@kensio/yulin 1.18.1 → 1.19.0

package/dist/service/cognito/user-pool/sim-cognito-user-pool.js

@@ -56,10 +56,9 @@ export class SimCognitoUserPool {
     /**
      * Replace this pool's settings with the ones an update asked for.
      *
-     * `UpdateUserPool` replaces rather than merges, as real Cognito does: the
-     * settings object is built from the update's own request, so a setting the
-     * request left out goes back to the default `CreateUserPool` would have
-     * given it rather than staying as it was.
+     * `UpdateUserPool` replaces rather than merges, as real Cognito does, so a
+     * setting the request left out goes back to the default `CreateUserPool`
+     * would have given it rather than staying as it was.
      */
     update(settings) {
         this.#settings = settings;
@@ -82,151 +81,137 @@ export class SimCognitoUserPool {
         return this.keys.jwks();
     }
     /**
-     * When the pool's settings last changed.
-     *
-     * A pool that no `UpdateUserPool` request has reached reports its creation
-     * date, as a real one does.
+     * When the pool's settings last changed, which is its creation date until
+     * an `UpdateUserPool` request reaches it.
      */
     get lastModifiedDate() {
         return this.#modifiedDate;
     }
-    /**
-     * Every app client of this pool, in creation order.
-     */
+    /** Every app client of this pool, in creation order. */
     get clients() {
         return this.clientStore.all;
     }
-    /**
-     * The app client ids already in use in this pool.
-     */
+    /** The app client ids already in use in this pool. */
     get clientIds() {
         return this.clientStore.ids;
     }
-    /**
-     * Store a newly created app client.
-     */
+    /** Store a newly created app client. */
     addClient(client) {
         this.clientStore.add(client);
     }
-    /**
-     * Forget a deleted app client.
-     */
+    /** Forget a deleted app client. */
     removeClient(client) {
         this.clientStore.remove(client);
     }
-    /**
-     * Find an app client of this pool by id.
-     */
+    /** Find an app client of this pool by id. */
     findClient(clientId) {
         return this.clientStore.find(clientId);
     }
-    /**
-     * Resolve an app client of this pool by id, or refuse.
-     */
+    /** Resolve an app client of this pool by id, or refuse. */
     requireClient(clientId) {
         return this.clientStore.require(clientId);
     }
-    /**
-     * Every user in this pool, in creation order.
-     */
+    /** Every user in this pool, in creation order. */
     get users() {
         return this.userStore.all;
     }
-    /**
-     * How many users this pool holds.
-     */
+    /** How many users this pool holds. */
     get userCount() {
         return this.userStore.count;
     }
-    /**
-     * Store a newly created user, refusing a username already in this pool.
-     */
+    /** Store a newly created user, refusing a username already in this pool. */
     addUser(user) {
         this.userStore.add(user);
     }
     /**
      * Forget a deleted user, take them out of every group, and forget the
-     * tokens they hold.
-     *
-     * A group holding a user that no longer exists would answer `ListUsersInGroup`
-     * with a member this pool cannot describe, and a refresh token outliving its
-     * user would sign in someone the pool cannot describe either.
+     * tokens they hold. A group holding a user that no longer exists, or a
+     * refresh token outliving one, would reach a user this pool cannot
+     * describe.
      */
     removeUser(user) {
         this.userStore.remove(user);
         this.groupStore.forgetUser(user.username);
         this.auth.signOut(user.username);
     }
-    /**
-     * Find a user of this pool by username.
-     */
+    /** Find a user of this pool by username. */
     findUser(username) {
         return this.userStore.find(username);
     }
-    /**
-     * Resolve a user of this pool by username, or refuse.
-     */
+    /** Resolve a user of this pool by username, or refuse. */
     requireUser(username) {
         return this.userStore.require(username);
     }
     /**
      * The confirmation code a user of this pool has outstanding, if it has one.
      *
-     * This and `softwareTokenCode` are the simulator's own accessors, for a test
-     * that has nowhere else to read a code from: nothing here delivers a message
-     * or holds the user's phone. Real Cognito reports either code to nobody.
+     * This, `softwareTokenCode` and `webAuthnCredential` are the simulator's own
+     * accessors, for a test with nowhere else to read a secret from: nothing
+     * here delivers a message, holds the user's phone or runs a browser. Real
+     * Cognito reports none of them to anybody.
