@kensio/yulin 1.18.1 → 1.19.0

package/dist/service/cognito/command/client/sim-cognito-unsimulated-client-options.js

@@ -18,9 +18,7 @@ export class SimCognitoUnsimulatedUserPoolClientOptions {
         this.unsimulated.refuseUnless("EnableTokenRevocation", input.EnableTokenRevocation, true, "token revocation");
         this.unsimulated.refuse("ClientSecret", input.ClientSecret, "a secret of your own instead of a generated one");
         this.unsimulated.refuse("AnalyticsConfiguration", input.AnalyticsConfiguration, "Amazon Pinpoint analytics");
-        this.unsimulated.refuse("AuthSessionValidity", input.AuthSessionValidity, "the authentication session lifetime");
         this.unsimulated.refuse("EnablePropagateAdditionalUserContextData", input.EnablePropagateAdditionalUserContextData, "threat protection context data");
-        this.unsimulated.refuse("RefreshTokenRotation", input.RefreshTokenRotation, "refresh token rotation");
         this.unsimulated.refuse("ReadAttributes", input.ReadAttributes, "per-client attribute permissions");
         this.unsimulated.refuse("WriteAttributes", input.WriteAttributes, "per-client attribute permissions");
     }

package/dist/service/cognito/command/client/sim-cognito-unsimulated-client-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-unsimulated-client-options.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-unsimulated-client-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAGjF;;;;;;GAMG;AACH,MAAM,OAAO,0CAA0C;IACpC,WAAW,CAA6B;IAEzD,YAAY,SAAiB;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAA4C;QACnD,IAAI,CAAC,WAAW,CAAC,YAAY,CAC3B,uBAAuB,EACvB,KAAK,CAAC,qBAAqB,EAC3B,IAAI,EACJ,kBAAkB,CACnB,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,cAAc,EACd,KAAK,CAAC,YAAY,EAClB,iDAAiD,CAClD,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,wBAAwB,EACxB,KAAK,CAAC,sBAAsB,EAC5B,2BAA2B,CAC5B,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,qBAAqB,EACrB,KAAK,CAAC,mBAAmB,EACzB,qCAAqC,CACtC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,0CAA0C,EAC1C,KAAK,CAAC,wCAAwC,EAC9C,gCAAgC,CACjC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,sBAAsB,EACtB,KAAK,CAAC,oBAAoB,EAC1B,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,gBAAgB,EAChB,KAAK,CAAC,cAAc,EACpB,kCAAkC,CACnC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,kCAAkC,CACnC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-unsimulated-client-options.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-unsimulated-client-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAGjF;;;;;;GAMG;AACH,MAAM,OAAO,0CAA0C;IACpC,WAAW,CAA6B;IAEzD,YAAY,SAAiB;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAA4C;QACnD,IAAI,CAAC,WAAW,CAAC,YAAY,CAC3B,uBAAuB,EACvB,KAAK,CAAC,qBAAqB,EAC3B,IAAI,EACJ,kBAAkB,CACnB,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,cAAc,EACd,KAAK,CAAC,YAAY,EAClB,iDAAiD,CAClD,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,wBAAwB,EACxB,KAAK,CAAC,sBAAsB,EAC5B,2BAA2B,CAC5B,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,0CAA0C,EAC1C,KAAK,CAAC,wCAAwC,EAC9C,gCAAgC,CACjC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,gBAAgB,EAChB,KAAK,CAAC,cAAc,EACpB,kCAAkC,CACnC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,kCAAkC,CACnC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/client/sim-cognito-user-pool-client-view.d.ts

@@ -17,9 +17,10 @@ export declare class SimCognitoUserPoolClientView {
      * set none of is left out rather than reported empty.
      *
      * `AccessTokenValidity` and `IdTokenValidity` appear only when the request
-     * set them, which is what real Cognito does. `RefreshTokenValidity` always
-     * appears, defaulted to thirty days, and so does
-     * `PreventUserExistenceErrors`, defaulted to `LEGACY`.
+     * set them, which is what real Cognito does, and so does
+     * `RefreshTokenRotation`. `RefreshTokenValidity` always appears, defaulted
+     * to thirty days, and so does `PreventUserExistenceErrors`, defaulted to
+     * `LEGACY`.
      */
     describe(client: SimCognitoUserPoolClient): SimCognitoUserPoolClientType;
     /**

package/dist/service/cognito/command/client/sim-cognito-user-pool-client-view.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client-view.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-user-pool-client-view.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC/F,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAElF;;GAEG;AACH,qBAAa,4BAA4B;IACvC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,MAAM,EAAE,wBAAwB,GAAG,4BAA4B,CAkBvE;IAED;;;OAGG;IACH,SAAS,CACP,MAAM,EAAE,wBAAwB,GAC/B,mCAAmC,CAMrC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-client-view.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-user-pool-client-view.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC/F,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAElF;;GAEG;AACH,qBAAa,4BAA4B;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,MAAM,EAAE,wBAAwB,GAAG,4BAA4B,CAoBvE;IAED;;;OAGG;IACH,SAAS,CACP,MAAM,EAAE,wBAAwB,GAC/B,mCAAmC,CAMrC;CACF"}

