@kensio/yulin 1.18.1 → 1.19.0

package/dist/service/cognito/serve/page/sim-cognito-managed-login.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-managed-login.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-managed-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,gDAAgD,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAEhF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IAChB,WAAW,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC1C,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACxC,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACxC,WAAW,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC1C,kBAAkB,GAAG,IAAI,4BAA4B,EAAE,CAAC;IACxD,iBAAiB,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAEvE;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,QAAgB;QAChC,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,OAAgC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAElC,QAAQ,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC7B,KAAK,oBAAoB,EAAE,CAAC;gBAC1B,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC;YACD,KAAK,4BAA4B,EAAE,CAAC;gBAClC,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC;YACD,KAAK,2BAA2B,EAAE,CAAC;gBACjC,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC;YACD,SAAS,CAAC;gBACR,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,aAAa,CACX,OAAgC,EAChC,UAAoC,EACpC,KAAc;QAEd,IAAI,gCAAgC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAC3B,OAAO,CAAC,IAAI,EACZ,UAAU,EACV,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CACpC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,OAAgC;QAC7C,OAAO,IAAI,kBAAkB,CAC3B,OAAO,EACP,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAC7D,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-managed-login.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-managed-login.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAEhF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IAChB,WAAW,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC1C,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACxC,WAAW,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC1C,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACxC,WAAW,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC1C,kBAAkB,GAAG,IAAI,4BAA4B,EAAE,CAAC;IACxD,iBAAiB,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAEvE;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,QAAgB;QAChC,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,OAAgC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAElC,QAAQ,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC7B,KAAK,oBAAoB,EAAE,CAAC;gBAC1B,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC;YACD,KAAK,4BAA4B,EAAE,CAAC;gBAClC,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC;YACD,KAAK,2BAA2B,EAAE,CAAC;gBACjC,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC;YACD,SAAS,CAAC;gBACR,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,aAAa,CACX,OAAgC,EAChC,UAAoC,EACpC,KAAc;QAEd,IAAI,gCAAgC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAC3B,OAAO,CAAC,IAAI,EACZ,UAAU,EACV,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CACpC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,OAAgC;QAC7C,OAAO,IAAI,kBAAkB,CAC3B,OAAO,EACP,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAC7D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/serve/page/sim-cognito-passkey-page.d.ts

@@ -0,0 +1,23 @@
+import { type SimCognitoPageParameters } from "./sim-cognito-page-markup.js";
+/**
+ * What a browser is asked for once it has said it will sign in with a passkey.
+ *
+ * Real managed login runs the WebAuthn ceremony here, in the browser, with the
+ * person's own authenticator, and posts the credential back without asking
+ * anybody anything. These pages serve no script, so the ceremony is a field on
+ * a form. A test reads what the authenticator would have produced off the pool
+ * with `SimCognitoUserPool.webAuthnAssertion`, passing the session this page
+ * carries, and posts it back.
+ *
+ * The form posts to the authorize endpoint, as the sign-in form does, carrying
+ * the parameters the browser arrived on and the challenge the pool issued.
+ */
+export declare class SimCognitoPasskeyPage {
+    private readonly markup;
+    /**
+     * The page a browser is answered with, naming the challenge a passkey has to
+     * answer.
+     */
+    render(parameters: SimCognitoPageParameters, username: string, session: string): Response;
+}
+//# sourceMappingURL=sim-cognito-passkey-page.d.ts.map

package/dist/service/cognito/serve/page/sim-cognito-passkey-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-passkey-page.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-passkey-page.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAGtC;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD;;;OAGG;IACH,MAAM,CACJ,UAAU,EAAE,wBAAwB,EACpC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,QAAQ,CAmBV;CACF"}

package/dist/service/cognito/serve/page/sim-cognito-passkey-page.js

@@ -0,0 +1,36 @@
+import { SimCognitoPageMarkup, } from "./sim-cognito-page-markup.js";
+import { simCognitoAuthorizePath } from "./sim-cognito-page-paths.js";
+/**
+ * What a browser is asked for once it has said it will sign in with a passkey.
+ *
+ * Real managed login runs the WebAuthn ceremony here, in the browser, with the
+ * person's own authenticator, and posts the credential back without asking
+ * anybody anything. These pages serve no script, so the ceremony is a field on
+ * a form. A test reads what the authenticator would have produced off the pool
+ * with `SimCognitoUserPool.webAuthnAssertion`, passing the session this page
+ * carries, and posts it back.
+ *
+ * The form posts to the authorize endpoint, as the sign-in form does, carrying
+ * the parameters the browser arrived on and the challenge the pool issued.
+ */
+export class SimCognitoPasskeyPage {
+    markup = new SimCognitoPageMarkup();
+    /**
+     * The page a browser is answered with, naming the challenge a passkey has to
+     * answer.
+     */
+    render(parameters, username, session) {
+        const body = this.markup.message(`Present the passkey registered for ${username}, as the credential ` +
+            `answering this challenge.`) +
+            this.markup.form(simCognitoAuthorizePath, this.markup.hidden({
+                ...parameters,
+                username,
+                passkey_session: session,
+            }) +
+                this.markup.field("credential", "Credential") +
+                this.markup.submit("present", "Sign in")) +
+            this.markup.link(simCognitoAuthorizePath, parameters, "Back to sign in");
+        return this.markup.page("Present your passkey", body);
+    }
+}
+//# sourceMappingURL=sim-cognito-passkey-page.js.map