      */
     confirmationCode(username) {
-        return this.requireUser(requireSimCognitoUsername(username))
-            .confirmationCode;
+        return this.userNamed(username).confirmationCode;
     }
     /**
-     * The code a user's authenticator app is showing now, for a user that has
-     * been given a software token secret. A test that would rather compute the
-     * code itself can do so from the `SecretCode`, which is a real shared secret.
+     * The code a user's authenticator app is showing now. A test that would
+     * rather compute it can do so from the `SecretCode`, which is a real shared
+     * secret.
      */
     softwareTokenCode(username) {
-        return this.requireUser(requireSimCognitoUsername(username)).mfa.codeAt(this.clock.now());
+        return this.userNamed(username).mfa.codeAt(this.clock.now());
+    }
+    /**
+     * The credential a user's authenticator would have created for the passkey
+     * registration it has been given options for, which is what
+     * `CompleteWebAuthnRegistration` takes as its `Credential`.
+     */
+    webAuthnCredential(username) {
+        return this.userNamed(username).webAuthn.registrationCredential();
+    }
+    /**
+     * The credential a user's authenticator would have presented for the
+     * `WEB_AUTHN` challenge a session was issued with.
+     *
+     * The session is the `Session` the challenge answered with, because the
+     * challenge a passkey signs belongs to that one sign-in. Pass the result to
+     * `RespondToAuthChallenge` as its `CREDENTIAL`, which travels as JSON.
+     */
+    webAuthnAssertion(session) {
+        const answering = this.auth.requireWebAuthnSession(session);
+        const user = this.userNamed(answering.username);
+        return user.webAuthn.device.present(answering.requireWebAuthnOptions(), Buffer.from(user.sub).toString("base64url"));
     }
     /** Every message this pool would have sent, oldest first. */
     sentMessages() {
         return this.messages.all;
     }
-    /**
-     * Every group in this pool, in creation order.
-     */
+    /** Every group in this pool, in creation order. */
     get groups() {
         return this.groupStore.all;
     }
-    /**
-     * Store a newly created group, refusing a name already in this pool.
-     */
+    /** Store a newly created group, refusing a name already in this pool. */
     addGroup(group) {
         this.groupStore.add(group);
     }
-    /**
-     * Forget a deleted group, and with it the membership of its users.
-     */
+    /** Forget a deleted group, and with it the membership of its users. */
     removeGroup(group) {
         this.groupStore.remove(group);
     }
-    /**
-     * Find a group of this pool by name.
-     */
+    /** Find a group of this pool by name. */
     findGroup(groupName) {
         return this.groupStore.find(groupName);
     }
-    /**
-     * Resolve a group of this pool by name, or refuse.
-     */
+    /** Resolve a group of this pool by name, or refuse. */
     requireGroup(groupName) {
         return this.groupStore.require(groupName);
     }
-    /**
-     * The groups a user of this pool belongs to, strongest precedence first.
-     */
+    /** The groups a user of this pool belongs to, strongest precedence first. */
     groupsOf(username) {
         return this.groupStore.forUser(username);
     }
+    userNamed(username) {
+        return this.requireUser(requireSimCognitoUsername(username));
+    }
 }
 //# sourceMappingURL=sim-cognito-user-pool.js.map

package/dist/service/cognito/user-pool/sim-cognito-user-pool.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAG/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAGzF,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAE/B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAMtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EACL,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AAUxC;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACb,EAAE,CAAuB;IACzB,GAAG,CAAwB;IAC3B,IAAI,CAAS;IACb,YAAY,CAAO;IAEnC;;OAEG;IACa,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAEhD;;;;OAIG;IACa,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3C,KAAK,CAAW;IAChB,WAAW,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAClD,SAAS,CAAsB;IAC/B,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACxC,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAEjD,SAAS,CAA6B;IACtC,aAAa,CAAO;IAEpB,YAAY,UAAwC;QAClD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,IAAI,mBAAmB,CACtC,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CACvC,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,QAAoC;QACzC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACxC,CAAC;IAED,0DAA0D;IAC1D,IAAI,SAAS;QACX,OAAO,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,oEAAoE;IACpE,IAAI,YAAY;QACd,OAAO,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,uEAAuE;IACvE,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;IAC9B,CAAC;IAED,6EAA6E;IAC7E,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAgC;QAC3C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,aAAa,CACX,QAAoC;QAEpC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAoB;QAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,IAAoB;QAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAA4B;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,WAAW,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;aACzD,gBAAgB,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,WAAW,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CACrE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAsB;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,KAAsB;QAChC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,SAAiB;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,SAA8B;QACzC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool.js","sourceRoot":"","sources":["../../../../src/service/cognito/user-pool/sim-cognito-user-pool.