package/dist/service/cognito/command/client/sim-cognito-user-pool-client-view.js

@@ -14,9 +14,10 @@ export class SimCognitoUserPoolClientView {
      * set none of is left out rather than reported empty.
      *
      * `AccessTokenValidity` and `IdTokenValidity` appear only when the request
-     * set them, which is what real Cognito does. `RefreshTokenValidity` always
-     * appears, defaulted to thirty days, and so does
-     * `PreventUserExistenceErrors`, defaulted to `LEGACY`.
+     * set them, which is what real Cognito does, and so does
+     * `RefreshTokenRotation`. `RefreshTokenValidity` always appears, defaulted
+     * to thirty days, and so does `PreventUserExistenceErrors`, defaulted to
+     * `LEGACY`.
      */
     describe(client) {
         const { tokenValidity } = client;
@@ -30,6 +31,8 @@ export class SimCognitoUserPoolClientView {
             AccessTokenValidity: tokenValidity.accessToken.validity,
             IdTokenValidity: tokenValidity.idToken.validity,
             RefreshTokenValidity: tokenValidity.refreshToken.validity,
+            AuthSessionValidity: client.authSessionValidity.minutes,
+            RefreshTokenRotation: client.refreshTokenRotation.toOutput(),
             TokenValidityUnits: tokenValidity.unitsOutput(),
             CreationDate: client.creationDate,
             LastModifiedDate: client.lastModifiedDate,

package/dist/service/cognito/command/client/sim-cognito-user-pool-client-view.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client-view.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-user-pool-client-view.ts"],"names":[],"mappings":"AAIA;;GAEG;AACH,MAAM,OAAO,4BAA4B;IACvC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,MAAgC;QACvC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;QAEjC,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;YAClD,0BAA0B,EAAE,MAAM,CAAC,0BAA0B,CAAC,KAAK;YACnE,mBAAmB,EAAE,aAAa,CAAC,WAAW,CAAC,QAAQ;YACvD,eAAe,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ;YAC/C,oBAAoB,EAAE,aAAa,CAAC,YAAY,CAAC,QAAQ;YACzD,kBAAkB,EAAE,aAAa,CAAC,WAAW,EAAE;YAC/C,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;SAC3B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,SAAS,CACP,MAAgC;QAEhC,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-client-view.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-user-pool-client-view.ts"],"names":[],"mappings":"AAIA;;GAEG;AACH,MAAM,OAAO,4BAA4B;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,MAAgC;QACvC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;QAEjC,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC,MAAM;YAClD,0BAA0B,EAAE,MAAM,CAAC,0BAA0B,CAAC,KAAK;YACnE,mBAAmB,EAAE,aAAa,CAAC,WAAW,CAAC,QAAQ;YACvD,eAAe,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ;YAC/C,oBAAoB,EAAE,aAAa,CAAC,YAAY,CAAC,QAAQ;YACzD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO;YACvD,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,CAAC,QAAQ,EAAE;YAC5D,kBAAkB,EAAE,aAAa,CAAC,WAAW,EAAE;YAC/C,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;SAC3B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,SAAS,CACP,MAAgC;QAEhC,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/client/user-pool-client.command.d.ts

@@ -1,6 +1,7 @@
 import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
 import type { SimCognitoTokenValidityUnitsType } from "../../user-pool/client/sim-cognito-token-validity.js";
 import type { SimCognitoOAuthSettingsType } from "../../user-pool/client/sim-cognito-oauth-settings.js";
+import type { SimCognitoRefreshTokenRotationType } from "../../user-pool/client/sim-cognito-refresh-token-rotation.js";
 /**
  * An app client as sim Cognito reports it.
  *
@@ -20,6 +21,8 @@ export interface SimCognitoUserPoolClientType extends SimCognitoOAuthSettingsTyp
     readonly AccessTokenValidity?: number | undefined;
     readonly IdTokenValidity?: number | undefined;
     readonly RefreshTokenValidity?: number | undefined;
+    readonly AuthSessionValidity?: number | undefined;
+    readonly RefreshTokenRotation?: SimCognitoRefreshTokenRotationType | undefined;
     readonly TokenValidityUnits?: SimCognitoTokenValidityUnitsType | undefined;
     readonly CreationDate?: Date | undefined;
     readonly LastModifiedDate?: Date | undefined;
@@ -57,7 +60,7 @@ export interface SimCognitoUserPoolClientSettingsInput {
     readonly LogoutURLs?: readonly string[] | undefined;
     readonly PreventUserExistenceErrors?: string | undefined;
     readonly ReadAttributes?: readonly string[] | undefined;
-    readonly RefreshTokenRotation?: object | undefined;
+    readonly RefreshTokenRotation?: SimCognitoRefreshTokenRotationType | undefined;
     readonly SupportedIdentityProviders?: readonly string[] | undefined;
     readonly WriteAttributes?: readonly string[] | undefined;
 }

