@kensio/yulin 1.18.1 → 1.19.0

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-user-web-authn.d.ts

@@ -0,0 +1,73 @@
+import { type SimCognitoWebAuthnRegistrationRequest } from "./sim-cognito-web-authn-creation-options.js";
+import type { SimCognitoWebAuthnCredential } from "./sim-cognito-web-authn-credential.js";
+import { SimCognitoWebAuthnDevice } from "./sim-cognito-web-authn-device.js";
+import type { SimCognitoWebAuthnCreationOptions, SimCognitoWebAuthnCredentialDocument } from "./sim-cognito-web-authn-document.js";
+interface SimCognitoUserWebAuthnProperties {
+    /** What to call when the user's passkeys change. */
+    readonly changed: () => void;
+}
+/**
+ * The passkeys one simulated user has, and the registration it is part way
+ * through.
+ *
+ * `StartWebAuthnRegistration` issues the challenge a passkey is created
+ * against, and `CompleteWebAuthnRegistration` hands back the credential the
+ * authenticator made from it. The challenge is spent either way, so a
+ * credential cannot be replayed into a second registration.
+ *
+ * The device the credential comes from is here too, because a test has no
+ * browser and no phone. What it holds is only the private half. What the pool
+ * keeps of a registration is the public key, the relying party and the
+ * identifier, and all of it is checked before any of it is stored.
+ *
+ * Registering or deleting a passkey moves the user's `UserLastModifiedDate`
+ * on, as every other change to a user does. Whether real Cognito moves it for
+ * a passkey was not checked against a live account.
+ */
+export declare class SimCognitoUserWebAuthn {
+    #private;
+    constructor(properties: SimCognitoUserWebAuthnProperties);
+    /**
+     * The stand-in authenticator this user's passkeys live on, which is what
+     * makes one and what presents one.
+     */
+    get device(): SimCognitoWebAuthnDevice;
+    /**
+     * The passkeys this user has registered, oldest first.
+     */
+    get credentials(): readonly SimCognitoWebAuthnCredential[];
+    /**
+     * Ask for a passkey, and remember the challenge it has to be created
+     * against.
+     *
+     * A second call replaces the first, as real Cognito replaces one: the
+     * challenge a browser was part way through answering is spent whether or not
+     * a credential ever came back for it.
+     */
+    startRegistration(request: SimCognitoWebAuthnRegistrationRequest): SimCognitoWebAuthnCreationOptions;
+    /**
+     * Register the passkey a browser created, having checked it answers the
+     * challenge this user was issued.
+     */
+    completeRegistration(credential: unknown, now: Date): void;
+    /**
+     * Forget a passkey, or refuse an identifier this user has none for.
+     */
+    remove(credentialId: string | undefined): void;
+    /**
+     * The credential this user's authenticator would have made for the
+     * registration it has been given options for.
+     *
+     * This is the simulator's own accessor, for a test that has no browser to
+     * run the ceremony in. Real Cognito hands the options to a browser and the
+     * browser hands back the credential.
+     */
+    registrationCredential(): SimCognitoWebAuthnCredentialDocument;
+    /**
+     * The registration this user is part way through, or a refusal saying it is
+     * part way through none.
+     */
+    private requirePending;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-web-authn.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-user-web-authn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-web-authn.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-user-web-authn.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,qCAAqC,EAC3C,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,KAAK,EACV,iCAAiC,EACjC,oCAAoC,EACrC,MAAM,qCAAqC,CAAC;AAE7C,UAAU,gCAAgC;IACxC,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,sBAAsB;;IAajC,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;;OAGG;IACH,IAAI,MAAM,IAAI,wBAAwB,CAErC;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,SAAS,4BAA4B,EAAE,CAEzD;IAED;;;;;;;OAOG;IACH,iBAAiB,CACf,OAAO,EAAE,qCAAqC,GAC7C,iCAAiC,CASnC;IAED;;;OAGG;IACH,oBAAoB,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAazD;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAU7C;IAED;;;;;;;OAOG;IACH,sBAAsB,IAAI,oCAAoC,CAE7D;IAED;;;OAGG;IACH,OAAO,CAAC,cAAc;CAWvB"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-user-web-authn.js

@@ -0,0 +1,113 @@
+import { SimCognitoResourceNotFoundException } from "../../../error/sim-cognito.error.js";
+import { SimCognitoWebAuthnChallengeNotFoundException } from "../../../error/sim-cognito-web-authn.error.js";
+import { simCognitoWebAuthnRegistered } from "./sim-cognito-web-authn-attested-key.js";
+import { simCognitoWebAuthnCreationOptions, } from "./sim-cognito-web-authn-creation-options.js";
+import { SimCognitoWebAuthnDevice } from "./sim-cognito-web-authn-device.js";
+/**
+ * The passkeys one simulated user has, and the registration it is part way
+ * through.