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gDAAgD,CAAC;AAG/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAGzF,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAE/B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAOtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EACL,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AAUxC;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACb,EAAE,CAAuB;IACzB,GAAG,CAAwB;IAC3B,IAAI,CAAS;IACb,YAAY,CAAO;IAEnC;;OAEG;IACa,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAEhD;;;;OAIG;IACa,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3C,KAAK,CAAW;IAChB,WAAW,GAAG,IAAI,6BAA6B,EAAE,CAAC;IAClD,SAAS,CAAsB;IAC/B,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACxC,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAEjD,SAAS,CAA6B;IACtC,aAAa,CAAO;IAEpB,YAAY,UAAwC;QAClD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,IAAI,mBAAmB,CACtC,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CACvC,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,QAAoC;QACzC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACxC,CAAC;IAED,0DAA0D;IAC1D,IAAI,SAAS;QACX,OAAO,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,oEAAoE;IACpE,IAAI,YAAY;QACd,OAAO,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,uEAAuE;IACvE,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;IAC9B,CAAC;IAED,6EAA6E;IAC7E,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,wDAAwD;IACxD,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED,sDAAsD;IACtD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED,wCAAwC;IACxC,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,mCAAmC;IACnC,YAAY,CAAC,MAAgC;QAC3C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,6CAA6C;IAC7C,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,2DAA2D;IAC3D,aAAa,CACX,QAAoC;QAEpC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,kDAAkD;IAClD,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED,sCAAsC;IACtC,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,4EAA4E;IAC5E,OAAO,CAAC,IAAoB;QAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,IAAoB;QAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,4CAA4C;IAC5C,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,0DAA0D;IAC1D,WAAW,CAAC,QAA4B;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,gBAAgB,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC;IACpE,CAAC;IAED;;;;;;;OAOG;IACH,iBAAiB,CAAC,OAAe;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEhD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CACjC,SAAS,CAAC,sBAAsB,EAAE,EAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAC5C,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED,mDAAmD;IACnD,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;IAC7B,CAAC;IAED,yEAAyE;IACzE,QAAQ,CAAC,KAAsB;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,uEAAuE;IACvE,WAAW,CAAC,KAAsB;QAChC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,yCAAyC;IACzC,SAAS,CAAC,SAAiB;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,uDAAuD;IACvD,YAAY,CAAC,SAA8B;QACzC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,6EAA6E;IAC7E,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAEO,SAAS,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,WAAW,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;CACF"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.d.ts

@@ -1,4 +1,5 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { SimCognitoIssuedToken } from "../auth/sim-cognito-issued-token.js";
 import type { SimCognitoUserPoolClient } from "../client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
 import type { SimCognitoTriggerOccasion } from "../trigger/sim-cognito-trigger-occasion.js";
@@ -41,6 +42,16 @@ interface SimCognitoIssueTokensProperties {
      */
     readonly scopes?: readonly string[] | undefined;
 }
+/**
+ * Reissuing tokens for a refresh token the caller presented.
+ */
+interface SimCognitoRefreshTokensProperties extends SimCognitoIssueTokensProperties {
+    /**
+     * The refresh token the request was made with, which a rotating app client
+     * spends and replaces.
+     */
+    readonly spent: SimCognitoIssuedToken;
+}
 /**
  * Issues the tokens a successful authentication answers with.
  *
@@ -62,6 +73,10 @@ export declare class SimCognitoTokenIssuer {
     private readonly triggers;
     constructor(properties: SimCognitoTokenIssuerProperties);
     private static expiryOf;
+    /**
+     * Mint an opaque refresh token, as real Cognito's is opaque.
+     */
+    private static mintRefreshToken;
     /**
      * Sign an id token and an access token for a user, and mint a refresh
      * token to go with them.
@@ -84,6 +99,25 @@ export declare class SimCognitoTokenIssuer {
      * that expires.