package/dist/service/cognito/command/client/user-pool-client.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-pool-client.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/user-pool-client.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AAC7G,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AAExG;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA6B,SAAQ,2BAA2B;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gCAAgC,GAAG,SAAS,CAAC;IAC3E,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gCAAgC,GAAG,SAAS,CAAC;IAC3E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,+BAA+B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,wCAAwC,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;GAKG;AACH,MAAM,WAAW,mCAAoC,SAAQ,qCAAqC;IAChG,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,mCAAmC,CAAC;CACrD;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,cAAc,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACnE,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mCAAoC,SAAQ,qCAAqC;IAChG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,mCAAmC,CAAC;CACrD;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,cAAc,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACnE,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,qCAAqC,CAAC;CACvD;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,cAAc,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACnE,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,mCAAmC,CAAC;CACrD;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}
+{"version":3,"file":"user-pool-client.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/user-pool-client.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AAC7G,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AACxG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,8DAA8D,CAAC;AAEvH;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA6B,SAAQ,2BAA2B;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,oBAAoB,CAAC,EAC1B,kCAAkC,GAClC,SAAS,CAAC;IACd,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gCAAgC,GAAG,SAAS,CAAC;IAC3E,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gCAAgC,GAAG,SAAS,CAAC;IAC3E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,+BAA+B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,wCAAwC,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,oBAAoB,CAAC,EAC1B,kCAAkC,GAClC,SAAS,CAAC;IACd,QAAQ,CAAC,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC1D;AAED;;;;;GAKG;AACH,MAAM,WAAW,mCAAoC,SAAQ,qCAAqC;IAChG,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,mCAAmC,CAAC;CACrD;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,cAAc,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACnE,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mCAAoC,SAAQ,qCAAqC;IAChG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,mCAAmC,CAAC;CACrD;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,cAAc,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACnE,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,qCAAqC,CAAC;CACvD;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,cAAc,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACnE,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,mCAAmC,CAAC;CACrD;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC"}

package/dist/service/cognito/command/hosted/hosted-auth.command.d.ts

@@ -28,6 +28,28 @@ export interface SimCognitoAuthorizeInput {
      */
     readonly username?: string | undefined;
     readonly password?: string | undefined;
+    /**
+     * Whether the person pressed managed login's passkey button rather than
+     * filling in a password.
+     *
+     * The pool answers that with a challenge, and the credential answering it
+     * comes back in the next request.
+     */
+    readonly passkey?: string | undefined;
+    /**
+     * The credential a passkey was presented as, which is the JSON a browser
+     * serializes a `PublicKeyCredential` to.
+     *
+     * Real managed login collects this in the browser, from the person's own
+     * authenticator. These pages serve no script, so the form asks for it and
+     * `SimCognitoUserPool.webAuthnAssertion` is where a test reads it from.
+     */
+    readonly credential?: string | undefined;
+    /**
+     * The challenge session the presented credential answers, which the pool
+     * issued when the passkey was asked for.
+     */
+    readonly passkey_session?: string | undefined;
 }
 /**
  * Where a hosted endpoint sends the browser next.

package/dist/service/cognito/command/hosted/hosted-auth.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-auth.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/hosted-auth.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpD;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEvC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC"}
+{"version":3,"file":"hosted-auth.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/hosted-auth.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEpD;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEvC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEvC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC"}

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.d.ts

@@ -18,10 +18,10 @@ interface SimCognitoAuthorizeEndpointProperties {
  * A request naming a provider signs in the user that provider has been told is
  * signed in at it. A request naming none signs in one of the pool's own users,
  * with the username and password real managed login would have taken from its
- * form, or from the managed login session the browser presented. Nothing here
- * draws the form: the serving layer is what answers a browser with a page, and
- * a test calling this directly passes the two fields the form would have
- * posted.
+ * form, with a passkey presented against a challenge the pool issued, or from
+ * the managed login session the browser presented. Nothing here draws the
+ * form: the serving layer is what answers a browser with a page, and a test
+ * calling this directly passes the fields the form would have posted.
  */
 export declare class SimCognitoAuthorizeEndpoint {
     private readonly signIn;

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.js

@@ -14,10 +14,10 @@ import { SimCognitoHostedClient } from "./sim-cognito-hosted-client.js";
  * A request naming a provider signs in the user that provider has been told is
  * signed in at it. A request naming none signs in one of the pool's own users,
  * with the username and password real managed login would have taken from its
- * form, or from the managed login session the browser presented. Nothing here
- * draws the form: the serving layer is what answers a browser with a page, and
- * a test calling this directly passes the two fields the form would have
- * posted.
+ * form, with a passkey presented against a challenge the pool issued, or from
+ * the managed login session the browser presented. Nothing here draws the
+ * form: the serving layer is what answers a browser with a page, and a test
+ * calling this directly passes the fields the form would have posted.
  */
 export class SimCognitoAuthorizeEndpoint {
     signIn;

