@kensio/yulin 1.18.1 → 1.19.0

package/dist/service/cognito/command/auth/sim-cognito-new-password-challenge.js

@@ -15,10 +15,10 @@ export class SimCognitoNewPasswordChallenge {
      * Answer with `NEW_PASSWORD_REQUIRED` and a session.
      */
     issue(properties) {
-        const { pool, clientId, user } = properties;
+        const { pool, client, user } = properties;
         const session = new SimCognitoAuthSession({
             username: user.username,
-            clientId,
+            client,
             challengeName: newPasswordRequiredChallenge,
             issuedAt: this.clock.now(),
         });

package/dist/service/cognito/command/auth/sim-cognito-new-password-challenge.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-new-password-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-new-password-challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAGzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAa/E;;;;;GAKG;AACH,MAAM,OAAO,8BAA8B;IACxB,KAAK,CAAW;IAEjC,YAAY,UAAoD;QAC9D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CACH,UAAyC;QAEzC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC;YACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ;YACR,aAAa,EAAE,4BAA4B;YAC3C,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE9B,OAAO;YACL,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,4BAA4B;YAC3C,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,mBAAmB,EAAE;gBACnB,eAAe,EAAE,IAAI,CAAC,QAAQ;gBAC9B,kBAAkB,EAAE,IAAI;gBACxB,cAAc,EAAE,IAAI;aACrB;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-new-password-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-new-password-challenge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAIzF,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAa/E;;;;;GAKG;AACH,MAAM,OAAO,8BAA8B;IACxB,KAAK,CAAW;IAEjC,YAAY,UAAoD;QAC9D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CACH,UAAyC;QAEzC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC;YACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM;YACN,aAAa,EAAE,4BAA4B;YAC3C,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE9B,OAAO;YACL,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,4BAA4B;YAC3C,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,mBAAmB,EAAE;gBACnB,eAAe,EAAE,IAAI,CAAC,QAAQ;gBAC9B,kBAAkB,EAAE,IAAI;gBACxB,cAAc,EAAE,IAAI;aACrB;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-password-response.d.ts

@@ -0,0 +1,31 @@
+import type { SimCognitoAuthSession } from "../../user-pool/auth/sim-cognito-auth-session.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoFirstFactorResponseRequest } from "./sim-cognito-first-factor-response.js";
+import type { SimCognitoSignInCompletion } from "./sim-cognito-sign-in-completion.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+interface SimCognitoPasswordResponseProperties {
+    readonly completion: SimCognitoSignInCompletion;
+}
+/**
+ * Signing in with the password a `USER_AUTH` challenge asked for.
+ *
+ * This is the same password check `USER_PASSWORD_AUTH` makes, reached the
+ * other way. A `PASSWORD` challenge is answered with it, and so is a
+ * `SELECT_CHALLENGE` whose `ANSWER` picked `PASSWORD`, which is the shape the
+ * Cognito documentation gives for choosing a password.
+ *
+ * A user that has registered a second factor is challenged for it afterwards,
+ * as it is on every other password sign-in. A wrong password leaves the
+ * challenge session standing, so the person can type it again.
+ */
+export declare class SimCognitoPasswordResponse {
+    private readonly completion;
+    constructor(properties: SimCognitoPasswordResponseProperties);
+    /**
+     * Check the password and finish, or answer with the second factor the user
+     * still owes.
+     */
+    complete(request: SimCognitoFirstFactorResponseRequest, session: SimCognitoAuthSession, user: SimCognitoUser): Promise<SimCognitoAuthenticationOutput>;
+}
+export {};
+//# sourceMappingURL=sim-cognito-password-response.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-password-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-password-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-password-response.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAE9F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,wCAAwC,CAAC;AACnG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;CACjD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IAExD,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;;OAGG;IACG,QAAQ,CACZ,OAAO,EAAE,oCAAoC,EAC7C,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,8BAA8B,CAAC,CAezC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-password-response.js

@@ -0,0 +1,39 @@
+import { requireSimCognitoConfirmed, requireSimCognitoPasswordSet, requireSimCognitoSignIn, } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
+/**
+ * Signing in with the password a `USER_AUTH` challenge asked for.
+ *
+ * This is the same password check `USER_PASSWORD_AUTH` makes, reached the
+ * other way. A `PASSWORD` challenge is answered with it, and so is a
+ * `SELECT_CHALLENGE` whose `ANSWER` picked `PASSWORD`, which is the shape the
+ * Cognito documentation gives for choosing a password.
+ *
+ * A user that has registered a second factor is challenged for it afterwards,
+ * as it is on every other password sign-in. A wrong password leaves the
+ * challenge session standing, so the person can type it again.
+ */
+export class SimCognitoPasswordResponse {
+    completion;
+    constructor(properties) {
+        this.completion = properties.completion;
+    }
+    /**
+     * Check the password and finish, or answer with the second factor the user
+     * still owes.
+     */
+    async complete(request, session, user) {
+        requireSimCognitoSignIn(user, request.parameters.require("PASSWORD"));
+        requireSimCognitoConfirmed(user);
+        requireSimCognitoPasswordSet(user);
+        request.pool.auth.removeSession(session);
+        return await this.completion.challengeOrComplete({
+            pool: request.pool,
+            client: request.client,
+            user,
+            occasion: SimCognitoTriggerOccasion.tokenGeneration,
+            tokenClientMetadata: request.clientMetadata,
+            clientMetadata: request.clientMetadata,
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-password-response.js.map

