is the `Session` the challenge answered with, because the
+     * challenge a passkey signs belongs to that one sign-in. Pass the result to
+     * `RespondToAuthChallenge` as its `CREDENTIAL`, which travels as JSON.
      */
+    webAuthnAssertion(session: string): SimCognitoWebAuthnCredentialDocument;
+    /** Every message this pool would have sent, oldest first. */
+    sentMessages(): readonly SimCognitoSentMessage[];
+    /** Every group in this pool, in creation order. */
+    get groups(): readonly SimCognitoGroup[];
+    /** Store a newly created group, refusing a name already in this pool. */
     addGroup(group: SimCognitoGroup): void;
-    /**
-     * Forget a deleted group, and with it the membership of its users.
-     */
+    /** Forget a deleted group, and with it the membership of its users. */
     removeGroup(group: SimCognitoGroup): void;
-    /**
-     * Find a group of this pool by name.
-     */
+    /** Find a group of this pool by name. */
     findGroup(groupName: string): SimCognitoGroup | undefined;
-    /**
-     * Resolve a group of this pool by name, or refuse.
-     */
+    /** Resolve a group of this pool by name, or refuse. */
     requireGroup(groupName: SimCognitoGroupName): SimCognitoGroup;
-    /**
-     * The groups a user of this pool belongs to, strongest precedence first.
-     */
+    /** The groups a user of this pool belongs to, strongest precedence first. */
     groupsOf(username: string): readonly SimCognitoGroup[];
+    private userNamed;
 }
 export {};
 //# sourceMappingURL=sim-cognito-user-pool.d.ts.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAE9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,gCAAgC,CAAC;AAExC,UAAU,4BAA4B;IACpC,QAAQ,CAAC,EAAE,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;;IAC7B,SAAgB,EAAE,EAAE,oBAAoB,CAAC;IACzC,SAAgB,GAAG,EAAE,qBAAqB,CAAC;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC;;OAEG;IACH,SAAgB,IAAI,qBAA4B;IAEhD;;;;OAIG;IACH,SAAgB,QAAQ,6BAAoC;IAE5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IAKjD,YAAY,UAAU,EAAE,4BAA4B,EAWnD;IAED;;;;OAIG;IACH,IAAI,QAAQ,IAAI,0BAA0B,CAEzC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,QAAQ,EAAE,0BAA0B,GAAG,IAAI,CAGjD;IAED,0DAA0D;IAC1D,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,oEAAoE;IACpE,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,uEAAuE;IACvE,IAAI,UAAU,IAAI,oBAAoB,CAErC;IAED,6EAA6E;IAC7E,IAAI,IAAI,cAAc,CAErB;IAED;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;OAEG;IACH,IAAI,OAAO,IAAI,SAAS,wBAAwB,EAAE,CAEjD;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,CAE3B;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEnD;IAED;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAEjE;IAED;;OAEG;IACH,aAAa,CACX,QAAQ,EAAE,0BAA0B,GACnC,wBAAwB,CAE1B;IAED;;OAEG;IACH,IAAI,KAAK,IAAI,SAAS,cAAc,EAAE,CAErC;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAElC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAIrC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAErD;IAED;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,cAAc,CAExD;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGrD;IAED;;;;OAIG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAItD;IAED,6DAA6D;IAC7D,YAAY,IAAI,SAAS,qBAAqB,EAAE,CAE/C;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,SAAS,eAAe,EAAE,CAEvC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAErC;IAED;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAExC;IAED;;OAEG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAExD;IAED;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,mBAAmB,GAAG,eAAe,CAE5D;IAED;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,eAAe,EAAE,CAErD;CACF"}
+{"version":3,"file":"sim-cognito-user-pool.d.ts","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAE9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,oDAAoD,CAAC;AAE/G,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,gCAAgC,CAAC;AAExC,UAAU,4BAA4B;IACpC,QAAQ,CAAC,EAAE,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,kBAAkB;;IAC7B,SAAgB,EAAE,EAAE,oBAAoB,CAAC;IACzC,SAAgB,GAAG,EAAE,qBAAqB,CAAC;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC;;OAEG;IACH,SAAgB,IAAI,qBAA4B;IAEhD;;;;OAIG;IACH,SAAgB,QAAQ,6BAAoC;IAE5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA4B;IAKjD,YAAY,UAAU,EAAE,4BAA4B,EAWnD;IAED;;;;OAIG;IACH,IAAI,QAAQ,IAAI,0BAA0B,CAEzC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,EAAE,0BAA0B,GAAG,IAAI,CAGjD;IAED,0DAA0D;IAC1D,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,oEAAoE;IACpE,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,uEAAuE;IACvE,IAAI,UAAU,IAAI,oBAAoB,CAErC;IAED,6EAA6E;IAC7E,IAAI,IAAI,cAAc,CAErB;IAED;;;OAGG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED,wDAAwD;IACxD,IAAI,OAAO,IAAI,SAAS,wBAAwB,EAAE,CAEjD;IAED,sDAAsD;IACtD,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,CAE3B;IAED,wCAAwC;IACxC,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED,mCAAmC;IACnC,YAAY,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEnD;IAED,6CAA6C;IAC7C,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAEjE;IAED,2DAA2D;IAC3D,aAAa,CACX,QAAQ,EAAE,0BAA0B,GACnC,wBAAwB,CAE1B;IAED,kDAAkD;IAClD,IAAI,KAAK,IAAI,SAAS,cAAc,EAAE,CAErC;IAED,sCAAsC;IACtC,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,4EAA4E;IAC5E,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAElC;IAED;;;;;OAKG;IACH,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAIrC;IAED,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAErD;IAED,0DAA0D;IAC1D,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,cAAc,CAExD;IAED;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErD;IAED;;;;OAIG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEtD;IAED;;;;OAIG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,oCAAoC,CAEzE;IAED;;;;;;;OAOG;IACH,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,oCAAoC,CAQvE;IAED,6DAA6D;IAC7D,YAAY,IAAI,SAAS,qBAAqB,EAAE,CAE/C;IAED,mDAAmD;IACnD,IAAI,MAAM,IAAI,SAAS,eAAe,EAAE,CAEvC;IAED,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAErC;IAED,uEAAuE;IACvE,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAExC;IAED,yCAAyC;IACzC,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAExD;IAED,uDAAuD;IACvD,YAAY,CAAC,SAAS,EAAE,mBAAmB,GAAG,eAAe,CAE5D;IAED,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,eAAe,EAAE,CAErD;IAED,OAAO,CAAC,SAAS;CAGlB"}