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.d.ts

@@ -1,12 +1,18 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
 import type { SimCognitoUserFactory } from "../../user-pool/user/sim-cognito-user-factory.js";
+import type { SimCognitoFirstFactorChallenge } from "../auth/sim-cognito-first-factor-challenge.js";
 import { SimCognitoAuthorizeEndpoint } from "./sim-cognito-authorize-endpoint.js";
 import { SimCognitoLogoutEndpoint } from "./sim-cognito-logout-endpoint.js";
 import { SimCognitoTokenEndpoint } from "./sim-cognito-token-endpoint.js";
 interface SimCognitoHostedCommandsProperties {
     readonly tokenIssuer: SimCognitoTokenIssuer;
     readonly userFactory: SimCognitoUserFactory;
+    /**
+     * What asks a user for a passkey, shared with the API sign-ins so a passkey
+     * at the hosted domain answers the same kind of challenge.
+     */
+    readonly challenge: SimCognitoFirstFactorChallenge;
     readonly clock: SimClock;
 }
 /**

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,SAAS,EAAE,2BAA2B,CAAC;IACvD,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAC/C,SAAgB,MAAM,2BAAkC;IAExD,YAAY,UAAU,EAAE,kCAAkC,EAWzD;CACF"}
+{"version":3,"file":"sim-cognito-hosted-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AACpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAE5C;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,SAAS,EAAE,2BAA2B,CAAC;IACvD,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAC/C,SAAgB,MAAM,2BAAkC;IAExD,YAAY,UAAU,EAAE,kCAAkC,EAYzD;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.js

@@ -17,10 +17,11 @@ export class SimCognitoHostedCommands {
     token;
     logout = new SimCognitoLogoutEndpoint();
     constructor(properties) {
-        const { tokenIssuer, userFactory, clock } = properties;
+        const { tokenIssuer, userFactory, challenge, clock } = properties;
         this.authorize = new SimCognitoAuthorizeEndpoint({
             signIn: new SimCognitoHostedSignIn({
                 federatedSignIn: new SimCognitoFederatedSignIn({ userFactory }),
+                challenge,
                 clock,
             }),
             clock,

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-commands.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AAGjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAQ1E;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IACnB,SAAS,CAA8B;IACvC,KAAK,CAA0B;IAC/B,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAExD,YAAY,UAA8C;QACxD,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QAEvD,IAAI,CAAC,SAAS,GAAG,IAAI,2BAA2B,CAAC;YAC/C,MAAM,EAAE,IAAI,sBAAsB,CAAC;gBACjC,eAAe,EAAE,IAAI,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC;gBAC/D,KAAK;aACN,CAAC;YACF,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-hosted-commands.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AAIjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAc1E;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IACnB,SAAS,CAA8B;IACvC,KAAK,CAA0B;IAC/B,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAExD,YAAY,UAA8C;QACxD,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QAElE,IAAI,CAAC,SAAS,GAAG,IAAI,2BAA2B,CAAC;YAC/C,MAAM,EAAE,IAAI,sBAAsB,CAAC;gBACjC,eAAe,EAAE,IAAI,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC;gBAC/D,SAAS;gBACT,KAAK;aACN,CAAC;YACF,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-passkey-sign-in.d.ts