package/dist/service/cognito/command/auth/sim-cognito-password-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-password-response.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-password-response.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AAUpG;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,0BAA0B;IACpB,UAAU,CAA6B;IAExD,YAAY,UAAgD;QAC1D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CACZ,OAA6C,EAC7C,OAA8B,EAC9B,IAAoB;QAEpB,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACtE,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACjC,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAEnC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEzC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAC/C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI;YACJ,QAAQ,EAAE,yBAAyB,CAAC,eAAe;YACnD,mBAAmB,EAAE,OAAO,CAAC,cAAc;YAC3C,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-password-sign-in.js

@@ -47,7 +47,7 @@ export class SimCognitoPasswordSignIn {
         requireSimCognitoConfirmed(user);
         requireSimCognitoPasswordSet(user);
         if (user.status.mustChangePassword) {
-            return this.challenge.issue({ pool, clientId: client.id, user });
+            return this.challenge.issue({ pool, client, user });
         }
         // A user that has registered a second factor is challenged for it here
         // rather than answered with tokens, which is what the pool's

package/dist/service/cognito/command/auth/sim-cognito-password-sign-in.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-password-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-password-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAGrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AA8BpG;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAClB,YAAY,CAAyB;IACrC,UAAU,CAA6B;IACvC,SAAS,CAAiC;IAC1C,QAAQ,CAA6B;IAEtD,YAAY,UAA8C;QACxD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,MAAM,CACV,OAA8B;QAE9B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACpC,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;QAEH,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACjC,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,uEAAuE;QACvE,6DAA6D;QAC7D,4BAA4B;QAC5B,EAAE;QACF,yEAAyE;QACzE,uEAAuE;QACvE,8CAA8C;QAC9C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAC/C,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,QAAQ,EAAE,yBAAyB,CAAC,eAAe;YACnD,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-password-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-password-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAGrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AA8BpG;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAClB,YAAY,CAAyB;IACrC,UAAU,CAA6B;IACvC,SAAS,CAAiC;IAC1C,QAAQ,CAA6B;IAEtD,YAAY,UAA8C;QACxD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,MAAM,CACV,OAA8B;QAE9B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACpC,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;QAEH,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACjC,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,uEAAuE;QACvE,6DAA6D;QAC7D,4BAA4B;QAC5B,EAAE;QACF,yEAAyE;QACzE,uEAAuE;QACvE,8CAA8C;QAC9C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAC/C,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,QAAQ,EAAE,yBAAyB,CAAC,eAAe;YACnD,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-refresh-sign-in.d.ts

@@ -1,9 +1,9 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
-import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
+import type { SimCognitoRefreshedTokens } from "./sim-cognito-refreshed-tokens.js";
 import type { SimCognitoAuthRequest } from "./sim-cognito-password-sign-in.js";
 import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
 interface SimCognitoRefreshSignInProperties {
-    readonly tokenIssuer: SimCognitoTokenIssuer;
+    readonly refreshedTokens: SimCognitoRefreshedTokens;
     readonly clock: SimClock;
 }
 /**
@@ -13,15 +13,10 @@ interface SimCognitoRefreshSignInProperties {
  * it is, which is why one presented to another app client is refused. Nothing
  * new comes back with the tokens, because real Cognito issues no new refresh
  * token here, so a client keeps the one it has until that expires.
- *
- * The pool's `PreTokenGeneration` trigger runs for the reissued tokens, as it
- * does on real Cognito, so a claim it changed since the sign-in is on the token
- * a refresh answers with rather than being stale for the life of the session.
  */
 export declare class SimCognitoRefreshSignIn {
-    private readonly tokenIssuer;
+    private readonly refreshedTokens;
     private readonly clock;
-    private readonly result;
     constructor(properties: SimCognitoRefreshSignInProperties);
     /**
      * Refresh a session, or refuse the token it was asked for with.