package/dist/service/cognito/serve/page/sim-cognito-passkey-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-passkey-page.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-passkey-page.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEtE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,qBAAqB;IACf,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAErD;;;OAGG;IACH,MAAM,CACJ,UAAoC,EACpC,QAAgB,EAChB,OAAe;QAEf,MAAM,IAAI,GACR,IAAI,CAAC,MAAM,CAAC,OAAO,CACjB,sCAAsC,QAAQ,sBAAsB;YAClE,2BAA2B,CAC9B;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uBAAuB,EACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBACjB,GAAG,UAAU;gBACb,QAAQ;gBACR,eAAe,EAAE,OAAO;aACzB,CAAC;gBACA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAC3C;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAE3E,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;CACF"}

package/dist/service/cognito/serve/page/sim-cognito-sign-in-page.d.ts

@@ -4,7 +4,9 @@ import { type SimCognitoPageParameters } from "./sim-cognito-page-markup.js";
  * The sign-in form managed login answers an authorize request with.
  *
  * The form posts back to the authorize endpoint, carrying the parameters the
- * browser arrived on as hidden inputs and the two fields the person filled in.
+ * browser arrived on as hidden inputs and the fields the person filled in. A
+ * pool that allows a passkey at the first prompt offers one beside the
+ * password.
  * The pool's identity providers are links to the same endpoint with
  * `identity_provider` set, so both ways in are reachable from this one page,
  * and the other pages of the journey are links beside them.
@@ -16,5 +18,15 @@ export declare class SimCognitoSignInPage {
      * already been refused once.
      */
     render(pool: SimCognitoUserPool, parameters: SimCognitoPageParameters, message?: string): Response;
+    /**
+     * The passkey button, where the pool allows one at the first prompt.
+     *
+     * It skips the browser's own validation so that the password field can be
+     * left empty, and posts the username the person typed. Real managed login
+     * runs the WebAuthn ceremony in the browser at this point, and this
+     * simulation serves no script, so the button is the whole of what the form
+     * sends.
+     */
+    private passkeyButton;
 }
 //# sourceMappingURL=sim-cognito-sign-in-page.d.ts.map

package/dist/service/cognito/serve/page/sim-cognito-sign-in-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-sign-in-page.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-sign-in-page.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAkBtC;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,UAAU,EAAE,wBAAwB,EACpC,OAAO,CAAC,EAAE,MAAM,GACf,QAAQ,CAgBV;CACF"}
+{"version":3,"file":"sim-cognito-sign-in-page.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-sign-in-page.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAuBtC;;;;;;;;;;GAUG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,UAAU,EAAE,wBAAwB,EACpC,OAAO,CAAC,EAAE,MAAM,GACf,QAAQ,CAiBV;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;CAOtB"}

package/dist/service/cognito/serve/page/sim-cognito-sign-in-page.js

@@ -1,6 +1,10 @@
 import { SimCognitoPageMarkup, } from "./sim-cognito-page-markup.js";
 import { simCognitoAuthorizePath, simCognitoConfirmPath, simCognitoForgotPasswordPath, simCognitoSignUpPath, } from "./sim-cognito-page-paths.js";
 import { simCognitoProviderLinks } from "./sim-cognito-provider-links.js";
+/**
+ * The factor a pool has to allow before the form offers a passkey.
+ */
+const webAuthnFactor = "WEB_AUTHN";
 /**
  * The other pages the sign-in form links to, in the order they are offered.
  */
@@ -13,7 +17,9 @@ const linkedPages = [
  * The sign-in form managed login answers an authorize request with.
  *
  * The form posts back to the authorize endpoint, carrying the parameters the
- * browser arrived on as hidden inputs and the two fields the person filled in.
+ * browser arrived on as hidden inputs and the fields the person filled in. A
+ * pool that allows a passkey at the first prompt offers one beside the
+ * password.
  * The pool's identity providers are links to the same endpoint with
  * `identity_provider` set, so both ways in are reachable from this one page,
  * and the other pages of the journey are links beside them.
@@ -29,12 +35,28 @@ export class SimCognitoSignInPage {
             this.markup.form(simCognitoAuthorizePath, this.markup.hidden(parameters) +
                 this.markup.field("username", "Username") +
                 this.markup.field("password", "Password", "password") +
-                this.markup.submit("signIn", "Sign in")) +
+                this.markup.submit("signIn", "Sign in") +
+                this.passkeyButton(pool)) +
             simCognitoProviderLinks(this.markup, pool, parameters) +
             linkedPages
                 .map(([path, text]) => this.markup.link(path, parameters, text))
                 .join("");
         return this.markup.page("Sign in", body);
     }
+    /**
+     * The passkey button, where the pool allows one at the first prompt.
+     *
+     * It skips the browser's own validation so that the password field can be
+     * left empty, and posts the username the person typed. Real managed login
+     * runs the WebAuthn ceremony in the browser at this point, and this
+     * simulation serves no script, so the button is the whole of what the form
+     * sends.
+     */
+    passkeyButton(pool) {
+        if (!pool.settings.signInPolicy.factors.includes(webAuthnFactor)) {
+            return "";
+        }
+        return this.markup.submit("passkey", "Sign in with a passkey", true);
+    }
 }
 //# sourceMappingURL=sim-cognito-sign-in-page.js.map

