@kensio/yulin 1.18.2 → 1.19.0

package/dist/service/cognito/command/auth/sim-cognito-auth-challenge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-challenge.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,eAAO,MAAM,4BAA4B,0BAA0B,CAAC;AAgBpE;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,MAAM,CAaR"}
+{"version":3,"file":"sim-cognito-auth-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-challenge.ts"],"names":[],"mappings":"AAWA;;GAEG;AACH,eAAO,MAAM,4BAA4B,0BAA0B,CAAC;AAuBpE;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,MAAM,CAaR"}

package/dist/service/cognito/command/auth/sim-cognito-auth-challenge.js

@@ -1,5 +1,7 @@
 import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
 import { simCognitoSmsMfa, simCognitoSoftwareTokenMfa, } from "../../user-pool/user/mfa/sim-cognito-mfa-factors.js";
+import { simCognitoPasswordChallenge, simCognitoWebAuthnChallenge, } from "./sim-cognito-available-challenges.js";
+import { simCognitoSelectChallenge } from "./sim-cognito-first-factor-challenge.js";
 /**
  * The challenge a user with a temporary password is answered with.
  */
@@ -11,11 +13,18 @@ export const newPasswordRequiredChallenge = "NEW_PASSWORD_REQUIRED";
  * how Cognito names them: a user registered for a software token is
  * challenged with `SOFTWARE_TOKEN_MFA` and answers with a
  * `SOFTWARE_TOKEN_MFA_CODE`.
+ *
+ * The last three are the first factors of a `USER_AUTH` sign-in.
+ * `SELECT_CHALLENGE` is answered with the factor the user picked, and the
+ * other two with the factor itself.
  */
 const answerableChallenges = [
     newPasswordRequiredChallenge,
     simCognitoSmsMfa,
     simCognitoSoftwareTokenMfa,
+    simCognitoSelectChallenge,
+    simCognitoPasswordChallenge,
+    simCognitoWebAuthnChallenge,
 ];
 /**
  * Refuse a challenge this simulation cannot answer.

package/dist/service/cognito/command/auth/sim-cognito-auth-challenge.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,qDAAqD,CAAC;AAE7D;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAuB,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAsB;IAC9C,4BAA4B;IAC5B,gBAAgB;IAChB,0BAA0B;CAC3B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,aAAiC;IAEjC,IACE,aAAa,KAAK,SAAS;QAC3B,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC5C,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,IAAI,mCAAmC,CAC3C,kBAAkB,MAAM,CAAC,aAAa,CAAC,sBAAsB;QAC3D,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;QAC7D,oBAAoB,CACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sim-cognito-auth-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EACL,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAEpF;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAuB,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAsB;IAC9C,4BAA4B;IAC5B,gBAAgB;IAChB,0BAA0B;IAC1B,yBAAyB;IACzB,2BAA2B;IAC3B,2BAA2B;CAC5B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,aAAiC;IAEjC,IACE,aAAa,KAAK,SAAS;QAC3B,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC5C,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,IAAI,mCAAmC,CAC3C,kBAAkB,MAAM,CAAC,aAAa,CAAC,sBAAsB;QAC3D,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;QAC7D,oBAAoB,CACvB,CAAC;AACJ,CAAC"}

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.d.ts

@@ -8,6 +8,7 @@ import { SimCognitoAdminInitiateAuth } from "./sim-cognito-admin-initiate-auth.j
 import { SimCognitoAdminRespondToChallenge } from "./sim-cognito-admin-respond-to-challenge.js";
 import { SimCognitoGetTokensFromRefreshToken } from "./sim-cognito-get-tokens-from-refresh-token.js";
 import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
+import type { SimCognitoFirstFactorChallenge } from "./sim-cognito-first-factor-challenge.js";
 import { SimCognitoInitiateAuth } from "./sim-cognito-initiate-auth.js";
 import { SimCognitoRespondToChallenge } from "./sim-cognito-respond-to-challenge.js";
 import { SimCognitoSignOutCommands } from "./sim-cognito-sign-out.js";
@@ -28,6 +29,11 @@ interface SimCognitoAuthCommandsProperties {
      * recorded the same way.
      */
     readonly messenger: SimCognitoPoolMessenger;
+    /**
+     * What asks a user for its first factor, shared with the hosted endpoints so
+     * a passkey presented at either answers the same kind of challenge.
+     */
+    readonly firstFactor: SimCognitoFirstFactorChallenge;
 }
 /**
  * The authentication command handlers of one simulated Cognito scope.

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AACrG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAC5G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAEhG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAQxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAErF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAE9C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAE5C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;;;;;;;;;GAUG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,uBAAuB,EAAE,iCAAiC,CAAC;IAC3E,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,kBAAkB,EAAE,4BAA4B,CAAC;IACjE,SAAgB,yBAAyB,EAAE,mCAAmC,CAAC;IAC/E,SAAgB,OAAO,EAAE,yBAAyB,CAAC;IAEnD,YAAY,UAAU,EAAE,gCAAgC,EA8DvD;CACF"}
+{"version":3,"file":"sim-cognito-auth-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AACrG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAC5G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAEhG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAI9F,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAQxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAGrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,UAAU,gCAAgC;IACxC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAE9C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAE5C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAE5C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,8BAA8B,CAAC;CACtD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,uBAAuB,EAAE,iCAAiC,CAAC;IAC3E,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,kBAAkB,EAAE,4BAA4B,CAAC;IACjE,SAAgB,yBAAyB,EAAE,mCAAmC,CAAC;IAC/E,SAAgB,OAAO,EAAE,yBAAyB,CAAC;IAEnD,YAAY,UAAU,EAAE,gCAAgC,EA6EvD;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.js