package/dist/service/cognito/command/auth/sim-cognito-refresh-sign-in.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-refresh-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-refresh-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAGpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAI/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,iCAAiC;IACzC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,YAAY,UAAU,EAAE,iCAAiC,EAGxD;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,8BAA8B,CAAC,CAoCzC;CACF"}
+{"version":3,"file":"sim-cognito-refresh-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-refresh-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAIpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,iCAAiC;IACzC,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAuBD;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,iCAAiC,EAGxD;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,8BAA8B,CAAC,CA8BzC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-refresh-sign-in.js

@@ -1,8 +1,22 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
 import { requireSimCognitoSecretHash } from "../../user-pool/auth/sim-cognito-secret-hash.js";
-import { requireSimCognitoEnabled } from "../../user-pool/auth/sim-cognito-sign-in.js";
-import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
-import { requireSimCognitoUsername } from "../../user-pool/user/sim-cognito-username.js";
-import { SimCognitoAuthenticationResult } from "./sim-cognito-authentication-result.js";
+/**
+ * Refuse a refresh through an app client that rotates its refresh tokens.
+ *
+ * Rotation and `REFRESH_TOKEN_AUTH` do not go together on real Cognito, which
+ * is why `aws-cdk-lib` drops `ALLOW_REFRESH_TOKEN_AUTH` from a client the
+ * moment it is given a rotation grace period. A client that kept the flow
+ * anyway is told where the operation went rather than handed tokens the real
+ * pool would not have handed it.
+ */
+function requireSimCognitoNoRotation(client) {
+    if (!client.refreshTokenRotation.enabled) {
+        return;
+    }
+    throw new SimCognitoInvalidParameterException(`REFRESH_TOKEN_AUTH is not available on the client ${client.id}: it ` +
+        `rotates its refresh tokens, so renew the session with ` +
+        `GetTokensFromRefreshToken instead`);
+}
 /**
  * Trading a refresh token for a new access and id token.
  *
@@ -10,17 +24,12 @@ import { SimCognitoAuthenticationResult } from "./sim-cognito-authentication-res
  * it is, which is why one presented to another app client is refused. Nothing
  * new comes back with the tokens, because real Cognito issues no new refresh
  * token here, so a client keeps the one it has until that expires.
- *
- * The pool's `PreTokenGeneration` trigger runs for the reissued tokens, as it
- * does on real Cognito, so a claim it changed since the sign-in is on the token
- * a refresh answers with rather than being stale for the life of the session.
  */
 export class SimCognitoRefreshSignIn {
-    tokenIssuer;
+    refreshedTokens;
     clock;
-    result = new SimCognitoAuthenticationResult();
     constructor(properties) {
-        this.tokenIssuer = properties.tokenIssuer;
+        this.refreshedTokens = properties.refreshedTokens;
         this.clock = properties.clock;
     }
     /**
@@ -28,6 +37,7 @@ export class SimCognitoRefreshSignIn {
      */
     async handle(request) {
         const { pool, client, parameters } = request;
+        requireSimCognitoNoRotation(client);
         const refreshToken = pool.auth.requireRefreshToken({
             value: parameters.require("REFRESH_TOKEN"),
             clientId: client.id,
@@ -36,19 +46,16 @@ export class SimCognitoRefreshSignIn {
         // The hash covers the username, and the request carries none, so the one
         // the token was issued to is what it has to have been computed with.
         requireSimCognitoSecretHash(refreshToken.username, client, parameters.find("SECRET_HASH"));
-        const user = pool.requireUser(requireSimCognitoUsername(refreshToken.username));
-        requireSimCognitoEnabled(user);
         // A refresh runs through `InitiateAuth`, whose `ClientMetadata` real
         // Cognito does not pass to the token trigger, so none travels with these
         // tokens.
         return {
             $metadata: {},
-            AuthenticationResult: this.result.of(await this.tokenIssuer.reissue({
+            AuthenticationResult: await this.refreshedTokens.issue({
                 pool,
                 client,
-                user,
-                occasion: SimCognitoTriggerOccasion.refreshTokenGeneration,
-            })),
+                refreshToken,
+            }),
         };
     }
 }