package/dist/service/cognito/serve/page/sim-cognito-sign-in-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-sign-in-page.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-sign-in-page.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,GAA2C;IAC1D,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACjC,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;IAC5C,CAAC,4BAA4B,EAAE,0BAA0B,CAAC;CAC3D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAErD;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,UAAoC,EACpC,OAAgB;QAEhB,MAAM,IAAI,GACR,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uBAAuB,EACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC;gBACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAC1C;YACD,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC;YACtD,WAAW;iBACR,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;iBAC/D,IAAI,CAAC,EAAE,CAAC,CAAC;QAEd,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-sign-in-page.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-sign-in-page.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E;;GAEG;AACH,MAAM,cAAc,GAAG,WAAW,CAAC;AAEnC;;GAEG;AACH,MAAM,WAAW,GAA2C;IAC1D,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACjC,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;IAC5C,CAAC,4BAA4B,EAAE,0BAA0B,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAErD;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,UAAoC,EACpC,OAAgB;QAEhB,MAAM,IAAI,GACR,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uBAAuB,EACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC;gBACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC;gBACvC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAC3B;YACD,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC;YACtD,WAAW;iBACR,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;iBAC/D,IAAI,CAAC,EAAE,CAAC,CAAC;QAEd,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACK,aAAa,CAAC,IAAwB;QAC5C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC;CACF"}

package/dist/service/cognito/sim-cognito-authentication.d.ts

@@ -44,6 +44,14 @@ export declare abstract class SimCognitoAuthentication {
      * Handle a RespondToAuthChallenge Command from the SDK.
      */
     respondToAuthChallenge(command: simCognitoCommands.SimRespondToAuthChallengeCommand): Promise<simCognitoCommands.SimRespondToAuthChallengeCommandOutput>;
+    /**
+     * Handle a GetTokensFromRefreshToken Command from the SDK.
+     *
+     * No caller is read, because real Cognito authorizes this operation with no
+     * IAM policy at all: it is what an application calls to renew a session, and
+     * the refresh token and the client secret are what it is checked against.
+     */
+    getTokensFromRefreshToken(command: simCognitoCommands.SimGetTokensFromRefreshTokenCommand): Promise<simCognitoCommands.SimGetTokensFromRefreshTokenCommandOutput>;
     /**
      * Handle a GlobalSignOut Command from the SDK.
      *

package/dist/service/cognito/sim-cognito-authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authentication.d.ts","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,KAAK,kBAAkB,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAE5E,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,8BAAsB,wBAAwB;IAC5C,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAChD,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAEnD,SAAS,aAAa,UAAU,EAAE,kCAAkC,EAGnE;IAED;;OAEG;IACG,iBAAiB,CACrB,OAAO,EAAE,kBAAkB,CAAC,2BAA2B,EACvD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAG/D;IAED;;OAEG;IACG,2BAA2B,CAC/B,OAAO,EAAE,kBAAkB,CAAC,qCAAqC,EACjE,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,2CAA2C,CAAC,CAGzE;IAED;;;;;OAKG;IACG,YAAY,CAChB,OAAO,EAAE,kBAAkB,CAAC,sBAAsB,GACjD,OAAO,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAG1D;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,GAC3D,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;;;OAIG;IACG,aAAa,CACjB,OAAO,EAAE,kBAAkB,CAAC,uBAAuB,GAClD,OAAO,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAG3D;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,EAC5D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;CACF"}
+{"version":3,"file":"sim-cognito-authentication.d.ts","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,KAAK,kBAAkB,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAE5E,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,8BAAsB,wBAAwB;IAC5C,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAChD,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAEnD,SAAS,aAAa,UAAU,EAAE,kCAAkC,EAGnE;IAED;;OAEG;IACG,iBAAiB,CACrB,OAAO,EAAE,kBAAkB,CAAC,2BAA2B,EACvD,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAG/D;IAED;;OAEG;IACG,2BAA2B,CAC/B,OAAO,EAAE,kBAAkB,CAAC,qCAAqC,EACjE,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,2CAA2C,CAAC,CAGzE;IAED;;;;;OAKG;IACG,YAAY,CAChB,OAAO,EAAE,kBAAkB,CAAC,sBAAsB,GACjD,OAAO,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAG1D;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,GAC3D,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;;;;;OAMG;IACG,yBAAyB,CAC7B,OAAO,EAAE,kBAAkB,CAAC,mCAAmC,GAC9D,OAAO,CAAC,kBAAkB,CAAC,yCAAyC,CAAC,CAGvE;IAED;;;;OAIG;IACG,aAAa,CACjB,OAAO,EAAE,kBAAkB,CAAC,uBAAuB,GAClD,OAAO,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAG3D;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,EAC5D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;CACF"}