@@ -0,0 +1,65 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+import type { SimCognitoFirstFactorChallenge } from "../auth/sim-cognito-first-factor-challenge.js";
+/**
+ * The passkey a form has just presented.
+ */
+export interface SimCognitoPresentedPasskey {
+    readonly username: string;
+    /** The JSON a browser serializes a `PublicKeyCredential` to. */
+    readonly credential: string;
+    /** The challenge session the credential answers. */
+    readonly session: string | undefined;
+}
+interface SimCognitoHostedPasskeySignInProperties {
+    /**
+     * The challenge issuer the API sign-ins use, so a passkey presented at the
+     * hosted domain answers the same kind of challenge as one presented through
+     * `InitiateAuth`.
+     */
+    readonly challenge: SimCognitoFirstFactorChallenge;
+    readonly clock: SimClock;
+}
+/**
+ * Signing one of a pool's own users in at the authorize endpoint with a
+ * passkey.
+ *
+ * It takes two requests, as it does on real managed login. The first names the
+ * user and asks for a passkey, and the pool answers with a challenge. The
+ * second presents the credential answering it, and the signature is checked
+ * against the public key the registration stored.
+ *
+ * Real managed login runs the ceremony between the two, in the browser, with
+ * the person's own authenticator. These pages serve no script, so the
+ * simulation asks for the credential instead and a caller presents it.
+ * `SimCognitoUserPool.webAuthnAssertion` is what a test reads it from. Nothing
+ * here signs in on a username alone, because a passkey a caller does not hold
+ * is a passkey it cannot present.
+ *
+ * A passkey meets the pool's second factor as well as its first, so a user
+ * that has registered one signs in here where the password form would answer
+ * with a page asking for a code.
+ */
+export declare class SimCognitoHostedPasskeySignIn {
+    private readonly challenge;
+    private readonly clock;
+    constructor(properties: SimCognitoHostedPasskeySignInProperties);
+    /**
+     * Ask this user for a passkey, or refuse where the pool allows none and
+     * where the user has registered none.
+     */
+    ask(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, username: string): never;
+    /**
+     * The user the presented credential signs in, having checked that this
+     * user's passkey signed the challenge the pool issued.
+     */
+    present(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, presented: SimCognitoPresentedPasskey): SimCognitoUser;
+    /**
+     * The user this sign-in names, held to what every sign-in holds a user to.
+     */
+    private signingIn;
+}
+export {};
+//# sourceMappingURL=sim-cognito-hosted-passkey-sign-in.d.ts.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-passkey-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-passkey-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-passkey-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAMpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAI/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAEpG;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,UAAU,uCAAuC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,uCAAuC,EAG9D;IAED;;;OAGG;IACH,GAAG,CACD,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,MAAM,GACf,KAAK,CASP;IAED;;;OAGG;IACH,OAAO,CACL,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,0BAA0B,GACpC,cAAc,CAsBhB;IAED;;OAEG;IACH,OAAO,CAAC,SAAS;CAWlB"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-passkey-sign-in.js

@@ -0,0 +1,71 @@
+import { SimCognitoPasskeyRequired } from "../../error/sim-cognito-managed-login.error.js";
+import { requireSimCognitoReadyToSignIn, requireSimCognitoSignInUser, } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { requireSimCognitoWebAuthnAssertion } from "../../user-pool/user/web-authn/sim-cognito-web-authn-assertion.js";
+import { SimCognitoAuthParameters } from "../auth/sim-cognito-auth-parameters.js";
+import { simCognitoWebAuthnChallenge } from "../auth/sim-cognito-available-challenges.js";
+/**
+ * Signing one of a pool's own users in at the authorize endpoint with a
+ * passkey.
+ *
+ * It takes two requests, as it does on real managed login. The first names the
+ * user and asks for a passkey, and the pool answers with a challenge. The
+ * second presents the credential answering it, and the signature is checked
+ * against the public key the registration stored.
+ *
+ * Real managed login runs the ceremony between the two, in the browser, with
+ * the person's own authenticator. These pages serve no script, so the
+ * simulation asks for the credential instead and a caller presents it.
+ * `SimCognitoUserPool.webAuthnAssertion` is what a test reads it from. Nothing
+ * here signs in on a username alone, because a passkey a caller does not hold
+ * is a passkey it cannot present.
+ *
+ * A passkey meets the pool's second factor as well as its first, so a user
+ * that has registered one signs in here where the password form would answer
+ * with a page asking for a code.
+ */
+export class SimCognitoHostedPasskeySignIn {
+    challenge;
+    clock;
+    constructor(properties) {
+        this.challenge = properties.challenge;
+        this.clock = properties.clock;
+    }
+    /**
+     * Ask this user for a passkey, or refuse where the pool allows none and
+     * where the user has registered none.
+     */
+    ask(pool, client, username) {
+        const user = this.signingIn(pool, client, username);
+        const asked = this.challenge.issue({ pool, client, user }, simCognitoWebAuthnChallenge, "passkey");
+        throw new SimCognitoPasskeyRequired(username, String(asked.Session));
+    }
+    /**
+     * The user the presented credential signs in, having checked that this
+     * user's passkey signed the challenge the pool issued.
+     */
+    present(pool, client, presented) {
+        const { username } = presented;
+        const session = pool.auth.requireSession({
+            sessionId: presented.session,
+            username,
+            clientId: client.id,
+            challengeName: simCognitoWebAuthnChallenge,
+            now: this.clock.now(),
+        });
+        const user = this.signingIn(pool, client, username);
+        requireSimCognitoWebAuthnAssertion(user.webAuthn.credentials, new SimCognitoAuthParameters("the managed login form", {
+            credential: presented.credential,
+        }).requireDocument("credential"), session.requireWebAuthnOptions());
+        pool.auth.removeSession(session);
+        return user;
+    }
+    /**
+     * The user this sign-in names, held to what every sign-in holds a user to.
+     */
+    signingIn(pool, client, username) {
+        const user = requireSimCognitoSignInUser(pool, client, username);
+        requireSimCognitoReadyToSignIn(user);
+        return user;
+    }
+}
+//# sourceMappingURL=sim-cognito-hosted-passkey-sign-in.js.map