package/dist/service/cognito/command/auth/sim-cognito-refresh-sign-in.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-refresh-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-refresh-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAEvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AASxF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,uBAAuB;IACjB,WAAW,CAAwB;IACnC,KAAK,CAAW;IAChB,MAAM,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAE/D,YAAY,UAA6C;QACvD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAA8B;QAE9B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;YACjD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC;YAC1C,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,yEAAyE;QACzE,qEAAqE;QACrE,2BAA2B,CACzB,YAAY,CAAC,QAAQ,EACrB,MAAM,EACN,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAC/B,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAC3B,yBAAyB,CAAC,YAAY,CAAC,QAAQ,CAAC,CACjD,CAAC;QAEF,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAE/B,qEAAqE;QACrE,yEAAyE;QACzE,UAAU;QACV,OAAO;YACL,SAAS,EAAE,EAAE;YACb,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAClC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;gBAC7B,IAAI;gBACJ,MAAM;gBACN,IAAI;gBACJ,QAAQ,EAAE,yBAAyB,CAAC,sBAAsB;aAC3D,CAAC,CACH;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-refresh-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-refresh-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAW9F;;;;;;;;GAQG;AACH,SAAS,2BAA2B,CAAC,MAAgC;IACnE,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC;QACzC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,mCAAmC,CAC3C,qDAAqD,MAAM,CAAC,EAAE,OAAO;QACnE,wDAAwD;QACxD,mCAAmC,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IACjB,eAAe,CAA4B;IAC3C,KAAK,CAAW;IAEjC,YAAY,UAA6C;QACvD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAA8B;QAE9B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAE7C,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAEpC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;YACjD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC;YAC1C,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,yEAAyE;QACzE,qEAAqE;QACrE,2BAA2B,CACzB,YAAY,CAAC,QAAQ,EACrB,MAAM,EACN,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAC/B,CAAC;QAEF,qEAAqE;QACrE,yEAAyE;QACzE,UAAU;QACV,OAAO;YACL,SAAS,EAAE,EAAE;YACb,oBAAoB,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;gBACrD,IAAI;gBACJ,MAAM;gBACN,YAAY;aACb,CAAC;SACH,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-refreshed-tokens.d.ts

@@ -0,0 +1,56 @@
+import type { SimCognitoIssuedToken } from "../../user-pool/auth/sim-cognito-issued-token.js";
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
+import type { SimCognitoAuthenticationResultType } from "./auth.command.js";
+interface SimCognitoRefreshedTokensProperties {
+    readonly tokenIssuer: SimCognitoTokenIssuer;
+}
+/**
+ * What a refresh has to name for tokens to come back: the pool, the app client
+ * it goes through, and the refresh token the pool has already accepted.
+ */
+interface SimCognitoRefreshedTokensRequest {
+    readonly pool: SimCognitoUserPool;
+    readonly client: SimCognitoUserPoolClient;
+    readonly refreshToken: SimCognitoIssuedToken;
+    /**
+     * The `ClientMetadata` the request carried, which reaches the pool's token
+     * trigger. A `REFRESH_TOKEN_AUTH` refresh passes none, as real Cognito
+     * passes none from `InitiateAuth`.
+     */
+    readonly clientMetadata?: Readonly<Record<string, string>> | undefined;
+}
+/**
+ * The tokens a refresh answers with, whichever operation asked for them.
+ *
+ * `REFRESH_TOKEN_AUTH` and `GetTokensFromRefreshToken` prove the caller
+ * differently and reach the pool differently, and once the refresh token is
+ * accepted they answer the same way, so what they share is here.
+ *
+ * Which app client the refresh went through decides whether a new refresh
+ * token comes back. A rotating client hands one out and spends the token that
+ * bought it, and a client with rotation off answers with the access and id
+ * token alone, leaving the caller the token it already has.
+ *
+ * The pool's `PreTokenGeneration` trigger runs for the reissued tokens either
+ * way, as it does on real Cognito, so a claim it changed since the sign-in is
+ * on the token a refresh answers with rather than being stale for the life of
+ * the session.
+ */
+export declare class SimCognitoRefreshedTokens {
+    private readonly tokenIssuer;
+    private readonly result;
+    constructor(properties: SimCognitoRefreshedTokensProperties);
+    /**
+     * Reissue a session's tokens, rotating its refresh token where the app
+     * client rotates.
+     *
+     * The refresh token names no user: the pool that issued it is what knows
+     * whose it is, which is why the user is looked up from the token rather than
+     * from the request.
+     */
+    issue(request: SimCognitoRefreshedTokensRequest): Promise<SimCognitoAuthenticationResultType>;
+}
+export {};
+//# sourceMappingURL=sim-cognito-refreshed-tokens.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-refreshed-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-refreshed-tokens.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-refreshed-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAE9F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAI/F,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,mBAAmB,CAAC;AAE5E,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED;;;GAGG;AACH,UAAU,gCAAgC;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;IAE7C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,YAAY,UAAU,EAAE,mCAAmC,EAE1D;IAED;;;;;;;OAOG;IACG,KAAK,CACT,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,kCAAkC,CAAC,CAkB7C;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-refreshed-tokens.js