package/dist/service/cognito/sim-cognito-authentication.js

@@ -48,6 +48,17 @@ export class SimCognitoAuthentication {
         await this.background.sequence();
         return this.commands.auth.respondToChallenge.handle(command);
     }
+    /**
+     * Handle a GetTokensFromRefreshToken Command from the SDK.
+     *
+     * No caller is read, because real Cognito authorizes this operation with no
+     * IAM policy at all: it is what an application calls to renew a session, and
+     * the refresh token and the client secret are what it is checked against.
+     */
+    async getTokensFromRefreshToken(command) {
+        await this.background.sequence();
+        return this.commands.auth.getTokensFromRefreshToken.handle(command);
+    }
     /**
      * Handle a GlobalSignOut Command from the SDK.
      *

package/dist/service/cognito/sim-cognito-authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-authentication.js","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-authentication.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;GAWG;AACH,MAAM,OAAgB,wBAAwB;IACzB,QAAQ,CAAqB;IAC7B,UAAU,CAAsB;IAEnD,YAAsB,UAA8C;QAClE,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CACrB,OAAuD,EACvD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,2BAA2B,CAC/B,OAAiE,EACjE,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,OAAmD;QAEnD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-authentication.js","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-authentication.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;GAWG;AACH,MAAM,OAAgB,wBAAwB;IACzB,QAAQ,CAAqB;IAC7B,UAAU,CAAsB;IAEnD,YAAsB,UAA8C;QAClE,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CACrB,OAAuD,EACvD,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,2BAA2B,CAC/B,OAAiE,EACjE,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,yBAAyB,CAC7B,OAA+D;QAE/D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,OAAmD;QAEnD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D,EAC5D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/dist/service/cognito/sim-cognito-user-factors.d.ts

@@ -16,6 +16,10 @@ interface SimCognitoUserFactorsProperties {
  * `AdminSetUserMFAPreference` is the administrative one, and authorizes
  * against the pool like every other admin operation.
  *
+ * The passkey operations are here for the same reason: a passkey is
+ * registered by the user it belongs to, from a session that already exists,
+ * and the access token is the whole of the authorization.
+ *
  * `SimCognitoUserDirectory` extends this, which extends
  * `SimCognitoAuthentication`.
  */
@@ -39,6 +43,27 @@ export declare abstract class SimCognitoUserFactors extends SimCognitoAuthentica
      * Handle a SetUserMFAPreference Command from the SDK.
      */
     setUserMFAPreference(command: simCognitoCommands.SimSetUserMFAPreferenceCommand): Promise<simCognitoCommands.SimSetUserMFAPreferenceCommandOutput>;
+    /**
+     * Handle a StartWebAuthnRegistration Command from the SDK.
+     *
+     * The options this answers with are what a browser passes to
+     * `navigator.credentials.create()`. A test with no browser reads the
+     * credential its own authenticator would have made off the pool, through
+     * `SimCognitoUserPool.webAuthnCredential`.
+     */
+    startWebAuthnRegistration(command: simCognitoCommands.SimStartWebAuthnRegistrationCommand): Promise<simCognitoCommands.SimStartWebAuthnRegistrationCommandOutput>;
+    /**
+     * Handle a CompleteWebAuthnRegistration Command from the SDK.
+     */
+    completeWebAuthnRegistration(command: simCognitoCommands.SimCompleteWebAuthnRegistrationCommand): Promise<simCognitoCommands.SimCompleteWebAuthnRegistrationCommandOutput>;
+    /**
+     * Handle a ListWebAuthnCredentials Command from the SDK.
+     */
+    listWebAuthnCredentials(command: simCognitoCommands.SimListWebAuthnCredentialsCommand): Promise<simCognitoCommands.SimListWebAuthnCredentialsCommandOutput>;
+    /**
+     * Handle a DeleteWebAuthnCredential Command from the SDK.
+     */
+    deleteWebAuthnCredential(command: simCognitoCommands.SimDeleteWebAuthnCredentialCommand): Promise<simCognitoCommands.SimDeleteWebAuthnCredentialCommandOutput>;
     /**
      * Handle an AdminSetUserMFAPreference Command from the SDK.
      */