@@ -3,6 +3,9 @@ import { SimCognitoAdminRespondToChallenge } from "./sim-cognito-admin-respond-t
 import { SimCognitoAuthFlowRunner } from "./sim-cognito-auth-flow-runner.js";
 import { SimCognitoGetTokensFromRefreshToken } from "./sim-cognito-get-tokens-from-refresh-token.js";
 import { SimCognitoChallengeResponses } from "./sim-cognito-challenge-responses.js";
+import { SimCognitoFirstFactorResponse } from "./sim-cognito-first-factor-response.js";
+import { SimCognitoPasswordResponse } from "./sim-cognito-password-response.js";
+import { SimCognitoWebAuthnResponse } from "./sim-cognito-web-authn-response.js";
 import { SimCognitoInitiateAuth } from "./sim-cognito-initiate-auth.js";
 import { SimCognitoMfaChallenge } from "./sim-cognito-mfa-challenge.js";
 import { SimCognitoMfaResponse } from "./sim-cognito-mfa-response.js";
@@ -13,6 +16,7 @@ import { SimCognitoRefreshSignIn } from "./sim-cognito-refresh-sign-in.js";
 import { SimCognitoRefreshedTokens } from "./sim-cognito-refreshed-tokens.js";
 import { SimCognitoRespondToChallenge } from "./sim-cognito-respond-to-challenge.js";
 import { SimCognitoSignInCompletion } from "./sim-cognito-sign-in-completion.js";
+import { SimCognitoUserAuthSignIn } from "./sim-cognito-user-auth-sign-in.js";
 import { SimCognitoSignOutCommands } from "./sim-cognito-sign-out.js";
 /**
  * The authentication command handlers of one simulated Cognito scope.
@@ -33,7 +37,7 @@ export class SimCognitoAuthCommands {
     getTokensFromRefreshToken;
     signOut;
     constructor(properties) {
-        const { resolver, authResolver, pools, clock, triggers, tokenIssuer, messenger, } = properties;
+        const { resolver, authResolver, pools, clock, triggers, tokenIssuer, messenger, firstFactor, } = properties;
         // Every sign-in ends the same way, wherever it finished: with the second
         // factor where the user owes one, and with the tokens and the
         // PostAuthentication trigger where it does not.
@@ -46,14 +50,21 @@ export class SimCognitoAuthCommands {
         // and which app client the refresh went through is what decides whether a
         // new refresh token comes back.
         const refreshedTokens = new SimCognitoRefreshedTokens({ tokenIssuer });
+        const passwordSignIn = new SimCognitoPasswordSignIn({
+            authResolver,
+            completion,
+            challenge: new SimCognitoNewPasswordChallenge({ clock }),
+            triggers,
+        });
         const flowRunner = new SimCognitoAuthFlowRunner({
-            passwordSignIn: new SimCognitoPasswordSignIn({
+            passwordSignIn,
+            refreshSignIn: new SimCognitoRefreshSignIn({ refreshedTokens, clock }),
+            userAuthSignIn: new SimCognitoUserAuthSignIn({
                 authResolver,
-                completion,
-                challenge: new SimCognitoNewPasswordChallenge({ clock }),
+                challenge: firstFactor,
+                passwordSignIn,
                 triggers,
             }),
-            refreshSignIn: new SimCognitoRefreshSignIn({ refreshedTokens, clock }),
         });
         const responses = new SimCognitoChallengeResponses({
             newPassword: new SimCognitoNewPasswordResponse({
@@ -62,6 +73,13 @@ export class SimCognitoAuthCommands {
                 clock,
             }),
             mfa: new SimCognitoMfaResponse({ authResolver, completion, clock }),
+            firstFactor: new SimCognitoFirstFactorResponse({
+                authResolver,
+                challenge: firstFactor,
+                password: new SimCognitoPasswordResponse({ completion }),
+                webAuthn: new SimCognitoWebAuthnResponse({ completion }),
+                clock,
+            }),
         });
         this.adminInitiateAuth = new SimCognitoAdminInitiateAuth({
             authResolver,