@@ -0,0 +1,50 @@
+import { requireSimCognitoEnabled } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
+import { requireSimCognitoUsername } from "../../user-pool/user/sim-cognito-username.js";
+import { SimCognitoAuthenticationResult } from "./sim-cognito-authentication-result.js";
+/**
+ * The tokens a refresh answers with, whichever operation asked for them.
+ *
+ * `REFRESH_TOKEN_AUTH` and `GetTokensFromRefreshToken` prove the caller
+ * differently and reach the pool differently, and once the refresh token is
+ * accepted they answer the same way, so what they share is here.
+ *
+ * Which app client the refresh went through decides whether a new refresh
+ * token comes back. A rotating client hands one out and spends the token that
+ * bought it, and a client with rotation off answers with the access and id
+ * token alone, leaving the caller the token it already has.
+ *
+ * The pool's `PreTokenGeneration` trigger runs for the reissued tokens either
+ * way, as it does on real Cognito, so a claim it changed since the sign-in is
+ * on the token a refresh answers with rather than being stale for the life of
+ * the session.
+ */
+export class SimCognitoRefreshedTokens {
+    tokenIssuer;
+    result = new SimCognitoAuthenticationResult();
+    constructor(properties) {
+        this.tokenIssuer = properties.tokenIssuer;
+    }
+    /**
+     * Reissue a session's tokens, rotating its refresh token where the app
+     * client rotates.
+     *
+     * The refresh token names no user: the pool that issued it is what knows
+     * whose it is, which is why the user is looked up from the token rather than
+     * from the request.
+     */
+    async issue(request) {
+        const { pool, client, refreshToken, clientMetadata } = request;
+        const user = pool.requireUser(requireSimCognitoUsername(refreshToken.username));
+        requireSimCognitoEnabled(user);
+        return this.result.of(await this.tokenIssuer.refresh({
+            pool,
+            client,
+            user,
+            clientMetadata,
+            spent: refreshToken,
+            occasion: SimCognitoTriggerOccasion.refreshTokenGeneration,
+        }));
+    }
+}
+//# sourceMappingURL=sim-cognito-refreshed-tokens.js.map

package/dist/service/cognito/command/auth/sim-cognito-refreshed-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-refreshed-tokens.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-refreshed-tokens.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAIvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAwBxF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,yBAAyB;IACnB,WAAW,CAAwB;IACnC,MAAM,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAE/D,YAAY,UAA+C;QACzD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CACT,OAAyC;QAEzC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAC3B,yBAAyB,CAAC,YAAY,CAAC,QAAQ,CAAC,CACjD,CAAC;QAEF,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAE/B,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,CACnB,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAC7B,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;YACd,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,yBAAyB,CAAC,sBAAsB;SAC3D,CAAC,CACH,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-unsimulated-auth-options.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gCAAgC,EAChC,0CAA0C,EAC1C,2BAA2B,EAC3B,qCAAqC,EACtC,MAAM,mBAAmB,CAAC;AAU3B;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAE9B;IACF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAE5B;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkD;IAC7E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAEvB;IAEF,OAAO,CAAC,MAAM,CAAC,YAAY;IAW3B;;OAEG;IACH,qBAAqB,CAAC,KAAK,EAAE,gCAAgC,GAAG,IAAI,CAYnE;IAED;;;OAGG;IACH,qBAAqB,CACnB,KAAK,EAAE,0CAA0C,GAChD,IAAI,CAON;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,GAAG,IAAI,CAYzD;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,qCAAqC,GAAG,IAAI,CAOnE;CACF"}
+{"version":3,"file":"sim-cognito-unsimulated-auth-options.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gCAAgC,EAChC,0CAA0C,EAC1C,2BAA2B,EAC3B,qCAAqC,EACtC,MAAM,mBAAmB,CAAC;AAU3B;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAE9B;IACF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAE5B;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkD;IAC7E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAEvB;IAEF,OAAO,CAAC,MAAM,CAAC,YAAY;IAW3B;;OAEG;IACH,qBAAqB,CAAC,KAAK,EAAE,gCAAgC,GAAG,IAAI,CAcnE;IAED;;;OAGG;IACH,qBAAqB,CACnB,KAAK,EAAE,0CAA0C,GAChD,IAAI,CAON;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,GAAG,IAAI,CAezD;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,qCAAqC,GAAG,IAAI,CAOnE;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.js

@@ -29,7 +29,9 @@ export class SimCognitoUnsimulatedAuthOptions {
     refuseInAdminInitiate(input) {
         SimCognitoUnsimulatedAuthOptions.refuseShared(this.adminInitiation, input);
         this.adminInitiation.refuse("ContextData", input.ContextData, "threat protection, which reads the caller's device and address");
-        this.adminInitiation.refuse("Session", input.Session, "continuing a USER_AUTH flow that offered a choice of factors");
+        this.adminInitiation.refuse("Session", input.Session, "carrying a sign-in already part way through into a fresh " +
+            "AdminInitiateAuth, where a challenge this simulation issued is " +
+            "answered through AdminRespondToAuthChallenge");
     }
     /**
      * Refuse an `AdminRespondToAuthChallenge` request this simulation cannot
@@ -45,7 +47,10 @@ export class SimCognitoUnsimulatedAuthOptions {
     refuseInInitiate(input) {
         SimCognitoUnsimulatedAuthOptions.refuseShared(this.initiation, input);
         this.initiation.refuse("UserContextData", input.UserContextData, "threat protection, which reads the caller's device and address");
-        this.initiation.refuse("Session", input.Session, "signing in directly from ConfirmSignUp");
+        this.initiation.refuse("Session", input.Session, "signing in directly from ConfirmSignUp, and carrying a sign-in " +
+            "already part way through into a fresh InitiateAuth, where a " +
+            "challenge this simulation issued is answered through " +
+            "RespondToAuthChallenge");
     }
     /**
      * Refuse a `RespondToAuthChallenge` request this simulation cannot honour.