+ *
+ * `StartWebAuthnRegistration` issues the challenge a passkey is created
+ * against, and `CompleteWebAuthnRegistration` hands back the credential the
+ * authenticator made from it. The challenge is spent either way, so a
+ * credential cannot be replayed into a second registration.
+ *
+ * The device the credential comes from is here too, because a test has no
+ * browser and no phone. What it holds is only the private half. What the pool
+ * keeps of a registration is the public key, the relying party and the
+ * identifier, and all of it is checked before any of it is stored.
+ *
+ * Registering or deleting a passkey moves the user's `UserLastModifiedDate`
+ * on, as every other change to a user does. Whether real Cognito moves it for
+ * a passkey was not checked against a live account.
+ */
+export class SimCognitoUserWebAuthn {
+    #device = new SimCognitoWebAuthnDevice();
+    #credentials = new Map();
+    /**
+     * The options the registration this user is part way through was issued
+     * with, which carry both the challenge and the relying party it answers to.
+     */
+    #pending;
+    /** What to tell the user when its passkeys change. */
+    #changed;
+    constructor(properties) {
+        this.#changed = properties.changed;
+    }
+    /**
+     * The stand-in authenticator this user's passkeys live on, which is what
+     * makes one and what presents one.
+     */
+    get device() {
+        return this.#device;
+    }
+    /**
+     * The passkeys this user has registered, oldest first.
+     */
+    get credentials() {
+        return this.#credentials.values().toArray();
+    }
+    /**
+     * Ask for a passkey, and remember the challenge it has to be created
+     * against.
+     *
+     * A second call replaces the first, as real Cognito replaces one: the
+     * challenge a browser was part way through answering is spent whether or not
+     * a credential ever came back for it.
+     */
+    startRegistration(request) {
+        const options = simCognitoWebAuthnCreationOptions(request, this.credentials.map((each) => each.descriptor()));
+        this.#pending = options;
+        return options;
+    }
+    /**
+     * Register the passkey a browser created, having checked it answers the
+     * challenge this user was issued.
+     */
+    completeRegistration(credential, now) {
+        // The challenge is spent before the credential is read, so a refused one
+        // cannot be retried against the same challenge. Real Cognito issues one
+        // challenge per registration, and StartWebAuthnRegistration is what issues
+        // another.
+        const pending = this.requirePending();
+        this.#pending = undefined;
+        const registered = simCognitoWebAuthnRegistered(pending, credential, now);
+        this.#credentials.set(registered.credentialId, registered);
+        this.#changed();
+    }
+    /**
+     * Forget a passkey, or refuse an identifier this user has none for.
+     */
+    remove(credentialId) {
+        if (credentialId === undefined || !this.#credentials.delete(credentialId)) {
+            throw new SimCognitoResourceNotFoundException(`This user has no registered passkey with the credential id ` +
+                `'${String(credentialId)}'`);
+        }
+        this.#device.forget(credentialId);
+        this.#changed();
+    }
+    /**
+     * The credential this user's authenticator would have made for the
+     * registration it has been given options for.
+     *
+     * This is the simulator's own accessor, for a test that has no browser to
+     * run the ceremony in. Real Cognito hands the options to a browser and the
+     * browser hands back the credential.
+     */
+    registrationCredential() {
+        return this.#device.create(this.requirePending());
+    }
+    /**
+     * The registration this user is part way through, or a refusal saying it is
+     * part way through none.
