@kensio/yulin 1.18.2 → 1.19.0

package/dist/service/cognito/serve/page/sim-cognito-sign-in-page.d.ts

@@ -4,7 +4,9 @@ import { type SimCognitoPageParameters } from "./sim-cognito-page-markup.js";
  * The sign-in form managed login answers an authorize request with.
  *
  * The form posts back to the authorize endpoint, carrying the parameters the
- * browser arrived on as hidden inputs and the two fields the person filled in.
+ * browser arrived on as hidden inputs and the fields the person filled in. A
+ * pool that allows a passkey at the first prompt offers one beside the
+ * password.
  * The pool's identity providers are links to the same endpoint with
  * `identity_provider` set, so both ways in are reachable from this one page,
  * and the other pages of the journey are links beside them.
@@ -16,5 +18,15 @@ export declare class SimCognitoSignInPage {
      * already been refused once.
      */
     render(pool: SimCognitoUserPool, parameters: SimCognitoPageParameters, message?: string): Response;
+    /**
+     * The passkey button, where the pool allows one at the first prompt.
+     *
+     * It skips the browser's own validation so that the password field can be
+     * left empty, and posts the username the person typed. Real managed login
+     * runs the WebAuthn ceremony in the browser at this point, and this
+     * simulation serves no script, so the button is the whole of what the form
+     * sends.
+     */
+    private passkeyButton;
 }
 //# sourceMappingURL=sim-cognito-sign-in-page.d.ts.map

package/dist/service/cognito/serve/page/sim-cognito-sign-in-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-sign-in-page.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-sign-in-page.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAkBtC;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,UAAU,EAAE,wBAAwB,EACpC,OAAO,CAAC,EAAE,MAAM,GACf,QAAQ,CAgBV;CACF"}
+{"version":3,"file":"sim-cognito-sign-in-page.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-sign-in-page.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAuBtC;;;;;;;;;;GAUG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IAErD;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,UAAU,EAAE,wBAAwB,EACpC,OAAO,CAAC,EAAE,MAAM,GACf,QAAQ,CAiBV;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;CAOtB"}

package/dist/service/cognito/serve/page/sim-cognito-sign-in-page.js

@@ -1,6 +1,10 @@
 import { SimCognitoPageMarkup, } from "./sim-cognito-page-markup.js";
 import { simCognitoAuthorizePath, simCognitoConfirmPath, simCognitoForgotPasswordPath, simCognitoSignUpPath, } from "./sim-cognito-page-paths.js";
 import { simCognitoProviderLinks } from "./sim-cognito-provider-links.js";
+/**
+ * The factor a pool has to allow before the form offers a passkey.
+ */
+const webAuthnFactor = "WEB_AUTHN";
 /**
  * The other pages the sign-in form links to, in the order they are offered.
  */
@@ -13,7 +17,9 @@ const linkedPages = [
  * The sign-in form managed login answers an authorize request with.
  *
  * The form posts back to the authorize endpoint, carrying the parameters the
- * browser arrived on as hidden inputs and the two fields the person filled in.
+ * browser arrived on as hidden inputs and the fields the person filled in. A
+ * pool that allows a passkey at the first prompt offers one beside the
+ * password.
  * The pool's identity providers are links to the same endpoint with
  * `identity_provider` set, so both ways in are reachable from this one page,
  * and the other pages of the journey are links beside them.
@@ -29,12 +35,28 @@ export class SimCognitoSignInPage {
             this.markup.form(simCognitoAuthorizePath, this.markup.hidden(parameters) +
                 this.markup.field("username", "Username") +
                 this.markup.field("password", "Password", "password") +
-                this.markup.submit("signIn", "Sign in")) +
+                this.markup.submit("signIn", "Sign in") +
+                this.passkeyButton(pool)) +
             simCognitoProviderLinks(this.markup, pool, parameters) +
             linkedPages
                 .map(([path, text]) => this.markup.link(path, parameters, text))
                 .join("");
         return this.markup.page("Sign in", body);
     }
+    /**
+     * The passkey button, where the pool allows one at the first prompt.
+     *
+     * It skips the browser's own validation so that the password field can be
+     * left empty, and posts the username the person typed. Real managed login
+     * runs the WebAuthn ceremony in the browser at this point, and this
+     * simulation serves no script, so the button is the whole of what the form
+     * sends.
+     */
+    passkeyButton(pool) {
+        if (!pool.settings.signInPolicy.factors.includes(webAuthnFactor)) {
+            return "";
+        }
+        return this.markup.submit("passkey", "Sign in with a passkey", true);
+    }
 }
 //# sourceMappingURL=sim-cognito-sign-in-page.js.map