package/dist/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-unsimulated-auth-options.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAgBjF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,gCAAgC;IAC1B,eAAe,GAAG,IAAI,0BAA0B,CAC/D,mBAAmB,CACpB,CAAC;IACe,aAAa,GAAG,IAAI,0BAA0B,CAC7D,6BAA6B,CAC9B,CAAC;IACe,UAAU,GAAG,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAC5D,QAAQ,GAAG,IAAI,0BAA0B,CACxD,wBAAwB,CACzB,CAAC;IAEM,MAAM,CAAC,YAAY,CACzB,WAAuC,EACvC,KAAqC;QAErC,WAAW,CAAC,MAAM,CAChB,mBAAmB,EACnB,KAAK,CAAC,iBAAiB,EACvB,oBAAoB,CACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,KAAuC;QAC3D,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,CAAC,MAAM,CACzB,aAAa,EACb,KAAK,CAAC,WAAW,EACjB,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,MAAM,CACzB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,qBAAqB,CACnB,KAAiD;QAEjD,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,aAAa,CAAC,MAAM,CACvB,aAAa,EACb,KAAK,CAAC,WAAW,EACjB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAkC;QACjD,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,MAAM,CACpB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,CACpB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,wCAAwC,CACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAA4C;QAC3D,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAClB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,gEAAgE,CACjE,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-unsimulated-auth-options.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAgBjF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,gCAAgC;IAC1B,eAAe,GAAG,IAAI,0BAA0B,CAC/D,mBAAmB,CACpB,CAAC;IACe,aAAa,GAAG,IAAI,0BAA0B,CAC7D,6BAA6B,CAC9B,CAAC;IACe,UAAU,GAAG,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAC5D,QAAQ,GAAG,IAAI,0BAA0B,CACxD,wBAAwB,CACzB,CAAC;IAEM,MAAM,CAAC,YAAY,CACzB,WAAuC,EACvC,KAAqC;QAErC,WAAW,CAAC,MAAM,CAChB,mBAAmB,EACnB,KAAK,CAAC,iBAAiB,EACvB,oBAAoB,CACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,KAAuC;QAC3D,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,CAAC,MAAM,CACzB,aAAa,EACb,KAAK,CAAC,WAAW,EACjB,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,MAAM,CACzB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,2DAA2D;YACzD,iEAAiE;YACjE,8CAA8C,CACjD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,qBAAqB,CACnB,KAAiD;QAEjD,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,aAAa,CAAC,MAAM,CACvB,aAAa,EACb,KAAK,CAAC,WAAW,EACjB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAkC;QACjD,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,MAAM,CACpB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,CACpB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,iEAAiE;YAC/D,8DAA8D;YAC9D,uDAAuD;YACvD,wBAAwB,CAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAA4C;QAC3D,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAClB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,gEAAgE,CACjE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-user-auth-sign-in.d.ts

@@ -0,0 +1,44 @@
+import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
+import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
+import type { SimCognitoFirstFactorChallenge } from "./sim-cognito-first-factor-challenge.js";
+import type { SimCognitoPasswordSignIn, SimCognitoAuthRequest } from "./sim-cognito-password-sign-in.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+interface SimCognitoUserAuthSignInProperties {
+    readonly authResolver: SimCognitoAuthResolver;
+    readonly challenge: SimCognitoFirstFactorChallenge;
+    readonly passwordSignIn: SimCognitoPasswordSignIn;
+    readonly triggers: SimCognitoUserPoolTriggers;
+}
+/**
+ * Choice-based sign-in, which is the `USER_AUTH` flow.
+ *
+ * The user says who it is and the pool answers with the factors it could sign
+ * in with, drawn from the pool's `AllowedFirstAuthFactors` and narrowed to the
+ * ones this user has. A request naming a `PREFERRED_CHALLENGE` is answered
+ * with that factor's challenge instead, and one carrying a `PASSWORD` outright
+ * is signed in there and then, which is what real Cognito does with all three.
+ * The pool's policy is what settles all three: a pool that allows no password
+ * first refuses one however the request sent it.
+ *
+ * This is the flow a passkey is presented through. It is also another way in
+ * for a password, and `USER_PASSWORD_AUTH` goes on being the direct one.
+ */
+export declare class SimCognitoUserAuthSignIn {
+    private readonly authResolver;
+    private readonly challenge;
+    private readonly passwordSignIn;
+    private readonly triggers;
+    constructor(properties: SimCognitoUserAuthSignInProperties);
+    /**
+     * Offer this user its factors, ask for the one it preferred, or sign it in
+     * with the password it already sent.
+     *
+     * `PreAuthentication` runs once the user is known, as it does for a password
+     * sign-in. A request carrying a password reaches it through the password
+     * sign-in body, which runs the trigger itself, so this one runs the trigger
+     * only where it is answering with a challenge.
+     */
+    handle(request: SimCognitoAuthRequest): Promise<SimCognitoAuthenticationOutput>;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-auth-sign-in.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-user-auth-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-auth-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-user-auth-sign-in.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAC9F,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,UAAU,EAAE,kCAAkC,EAKzD;IAED;;;;;;;;OAQG;IACG,MAAM,CACV,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,8BAA8B,CAAC,CA8BzC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-user-auth-sign-in.js