+     */
+    requirePending() {
+        if (this.#pending === undefined) {
+            throw new SimCognitoWebAuthnChallengeNotFoundException("No passkey registration is in progress for this user: call " +
+                "StartWebAuthnRegistration for the challenge a credential is " +
+                "created against.");
+        }
+        return this.#pending;
+    }
+}
+//# sourceMappingURL=sim-cognito-user-web-authn.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-user-web-authn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-web-authn.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-user-web-authn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EAAE,4CAA4C,EAAE,MAAM,+CAA+C,CAAC;AAC7G,OAAO,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,EACL,iCAAiC,GAElC,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAW7E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,sBAAsB;IACxB,OAAO,GAAG,IAAI,wBAAwB,EAAE,CAAC;IACzC,YAAY,GAAG,IAAI,GAAG,EAAwC,CAAC;IAExE;;;OAGG;IACH,QAAQ,CAAgD;IAExD,sDAAsD;IAC7C,QAAQ,CAAa;IAE9B,YAAY,UAA4C;QACtD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;;OAOG;IACH,iBAAiB,CACf,OAA8C;QAE9C,MAAM,OAAO,GAAG,iCAAiC,CAC/C,OAAO,EACP,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAClD,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QAExB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,oBAAoB,CAAC,UAAmB,EAAE,GAAS;QACjD,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,WAAW;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtC,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAE1B,MAAM,UAAU,GAAG,4BAA4B,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QAE1E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAgC;QACrC,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,mCAAmC,CAC3C,6DAA6D;gBAC3D,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAC9B,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,cAAc;QACpB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,4CAA4C,CACpD,6DAA6D;gBAC3D,8DAA8D;gBAC9D,kBAAkB,CACrB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-assertion.d.ts

@@ -0,0 +1,22 @@
+import type { SimCognitoWebAuthnCredential } from "./sim-cognito-web-authn-credential.js";
+import type { SimCognitoWebAuthnCredentialDescriptor, SimCognitoWebAuthnRequestOptions } from "./sim-cognito-web-authn-document.js";
+/**
+ * The options a passkey is presented against, which a browser passes straight
+ * to `navigator.credentials.get()`.
+ *
+ * The passkeys the user has are named under `allowCredentials`, so an
+ * authenticator holding several knows which of them this pool would take.
+ */
+export declare function simCognitoWebAuthnRequestOptions(relyingPartyId: string, userVerification: string, allowed: readonly SimCognitoWebAuthnCredentialDescriptor[]): SimCognitoWebAuthnRequestOptions;
+/**
+ * The passkey a credential presented, having checked that it is one of this
+ * user's and that this user's key signed it.
+ *
+ * The ceremony is read the way a registration's is, and the signature is then
+ * checked against the public key the pool stored. A credential naming a
+ * passkey this user does not have, and one signed by another key, are both
+ * refused as `NotAuthorizedException`, which is what real Cognito answers a
+ * sign-in it will not complete with.
+ */
+export declare function requireSimCognitoWebAuthnAssertion(credentials: readonly SimCognitoWebAuthnCredential[], credential: unknown, options: SimCognitoWebAuthnRequestOptions): SimCognitoWebAuthnCredential;
+//# sourceMappingURL=sim-cognito-web-authn-assertion.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-assertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-assertion.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-assertion.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,KAAK,EACV,sCAAsC,EACtC,gCAAgC,EACjC,MAAM,qCAAqC,CAAC;AAQ7C;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,cAAc,EAAE,MAAM,EACtB,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,SAAS,sCAAsC,EAAE,GACzD,gCAAgC,CAQlC;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAChD,WAAW,EAAE,SAAS,4BAA4B,EAAE,EACpD,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,gCAAgC,GACxC,4BAA4B,CA8B9B"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-assertion.js

@@ -0,0 +1,53 @@
+import { SimCognitoNotAuthorizedException } from "../../../error/sim-cognito.error.js";
+import { requireSimCognitoWebAuthnCeremony } from "./sim-cognito-web-authn-ceremony.js";
+import { simCognitoWebAuthnChallenge } from "./sim-cognito-web-authn-signing.js";
+/**
+ * How long a browser is given to present a passkey, in milliseconds.
+ */
+const ceremonyTimeout = 60_000;
+/**
+ * The options a passkey is presented against, which a browser passes straight
+ * to `navigator.credentials.get()`.