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-commands.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-commands.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAErG,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAuBtE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sBAAsB;IACjB,iBAAiB,CAA8B;IAC/C,uBAAuB,CAAoC;IAC3D,YAAY,CAAyB;IACrC,kBAAkB,CAA+B;IACjD,yBAAyB,CAAsC;IAC/D,OAAO,CAA4B;IAEnD,YAAY,UAA4C;QACtD,MAAM,EACJ,QAAQ,EACR,YAAY,EACZ,KAAK,EACL,KAAK,EACL,QAAQ,EACR,WAAW,EACX,SAAS,GACV,GAAG,UAAU,CAAC;QACf,yEAAyE;QACzE,8DAA8D;QAC9D,gDAAgD;QAChD,MAAM,UAAU,GAAG,IAAI,0BAA0B,CAAC;YAChD,WAAW;YACX,QAAQ;YACR,YAAY,EAAE,IAAI,sBAAsB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,0EAA0E;QAC1E,0EAA0E;QAC1E,gCAAgC;QAChC,MAAM,eAAe,GAAG,IAAI,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACvE,MAAM,UAAU,GAAG,IAAI,wBAAwB,CAAC;YAC9C,cAAc,EAAE,IAAI,wBAAwB,CAAC;gBAC3C,YAAY;gBACZ,UAAU;gBACV,SAAS,EAAE,IAAI,8BAA8B,CAAC,EAAE,KAAK,EAAE,CAAC;gBACxD,QAAQ;aACT,CAAC;YACF,aAAa,EAAE,IAAI,uBAAuB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;SACvE,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,4BAA4B,CAAC;YACjD,WAAW,EAAE,IAAI,6BAA6B,CAAC;gBAC7C,YAAY;gBACZ,UAAU;gBACV,KAAK;aACN,CAAC;YACF,GAAG,EAAE,IAAI,qBAAqB,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;SACpE,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,GAAG,IAAI,2BAA2B,CAAC;YACvD,YAAY;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,uBAAuB,GAAG,IAAI,iCAAiC,CAAC;YACnE,YAAY;YACZ,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC;YAC7C,YAAY;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,GAAG,IAAI,4BAA4B,CAAC;YACzD,YAAY;YACZ,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,yBAAyB,GAAG,IAAI,mCAAmC,CAAC;YACvE,YAAY;YACZ,eAAe;YACf,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAyB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-auth-commands.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-commands.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAErG,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAEpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AA6BtE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sBAAsB;IACjB,iBAAiB,CAA8B;IAC/C,uBAAuB,CAAoC;IAC3D,YAAY,CAAyB;IACrC,kBAAkB,CAA+B;IACjD,yBAAyB,CAAsC;IAC/D,OAAO,CAA4B;IAEnD,YAAY,UAA4C;QACtD,MAAM,EACJ,QAAQ,EACR,YAAY,EACZ,KAAK,EACL,KAAK,EACL,QAAQ,EACR,WAAW,EACX,SAAS,EACT,WAAW,GACZ,GAAG,UAAU,CAAC;QACf,yEAAyE;QACzE,8DAA8D;QAC9D,gDAAgD;QAChD,MAAM,UAAU,GAAG,IAAI,0BAA0B,CAAC;YAChD,WAAW;YACX,QAAQ;YACR,YAAY,EAAE,IAAI,sBAAsB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,0EAA0E;QAC1E,0EAA0E;QAC1E,gCAAgC;QAChC,MAAM,eAAe,GAAG,IAAI,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACvE,MAAM,cAAc,GAAG,IAAI,wBAAwB,CAAC;YAClD,YAAY;YACZ,UAAU;YACV,SAAS,EAAE,IAAI,8BAA8B,CAAC,EAAE,KAAK,EAAE,CAAC;YACxD,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,wBAAwB,CAAC;YAC9C,cAAc;YACd,aAAa,EAAE,IAAI,uBAAuB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;YACtE,cAAc,EAAE,IAAI,wBAAwB,CAAC;gBAC3C,YAAY;gBACZ,SAAS,EAAE,WAAW;gBACtB,cAAc;gBACd,QAAQ;aACT,CAAC;SACH,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,4BAA4B,CAAC;YACjD,WAAW,EAAE,IAAI,6BAA6B,CAAC;gBAC7C,YAAY;gBACZ,UAAU;gBACV,KAAK;aACN,CAAC;YACF,GAAG,EAAE,IAAI,qBAAqB,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YACnE,WAAW,EAAE,IAAI,6BAA6B,CAAC;gBAC7C,YAAY;gBACZ,SAAS,EAAE,WAAW;gBACtB,QAAQ,EAAE,IAAI,0BAA0B,CAAC,EAAE,UAAU,EAAE,CAAC;gBACxD,QAAQ,EAAE,IAAI,0BAA0B,CAAC,EAAE,UAAU,EAAE,CAAC;gBACxD,KAAK;aACN,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,iBAAiB,GAAG,IAAI,2BAA2B,CAAC;YACvD,YAAY;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,uBAAuB,GAAG,IAAI,iCAAiC,CAAC;YACnE,YAAY;YACZ,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC;YAC7C,YAAY;YACZ,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,kBAAkB,GAAG,IAAI,4BAA4B,CAAC;YACzD,YAAY;YACZ,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,yBAAyB,GAAG,IAAI,mCAAmC,CAAC;YACvE,YAAY;YACZ,eAAe;YACf,KAAK;SACN,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAyB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-flow-runner.d.ts

@@ -1,10 +1,12 @@
 import type { SimCognitoAuthFlow } from "./sim-cognito-auth-flow.js";
 import type { SimCognitoPasswordSignIn, SimCognitoAuthRequest } from "./sim-cognito-password-sign-in.js";
 import type { SimCognitoRefreshSignIn } from "./sim-cognito-refresh-sign-in.js";
+import type { SimCognitoUserAuthSignIn } from "./sim-cognito-user-auth-sign-in.js";
 import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
 interface SimCognitoAuthFlowRunnerProperties {
     readonly passwordSignIn: SimCognitoPasswordSignIn;
     readonly refreshSignIn: SimCognitoRefreshSignIn;
+    readonly userAuthSignIn: SimCognitoUserAuthSignIn;
 }
 /**
  * Runs whichever flow a request resolved to.
@@ -13,13 +15,15 @@ interface SimCognitoAuthFlowRunnerProperties {
  * the pool differently, and once a flow is resolved they run the same bodies,
  * so the running of one lives here rather than in either command.
  *
- * Running a flow is asynchronous because either flow may have to wait on the
- * pool's Lambda triggers. A password sign-in runs the authentication triggers,
- * and both flows run `PreTokenGeneration` where they issue tokens.
+ * Running a flow is asynchronous because any of them may have to wait on the
+ * pool's Lambda triggers. A password sign-in and a choice-based one run the
+ * authentication triggers, and every flow runs `PreTokenGeneration` where it
+ * issues tokens.
  */
 export declare class SimCognitoAuthFlowRunner {
     private readonly passwordSignIn;
     private readonly refreshSignIn;
+    private readonly userAuthSignIn;
     constructor(properties: SimCognitoAuthFlowRunnerProperties);
     /**
      * Run a flow the app client is configured for.