@@ -0,0 +1,62 @@
+import { requireSimCognitoReadyToSignIn, requireSimCognitoSignInUser, } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { requireSimCognitoAllowedPassword } from "./sim-cognito-available-challenges.js";
+/**
+ * Choice-based sign-in, which is the `USER_AUTH` flow.
+ *
+ * The user says who it is and the pool answers with the factors it could sign
+ * in with, drawn from the pool's `AllowedFirstAuthFactors` and narrowed to the
+ * ones this user has. A request naming a `PREFERRED_CHALLENGE` is answered
+ * with that factor's challenge instead, and one carrying a `PASSWORD` outright
+ * is signed in there and then, which is what real Cognito does with all three.
+ * The pool's policy is what settles all three: a pool that allows no password
+ * first refuses one however the request sent it.
+ *
+ * This is the flow a passkey is presented through. It is also another way in
+ * for a password, and `USER_PASSWORD_AUTH` goes on being the direct one.
+ */
+export class SimCognitoUserAuthSignIn {
+    authResolver;
+    challenge;
+    passwordSignIn;
+    triggers;
+    constructor(properties) {
+        this.authResolver = properties.authResolver;
+        this.challenge = properties.challenge;
+        this.passwordSignIn = properties.passwordSignIn;
+        this.triggers = properties.triggers;
+    }
+    /**
+     * Offer this user its factors, ask for the one it preferred, or sign it in
+     * with the password it already sent.
+     *
+     * `PreAuthentication` runs once the user is known, as it does for a password
+     * sign-in. A request carrying a password reaches it through the password
+     * sign-in body, which runs the trigger itself, so this one runs the trigger
+     * only where it is answering with a challenge.
+     */
+    async handle(request) {
+        const { pool, client, parameters, clientMetadata } = request;
+        if (parameters.find("PASSWORD") !== undefined) {
+            // A password sent outright skips the choice, so the pool's policy is
+            // read here rather than out of the factors the choice would have
+            // offered.
+            requireSimCognitoAllowedPassword(pool);
+            return await this.passwordSignIn.handle(request);
+        }
+        const username = this.authResolver.username(client, parameters);
+        const user = requireSimCognitoSignInUser(pool, client, username);
+        await this.triggers.preAuthentication({
+            pool,
+            client,
+            user,
+            clientMetadata,
+        });
+        requireSimCognitoReadyToSignIn(user);
+        const preferred = parameters.find("PREFERRED_CHALLENGE");
+        const offer = { pool, client, user };
+        return preferred === undefined
+            ? this.challenge.offer(offer)
+            : this.challenge.issue(offer, preferred, "PREFERRED_CHALLENGE");
+    }
+}
+//# sourceMappingURL=sim-cognito-user-auth-sign-in.js.map

package/dist/service/cognito/command/auth/sim-cognito-user-auth-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-auth-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-user-auth-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAgBzF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,wBAAwB;IAClB,YAAY,CAAyB;IACrC,SAAS,CAAiC;IAC1C,cAAc,CAA2B;IACzC,QAAQ,CAA6B;IAEtD,YAAY,UAA8C;QACxD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,OAA8B;QAE9B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAE7D,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YAC9C,qEAAqE;YACrE,iEAAiE;YACjE,WAAW;YACX,gCAAgC,CAAC,IAAI,CAAC,CAAC;YAEvC,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACpC,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;QAEH,8BAA8B,CAAC,IAAI,CAAC,CAAC;QAErC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAErC,OAAO,SAAS,KAAK,SAAS;YAC5B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YAC7B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-web-authn-response.d.ts