+ *
+ * The passkeys the user has are named under `allowCredentials`, so an
+ * authenticator holding several knows which of them this pool would take.
+ */
+export function simCognitoWebAuthnRequestOptions(relyingPartyId, userVerification, allowed) {
+    return {
+        challenge: simCognitoWebAuthnChallenge(),
+        rpId: relyingPartyId,
+        timeout: ceremonyTimeout,
+        allowCredentials: allowed,
+        userVerification,
+    };
+}
+/**
+ * The passkey a credential presented, having checked that it is one of this
+ * user's and that this user's key signed it.
+ *
+ * The ceremony is read the way a registration's is, and the signature is then
+ * checked against the public key the pool stored. A credential naming a
+ * passkey this user does not have, and one signed by another key, are both
+ * refused as `NotAuthorizedException`, which is what real Cognito answers a
+ * sign-in it will not complete with.
+ */
+export function requireSimCognitoWebAuthnAssertion(credentials, credential, options) {
+    const ceremony = requireSimCognitoWebAuthnCeremony({
+        credential,
+        field: "CREDENTIAL",
+        type: "webauthn.get",
+        challenge: options.challenge,
+        relyingPartyId: options.rpId,
+    });
+    const presented = credentials.find((each) => each.credentialId === ceremony.credentialId);
+    if (presented === undefined) {
+        throw new SimCognitoNotAuthorizedException("The credential presents a passkey this user has not registered.");
+    }
+    const signature = ceremony.response["signature"];
+    if (typeof signature !== "string" ||
+        !presented.signed(ceremony, Buffer.from(signature, "base64url"))) {
+        throw new SimCognitoNotAuthorizedException("The credential was not signed by this passkey.");
+    }
+    return presented;
+}
+//# sourceMappingURL=sim-cognito-web-authn-assertion.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-assertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-assertion.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-assertion.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAMxF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF;;GAEG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAC9C,cAAsB,EACtB,gBAAwB,EACxB,OAA0D;IAE1D,OAAO;QACL,SAAS,EAAE,2BAA2B,EAAE;QACxC,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,eAAe;QACxB,gBAAgB,EAAE,OAAO;QACzB,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kCAAkC,CAChD,WAAoD,EACpD,UAAmB,EACnB,OAAyC;IAEzC,MAAM,QAAQ,GAAG,iCAAiC,CAAC;QACjD,UAAU;QACV,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,CACtD,CAAC;IAEF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,gCAAgC,CACxC,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEjD,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,gCAAgC,CACxC,gDAAgD,CACjD,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-attested-key.d.ts

@@ -0,0 +1,15 @@
+import { SimCognitoWebAuthnCredential } from "./sim-cognito-web-authn-credential.js";
+import type { SimCognitoWebAuthnCreationOptions } from "./sim-cognito-web-authn-document.js";
+/**
+ * The passkey a pool keeps out of the credential a registration carried.
+ *
+ * The credential is read against the options the registration was issued with,
+ * which say which challenge it has to answer and which relying party it has to
+ * have been signed for. A browser reports the public key as
+ * `response.publicKey`, base64url of its SubjectPublicKeyInfo, and names the
+ * algorithm beside it. That is what is read here rather than the attestation
+ * object, which a real relying party parses out of CBOR and this simulation
+ * does not.
+ */
+export declare function simCognitoWebAuthnRegistered(pending: SimCognitoWebAuthnCreationOptions, credential: unknown, createdAt: Date): SimCognitoWebAuthnCredential;
+//# sourceMappingURL=sim-cognito-web-authn-attested-key.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-attested-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-attested-key.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-attested-key.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAiD7F;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,iCAAiC,EAC1C,UAAU,EAAE,OAAO,EACnB,SAAS,EAAE,IAAI,GACd,4BAA4B,CAoB9B"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-attested-key.js

@@ -0,0 +1,68 @@
+import { SimCognitoWebAuthnCredentialNotSupportedException } from "../../../error/sim-cognito-web-authn.error.js";
+import { requireSimCognitoWebAuthnCeremony } from "./sim-cognito-web-authn-ceremony.js";
+import { SimCognitoWebAuthnCredential } from "./sim-cognito-web-authn-credential.js";
+import { simCognitoWebAuthnKeyFrom } from "./sim-cognito-web-authn-public-key.js";
+import { simCognitoWebAuthnAlgorithm } from "./sim-cognito-web-authn-signing.js";
+/**
+ * How a credential says it is attached when it says nothing, which is what a
+ * phone or a laptop reports.