package/dist/service/cognito/command/auth/sim-cognito-auth-flow-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-flow-runner.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flow-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;CACjD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IAExD,YAAY,UAAU,EAAE,kCAAkC,EAGzD;IAED;;OAEG;IACG,GAAG,CACP,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,8BAA8B,CAAC,CAMzC;CACF"}
+{"version":3,"file":"sim-cognito-auth-flow-runner.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flow-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;CACnD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IACxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAE1D,YAAY,UAAU,EAAE,kCAAkC,EAIzD;IAED;;OAEG;IACG,GAAG,CACP,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,8BAA8B,CAAC,CAUzC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-flow-runner.js

@@ -5,16 +5,19 @@
  * the pool differently, and once a flow is resolved they run the same bodies,
  * so the running of one lives here rather than in either command.
  *
- * Running a flow is asynchronous because either flow may have to wait on the
- * pool's Lambda triggers. A password sign-in runs the authentication triggers,
- * and both flows run `PreTokenGeneration` where they issue tokens.
+ * Running a flow is asynchronous because any of them may have to wait on the
+ * pool's Lambda triggers. A password sign-in and a choice-based one run the
+ * authentication triggers, and every flow runs `PreTokenGeneration` where it
+ * issues tokens.
  */
 export class SimCognitoAuthFlowRunner {
     passwordSignIn;
     refreshSignIn;
+    userAuthSignIn;
     constructor(properties) {
         this.passwordSignIn = properties.passwordSignIn;
         this.refreshSignIn = properties.refreshSignIn;
+        this.userAuthSignIn = properties.userAuthSignIn;
     }
     /**
      * Run a flow the app client is configured for.
@@ -23,6 +26,9 @@ export class SimCognitoAuthFlowRunner {
         if (flow.exchangesRefreshToken) {
             return await this.refreshSignIn.handle(request);
         }
+        if (flow.offersChoice) {
+            return await this.userAuthSignIn.handle(request);
+        }
         return await this.passwordSignIn.handle(request);
     }
 }

package/dist/service/cognito/command/auth/sim-cognito-auth-flow-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-flow-runner.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flow-runner.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;GAUG;AACH,MAAM,OAAO,wBAAwB;IAClB,cAAc,CAA2B;IACzC,aAAa,CAA0B;IAExD,YAAY,UAA8C;QACxD,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CACP,IAAwB,EACxB,OAA8B;QAE9B,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-auth-flow-runner.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flow-runner.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IAClB,cAAc,CAA2B;IACzC,aAAa,CAA0B;IACvC,cAAc,CAA2B;IAE1D,YAAY,UAA8C;QACxD,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CACP,IAAwB,EACxB,OAA8B;QAE9B,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-flow.d.ts

@@ -5,6 +5,7 @@ interface SimCognitoAuthFlowProperties {
     readonly legacySettings?: readonly string[];
     readonly aliases?: readonly string[];
     readonly exchangesRefreshToken?: boolean;
+    readonly offersChoice?: boolean;
 }
 /**
  * One authentication flow this simulation runs.
@@ -22,6 +23,11 @@ export declare class SimCognitoAuthFlow {
      * a user in with a password.
      */
     readonly exchangesRefreshToken: boolean;
+    /**
+     * Whether the flow offers the user a choice of first factors rather than
+     * taking the one its name settles.
+     */
+    readonly offersChoice: boolean;
     private readonly aliases;
     private readonly settings;
     constructor(properties: SimCognitoAuthFlowProperties);

package/dist/service/cognito/command/auth/sim-cognito-auth-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-flow.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAEvG,UAAU,4BAA4B;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,aAAa,EAAE,MAAM,CAAC;IAEtC;;;OAGG;IACH,SAAgB,qBAAqB,EAAE,OAAO,CAAC;IAE/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAE7C,YAAY,UAAU,EAAE,4BAA4B,EASnD;IAED;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEjC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAaxD;CACF"}
+{"version":3,"file":"sim-cognito-auth-flow.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAEvG,UAAU,4BAA4B;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,aAAa,EAAE,MAAM,CAAC;IAEtC;;;OAGG;IACH,SAAgB,qBAAqB,EAAE,OAAO,CAAC;IAE/C;;;OAGG;IACH,SAAgB,YAAY,EAAE,OAAO,CAAC;IAEtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAE7C,YAAY,UAAU,EAAE,4BAA4B,EAUnD;IAED;;OAEG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEjC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAaxD;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-flow.js