      */
     reissue(properties: SimCognitoIssueTokensProperties): Promise<SimCognitoIssuedTokens>;
+    /**
+     * Sign fresh tokens for a refresh token the caller presented.
+     *
+     * Whether a new refresh token comes back is the app client's to decide. A
+     * rotating client hands one out and spends the token that bought it, and a
+     * client with rotation off answers with the two JWTs alone, leaving the
+     * caller the refresh token it already has until that expires.
+     */
+    refresh(properties: SimCognitoRefreshTokensProperties): Promise<SimCognitoIssuedTokens>;
+    /**
+     * Sign fresh tokens and rotate the refresh token that bought them.
+     *
+     * The replacement runs out when the token it replaced would have, so a
+     * rotating session ends at the app client's `RefreshTokenValidity` however
+     * often it was renewed. The spent token is revoked after the replacement is
+     * stored, so it stays refusable for the grace period rather than being
+     * swept away with the tokens that have already run out.
+     */
+    private rotate;
     private signTokens;
     private claimsOverride;
 }

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-token-issuer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAclE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAE7C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAEvE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB;;;;;;;;;;;OAWG;IACG,KAAK,CACT,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAuBjC;IAED;;;;;;;OAOG;IACG,OAAO,CACX,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAEjC;YAEa,UAAU;YAyDV,cAAc;CAY7B"}
+{"version":3,"file":"sim-cognito-token-issuer.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAclE;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAE9B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAE7C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAEvE;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACjD;AAED;;GAEG;AACH,UAAU,iCAAkC,SAAQ,+BAA+B;IACjF;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;CACvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED,OAAO,CAAC,MAAM,CAAC,QAAQ;IAIvB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAI/B;;;;;;;;;;;OAWG;IACG,KAAK,CACT,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAuBjC;IAED;;;;;;;OAOG;IACG,OAAO,CACX,UAAU,EAAE,+BAA+B,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAEjC;IAED;;;;;;;OAOG;IACG,OAAO,CACX,UAAU,EAAE,iCAAiC,GAC5C,OAAO,CAAC,sBAAsB,CAAC,CAQjC;IAED;;;;;;;;OAQG;YACW,MAAM;YAkBN,UAAU;YAyDV,cAAc;CAY7B"}

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.js

@@ -36,6 +36,12 @@ export class SimCognitoTokenIssuer {
     static expiryOf(issuedAt, seconds) {
         return new Date(issuedAt.getTime() + seconds * 1000);
     }
+    /**
+     * Mint an opaque refresh token, as real Cognito's is opaque.
+     */
+    static mintRefreshToken() {
+        return randomBytes(refreshTokenBytes).toString("base64url");
+    }
     /**
      * Sign an id token and an access token for a user, and mint a refresh
      * token to go with them.
@@ -52,7 +58,7 @@ export class SimCognitoTokenIssuer {
         const { pool, client, user } = properties;
         const issuedAt = this.clock.now();
         const signed = await this.signTokens(properties, issuedAt);
-        const refreshToken = randomBytes(refreshTokenBytes).toString("base64url");
+        const refreshToken = SimCognitoTokenIssuer.mintRefreshToken();
         pool.auth.addRefreshToken(new SimCognitoIssuedToken({
             value: refreshToken,
             username: user.username,
@@ -76,6 +82,39 @@ export class SimCognitoTokenIssuer {
     async reissue(properties) {
         return await this.signTokens(properties, this.clock.now());
     }
+    /**
+     * Sign fresh tokens for a refresh token the caller presented.
+     *
+     * Whether a new refresh token comes back is the app client's to decide. A
+     * rotating client hands one out and spends the token that bought it, and a
+     * client with rotation off answers with the two JWTs alone, leaving the
+     * caller the refresh token it already has until that expires.
+     */
+    async refresh(properties) {
+        const rotation = properties.client.refreshTokenRotation;
+        if (!rotation.enabled) {
+            return await this.reissue(properties);
+        }
+        return await this.rotate(properties, rotation.retryGracePeriodSeconds);
+    }
+    /**
+     * Sign fresh tokens and rotate the refresh token that bought them.
+     *
+     * The replacement runs out when the token it replaced would have, so a
+     * rotating session ends at the app client's `RefreshTokenValidity` however
+     * often it was renewed. The spent token is revoked after the replacement is
+     * stored, so it stays refusable for the grace period rather than being
+     * swept away with the tokens that have already run out.