package/dist/service/cognito/sim-cognito-user-factors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-factors.d.ts","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-user-factors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,KAAK,KAAK,kBAAkB,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EACL,wBAAwB,EACxB,KAAK,wCAAwC,EAC9C,MAAM,iCAAiC,CAAC;AAEzC,YAAY,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAEhG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,8BAAsB,qBAAsB,SAAQ,wBAAwB;IAC1E,SAAS,aAAa,UAAU,EAAE,+BAA+B,EAEhE;IAED;;;;OAIG;IACG,OAAO,CACX,OAAO,EAAE,kBAAkB,CAAC,iBAAiB,GAC5C,OAAO,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAGrD;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,GAC3D,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,mBAAmB,CACvB,OAAO,EAAE,kBAAkB,CAAC,6BAA6B,GACxD,OAAO,CAAC,kBAAkB,CAAC,mCAAmC,CAAC,CAGjE;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,GACzD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,yBAAyB,CAC7B,OAAO,EAAE,kBAAkB,CAAC,mCAAmC,EAC/D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,yCAAyC,CAAC,CAGvE;CACF"}
+{"version":3,"file":"sim-cognito-user-factors.d.ts","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-user-factors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,KAAK,KAAK,kBAAkB,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EACL,wBAAwB,EACxB,KAAK,wCAAwC,EAC9C,MAAM,iCAAiC,CAAC;AAEzC,YAAY,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAEhG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;GAeG;AACH,8BAAsB,qBAAsB,SAAQ,wBAAwB;IAC1E,SAAS,aAAa,UAAU,EAAE,+BAA+B,EAEhE;IAED;;;;OAIG;IACG,OAAO,CACX,OAAO,EAAE,kBAAkB,CAAC,iBAAiB,GAC5C,OAAO,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAGrD;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,GAC3D,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,mBAAmB,CACvB,OAAO,EAAE,kBAAkB,CAAC,6BAA6B,GACxD,OAAO,CAAC,kBAAkB,CAAC,mCAAmC,CAAC,CAGjE;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,GACzD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;;;;;;OAOG;IACG,yBAAyB,CAC7B,OAAO,EAAE,kBAAkB,CAAC,mCAAmC,GAC9D,OAAO,CAAC,kBAAkB,CAAC,yCAAyC,CAAC,CAGvE;IAED;;OAEG;IACG,4BAA4B,CAChC,OAAO,EAAE,kBAAkB,CAAC,sCAAsC,GACjE,OAAO,CAAC,kBAAkB,CAAC,4CAA4C,CAAC,CAG1E;IAED;;OAEG;IACG,uBAAuB,CAC3B,OAAO,EAAE,kBAAkB,CAAC,iCAAiC,GAC5D,OAAO,CAAC,kBAAkB,CAAC,uCAAuC,CAAC,CAGrE;IAED;;OAEG;IACG,wBAAwB,CAC5B,OAAO,EAAE,kBAAkB,CAAC,kCAAkC,GAC7D,OAAO,CAAC,kBAAkB,CAAC,wCAAwC,CAAC,CAGtE;IAED;;OAEG;IACG,yBAAyB,CAC7B,OAAO,EAAE,kBAAkB,CAAC,mCAAmC,EAC/D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,yCAAyC,CAAC,CAGvE;CACF"}

package/dist/service/cognito/sim-cognito-user-factors.js

@@ -8,6 +8,10 @@ import { SimCognitoAuthentication, } from "./sim-cognito-authentication.js";
  * `AdminSetUserMFAPreference` is the administrative one, and authorizes
  * against the pool like every other admin operation.
  *
+ * The passkey operations are here for the same reason: a passkey is
+ * registered by the user it belongs to, from a session that already exists,
+ * and the access token is the whole of the authorization.
+ *
  * `SimCognitoUserDirectory` extends this, which extends
  * `SimCognitoAuthentication`.
  */
@@ -45,6 +49,39 @@ export class SimCognitoUserFactors extends SimCognitoAuthentication {
         await this.background.sequence();
         return this.commands.userMfa.setUserMfaPreference(command);
     }
+    /**
+     * Handle a StartWebAuthnRegistration Command from the SDK.
+     *
+     * The options this answers with are what a browser passes to
+     * `navigator.credentials.create()`. A test with no browser reads the
+     * credential its own authenticator would have made off the pool, through
+     * `SimCognitoUserPool.webAuthnCredential`.
+     */
+    async startWebAuthnRegistration(command) {
+        await this.background.sequence();
+        return this.commands.webAuthn.startWebAuthnRegistration(command);
+    }
+    /**
+     * Handle a CompleteWebAuthnRegistration Command from the SDK.
+     */
+    async completeWebAuthnRegistration(command) {
+        await this.background.sequence();
+        return this.commands.webAuthn.completeWebAuthnRegistration(command);
+    }
+    /**
+     * Handle a ListWebAuthnCredentials Command from the SDK.
+     */
+    async listWebAuthnCredentials(command) {
+        await this.background.sequence();
+        return this.commands.webAuthn.listWebAuthnCredentials(command);
+    }
+    /**
+     * Handle a DeleteWebAuthnCredential Command from the SDK.
+     */
+    async deleteWebAuthnCredential(command) {
+        await this.background.sequence();
+        return this.commands.webAuthn.deleteWebAuthnCredential(command);
+    }
     /**
      * Handle an AdminSetUserMFAPreference Command from the SDK.
      */