@@ -15,12 +15,18 @@ export class SimCognitoAuthFlow {
      * a user in with a password.
      */
     exchangesRefreshToken;
+    /**
+     * Whether the flow offers the user a choice of first factors rather than
+     * taking the one its name settles.
+     */
+    offersChoice;
     aliases;
     settings;
     constructor(properties) {
         this.name = properties.name;
         this.clientSetting = properties.clientSetting;
         this.exchangesRefreshToken = properties.exchangesRefreshToken ?? false;
+        this.offersChoice = properties.offersChoice ?? false;
         this.aliases = properties.aliases ?? [];
         this.settings = [
             properties.clientSetting,

package/dist/service/cognito/command/auth/sim-cognito-auth-flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-flow.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAWvF;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACb,IAAI,CAAS;IACb,aAAa,CAAS;IAEtC;;;OAGG;IACa,qBAAqB,CAAU;IAE9B,OAAO,CAAoB;IAC3B,QAAQ,CAAoB;IAE7C,YAAY,UAAwC;QAClD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,qBAAqB,GAAG,UAAU,CAAC,qBAAqB,IAAI,KAAK,CAAC;QACvE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG;YACd,UAAU,CAAC,aAAa;YACxB,GAAG,CAAC,UAAU,CAAC,cAAc,IAAI,EAAE,CAAC;SACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,QAAgB;QACtB,OAAO,QAAQ,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,MAAgC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC7C,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CACzC,CAAC;QAEF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,GAAG,IAAI,CAAC,IAAI,kCAAkC,MAAM,CAAC,EAAE,eAAe;YACpE,mBAAmB,IAAI,CAAC,aAAa,8BAA8B,CACtE,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-auth-flow.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAYvF;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IACb,IAAI,CAAS;IACb,aAAa,CAAS;IAEtC;;;OAGG;IACa,qBAAqB,CAAU;IAE/C;;;OAGG;IACa,YAAY,CAAU;IAErB,OAAO,CAAoB;IAC3B,QAAQ,CAAoB;IAE7C,YAAY,UAAwC;QAClD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,qBAAqB,GAAG,UAAU,CAAC,qBAAqB,IAAI,KAAK,CAAC;QACvE,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,KAAK,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG;YACd,UAAU,CAAC,aAAa;YACxB,GAAG,CAAC,UAAU,CAAC,cAAc,IAAI,EAAE,CAAC;SACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,QAAgB;QACtB,OAAO,QAAQ,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,MAAgC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC7C,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CACzC,CAAC;QAEF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,GAAG,IAAI,CAAC,IAAI,kCAAkC,MAAM,CAAC,EAAE,eAAe;YACpE,mBAAmB,IAAI,CAAC,aAAa,8BAA8B,CACtE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-flows.d.ts

@@ -17,6 +17,14 @@ export declare const userPasswordFlow: SimCognitoAuthFlow;
  * accepts either.
  */
 export declare const refreshTokenFlow: SimCognitoAuthFlow;
+/**
+ * Choice-based sign-in, where the pool offers the factors it allows first and
+ * the user presents one of them.
+ *
+ * This is the flow a passkey is presented through. It runs on both entry
+ * points, as it does on real Cognito.
+ */
+export declare const userAuthFlow: SimCognitoAuthFlow;
 /**
  * The flows one entry point into authentication runs.
  *

package/dist/service/cognito/command/auth/sim-cognito-auth-flows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-flows.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flows.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE;;GAEG;AACH,eAAO,MAAM,qBAAqB,oBAIhC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,oBAI3B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,oBAK3B,CAAC;AAEH;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IAEtD,YAAY,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,kBAAkB,EAAE,EAGlE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAcxD;CACF;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,qBAGzB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,eAAe,qBAG1B,CAAC"}
+{"version":3,"file":"sim-cognito-auth-flows.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flows.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE;;GAEG;AACH,eAAO,MAAM,qBAAqB,oBAIhC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,oBAI3B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,oBAK3B,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,oBAIvB,CAAC;AAEH;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IAEtD,YAAY,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,kBAAkB,EAAE,EAGlE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CAcxD;CACF;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,qBAIzB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,eAAe,qBAI1B,CAAC"}

package/dist/service/cognito/command/auth/sim-cognito-auth-flows.js

@@ -31,6 +31,18 @@ export const refreshTokenFlow = new SimCognitoAuthFlow({
     aliases: ["REFRESH_TOKEN"],
     exchangesRefreshToken: true,
 });
+/**
+ * Choice-based sign-in, where the pool offers the factors it allows first and
+ * the user presents one of them.
+ *
+ * This is the flow a passkey is presented through. It runs on both entry
+ * points, as it does on real Cognito.
+ */
+export const userAuthFlow = new SimCognitoAuthFlow({
+    name: "USER_AUTH",
+    clientSetting: "ALLOW_USER_AUTH",
+    offersChoice: true,
+});
 /**
  * The flows one entry point into authentication runs.
  *
@@ -58,8 +70,8 @@ export class SimCognitoAuthFlows {
             return flow;
         }
         throw new SimCognitoInvalidParameterException(`AuthFlow '${String(authFlow)}' is not simulated: ${this.operation} ` +
-            `here runs ${this.flows.map((each) => each.name).join(" and ")}. SRP, ` +
-            `custom authentication and choice-based sign-in are not implemented.`);
+            `here runs ${this.flows.map((each) => each.name).join(" and ")}. SRP ` +
+            `and custom authentication are not implemented.`);
     }
 }
 /**
@@ -68,6 +80,7 @@ export class SimCognitoAuthFlows {
 export const adminAuthFlows = new SimCognitoAuthFlows("AdminInitiateAuth", [
     adminUserPasswordFlow,
     refreshTokenFlow,
+    userAuthFlow,
 ]);
 /**
  * The flows `InitiateAuth` runs.
@@ -75,5 +88,6 @@ export const adminAuthFlows = new SimCognitoAuthFlows("AdminInitiateAuth", [
 export const clientAuthFlows = new SimCognitoAuthFlows("InitiateAuth", [
     userPasswordFlow,
     refreshTokenFlow,
+    userAuthFlow,
 ]);
 //# sourceMappingURL=sim-cognito-auth-flows.js.map