package/dist/service/cognito/serve/page/sim-cognito-sign-in-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-sign-in-page.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-sign-in-page.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,GAA2C;IAC1D,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACjC,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;IAC5C,CAAC,4BAA4B,EAAE,0BAA0B,CAAC;CAC3D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAErD;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,UAAoC,EACpC,OAAgB;QAEhB,MAAM,IAAI,GACR,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uBAAuB,EACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC;gBACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAC1C;YACD,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC;YACtD,WAAW;iBACR,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;iBAC/D,IAAI,CAAC,EAAE,CAAC,CAAC;QAEd,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-sign-in-page.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-sign-in-page.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E;;GAEG;AACH,MAAM,cAAc,GAAG,WAAW,CAAC;AAEnC;;GAEG;AACH,MAAM,WAAW,GAA2C;IAC1D,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACjC,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;IAC5C,CAAC,4BAA4B,EAAE,0BAA0B,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAErD;;;OAGG;IACH,MAAM,CACJ,IAAwB,EACxB,UAAoC,EACpC,OAAgB;QAEhB,MAAM,IAAI,GACR,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uBAAuB,EACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC;gBACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC;gBACvC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAC3B;YACD,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC;YACtD,WAAW;iBACR,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;iBAC/D,IAAI,CAAC,EAAE,CAAC,CAAC;QAEd,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;OAQG;IACK,aAAa,CAAC,IAAwB;QAC5C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC;CACF"}

package/dist/service/cognito/sim-cognito-user-factors.d.ts

@@ -16,6 +16,10 @@ interface SimCognitoUserFactorsProperties {
  * `AdminSetUserMFAPreference` is the administrative one, and authorizes
  * against the pool like every other admin operation.
  *
+ * The passkey operations are here for the same reason: a passkey is
+ * registered by the user it belongs to, from a session that already exists,
+ * and the access token is the whole of the authorization.
+ *
  * `SimCognitoUserDirectory` extends this, which extends
  * `SimCognitoAuthentication`.
  */
@@ -39,6 +43,27 @@ export declare abstract class SimCognitoUserFactors extends SimCognitoAuthentica
      * Handle a SetUserMFAPreference Command from the SDK.
      */
     setUserMFAPreference(command: simCognitoCommands.SimSetUserMFAPreferenceCommand): Promise<simCognitoCommands.SimSetUserMFAPreferenceCommandOutput>;
+    /**
+     * Handle a StartWebAuthnRegistration Command from the SDK.
+     *
+     * The options this answers with are what a browser passes to
+     * `navigator.credentials.create()`. A test with no browser reads the
+     * credential its own authenticator would have made off the pool, through
+     * `SimCognitoUserPool.webAuthnCredential`.
+     */
+    startWebAuthnRegistration(command: simCognitoCommands.SimStartWebAuthnRegistrationCommand): Promise<simCognitoCommands.SimStartWebAuthnRegistrationCommandOutput>;
+    /**
+     * Handle a CompleteWebAuthnRegistration Command from the SDK.
+     */
+    completeWebAuthnRegistration(command: simCognitoCommands.SimCompleteWebAuthnRegistrationCommand): Promise<simCognitoCommands.SimCompleteWebAuthnRegistrationCommandOutput>;
+    /**
+     * Handle a ListWebAuthnCredentials Command from the SDK.
+     */
+    listWebAuthnCredentials(command: simCognitoCommands.SimListWebAuthnCredentialsCommand): Promise<simCognitoCommands.SimListWebAuthnCredentialsCommandOutput>;
+    /**
+     * Handle a DeleteWebAuthnCredential Command from the SDK.
+     */
+    deleteWebAuthnCredential(command: simCognitoCommands.SimDeleteWebAuthnCredentialCommand): Promise<simCognitoCommands.SimDeleteWebAuthnCredentialCommandOutput>;
     /**
      * Handle an AdminSetUserMFAPreference Command from the SDK.
      */