+     */
+    async rotate(properties, gracePeriodSeconds) {
+        const { pool, spent } = properties;
+        const issuedAt = this.clock.now();
+        const signed = await this.signTokens(properties, issuedAt);
+        const refreshToken = SimCognitoTokenIssuer.mintRefreshToken();
+        pool.auth.addRefreshToken(spent.replacedBy(refreshToken, issuedAt));
+        pool.auth.revokeRefreshTokenAt(spent, SimCognitoTokenIssuer.expiryOf(issuedAt, gracePeriodSeconds));
+        return { ...signed, refreshToken };
+    }
     async signTokens(properties, issuedAt) {
         const { pool, client, user } = properties;
         const claimsOverride = await this.claimsOverride(properties);

package/dist/service/cognito/user-pool/token/sim-cognito-token-issuer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-token-issuer.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAM5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AA6C7B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAW;IAChB,QAAQ,CAA6B;IAEtD,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,QAAc,EAAE,OAAe;QACrD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CACT,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE1E,IAAI,CAAC,IAAI,CAAC,eAAe,CACvB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAC1C;YACD,sEAAsE;YACtE,iCAAiC;YACjC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,UAA2C;QAE3C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,UAA2C,EAC3C,QAAc;QAEd,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC;QACpE,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,QAAQ,CACzD,QAAQ,EACR,kBAAkB,CACnB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACpC,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CACrC;YACD,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC;YAC5C,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,4EAA4E;QAC5E,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAC5C,cAAc,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CACnD,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,cAAc,CACtB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,uEAAuE;YACvE,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CACH,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,WAAW,EAAE,iBAAiB;YAC9B,SAAS,EAAE,kBAAkB;SAC9B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,UAAU,CAAC;QAEpE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,EAAE;YACtD,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-token-issuer.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/token/sim-cognito-token-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAM5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAwD7B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qBAAqB;IACf,KAAK,CAAW;IAChB,QAAQ,CAA6B;IAEtD,YAAY,UAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,QAAc,EAAE,OAAe;QACrD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,gBAAgB;QAC7B,OAAO,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CACT,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,CAAC;QAE9D,IAAI,CAAC,IAAI,CAAC,eAAe,CACvB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAC1C;YACD,sEAAsE;YACtE,iCAAiC;YACjC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,UAA2C;QAE3C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,UAA6C;QAE7C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAExD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,MAAM,CAClB,UAA6C,EAC7C,kBAA0B;QAE1B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,CAAC;QAE9D,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAC5B,KAAK,EACL,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAC7D,CAAC;QAEF,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,UAA2C,EAC3C,QAAc;QAEd,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC;QACpE,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,QAAQ,CACzD,QAAQ,EACR,kBAAkB,CACnB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACpC,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,qBAAqB,CAAC,QAAQ,CACvC,QAAQ,EACR,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CACrC;YACD,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC;YAC5C,GAAG,UAAU;YACb,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,OAAO,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;QAEH,4EAA4E;QAC5E,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAC5C,cAAc,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CACnD,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,cAAc,CACtB,IAAI,qBAAqB,CAAC;YACxB,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,QAAQ;YACR,SAAS,EAAE,oBAAoB;YAC/B,uEAAuE;YACvE,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CACH,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,WAAW,EAAE,iBAAiB;YAC9B,SAAS,EAAE,kBAAkB;SAC9B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,UAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,UAAU,CAAC;QAEpE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,EAAE;YACtD,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/sim-cognito-user.d.ts

@@ -2,6 +2,7 @@ import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoFederatedIdentity } from "../idp/sim-cognito-federated-identity.js";
 import { SimCognitoUserMfa } from "./mfa/sim-cognito-user-mfa.js";
 import { SimCognitoUserPasswordReset } from "./sim-cognito-user-password-reset.js";
+import { SimCognitoUserWebAuthn } from "./web-authn/sim-cognito-user-web-authn.js";
 import type { SimCognitoAttributeType, SimCognitoUserAttributes } from "./sim-cognito-user-attributes.js";
 import { SimCognitoUserPassword } from "./sim-cognito-user-password.js";
 import { SimCognitoUserStatus } from "./sim-cognito-user-status.js";
@@ -44,6 +45,7 @@ export declare class SimCognitoUser {
     private readonly userAttributes;
     private readonly confirmation;
     private readonly userMfa;
+    private readonly userWebAuthn;
     private readonly reset;
     private readonly federatedIdentity;
     private userStatus;
@@ -51,13 +53,9 @@ export declare class SimCognitoUser {
     private isEnabled;
     private modifiedDate;
     constructor(properties: SimCognitoUserProperties);
-    /**
-     * When the user last changed.