+ */
+const defaultAttachment = "platform";
+/**
+ * The public key a credential carries, or a refusal where the pool cannot read
+ * one.
+ */
+function publicKeyOf(response) {
+    const encoded = response["publicKey"];
+    const publicKey = typeof encoded === "string"
+        ? simCognitoWebAuthnKeyFrom(encoded)
+        : undefined;
+    if (publicKey === undefined ||
+        response["publicKeyAlgorithm"] !== simCognitoWebAuthnAlgorithm) {
+        throw new SimCognitoWebAuthnCredentialNotSupportedException("The credential carries no public key this user pool can use: the " +
+            "registration asked for ECDSA over P-256, which a browser reports " +
+            "as response.publicKey with a publicKeyAlgorithm of " +
+            `${String(simCognitoWebAuthnAlgorithm)}.`);
+    }
+    return publicKey;
+}
+/**
+ * The strings of a credential member that is meant to be a list of them.
+ */
+function stringsOf(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter((each) => typeof each === "string");
+}
+/**
+ * The passkey a pool keeps out of the credential a registration carried.
+ *
+ * The credential is read against the options the registration was issued with,
+ * which say which challenge it has to answer and which relying party it has to
+ * have been signed for. A browser reports the public key as
+ * `response.publicKey`, base64url of its SubjectPublicKeyInfo, and names the
+ * algorithm beside it. That is what is read here rather than the attestation
+ * object, which a real relying party parses out of CBOR and this simulation
+ * does not.
+ */
+export function simCognitoWebAuthnRegistered(pending, credential, createdAt) {
+    const relyingPartyId = pending.rp.id;
+    const ceremony = requireSimCognitoWebAuthnCeremony({
+        credential,
+        field: "Credential",
+        type: "webauthn.create",
+        challenge: pending.challenge,
+        relyingPartyId,
+    });
+    const attachment = ceremony.document["authenticatorAttachment"];
+    return new SimCognitoWebAuthnCredential({
+        credentialId: ceremony.credentialId,
+        publicKey: publicKeyOf(ceremony.response),
+        relyingPartyId,
+        authenticatorAttachment: typeof attachment === "string" ? attachment : defaultAttachment,
+        transports: stringsOf(ceremony.response["transports"]),
+        createdAt,
+    });
+}
+//# sourceMappingURL=sim-cognito-web-authn-attested-key.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-attested-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-attested-key.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-attested-key.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iDAAiD,EAAE,MAAM,+CAA+C,CAAC;AAClH,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAErF,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF;;;GAGG;AACH,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC;;;GAGG;AACH,SAAS,WAAW,CAAC,QAA2C;IAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,SAAS,GACb,OAAO,OAAO,KAAK,QAAQ;QACzB,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC;QACpC,CAAC,CAAC,SAAS,CAAC;IAEhB,IACE,SAAS,KAAK,SAAS;QACvB,QAAQ,CAAC,oBAAoB,CAAC,KAAK,2BAA2B,EAC9D,CAAC;QACD,MAAM,IAAI,iDAAiD,CACzD,mEAAmE;YACjE,mEAAmE;YACnE,qDAAqD;YACrD,GAAG,MAAM,CAAC,2BAA2B,CAAC,GAAG,CAC5C,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAQ,KAA4B,CAAC,MAAM,CACzC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAA0C,EAC1C,UAAmB,EACnB,SAAe;IAEf,MAAM,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,iCAAiC,CAAC;QACjD,UAAU;QACV,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc;KACf,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IAEhE,OAAO,IAAI,4BAA4B,CAAC;QACtC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzC,cAAc;QACd,uBAAuB,EACrB,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB;QACjE,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACtD,SAAS;KACV,CAAC,CAAC;AACL,CAAC"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-ceremony.d.ts

@@ -0,0 +1,33 @@
+import { type SimCognitoWebAuthnClientDataRequest } from "./sim-cognito-web-authn-client-data.js";
+/**
+ * What a caller sent, once it has been read as a credential.