package/dist/service/cognito/sim-cognito-user-factors.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-factors.js","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-user-factors.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AASzC;;;;;;;;;;;GAWG;AACH,MAAM,OAAgB,qBAAsB,SAAQ,wBAAwB;IAC1E,YAAsB,UAA2C;QAC/D,KAAK,CAAC,UAAU,CAAC,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACX,OAA6C;QAE7C,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAyD;QAEzD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D;QAE1D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,yBAAyB,CAC7B,OAA+D,EAC/D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-factors.js","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-user-factors.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AASzC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAgB,qBAAsB,SAAQ,wBAAwB;IAC1E,YAAsB,UAA2C;QAC/D,KAAK,CAAC,UAAU,CAAC,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACX,OAA6C;QAE7C,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAyD;QAEzD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D;QAE1D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,yBAAyB,CAC7B,OAA+D;QAE/D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,4BAA4B,CAChC,OAAkE;QAElE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAC3B,OAA6D;QAE7D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAA8D;QAE9D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,yBAAyB,CAC7B,OAA+D,EAC/D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session.d.ts

@@ -1,6 +1,12 @@
+import type { SimCognitoUserPoolClient } from "../client/sim-cognito-user-pool-client.js";
+import type { SimCognitoWebAuthnRequestOptions } from "../user/web-authn/sim-cognito-web-authn-document.js";
 interface SimCognitoAuthSessionProperties {
     readonly username: string;
-    readonly clientId: string;
+    /**
+     * The app client the sign-in is running through, which is what says how
+     * long the session lasts: its `AuthSessionValidity`.
+     */
+    readonly client: SimCognitoUserPoolClient;
     readonly challengeName: string;
     readonly issuedAt: Date;
     /**
@@ -13,13 +19,24 @@ interface SimCognitoAuthSessionProperties {
      * app is showing.
      */
     readonly code?: string | undefined;
+    /**
+     * The options a `WEB_AUTHN` challenge asked a passkey to be presented
+     * against, for the challenge that asked.
+     *
+     * They live here for the same reason a code does. The challenge issued them,
+     * and a credential answering them can only complete the sign-in they belong
+     * to.
+     */
+    readonly webAuthnOptions?: SimCognitoWebAuthnRequestOptions | undefined;
 }
 /**
  * One challenge session, which is what an unfinished authentication carries
  * between the request that started it and the response that completes it.
  *
  * The session is opaque, single use, and tied to the user and app client that
- * got it: a session from one sign-in cannot complete another.
+ * got it: a session from one sign-in cannot complete another. How long it can
+ * be answered for is the app client's `AuthSessionValidity`, which is three
+ * minutes on a client that asked for none.
  */
 export declare class SimCognitoAuthSession {
     readonly id: string;
@@ -27,13 +44,27 @@ export declare class SimCognitoAuthSession {
     readonly clientId: string;
     readonly challengeName: string;
     readonly issuedAt: Date;
+    /**
+     * When this session runs out, which the app client's `AuthSessionValidity`
+     * decides. It is settled here rather than read back off the client, so a
+     * client updated mid-sign-in does not move the deadline of a challenge it
+     * has already issued.
+     */
+    readonly expiresAt: Date;
     /** The code this challenge sent, where it sent one. */
     readonly code: string | undefined;
+    /** What this challenge asked a passkey to be presented against. */
+    readonly webAuthnOptions: SimCognitoWebAuthnRequestOptions | undefined;
     constructor(properties: SimCognitoAuthSessionProperties);
     /**
      * Whether this session has run out by a given moment.
      */
     isExpiredAt(now: Date): boolean;
+    /**
+     * The options this challenge asked a passkey to be presented against, or a
+     * refusal where it asked for no passkey at all.
+     */
+    requireWebAuthnOptions(): SimCognitoWebAuthnRequestOptions;
     /**
      * Whether this session belongs to a user and app client.
      */

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-session.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-auth-session.ts"],"names":[],"mappings":"AAaA,UAAU,+BAA+B;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAExB;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,aAAa,EAAE,MAAM,CAAC;IACtC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAE/B,uDAAuD;IACvD,SAAgB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,YAAY,UAAU,EAAE,+BAA+B,EAOtD;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAM9B;IAED;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAEtC;CACF"}
+{"version":3,"file":"sim-cognito-auth-session.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-auth-session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAC;AAI5G,UAAU,+BAA+B;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAExB;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,gCAAgC,GAAG,SAAS,CAAC;CACzE;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,aAAa,EAAE,MAAM,CAAC;IACtC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAE/B;;;;;OAKG;IACH,SAAgB,SAAS,EAAE,IAAI,CAAC;IAEhC,uDAAuD;IACvD,SAAgB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,mEAAmE;IACnE,SAAgB,eAAe,EAAE,gCAAgC,GAAG,SAAS,CAAC;IAE9E,YAAY,UAAU,EAAE,+BAA+B,EAWtD;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE9B;IAED;;;OAGG;IACH,sBAAsB,IAAI,gCAAgC,CAQzD;IAED;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAEtC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session.js