package/dist/service/cognito/command/auth/sim-cognito-auth-flows.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-flows.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,kBAAkB,CAAC;IAC1D,IAAI,EAAE,0BAA0B;IAChC,aAAa,EAAE,gCAAgC;IAC/C,cAAc,EAAE,CAAC,mBAAmB,CAAC;CACtC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,kBAAkB,CAAC;IACrD,IAAI,EAAE,oBAAoB;IAC1B,aAAa,EAAE,0BAA0B;IACzC,cAAc,EAAE,CAAC,oBAAoB,CAAC;CACvC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,kBAAkB,CAAC;IACrD,IAAI,EAAE,oBAAoB;IAC1B,aAAa,EAAE,0BAA0B;IACzC,OAAO,EAAE,CAAC,eAAe,CAAC;IAC1B,qBAAqB,EAAE,IAAI;CAC5B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACb,SAAS,CAAS;IAClB,KAAK,CAAgC;IAEtD,YAAY,SAAiB,EAAE,KAAoC;QACjE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,QAA4B;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACzC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CACpC,CAAC;QAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,aAAa,MAAM,CAAC,QAAQ,CAAC,uBAAuB,IAAI,CAAC,SAAS,GAAG;YACnE,aAAa,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;YACvE,qEAAqE,CACxE,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,mBAAmB,CAAC,mBAAmB,EAAE;IACzE,qBAAqB;IACrB,gBAAgB;CACjB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,mBAAmB,CAAC,cAAc,EAAE;IACrE,gBAAgB;IAChB,gBAAgB;CACjB,CAAC,CAAC"}
+{"version":3,"file":"sim-cognito-auth-flows.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-flows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,kBAAkB,CAAC;IAC1D,IAAI,EAAE,0BAA0B;IAChC,aAAa,EAAE,gCAAgC;IAC/C,cAAc,EAAE,CAAC,mBAAmB,CAAC;CACtC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,kBAAkB,CAAC;IACrD,IAAI,EAAE,oBAAoB;IAC1B,aAAa,EAAE,0BAA0B;IACzC,cAAc,EAAE,CAAC,oBAAoB,CAAC;CACvC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,kBAAkB,CAAC;IACrD,IAAI,EAAE,oBAAoB;IAC1B,aAAa,EAAE,0BAA0B;IACzC,OAAO,EAAE,CAAC,eAAe,CAAC;IAC1B,qBAAqB,EAAE,IAAI;CAC5B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,kBAAkB,CAAC;IACjD,IAAI,EAAE,WAAW;IACjB,aAAa,EAAE,iBAAiB;IAChC,YAAY,EAAE,IAAI;CACnB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,mBAAmB;IACb,SAAS,CAAS;IAClB,KAAK,CAAgC;IAEtD,YAAY,SAAiB,EAAE,KAAoC;QACjE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,QAA4B;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACzC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CACpC,CAAC;QAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,aAAa,MAAM,CAAC,QAAQ,CAAC,uBAAuB,IAAI,CAAC,SAAS,GAAG;YACnE,aAAa,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ;YACtE,gDAAgD,CACnD,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,mBAAmB,CAAC,mBAAmB,EAAE;IACzE,qBAAqB;IACrB,gBAAgB;IAChB,YAAY;CACb,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,mBAAmB,CAAC,cAAc,EAAE;IACrE,gBAAgB;IAChB,gBAAgB;IAChB,YAAY;CACb,CAAC,CAAC"}

package/dist/service/cognito/command/auth/sim-cognito-auth-parameters.d.ts

@@ -13,6 +13,13 @@ export declare class SimCognitoAuthParameters {
      * Read a value the flow needs, or refuse.
      */
     require(name: string): string;
+    /**
+     * Read a value the flow needs as the JSON document it carries.
+     *
+     * A challenge response carries strings, so a credential travels as the JSON
+     * a browser serialized it to, which is how real Cognito takes one.
+     */
+    requireDocument(name: string): unknown;
     /**
      * Read a value that may or may not be there.
      */

package/dist/service/cognito/command/auth/sim-cognito-auth-parameters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-parameters.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-parameters.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YACE,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,EAIrD;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU5B;IAED;;OAEG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErC;CACF"}
+{"version":3,"file":"sim-cognito-auth-parameters.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-parameters.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD,YACE,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,EAIrD;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU5B;IAED;;;;;OAKG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAWrC;IAED;;OAEG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-auth-parameters.js

@@ -23,6 +23,22 @@ export class SimCognitoAuthParameters {
         }
         return value;
     }
+    /**
+     * Read a value the flow needs as the JSON document it carries.
+     *
+     * A challenge response carries strings, so a credential travels as the JSON
+     * a browser serialized it to, which is how real Cognito takes one.
+     */
+    requireDocument(name) {
+        const value = this.require(name);
+        try {
+            return JSON.parse(value);
+        }
+        catch {
+            throw new SimCognitoInvalidParameterException(`${name} in ${this.field} must be JSON: a credential travels as the ` +
+                `JSON a browser serializes a PublicKeyCredential to`);
+        }
+    }
     /**
      * Read a value that may or may not be there.
      */

package/dist/service/cognito/command/auth/sim-cognito-auth-parameters.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-parameters.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-parameters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAClB,KAAK,CAAS;IACd,MAAM,CAA8B;IAErD,YACE,KAAa,EACb,MAAoD;QAEpD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAY;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,8BAA8B,IAAI,OAAO,IAAI,CAAC,KAAK,EAAE,CACtD,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,IAAY;QACf,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-auth-parameters.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-auth-parameters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAClB,KAAK,CAAS;IACd,MAAM,CAA8B;IAErD,YACE,KAAa,EACb,MAAoD;QAEpD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAY;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,mCAAmC,CAC3C,8BAA8B,IAAI,OAAO,IAAI,CAAC,KAAK,EAAE,CACtD,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,IAAY;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,mCAAmC,CAC3C,GAAG,IAAI,OAAO,IAAI,CAAC,KAAK,6CAA6C;gBACnE,oDAAoD,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,IAAY;QACf,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-available-challenges.d.ts