package/dist/service/cognito/command/hosted/sim-cognito-hosted-passkey-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-hosted-passkey-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-passkey-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAC3F,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAIrD,OAAO,EAAE,kCAAkC,EAAE,MAAM,mEAAmE,CAAC;AACvH,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,6CAA6C,CAAC;AA0B1F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,6BAA6B;IACvB,SAAS,CAAiC;IAC1C,KAAK,CAAW;IAEjC,YAAY,UAAmD;QAC7D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,GAAG,CACD,IAAwB,EACxB,MAAgC,EAChC,QAAgB;QAEhB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EACtB,2BAA2B,EAC3B,SAAS,CACV,CAAC;QAEF,MAAM,IAAI,yBAAyB,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;OAGG;IACH,OAAO,CACL,IAAwB,EACxB,MAAgC,EAChC,SAAqC;QAErC,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;YACvC,SAAS,EAAE,SAAS,CAAC,OAAO;YAC5B,QAAQ;YACR,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,aAAa,EAAE,2BAA2B;YAC1C,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEpD,kCAAkC,CAChC,IAAI,CAAC,QAAQ,CAAC,WAAW,EACzB,IAAI,wBAAwB,CAAC,wBAAwB,EAAE;YACrD,UAAU,EAAE,SAAS,CAAC,UAAU;SACjC,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,EAChC,OAAO,CAAC,sBAAsB,EAAE,CACjC,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,SAAS,CACf,IAAwB,EACxB,MAAgC,EAChC,QAAgB;QAEhB,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,8BAA8B,CAAC,IAAI,CAAC,CAAC;QAErC,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.d.ts

@@ -2,10 +2,16 @@ import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoFederatedSignIn } from "../../user-pool/idp/sim-cognito-federated-sign-in.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoFirstFactorChallenge } from "../auth/sim-cognito-first-factor-challenge.js";
 import type { SimCognitoHostedSignedIn } from "./sim-cognito-hosted-signed-in.js";
 import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
 interface SimCognitoHostedSignInProperties {
     readonly federatedSignIn: SimCognitoFederatedSignIn;
+    /**
+     * The challenge issuer the API sign-ins use, which a passkey at the hosted
+     * domain is asked for through.
+     */
+    readonly challenge: SimCognitoFirstFactorChallenge;
     readonly clock: SimClock;
 }
 /**
@@ -23,6 +29,7 @@ export declare class SimCognitoHostedSignIn {
     private readonly clock;
     private readonly request;
     private readonly passwordSignIn;
+    private readonly passkeySignIn;
     private readonly browserSession;
     constructor(properties: SimCognitoHostedSignInProperties);
     /**
@@ -31,14 +38,16 @@ export declare class SimCognitoHostedSignIn {
      */
     signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput, presentedSession: string | undefined): SimCognitoHostedSignedIn;
     /**
-     * Sign in one of the pool's own users, from a password or from the session
-     * the browser is already holding.
+     * Sign in one of the pool's own users, with a passkey, with a password, or
+     * from the session the browser is already holding.
      *
-     * Credentials win over a session, because a request carrying them is the
-     * sign-in form coming back and real managed login answers that with a fresh
-     * sign-in. A request carrying neither, from a browser holding no session, is
-     * one the sign-in form is shown for. The serving layer answers with that
-     * page, from this refusal.
+     * A passkey takes two requests. The first asks for one and is answered with
+     * a challenge, and the second presents the credential answering it. A
+     * password takes one. Either wins over a session the browser is holding,
+     * because real managed login answers a form post with a fresh sign-in. A
+     * request carrying none of them, from a browser holding no session, is one
+     * the sign-in form is shown for. The serving layer answers with that page,
+     * from this refusal.
      */
     private localSignIn;
 }

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAKnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkC;IAEjE,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,EAC/B,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,wBAAwB,CAW1B;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;CAuBpB"}
+{"version":3,"file":"sim-cognito-hosted-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sDAAsD,CAAC;AACtG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAMpG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IAEpD;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IACvE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgC;IAC9D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkC;IAEjE,YAAY,UAAU,EAAE,gCAAgC,EAOvD;IAED;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,wBAAwB,EAC/B,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,wBAAwB,CAW1B;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,WAAW;CA0CpB"}