@@ -1,19 +1,14 @@
 import { randomBytes } from "node:crypto";
-/**
- * How long a challenge session lasts.
- *
- * Real Cognito gives an app client an `AuthSessionValidity` of three minutes
- * unless the client says otherwise, and `CreateUserPoolClient` refuses that
- * input here, so three minutes is what every session gets.
- */
-const sessionMinutes = 3;
+import { SimCognitoNotAuthorizedException } from "../../error/sim-cognito.error.js";
 const sessionBytes = 48;
 /**
  * One challenge session, which is what an unfinished authentication carries
  * between the request that started it and the response that completes it.
  *
  * The session is opaque, single use, and tied to the user and app client that
- * got it: a session from one sign-in cannot complete another.
+ * got it: a session from one sign-in cannot complete another. How long it can
+ * be answered for is the app client's `AuthSessionValidity`, which is three
+ * minutes on a client that asked for none.
  */
 export class SimCognitoAuthSession {
     id;
@@ -21,22 +16,42 @@ export class SimCognitoAuthSession {
     clientId;
     challengeName;
     issuedAt;
+    /**
+     * When this session runs out, which the app client's `AuthSessionValidity`
+     * decides. It is settled here rather than read back off the client, so a
+     * client updated mid-sign-in does not move the deadline of a challenge it
+     * has already issued.
+     */
+    expiresAt;
     /** The code this challenge sent, where it sent one. */
     code;
+    /** What this challenge asked a passkey to be presented against. */
+    webAuthnOptions;
     constructor(properties) {
         this.id = randomBytes(sessionBytes).toString("base64url");
         this.username = properties.username;
-        this.clientId = properties.clientId;
+        this.clientId = properties.client.id;
         this.challengeName = properties.challengeName;
         this.issuedAt = properties.issuedAt;
+        this.expiresAt = properties.client.authSessionValidity.expiryOf(properties.issuedAt);
         this.code = properties.code;
+        this.webAuthnOptions = properties.webAuthnOptions;
     }
     /**
      * Whether this session has run out by a given moment.
      */
     isExpiredAt(now) {
-        const expiresAt = new Date(this.issuedAt.getTime() + sessionMinutes * 60 * 1000);
-        return now.getTime() >= expiresAt.getTime();
+        return now.getTime() >= this.expiresAt.getTime();
+    }
+    /**
+     * The options this challenge asked a passkey to be presented against, or a
+     * refusal where it asked for no passkey at all.
+     */
+    requireWebAuthnOptions() {
+        if (this.webAuthnOptions === undefined) {
+            throw new SimCognitoNotAuthorizedException("Invalid session for the user.");
+        }
+        return this.webAuthnOptions;
     }
     /**
      * Whether this session belongs to a user and app client.

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-session.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,YAAY,GAAG,EAAE,CAAC;AAoBxB;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IAChB,EAAE,CAAS;IACX,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,aAAa,CAAS;IACtB,QAAQ,CAAO;IAE/B,uDAAuD;IACvC,IAAI,CAAqB;IAEzC,YAAY,UAA2C;QACrD,IAAI,CAAC,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,EAAE,GAAG,IAAI,CACrD,CAAC;QAEF,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAgB,EAAE,QAAgB;QAC1C,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAClE,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAqB;QAC3B,OAAO,IAAI,CAAC,aAAa,KAAK,aAAa,CAAC;IAC9C,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-auth-session.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAIpF,MAAM,YAAY,GAAG,EAAE,CAAC;AAmCxB;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChB,EAAE,CAAS;IACX,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,aAAa,CAAS;IACtB,QAAQ,CAAO;IAE/B;;;;;OAKG;IACa,SAAS,CAAO;IAEhC,uDAAuD;IACvC,IAAI,CAAqB;IAEzC,mEAAmE;IACnD,eAAe,CAA+C;IAE9E,YAAY,UAA2C;QACrD,IAAI,CAAC,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAC7D,UAAU,CAAC,QAAQ,CACpB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,sBAAsB;QACpB,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,gCAAgC,CACxC,+BAA+B,CAChC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAgB,EAAE,QAAgB;QAC1C,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAClE,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAqB;QAC3B,OAAO,IAAI,CAAC,aAAa,KAAK,aAAa,CAAC;IAC9C,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.d.ts