-     */
+    /** When the user last changed. */
     get lastModifiedDate(): Date;
-    /**
-     * Where the user is in the status lifecycle.
-     */
+    /** Where the user is in the status lifecycle. */
     get status(): SimCognitoUserStatus;
     /**
      * Whether the user may authenticate at all.
@@ -106,6 +104,11 @@ export declare class SimCognitoUser {
      * `UserLastModifiedDate` on, as every other change to a user does.
      */
     get mfa(): SimCognitoUserMfa;
+    /**
+     * The passkeys this user has registered. A passkey is a first factor rather
+     * than a second one, so it sits beside `mfa` rather than among it.
+     */
+    get webAuthn(): SimCognitoUserWebAuthn;
     /**
      * The password reset this user can go through, which is what a forgotten
      * password is replaced by and what an administrator can force.
@@ -134,9 +137,7 @@ export declare class SimCognitoUser {
      * issued, so a caller can try again with the right one.
      */
     confirmSignUp(code: string | undefined): void;
-    /**
-     * Confirm the sign-up without a code, as `AdminConfirmSignUp` does.
-     */
+    /** Confirm the sign-up without a code, as `AdminConfirmSignUp` does. */
     confirm(): void;
     /**
      * Mark the named attributes verified, where this user has them.
@@ -155,17 +156,11 @@ export declare class SimCognitoUser {
      * message for the user to read it from.
      */
     hasPassword(candidate: string | undefined): boolean;
-    /**
-     * Apply an attribute update to this user.
-     */
+    /** Apply an attribute update to this user. */
     updateAttributes(requested: readonly SimCognitoAttributeType[] | undefined): void;
-    /**
-     * Let the user authenticate again.
-     */
+    /** Let the user authenticate again. */
     enable(): void;
-    /**
-     * Stop the user authenticating.
-     */
+    /** Stop the user authenticating. */
     disable(): void;
     /**
      * Move the user to a status, and let the code it holds follow.

package/dist/service/cognito/user-pool/user/sim-cognito-user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,UAAU,wBAAwB;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAEvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAEnD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,cAAc;IACzB,SAAgB,QAAQ,EAAE,kBAAkB,CAAC;IAC7C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8B;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0C;IAC5E,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,YAAY,CAAO;IAE3B,YAAY,UAAU,EAAE,wBAAwB,EA+B/C;IAED;;OAEG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;;;;;;OAOG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;IACH,IAAI,UAAU,IAAI,SAAS,uBAAuB,EAAE,CAMnD;IAED;;;;;;OAMG;IACH,IAAI,QAAQ,IAAI,2BAA2B,GAAG,SAAS,CAEtD;IAED;;;;;OAKG;IACH,IAAI,eAAe,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjD;IAED;;;;;;;;OAQG;IACH,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED;;;;OAIG;IACH,IAAI,GAAG,IAAI,iBAAiB,CAE3B;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,2BAA2B,CAE/C;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAGlE;IAED;;;;;;OAMG;IACH,sBAAsB,IAAI,IAAI,CAI7B;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAI5C;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAGd;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAG/C;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElD;IAED;;OAEG;IACH,gBAAgB,CACd,SAAS,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,GACxD,IAAI,CAGN;IAED;;OAEG;IACH,MAAM,IAAI,IAAI,CAGb;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAGd;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,KAAK;CAGd"}