package/dist/service/cognito/sim-cognito-user-factors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-factors.d.ts","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-user-factors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,KAAK,KAAK,kBAAkB,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EACL,wBAAwB,EACxB,KAAK,wCAAwC,EAC9C,MAAM,iCAAiC,CAAC;AAEzC,YAAY,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAEhG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,8BAAsB,qBAAsB,SAAQ,wBAAwB;IAC1E,SAAS,aAAa,UAAU,EAAE,+BAA+B,EAEhE;IAED;;;;OAIG;IACG,OAAO,CACX,OAAO,EAAE,kBAAkB,CAAC,iBAAiB,GAC5C,OAAO,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAGrD;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,GAC3D,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,mBAAmB,CACvB,OAAO,EAAE,kBAAkB,CAAC,6BAA6B,GACxD,OAAO,CAAC,kBAAkB,CAAC,mCAAmC,CAAC,CAGjE;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,GACzD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;OAEG;IACG,yBAAyB,CAC7B,OAAO,EAAE,kBAAkB,CAAC,mCAAmC,EAC/D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,yCAAyC,CAAC,CAGvE;CACF"}
+{"version":3,"file":"sim-cognito-user-factors.d.ts","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-user-factors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,KAAK,KAAK,kBAAkB,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EACL,wBAAwB,EACxB,KAAK,wCAAwC,EAC9C,MAAM,iCAAiC,CAAC;AAEzC,YAAY,EAAE,wCAAwC,EAAE,MAAM,iCAAiC,CAAC;AAEhG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;GAeG;AACH,8BAAsB,qBAAsB,SAAQ,wBAAwB;IAC1E,SAAS,aAAa,UAAU,EAAE,+BAA+B,EAEhE;IAED;;;;OAIG;IACG,OAAO,CACX,OAAO,EAAE,kBAAkB,CAAC,iBAAiB,GAC5C,OAAO,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAGrD;IAED;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,kBAAkB,CAAC,gCAAgC,GAC3D,OAAO,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAGpE;IAED;;OAEG;IACG,mBAAmB,CACvB,OAAO,EAAE,kBAAkB,CAAC,6BAA6B,GACxD,OAAO,CAAC,kBAAkB,CAAC,mCAAmC,CAAC,CAGjE;IAED;;OAEG;IACG,oBAAoB,CACxB,OAAO,EAAE,kBAAkB,CAAC,8BAA8B,GACzD,OAAO,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAGlE;IAED;;;;;;;OAOG;IACG,yBAAyB,CAC7B,OAAO,EAAE,kBAAkB,CAAC,mCAAmC,GAC9D,OAAO,CAAC,kBAAkB,CAAC,yCAAyC,CAAC,CAGvE;IAED;;OAEG;IACG,4BAA4B,CAChC,OAAO,EAAE,kBAAkB,CAAC,sCAAsC,GACjE,OAAO,CAAC,kBAAkB,CAAC,4CAA4C,CAAC,CAG1E;IAED;;OAEG;IACG,uBAAuB,CAC3B,OAAO,EAAE,kBAAkB,CAAC,iCAAiC,GAC5D,OAAO,CAAC,kBAAkB,CAAC,uCAAuC,CAAC,CAGrE;IAED;;OAEG;IACG,wBAAwB,CAC5B,OAAO,EAAE,kBAAkB,CAAC,kCAAkC,GAC7D,OAAO,CAAC,kBAAkB,CAAC,wCAAwC,CAAC,CAGtE;IAED;;OAEG;IACG,yBAAyB,CAC7B,OAAO,EAAE,kBAAkB,CAAC,mCAAmC,EAC/D,OAAO,CAAC,EAAE,wCAAwC,GACjD,OAAO,CAAC,kBAAkB,CAAC,yCAAyC,CAAC,CAGvE;CACF"}