@@ -0,0 +1,35 @@
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
+/**
+ * The challenge a user answers with a password.
+ */
+export declare const simCognitoPasswordChallenge = "PASSWORD";
+/**
+ * The challenge a user answers by presenting a passkey.
+ */
+export declare const simCognitoWebAuthnChallenge = "WEB_AUTHN";
+/**
+ * The challenges a `USER_AUTH` sign-in offers this user, in the order the
+ * pool's sign-in policy named them.
+ *
+ * A pool created with no `SignInPolicy` allows a password and nothing else,
+ * which is what real Cognito falls back to.
+ */
+export declare function simCognitoAvailableChallenges(pool: SimCognitoUserPool, user: SimCognitoUser): readonly string[];
+/**
+ * Refuse a challenge this sign-in cannot offer, naming the ones it can.
+ *
+ * A factor the pool does not allow, one this user has nothing to answer with,
+ * and one this simulation does not present all fail here, because each of them
+ * ends the sign-in either way and the caller is owed the reason.
+ */
+export declare function requireSimCognitoAvailableChallenge(challengeName: string, available: readonly string[], field: string): void;
+/**
+ * Refuse a password at a pool that allows none at the first prompt.
+ *
+ * A `USER_AUTH` request carrying a `PASSWORD` outright never reaches the
+ * choice, so the policy is read here instead. A pool that allows no password
+ * first refuses one, as it refuses one picked out of the choice.
+ */
+export declare function requireSimCognitoAllowedPassword(pool: SimCognitoUserPool): void;
+//# sourceMappingURL=sim-cognito-available-challenges.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-available-challenges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-available-challenges.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-available-challenges.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E;;GAEG;AACH,eAAO,MAAM,2BAA2B,aAAa,CAAC;AAEtD;;GAEG;AACH,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAwCvD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,cAAc,GACnB,SAAS,MAAM,EAAE,CAInB;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,KAAK,EAAE,MAAM,GACZ,IAAI,CAgBN;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,kBAAkB,GACvB,IAAI,CASN"}

package/dist/service/cognito/command/auth/sim-cognito-available-challenges.js

@@ -0,0 +1,83 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The challenge a user answers with a password.
+ */
+export const simCognitoPasswordChallenge = "PASSWORD";
+/**
+ * The challenge a user answers by presenting a passkey.
+ */
+export const simCognitoWebAuthnChallenge = "WEB_AUTHN";
+/**
+ * The two first factors this simulation presents.
+ *
+ * A code sent by email or by text is a `USER_AUTH` challenge too, and neither
+ * is issued here. Nothing delivers a message, and the pool's own
+ * `EmailConfiguration` and `SmsConfiguration` are refused for the same reason.
+ */
+const presentedChallenges = [
+    simCognitoPasswordChallenge,
+    simCognitoWebAuthnChallenge,
+];
+/**
+ * Whether this user could present a factor the pool allows.
+ *
+ * A passkey has to have been registered, and a code has to have somewhere to
+ * be sent. Real Cognito answers a user with the challenges it could actually
+ * complete, and this is the same filter.
+ */
+function canPresent(factor, user) {
+    if (factor === simCognitoWebAuthnChallenge) {
+        return user.webAuthn.credentials.length > 0;
+    }
+    if (factor === "EMAIL_OTP") {
+        return user.attributeValues.has("email");
+    }
+    if (factor === "SMS_OTP") {
+        return user.attributeValues.has("phone_number");
+    }
+    return true;
+}
+/**
+ * The challenges a `USER_AUTH` sign-in offers this user, in the order the
+ * pool's sign-in policy named them.
+ *
+ * A pool created with no `SignInPolicy` allows a password and nothing else,
+ * which is what real Cognito falls back to.
+ */
+export function simCognitoAvailableChallenges(pool, user) {
+    return pool.settings.signInPolicy.factors.filter((factor) => canPresent(factor, user));
+}
+/**
+ * Refuse a challenge this sign-in cannot offer, naming the ones it can.
+ *
+ * A factor the pool does not allow, one this user has nothing to answer with,
+ * and one this simulation does not present all fail here, because each of them
+ * ends the sign-in either way and the caller is owed the reason.
+ */
+export function requireSimCognitoAvailableChallenge(challengeName, available, field) {
+    if (!available.includes(challengeName)) {
+        throw new SimCognitoInvalidParameterException(`${field} '${challengeName}' is not available to this user: the ` +
+            `sign-in offers ${available.join(", ")}`);
+    }
+    if (!presentedChallenges.includes(challengeName)) {
+        throw new SimCognitoInvalidParameterException(`${field} '${challengeName}' is not simulated: a code sent by email or ` +
+            `by text needs the pool's EmailConfiguration or SmsConfiguration, ` +
+            `and this simulation delivers no message. Sign in with ` +
+            `${presentedChallenges.join(" or ")} instead.`);
+    }
+}
+/**
+ * Refuse a password at a pool that allows none at the first prompt.
+ *
+ * A `USER_AUTH` request carrying a `PASSWORD` outright never reaches the
+ * choice, so the policy is read here instead. A pool that allows no password
+ * first refuses one, as it refuses one picked out of the choice.
+ */
+export function requireSimCognitoAllowedPassword(pool) {
+    const { factors } = pool.settings.signInPolicy;
+    if (!factors.includes(simCognitoPasswordChallenge)) {
+        throw new SimCognitoInvalidParameterException(`AuthParameters PASSWORD is not a first factor this user pool allows: ` +
+            `its SignInPolicy AllowedFirstAuthFactors names ${factors.join(", ")}`);
+    }
+}
+//# sourceMappingURL=sim-cognito-available-challenges.js.map