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.js

@@ -2,6 +2,7 @@ import { SimCognitoManagedLoginRequired } from "../../error/sim-cognito-managed-
 import { SimCognitoAuthorizeRequest } from "./sim-cognito-authorize-request.js";
 import { SimCognitoBrowserSession } from "./sim-cognito-browser-session.js";
 import { SimCognitoHostedCredentials } from "./sim-cognito-hosted-credentials.js";
+import { SimCognitoHostedPasskeySignIn } from "./sim-cognito-hosted-passkey-sign-in.js";
 import { SimCognitoHostedPasswordSignIn } from "./sim-cognito-hosted-password-sign-in.js";
 /**
  * Which user an authorize request signs in.
@@ -18,10 +19,15 @@ export class SimCognitoHostedSignIn {
     clock;
     request = new SimCognitoAuthorizeRequest();
     passwordSignIn = new SimCognitoHostedPasswordSignIn();
+    passkeySignIn;
     browserSession = new SimCognitoBrowserSession();
     constructor(properties) {
         this.federatedSignIn = properties.federatedSignIn;
         this.clock = properties.clock;
+        this.passkeySignIn = new SimCognitoHostedPasskeySignIn({
+            challenge: properties.challenge,
+            clock: properties.clock,
+        });
     }
     /**
      * The user this request signs in, at a provider, in the pool itself, or from
@@ -37,17 +43,30 @@ export class SimCognitoHostedSignIn {
         return this.browserSession.start(pool, user, now);
     }
     /**
-     * Sign in one of the pool's own users, from a password or from the session
-     * the browser is already holding.
+     * Sign in one of the pool's own users, with a passkey, with a password, or
+     * from the session the browser is already holding.
      *
-     * Credentials win over a session, because a request carrying them is the
-     * sign-in form coming back and real managed login answers that with a fresh
-     * sign-in. A request carrying neither, from a browser holding no session, is
-     * one the sign-in form is shown for. The serving layer answers with that
-     * page, from this refusal.
+     * A passkey takes two requests. The first asks for one and is answered with
+     * a challenge, and the second presents the credential answering it. A
+     * password takes one. Either wins over a session the browser is holding,
+     * because real managed login answers a form post with a fresh sign-in. A
+     * request carrying none of them, from a browser holding no session, is one
+     * the sign-in form is shown for. The serving layer answers with that page,
+     * from this refusal.
      */
     localSignIn(pool, client, input, presentedSession) {
         const now = this.clock.now();
+        const { username, credential } = input;
+        if (username !== undefined && credential !== undefined) {
+            return this.browserSession.start(pool, this.passkeySignIn.present(pool, client, {
+                username,
+                credential,
+                session: input.passkey_session,
+            }), now);
+        }
+        if (username !== undefined && input.passkey !== undefined) {
+            this.passkeySignIn.ask(pool, client, username);
+        }
         const credentials = SimCognitoHostedCredentials.in(input);
         if (credentials === undefined) {
             const returning = this.browserSession.signIn(pool, presentedSession, now);

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-hosted-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAIhG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAS1F;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IAChB,eAAe,CAA4B;IAC3C,KAAK,CAAW;IAChB,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC3C,cAAc,GAAG,IAAI,8BAA8B,EAAE,CAAC;IACtD,cAAc,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAEjE,YAAY,UAA4C;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,MAAgC,EAChC,KAA+B,EAC/B,gBAAoC;QAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAElE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAElE,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;OASG;IACK,WAAW,CACjB,IAAwB,EACxB,MAAgC,EAChC,KAA+B,EAC/B,gBAAoC;QAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,2BAA2B,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAE1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,8BAA8B,EAAE,CAAC;YAC7C,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAEnE,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-hosted-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-hosted-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AAKhG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAe1F;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IAChB,eAAe,CAA4B;IAC3C,KAAK,CAAW;IAChB,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC3C,cAAc,GAAG,IAAI,8BAA8B,EAAE,CAAC;IACtD,aAAa,CAAgC;IAC7C,cAAc,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAEjE,YAAY,UAA4C;QACtD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,aAAa,GAAG,IAAI,6BAA6B,CAAC;YACrD,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,MAAgC,EAChC,KAA+B,EAC/B,gBAAoC;QAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAElE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAElE,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;;;OAWG;IACK,WAAW,CACjB,IAAwB,EACxB,MAAgC,EAChC,KAA+B,EAC/B,gBAAoC;QAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAE7B,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAEvC,IAAI,QAAQ,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAC9B,IAAI,EACJ,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE;gBACvC,QAAQ;gBACR,UAAU;gBACV,OAAO,EAAE,KAAK,CAAC,eAAe;aAC/B,CAAC,EACF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,WAAW,GAAG,2BAA2B,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAE1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,8BAA8B,EAAE,CAAC;YAC7C,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAEnE,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-presented-grant.js