+{"version":3,"file":"sim-cognito-user.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,UAAU,wBAAwB;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAEvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAEnD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,cAAc;IACzB,SAAgB,QAAQ,EAAE,kBAAkB,CAAC;IAC7C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8B;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0C;IAC5E,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,YAAY,CAAO;IAE3B,YAAY,UAAU,EAAE,wBAAwB,EAkC/C;IAED,kCAAkC;IAClC,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED,iDAAiD;IACjD,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;;;;;;OAOG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;IACH,IAAI,UAAU,IAAI,SAAS,uBAAuB,EAAE,CAMnD;IAED;;;;;;OAMG;IACH,IAAI,QAAQ,IAAI,2BAA2B,GAAG,SAAS,CAEtD;IAED;;;;;OAKG;IACH,IAAI,eAAe,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjD;IAED;;;;;;;;OAQG;IACH,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED;;;;OAIG;IACH,IAAI,GAAG,IAAI,iBAAiB,CAE3B;IAED;;;OAGG;IACH,IAAI,QAAQ,IAAI,sBAAsB,CAErC;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,2BAA2B,CAE/C;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAGlE;IAED;;;;;;OAMG;IACH,sBAAsB,IAAI,IAAI,CAI7B;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAI5C;IAED,wEAAwE;IACxE,OAAO,IAAI,IAAI,CAGd;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAG/C;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElD;IAED,8CAA8C;IAC9C,gBAAgB,CACd,SAAS,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,GACxD,IAAI,CAGN;IAED,uCAAuC;IACvC,MAAM,IAAI,IAAI,CAGb;IAED,oCAAoC;IACpC,OAAO,IAAI,IAAI,CAGd;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,KAAK;CAGd"}

package/dist/service/cognito/user-pool/user/sim-cognito-user.js

@@ -1,6 +1,7 @@
 import { SimCognitoUserMfa } from "./mfa/sim-cognito-user-mfa.js";
 import { SimCognitoUserConfirmation } from "./sim-cognito-user-confirmation.js";
 import { SimCognitoUserPasswordReset } from "./sim-cognito-user-password-reset.js";
+import { SimCognitoUserWebAuthn } from "./web-authn/sim-cognito-user-web-authn.js";
 import { SimCognitoUserPassword } from "./sim-cognito-user-password.js";
 import { SimCognitoUserStatus } from "./sim-cognito-user-status.js";
 /**
@@ -23,6 +24,7 @@ export class SimCognitoUser {
     userAttributes;
     confirmation;
     userMfa;
+    userWebAuthn;
     reset;
     federatedIdentity;
     userStatus;
@@ -41,12 +43,16 @@ export class SimCognitoUser {
         this.clock = properties.clock;
         this.creationDate = this.clock.now();
         this.modifiedDate = this.creationDate;
+        // Everything a user holds separately tells it when it has changed, so the
+        // user's last modified date moves on wherever the change was made.
+        const changed = () => {
+            this.touch();
+        };
         this.userMfa = new SimCognitoUserMfa({
             attributes: this.userAttributes.values,
-            changed: () => {
-                this.touch();
-            },
+            changed,
         });
+        this.userWebAuthn = new SimCognitoUserWebAuthn({ changed });
         this.reset = new SimCognitoUserPasswordReset({
             confirmation: this.confirmation,
             status: () => this.userStatus,
@@ -56,20 +62,14 @@ export class SimCognitoUser {
             chosen: (password) => {
                 this.setPassword(password, true);
             },
-            changed: () => {
-                this.touch();
-            },
+            changed,
         });
     }
-    /**
-     * When the user last changed.
-     */
+    /** When the user last changed. */
     get lastModifiedDate() {
         return this.modifiedDate;
     }
-    /**
-     * Where the user is in the status lifecycle.
-     */
+    /** Where the user is in the status lifecycle. */
     get status() {
         return this.userStatus;
     }
@@ -136,6 +136,13 @@ export class SimCognitoUser {
     get mfa() {
         return this.userMfa;
     }
+    /**
+     * The passkeys this user has registered. A passkey is a first factor rather
+     * than a second one, so it sits beside `mfa` rather than among it.
+     */
+    get webAuthn() {
+        return this.userWebAuthn;
+    }
     /**
      * The password reset this user can go through, which is what a forgotten
      * password is replaced by and what an administrator can force.
@@ -177,9 +184,7 @@ export class SimCognitoUser {
         this.confirmation.require(code);
         this.moveTo(SimCognitoUserStatus.confirmed);
     }
-    /**
-     * Confirm the sign-up without a code, as `AdminConfirmSignUp` does.