@@ -27,6 +27,15 @@ export declare class SimCognitoIssuedTokenStore {
      * Remember a refresh token, so it can be exchanged later.
      */
     addRefreshToken(token: SimCognitoIssuedToken): void;
+    /**
+     * Stop honouring a refresh token from a moment on, because a rotation has
+     * replaced it.
+     *
+     * The moment is the end of the app client's retry grace period rather than
+     * now, so a client that retried a request whose answer it never saw is
+     * answered with the tokens instead of being sent back to the sign-in page.
+     */
+    revokeRefreshTokenAt(token: SimCognitoIssuedToken, revokedAt: Date): void;
     /**
      * Remember an access token, so a sign-out can be authorized with it.
      */
@@ -36,7 +45,8 @@ export declare class SimCognitoIssuedTokenStore {
      *
      * A token this pool never issued, one belonging to another app client, one
      * that has run out, and one the user has been signed out of all fail the
-     * same way, as they do on real Cognito.
+     * same way, as they do on real Cognito. A rotated-out token whose grace
+     * period is up is refused as a revoked one, which is what it now is.
      */
     requireRefreshToken(request: SimCognitoRefreshTokenRequest): SimCognitoIssuedToken;
     /**

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4C;IAC1E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IAEzE;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAe1B;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKlD;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKjD;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAYvB;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,qBAAqB,GAAG,SAAS,CAMnC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMjC;CACF"}
+{"version":3,"file":"sim-cognito-issued-token-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4C;IAC1E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IAEzE;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAe1B;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKlD;IAED;;;;;;;OAOG;IACH,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,CAExE;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAKjD;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAkBvB;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,qBAAqB,GAAG,SAAS,CAMnC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMjC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.js

@@ -28,9 +28,20 @@ export class SimCognitoIssuedTokenStore {
      * Remember a refresh token, so it can be exchanged later.
      */
     addRefreshToken(token) {
-        SimCognitoIssuedTokenStore.forgetSpent(this.refreshTokens, (issued) => issued.isExpiredAt(token.issuedAt));
+        SimCognitoIssuedTokenStore.forgetSpent(this.refreshTokens, (issued) => issued.isSpentAt(token.issuedAt));
         this.refreshTokens.set(token.value, token);
     }
+    /**
+     * Stop honouring a refresh token from a moment on, because a rotation has
+     * replaced it.
+     *
+     * The moment is the end of the app client's retry grace period rather than
+     * now, so a client that retried a request whose answer it never saw is
+     * answered with the tokens instead of being sent back to the sign-in page.
+     */
+    revokeRefreshTokenAt(token, revokedAt) {
+        this.refreshTokens.set(token.value, token.rotatedOutAt(revokedAt));
+    }
     /**
      * Remember an access token, so a sign-out can be authorized with it.
      */
@@ -43,7 +54,8 @@ export class SimCognitoIssuedTokenStore {
      *
      * A token this pool never issued, one belonging to another app client, one
      * that has run out, and one the user has been signed out of all fail the
-     * same way, as they do on real Cognito.
+     * same way, as they do on real Cognito. A rotated-out token whose grace
+     * period is up is refused as a revoked one, which is what it now is.
      */
     requireRefreshToken(request) {
         const issued = this.refreshTokens.get(request.value);
@@ -53,6 +65,9 @@ export class SimCognitoIssuedTokenStore {
         if (issued.isExpiredAt(request.now)) {
             throw new SimCognitoNotAuthorizedException("Refresh Token has expired.");
         }
+        if (issued.isRevokedAt(request.now)) {
+            throw new SimCognitoNotAuthorizedException("Refresh Token has been revoked.");
+        }
         return issued;
     }
     /**

package/dist/service/cognito/user-pool/auth/sim-cognito-issued-token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-issued-token-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAYpF;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACpB,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IACzD,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzE;;;OAGG;IACK,MAAM,CAAC,WAAW,CACxB,MAA0C,EAC1C,KAAiD;QAEjD,MAAM,MAAM,GAAG,MAAM;aAClB,MAAM,EAAE;aACR,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7B,OAAO,EAAE,CAAC;QAEb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACpE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAErD,IAAI,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,gCAAgC,CAAC,wBAAwB,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,CAAC,4BAA4B,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,KAAyB;QAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAgB;QACzB,MAAM,MAAM,GAAG,CAAC,MAA6B,EAAW,EAAE,CACxD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAE/B,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACnE,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-issued-token-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-issued-token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAYpF;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACpB,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IACzD,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzE;;;OAGG;IACK,MAAM,CAAC,WAAW,CACxB,MAA0C,EAC1C,KAAiD;QAEjD,MAAM,MAAM,GAAG,MAAM;aAClB,MAAM,EAAE;aACR,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7B,OAAO,EAAE,CAAC;QAEb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACpE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CACjC,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;OAOG;IACH,oBAAoB,CAAC,KAA4B,EAAE,SAAe;QAChE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CACnE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAErD,IAAI,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,gCAAgC,CAAC,wBAAwB,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,CAAC,4BAA4B,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,gCAAgC,CACxC,iCAAiC,CAClC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,KAAyB;QAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAgB;QACzB,MAAM,MAAM,GAAG,CAAC,MAA6B,EAAW,EAAE,CACxD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAE/B,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACnE,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;CACF"}