+ */
+export interface SimCognitoWebAuthnCeremony {
+    readonly credentialId: string;
+    readonly clientDataJson: Buffer;
+    readonly authenticatorData: Buffer;
+    /** The credential document itself, once it has been read as an object. */
+    readonly document: Readonly<Record<string, unknown>>;
+    /** The `response` half of it, which holds what the authenticator produced. */
+    readonly response: Readonly<Record<string, unknown>>;
+}
+/**
+ * What a request carried, and what the pool expects it to answer.
+ */
+export interface SimCognitoWebAuthnCeremonyRequest extends SimCognitoWebAuthnClientDataRequest {
+    /** The credential document the request carried, as it arrived. */
+    readonly credential: unknown;
+}
+/**
+ * Read the credential a request carried, and hold it to the ceremony the pool
+ * is part way through.
+ *
+ * A credential arrives as the JSON a browser produces from a
+ * `PublicKeyCredential`, so it is read rather than trusted: the client data
+ * says which ceremony it answers, which challenge, and where it was collected,
+ * and the authenticator data says which relying party it was signed for. What
+ * this leaves to the caller is the signature, which needs the public key of
+ * the credential being presented.
+ */
+export declare function requireSimCognitoWebAuthnCeremony(request: SimCognitoWebAuthnCeremonyRequest): SimCognitoWebAuthnCeremony;
+//# sourceMappingURL=sim-cognito-web-authn-ceremony.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-ceremony.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-ceremony.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-ceremony.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,wCAAwC,CAAC;AAQhD;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAErD,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,iCAAkC,SAAQ,mCAAmC;IAC5F,kEAAkE;IAClE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAkDD;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,iCAAiC,GACzC,0BAA0B,CAuB5B"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-ceremony.js

@@ -0,0 +1,67 @@
+import { createHash } from "node:crypto";
+import { SimCognitoInvalidParameterException } from "../../../error/sim-cognito.error.js";
+import { SimCognitoWebAuthnRelyingPartyMismatchException } from "../../../error/sim-cognito-web-authn.error.js";
+import { requireSimCognitoWebAuthnClientData, } from "./sim-cognito-web-authn-client-data.js";
+/**
+ * How many bytes of authenticator data come before the flags, which is the
+ * hash of the relying party id.
+ */
+const relyingPartyHashBytes = 32;
+/**
+ * A member of a credential that has to be there, as the base64url it is.
+ */
+function requireMember(value, member, field) {
+    if (typeof value !== "string" || value === "") {
+        throw new SimCognitoInvalidParameterException(`${field} ${member} must be the base64url string a browser's own ` +
+            `credential serialization carries it as`);
+    }
+    return value;
+}
+/**
+ * Refuse authenticator data signed for another relying party.
+ */
+function requireRelyingParty(authenticatorData, relyingPartyId) {
+    const signedFor = authenticatorData.subarray(0, relyingPartyHashBytes);
+    if (!signedFor.equals(createHash("sha256").update(relyingPartyId).digest())) {
+        throw new SimCognitoWebAuthnRelyingPartyMismatchException(`The credential was signed for another relying party, and this user ` +
+            `pool registers passkeys against ${relyingPartyId}.`);
+    }
+}
+/**
+ * The credential document a request carried, or a refusal where it is not one.
+ */
+function requireDocument(value, field) {
+    if (typeof value !== "object" || value === null) {
+        throw new SimCognitoInvalidParameterException(`${field} must be the credential a browser serializes from ` +
+            `navigator.credentials, carrying an id and a response`);
+    }
+    return value;
+}
+/**
+ * Read the credential a request carried, and hold it to the ceremony the pool
+ * is part way through.
+ *
+ * A credential arrives as the JSON a browser produces from a
+ * `PublicKeyCredential`, so it is read rather than trusted: the client data
+ * says which ceremony it answers, which challenge, and where it was collected,
+ * and the authenticator data says which relying party it was signed for. What
+ * this leaves to the caller is the signature, which needs the public key of
+ * the credential being presented.