@@ -37,7 +37,7 @@ export class SimCognitoPresentedGrant {
         const found = pool.auth.findRefreshToken(input.refresh_token);
         if (found === undefined ||
             !found.isFor(client.id) ||
-            found.isExpiredAt(now)) {
+            found.isSpentAt(now)) {
             throw new SimCognitoOAuthError({
                 code: "invalid_grant",
                 description: "The refresh token has been revoked, has run out, or was not " +

package/dist/service/cognito/command/hosted/sim-cognito-presented-grant.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-presented-grant.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-presented-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAe9E;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IACnC;;;;;;OAMG;IACH,IAAI,CAAC,OAAwC;QAC3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAE/D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,eAAe;gBACrB,WAAW,EACT,gEAAgE;oBAChE,mCAAmC;gBACrC,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAEhD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,YAAY,CACV,OAAwC;QAExC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAE9D,IACE,KAAK,KAAK,SAAS;YACnB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,EACtB,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,eAAe;gBACrB,WAAW,EACT,8DAA8D;oBAC9D,2BAA2B;gBAC7B,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,IAAwB,EAAE,QAAgB;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAErC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,eAAe;gBACrB,WAAW,EACT,+DAA+D;oBAC/D,aAAa,IAAI,CAAC,EAAE,EAAE;gBACxB,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,uBAAuB,CAC7B,IAAiC,EACjC,WAA+B;QAE/B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EACT,kEAAkE;oBAClE,qBAAqB;gBACvB,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,eAAe,CACrB,IAAiC,EACjC,YAAgC;QAEhC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,eAAe;gBACrB,WAAW,EACT,gEAAgE;oBAChE,iCAAiC;gBACnC,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-presented-grant.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-presented-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAe9E;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IACnC;;;;;;OAMG;IACH,IAAI,CAAC,OAAwC;QAC3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAE/D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,eAAe;gBACrB,WAAW,EACT,gEAAgE;oBAChE,mCAAmC;gBACrC,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAEhD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,YAAY,CACV,OAAwC;QAExC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAE9D,IACE,KAAK,KAAK,SAAS;YACnB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EACpB,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,eAAe;gBACrB,WAAW,EACT,8DAA8D;oBAC9D,2BAA2B;gBAC7B,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,IAAwB,EAAE,QAAgB;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAErC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,eAAe;gBACrB,WAAW,EACT,+DAA+D;oBAC/D,aAAa,IAAI,CAAC,EAAE,EAAE;gBACxB,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,uBAAuB,CAC7B,IAAiC,EACjC,WAA+B;QAE/B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,qBAAqB;gBAC3B,WAAW,EACT,kEAAkE;oBAClE,qBAAqB;gBACvB,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,eAAe,CACrB,IAAiC,EACjC,YAAgC;QAEhC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,IAAI,EAAE,eAAe;gBACrB,WAAW,EACT,gEAAgE;oBAChE,iCAAiC;gBACnC,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-token-grants.d.ts

@@ -32,9 +32,9 @@ export declare class SimCognitoTokenGrants {
     /**
      * Sign fresh tokens for an application that presented a refresh token.
      *
-     * No new refresh token comes back, as none does from real Cognito with
-     * refresh token rotation off, and the access token keeps the scopes the
-     * sign-in it came from was granted.
+     * A new refresh token comes back only where the app client rotates its
+     * refresh tokens, as one does from real Cognito, and the access token keeps
+     * the scopes the sign-in it came from was granted.
      */
     refresh(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoTokenInput): Promise<SimCognitoTokenOutput>;
 }

package/dist/service/cognito/command/hosted/sim-cognito-token-grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-token-grants.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-token-grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAI/F,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAElC,UAAU,+BAA+B;IACvC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;;;;;OAMG;IACG,YAAY,CAChB,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAiBhC;IAED;;;;;;OAMG;IACG,OAAO,CACX,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAiBhC;CACF"}
+{"version":3,"file":"sim-cognito-token-grants.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/hosted/sim-cognito-token-grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAI/F,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAElC,UAAU,+BAA+B;IACvC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,YAAY,UAAU,EAAE,+BAA+B,EAGtD;IAED;;;;;;OAMG;IACG,YAAY,CAChB,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAiBhC;IAED;;;;;;OAMG;IACG,OAAO,CACX,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAkBhC;CACF"}

package/dist/service/cognito/command/hosted/sim-cognito-token-grants.js

@@ -45,9 +45,9 @@ export class SimCognitoTokenGrants {
     /**
      * Sign fresh tokens for an application that presented a refresh token.
      *
-     * No new refresh token comes back, as none does from real Cognito with
-     * refresh token rotation off, and the access token keeps the scopes the
-     * sign-in it came from was granted.
+     * A new refresh token comes back only where the app client rotates its
+     * refresh tokens, as one does from real Cognito, and the access token keeps
+     * the scopes the sign-in it came from was granted.
      */
     async refresh(pool, client, input) {
         const refreshToken = this.presented.refreshToken({
@@ -57,10 +57,11 @@ export class SimCognitoTokenGrants {
             now: this.clock.now(),
         });
         const user = this.presented.user(pool, refreshToken.username);
-        const issued = await this.tokenIssuer.reissue({
+        const issued = await this.tokenIssuer.refresh({
             pool,
             client,
             user,
+            spent: refreshToken,
             occasion: SimCognitoTriggerOccasion.refreshTokenGeneration,
             scopes: refreshToken.scopes,
         });