@@ -0,0 +1,30 @@
+import type { SimCognitoAuthSession } from "../../user-pool/auth/sim-cognito-auth-session.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoFirstFactorResponseRequest } from "./sim-cognito-first-factor-response.js";
+import type { SimCognitoSignInCompletion } from "./sim-cognito-sign-in-completion.js";
+import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
+interface SimCognitoWebAuthnResponseProperties {
+    readonly completion: SimCognitoSignInCompletion;
+}
+/**
+ * Answering a `WEB_AUTHN` challenge with a passkey.
+ *
+ * The credential travels as the JSON a browser serializes a
+ * `PublicKeyCredential` to, and it is read against the options the challenge
+ * issued. The signature is what settles it, checked against the public key the
+ * registration stored.
+ *
+ * A passkey finishes the sign-in on its own. Real Cognito counts one as having
+ * met the pool's MFA requirement, so a user that has registered a second
+ * factor is not challenged for it here, where a password sign-in would be.
+ */
+export declare class SimCognitoWebAuthnResponse {
+    private readonly completion;
+    constructor(properties: SimCognitoWebAuthnResponseProperties);
+    /**
+     * Present the passkey, and sign the user in.
+     */
+    complete(request: SimCognitoFirstFactorResponseRequest, session: SimCognitoAuthSession, user: SimCognitoUser): Promise<SimCognitoAuthenticationOutput>;
+}
+export {};
+//# sourceMappingURL=sim-cognito-web-authn-response.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-web-authn-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-web-authn-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAE9F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,wCAAwC,CAAC;AACnG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;CACjD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IAExD,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;OAEG;IACG,QAAQ,CACZ,OAAO,EAAE,oCAAoC,EAC7C,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,8BAA8B,CAAC,CAiBzC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-web-authn-response.js

@@ -0,0 +1,36 @@
+import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
+import { requireSimCognitoWebAuthnAssertion } from "../../user-pool/user/web-authn/sim-cognito-web-authn-assertion.js";
+/**
+ * Answering a `WEB_AUTHN` challenge with a passkey.
+ *
+ * The credential travels as the JSON a browser serializes a
+ * `PublicKeyCredential` to, and it is read against the options the challenge
+ * issued. The signature is what settles it, checked against the public key the
+ * registration stored.
+ *
+ * A passkey finishes the sign-in on its own. Real Cognito counts one as having
+ * met the pool's MFA requirement, so a user that has registered a second
+ * factor is not challenged for it here, where a password sign-in would be.
+ */
+export class SimCognitoWebAuthnResponse {
+    completion;
+    constructor(properties) {
+        this.completion = properties.completion;
+    }
+    /**
+     * Present the passkey, and sign the user in.
+     */
+    async complete(request, session, user) {
+        requireSimCognitoWebAuthnAssertion(user.webAuthn.credentials, request.parameters.requireDocument("CREDENTIAL"), session.requireWebAuthnOptions());
+        request.pool.auth.removeSession(session);
+        return await this.completion.complete({
+            pool: request.pool,
+            client: request.client,
+            user,
+            occasion: SimCognitoTriggerOccasion.tokenGeneration,
+            tokenClientMetadata: request.clientMetadata,
+            clientMetadata: request.clientMetadata,
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-web-authn-response.js.map

package/dist/service/cognito/command/auth/sim-cognito-web-authn-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-response.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-web-authn-response.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AAEpG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mEAAmE,CAAC;AASvH;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,0BAA0B;IACpB,UAAU,CAA6B;IAExD,YAAY,UAAgD;QAC1D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CACZ,OAA6C,EAC7C,OAA8B,EAC9B,IAAoB;QAEpB,kCAAkC,CAChC,IAAI,CAAC,QAAQ,CAAC,WAAW,EACzB,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,YAAY,CAAC,EAChD,OAAO,CAAC,sBAAsB,EAAE,CACjC,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEzC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI;YACJ,QAAQ,EAAE,yBAAyB,CAAC,eAAe;YACnD,mBAAmB,EAAE,OAAO,CAAC,cAAc;YAC3C,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/command/client/sim-cognito-unsimulated-client-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-unsimulated-client-options.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-unsimulated-client-options.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+BAA+B,CAAC;AAE3F;;;;;;GAMG;AACH,qBAAa,0CAA0C;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,YAAY,SAAS,EAAE,MAAM,EAE5B;IAED;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,qCAAqC,GAAG,IAAI,CA0C3D;CACF"}
+{"version":3,"file":"sim-cognito-unsimulated-client-options.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-unsimulated-client-options.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+BAA+B,CAAC;AAE3F;;;;;;GAMG;AACH,qBAAa,0CAA0C;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,YAAY,SAAS,EAAE,MAAM,EAE5B;IAED;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,qCAAqC,GAAG,IAAI,CAgC3D;CACF"}