-     */
+    /** Confirm the sign-up without a code, as `AdminConfirmSignUp` does. */
     confirm() {
         this.userStatus.requireConfirmable();
         this.moveTo(SimCognitoUserStatus.confirmed);
@@ -206,23 +211,17 @@ export class SimCognitoUser {
     hasPassword(candidate) {
         return this.userPassword?.matches(candidate) ?? false;
     }
-    /**
-     * Apply an attribute update to this user.
-     */
+    /** Apply an attribute update to this user. */
     updateAttributes(requested) {
         this.userAttributes.update(requested);
         this.touch();
     }
-    /**
-     * Let the user authenticate again.
-     */
+    /** Let the user authenticate again. */
     enable() {
         this.isEnabled = true;
         this.touch();
     }
-    /**
-     * Stop the user authenticating.
-     */
+    /** Stop the user authenticating. */
     disable() {
         this.isEnabled = false;
         this.touch();

package/dist/service/cognito/user-pool/user/sim-cognito-user.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAKnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAwBpE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,cAAc;IACT,QAAQ,CAAqB;IAC7B,GAAG,CAAS;IACZ,YAAY,CAAO;IAElB,KAAK,CAAW;IAChB,cAAc,CAA2B;IACzC,YAAY,CAA6B;IACzC,OAAO,CAAoB;IAC3B,KAAK,CAA8B;IACnC,iBAAiB,CAA0C;IACpE,UAAU,CAAuB;IACjC,YAAY,CAAqC;IACjD,SAAS,GAAG,IAAI,CAAC;IACjB,YAAY,CAAO;IAE3B,YAAY,UAAoC;QAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC7C,IAAI,CAAC,UAAU;YACb,UAAU,CAAC,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,CAAC;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACnC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM;YACtC,OAAO,EAAE,GAAS,EAAE;gBAClB,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,2BAA2B,CAAC;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM,EAAE,GAAyB,EAAE,CAAC,IAAI,CAAC,UAAU;YACnD,KAAK,EAAE,CAAC,MAAM,EAAQ,EAAE;gBACtB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;YACD,MAAM,EAAE,CAAC,QAAQ,EAAQ,EAAE;gBACzB,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,EAAE,GAAS,EAAE;gBAClB,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,IAAI,UAAU;QACZ,OAAO;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;YAChC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC/C,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO;SAC/B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAgB,EAAE,SAA8B;QAC1D,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IACH,sBAAsB;QACpB,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAwB;QACpC,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAwB;QACvC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAA6B;QACvC,OAAO,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,SAAyD;QAEzD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,MAA4B;QACzC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAwBpE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,cAAc;IACT,QAAQ,CAAqB;IAC7B,GAAG,CAAS;IACZ,YAAY,CAAO;IAElB,KAAK,CAAW;IAChB,cAAc,CAA2B;IACzC,YAAY,CAA6B;IACzC,OAAO,CAAoB;IAC3B,YAAY,CAAyB;IACrC,KAAK,CAA8B;IACnC,iBAAiB,CAA0C;IACpE,UAAU,CAAuB;IACjC,YAAY,CAAqC;IACjD,SAAS,GAAG,IAAI,CAAC;IACjB,YAAY,CAAO;IAE3B,YAAY,UAAoC;QAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC7C,IAAI,CAAC,UAAU;YACb,UAAU,CAAC,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,CAAC;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC,CAAC;QAEF,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACnC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM;YACtC,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,2BAA2B,CAAC;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM,EAAE,GAAyB,EAAE,CAAC,IAAI,CAAC,UAAU;YACnD,KAAK,EAAE,CAAC,MAAM,EAAQ,EAAE;gBACtB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;YACD,MAAM,EAAE,CAAC,QAAQ,EAAQ,EAAE;gBACzB,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC;YACD,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,iDAAiD;IACjD,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,IAAI,UAAU;QACZ,OAAO;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;YAChC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC/C,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO;SAC/B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAgB,EAAE,SAA8B;QAC1D,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IACH,sBAAsB;QACpB,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAwB;QACpC,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,wEAAwE;IACxE,OAAO;QACL,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAwB;QACvC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAA6B;QACvC,OAAO,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;IACxD,CAAC;IAED,8CAA8C;IAC9C,gBAAgB,CACd,SAAyD;QAEzD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,uCAAuC;IACvC,MAAM;QACJ,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,oCAAoC;IACpC,OAAO;QACL,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,MAA4B;QACzC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;CACF"}