+ */
+export function requireSimCognitoWebAuthnCeremony(request) {
+    const { field } = request;
+    const document = requireDocument(request.credential, field);
+    const response = requireDocument(document["response"], field);
+    const clientDataJson = Buffer.from(requireMember(response["clientDataJSON"], "clientDataJSON", field), "base64url");
+    const authenticatorData = Buffer.from(requireMember(response["authenticatorData"], "authenticatorData", field), "base64url");
+    requireSimCognitoWebAuthnClientData(clientDataJson, request);
+    requireRelyingParty(authenticatorData, request.relyingPartyId);
+    return {
+        credentialId: requireMember(document["id"], "id", field),
+        clientDataJson,
+        authenticatorData,
+        document,
+        response,
+    };
+}
+//# sourceMappingURL=sim-cognito-web-authn-ceremony.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-ceremony.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-ceremony.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-ceremony.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EAAE,+CAA+C,EAAE,MAAM,+CAA+C,CAAC;AAChH,OAAO,EACL,mCAAmC,GAEpC,MAAM,wCAAwC,CAAC;AAEhD;;;GAGG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAyBjC;;GAEG;AACH,SAAS,aAAa,CAAC,KAAc,EAAE,MAAc,EAAE,KAAa;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,IAAI,MAAM,gDAAgD;YAChE,wCAAwC,CAC3C,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,iBAAyB,EACzB,cAAsB;IAEtB,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAEvE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,+CAA+C,CACvD,qEAAqE;YACnE,mCAAmC,cAAc,GAAG,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CACtB,KAAc,EACd,KAAa;IAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,oDAAoD;YAC1D,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAC/C,OAA0C;IAE1C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1B,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAChC,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAClE,WAAW,CACZ,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CACnC,aAAa,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,EACxE,WAAW,CACZ,CAAC;IAEF,mCAAmC,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC7D,mBAAmB,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAE/D,OAAO;QACL,YAAY,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC;QACxD,cAAc;QACd,iBAAiB;QACjB,QAAQ;QACR,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-client-data.d.ts

@@ -0,0 +1,24 @@
+/**
+ * What the client data of a ceremony has to say.
+ */
+export interface SimCognitoWebAuthnClientDataRequest {
+    /** The input the credential arrived in, which a refusal names. */
+    readonly field: string;
+    /** Which half of the ceremony this is. */
+    readonly type: "webauthn.create" | "webauthn.get";
+    /** The challenge the pool issued, which the credential has to answer. */
+    readonly challenge: string;
+    /** The domain the credential has to have been collected for. */
+    readonly relyingPartyId: string;
+}
+/**
+ * Refuse client data that answers something other than the challenge this pool
+ * issued, or that was collected somewhere the relying party does not cover.
+ *
+ * The client data is what the authenticator signed over, so what it says about
+ * the ceremony is worth as much as the signature that covers it. A credential
+ * collected at another origin is what a relying party check is for, and one
+ * carrying another challenge is a replay.
+ */
+export declare function requireSimCognitoWebAuthnClientData(clientDataJson: Buffer, request: SimCognitoWebAuthnClientDataRequest): void;
+//# sourceMappingURL=sim-cognito-web-authn-client-data.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-client-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-client-data.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-client-data.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAAC;IAElD,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,gEAAgE;IAChE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AA0BD;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,mCAAmC,GAC3C,IAAI,CAwBN"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-client-data.js

@@ -0,0 +1,45 @@
+import { SimCognitoInvalidParameterException } from "../../../error/sim-cognito.error.js";
+import { SimCognitoWebAuthnChallengeNotFoundException, SimCognitoWebAuthnOriginNotAllowedException, } from "../../../error/sim-cognito-web-authn.error.js";
+/**
+ * The client data a credential carries, parsed as the JSON it is.
+ */
+function clientDataOf(clientDataJson, field) {
+    try {
+        const parsed = JSON.parse(clientDataJson.toString("utf8"));
+        if (typeof parsed === "object" && parsed !== null) {
+            return parsed;
+        }
+    }
+    catch {
+        // Falls through to the refusal below, which says the same thing about an
+        // unparseable client data as about one that is not an object.
+    }
+    throw new SimCognitoInvalidParameterException(`${field} response.clientDataJSON is not the JSON object a browser ` +
+        `collects for a WebAuthn ceremony`);
+}
+/**
+ * Refuse client data that answers something other than the challenge this pool
+ * issued, or that was collected somewhere the relying party does not cover.