package/dist/service/cognito/command/auth/sim-cognito-available-challenges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-available-challenges.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-available-challenges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAKvF;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,UAAU,CAAC;AAEtD;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAsB;IAC7C,2BAA2B;IAC3B,2BAA2B;CAC5B,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,UAAU,CACjB,MAAiC,EACjC,IAAoB;IAEpB,IAAI,MAAM,KAAK,2BAA2B,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,IAAwB,EACxB,IAAoB;IAEpB,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAC1D,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CACzB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CACjD,aAAqB,EACrB,SAA4B,EAC5B,KAAa;IAEb,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,KAAK,aAAa,uCAAuC;YAC/D,kBAAkB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,KAAK,aAAa,8CAA8C;YACtE,mEAAmE;YACnE,wDAAwD;YACxD,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CACjD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAC9C,IAAwB;IAExB,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;IAE/C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,mCAAmC,CAC3C,uEAAuE;YACrE,kDAAkD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/cognito/command/auth/sim-cognito-challenge-responses.d.ts

@@ -1,9 +1,11 @@
+import type { SimCognitoFirstFactorResponse } from "./sim-cognito-first-factor-response.js";
 import type { SimCognitoMfaResponse } from "./sim-cognito-mfa-response.js";
 import type { SimCognitoChallengeResponseRequest, SimCognitoNewPasswordResponse } from "./sim-cognito-new-password-response.js";
 import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
 interface SimCognitoChallengeResponsesProperties {
     readonly newPassword: SimCognitoNewPasswordResponse;
     readonly mfa: SimCognitoMfaResponse;
+    readonly firstFactor: SimCognitoFirstFactorResponse;
 }
 /**
  * Sends a challenge response to whichever challenge it is answering.
@@ -15,6 +17,7 @@ interface SimCognitoChallengeResponsesProperties {
 export declare class SimCognitoChallengeResponses {
     private readonly newPassword;
     private readonly mfa;
+    private readonly firstFactor;
     constructor(properties: SimCognitoChallengeResponsesProperties);
     /**
      * Answer the challenge the request names, or refuse a challenge this

package/dist/service/cognito/command/auth/sim-cognito-challenge-responses.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-challenge-responses.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-challenge-responses.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EACV,kCAAkC,EAClC,6BAA6B,EAC9B,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAE5C,YAAY,UAAU,EAAE,sCAAsC,EAG7D;IAED;;;OAGG;IACG,MAAM,CACV,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,8BAA8B,CAAC,CAQzC;CACF"}
+{"version":3,"file":"sim-cognito-challenge-responses.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-challenge-responses.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EACV,kCAAkC,EAClC,6BAA6B,EAC9B,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;CACrD;AAWD;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAE5D,YAAY,UAAU,EAAE,sCAAsC,EAI7D;IAED;;;OAGG;IACG,MAAM,CACV,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,8BAA8B,CAAC,CAezC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-challenge-responses.js

@@ -1,4 +1,14 @@
 import { newPasswordRequiredChallenge, requireSimCognitoChallengeName, } from "./sim-cognito-auth-challenge.js";
+import { simCognitoPasswordChallenge, simCognitoWebAuthnChallenge, } from "./sim-cognito-available-challenges.js";
+import { simCognitoSelectChallenge } from "./sim-cognito-first-factor-challenge.js";
+/**
+ * The challenges a `USER_AUTH` sign-in issues, which one responder answers.
+ */
+const firstFactorChallenges = new Set([
+    simCognitoSelectChallenge,
+    simCognitoPasswordChallenge,
+    simCognitoWebAuthnChallenge,
+]);
 /**
  * Sends a challenge response to whichever challenge it is answering.
  *
@@ -9,9 +19,11 @@ import { newPasswordRequiredChallenge, requireSimCognitoChallengeName, } from ".
 export class SimCognitoChallengeResponses {
     newPassword;
     mfa;
+    firstFactor;
     constructor(properties) {
         this.newPassword = properties.newPassword;
         this.mfa = properties.mfa;
+        this.firstFactor = properties.firstFactor;
     }
     /**
      * Answer the challenge the request names, or refuse a challenge this
@@ -22,6 +34,12 @@ export class SimCognitoChallengeResponses {
         if (challenge === newPasswordRequiredChallenge) {
             return await this.newPassword.handle(request);
         }
+        if (firstFactorChallenges.has(challenge)) {
+            return await this.firstFactor.handle({
+                ...request,
+                challengeName: challenge,
+            });
+        }
         return await this.mfa.handle({ ...request, challengeName: challenge });
     }
 }