+ *
+ * The client data is what the authenticator signed over, so what it says about
+ * the ceremony is worth as much as the signature that covers it. A credential
+ * collected at another origin is what a relying party check is for, and one
+ * carrying another challenge is a replay.
+ */
+export function requireSimCognitoWebAuthnClientData(clientDataJson, request) {
+    const { field, type, challenge, relyingPartyId } = request;
+    const clientData = clientDataOf(clientDataJson, field);
+    if (clientData["type"] !== type) {
+        throw new SimCognitoInvalidParameterException(`${field} response.clientDataJSON is for ` +
+            `'${String(clientData["type"])}' rather than '${type}'`);
+    }
+    if (clientData["challenge"] !== challenge) {
+        throw new SimCognitoWebAuthnChallengeNotFoundException("The credential answers a challenge this user pool did not issue, or " +
+            "one it has already spent.");
+    }
+    if (clientData["origin"] !== `https://${relyingPartyId}`) {
+        throw new SimCognitoWebAuthnOriginNotAllowedException(`The credential was collected at '${String(clientData["origin"])}', ` +
+            `which is not an origin of the relying party ${relyingPartyId}.`);
+    }
+}
+//# sourceMappingURL=sim-cognito-web-authn-client-data.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-client-data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-client-data.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-client-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EACL,4CAA4C,EAC5C,2CAA2C,GAC5C,MAAM,+CAA+C,CAAC;AAmBvD;;GAEG;AACH,SAAS,YAAY,CACnB,cAAsB,EACtB,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,MAAiC,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,8DAA8D;IAChE,CAAC;IAED,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,4DAA4D;QAClE,kCAAkC,CACrC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CACjD,cAAsB,EACtB,OAA4C;IAE5C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAC3D,MAAM,UAAU,GAAG,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAEvD,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,kCAAkC;YACxC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,kBAAkB,IAAI,GAAG,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,4CAA4C,CACpD,sEAAsE;YACpE,2BAA2B,CAC9B,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,WAAW,cAAc,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,2CAA2C,CACnD,oCAAoC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK;YACnE,+CAA+C,cAAc,GAAG,CACnE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-creation-options.d.ts

@@ -0,0 +1,28 @@
+import type { SimCognitoWebAuthnCreationOptions, SimCognitoWebAuthnCredentialDescriptor } from "./sim-cognito-web-authn-document.js";
+/**
+ * What a pool needs to know before it can ask for a passkey.
+ */
+export interface SimCognitoWebAuthnRegistrationRequest {
+    /** The domain the passkey is registered against. */
+    readonly relyingPartyId: string;
+    /** The pool's own name, which a browser shows the person. */
+    readonly relyingPartyName: string;
+    /** The user handle the authenticator stores, which is the user's `sub`. */
+    readonly userHandle: string;
+    /** The name the authenticator shows for the account. */
+    readonly username: string;
+    /** Whether the authenticator has to check who is holding it. */
+    readonly userVerification: string;
+}
+/**
+ * The options a passkey is created from, which a browser passes straight to
+ * `navigator.credentials.create()`.
+ *
+ * The challenge is fresh for every registration, and is what the authenticator
+ * signs over. The passkeys the user already has are excluded, so an
+ * authenticator already holding one makes another rather than replacing it,
+ * and the key is asked to be discoverable so a later sign-in can present it
+ * without being told which user is signing in.
+ */
+export declare function simCognitoWebAuthnCreationOptions(request: SimCognitoWebAuthnRegistrationRequest, excluded: readonly SimCognitoWebAuthnCredentialDescriptor[]): SimCognitoWebAuthnCreationOptions;
+//# sourceMappingURL=sim-cognito-web-authn-creation-options.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-creation-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-creation-options.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-creation-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iCAAiC,EACjC,sCAAsC,EACvC,MAAM,qCAAqC,CAAC;AAc7C;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD,oDAAoD;IACpD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,6DAA6D;IAC7D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,gEAAgE;IAChE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,qCAAqC,EAC9C,QAAQ,EAAE,SAAS,sCAAsC,EAAE,GAC1D,iCAAiC,CAqBnC"}