package/dist/service/cognito/sim-cognito-user-factors.js

@@ -8,6 +8,10 @@ import { SimCognitoAuthentication, } from "./sim-cognito-authentication.js";
  * `AdminSetUserMFAPreference` is the administrative one, and authorizes
  * against the pool like every other admin operation.
  *
+ * The passkey operations are here for the same reason: a passkey is
+ * registered by the user it belongs to, from a session that already exists,
+ * and the access token is the whole of the authorization.
+ *
  * `SimCognitoUserDirectory` extends this, which extends
  * `SimCognitoAuthentication`.
  */
@@ -45,6 +49,39 @@ export class SimCognitoUserFactors extends SimCognitoAuthentication {
         await this.background.sequence();
         return this.commands.userMfa.setUserMfaPreference(command);
     }
+    /**
+     * Handle a StartWebAuthnRegistration Command from the SDK.
+     *
+     * The options this answers with are what a browser passes to
+     * `navigator.credentials.create()`. A test with no browser reads the
+     * credential its own authenticator would have made off the pool, through
+     * `SimCognitoUserPool.webAuthnCredential`.
+     */
+    async startWebAuthnRegistration(command) {
+        await this.background.sequence();
+        return this.commands.webAuthn.startWebAuthnRegistration(command);
+    }
+    /**
+     * Handle a CompleteWebAuthnRegistration Command from the SDK.
+     */
+    async completeWebAuthnRegistration(command) {
+        await this.background.sequence();
+        return this.commands.webAuthn.completeWebAuthnRegistration(command);
+    }
+    /**
+     * Handle a ListWebAuthnCredentials Command from the SDK.
+     */
+    async listWebAuthnCredentials(command) {
+        await this.background.sequence();
+        return this.commands.webAuthn.listWebAuthnCredentials(command);
+    }
+    /**
+     * Handle a DeleteWebAuthnCredential Command from the SDK.
+     */
+    async deleteWebAuthnCredential(command) {
+        await this.background.sequence();
+        return this.commands.webAuthn.deleteWebAuthnCredential(command);
+    }
     /**
      * Handle an AdminSetUserMFAPreference Command from the SDK.
      */

package/dist/service/cognito/sim-cognito-user-factors.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-factors.js","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-user-factors.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AASzC;;;;;;;;;;;GAWG;AACH,MAAM,OAAgB,qBAAsB,SAAQ,wBAAwB;IAC1E,YAAsB,UAA2C;QAC/D,KAAK,CAAC,UAAU,CAAC,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACX,OAA6C;QAE7C,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAyD;QAEzD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D;QAE1D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,yBAAyB,CAC7B,OAA+D,EAC/D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-factors.js","sourceRoot":"","sources":["../../../src/service/cognito/sim-cognito-user-factors.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AASzC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAgB,qBAAsB,SAAQ,wBAAwB;IAC1E,YAAsB,UAA2C;QAC/D,KAAK,CAAC,UAAU,CAAC,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACX,OAA6C;QAE7C,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,OAA4D;QAE5D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAyD;QAEzD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0D;QAE1D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,yBAAyB,CAC7B,OAA+D;QAE/D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,4BAA4B,CAChC,OAAkE;QAElE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAC3B,OAA6D;QAE7D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAA8D;QAE9D,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,yBAAyB,CAC7B,OAA+D,EAC/D,OAAkD;QAElD,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session.d.ts

@@ -1,6 +1,12 @@
+import type { SimCognitoUserPoolClient } from "../client/sim-cognito-user-pool-client.js";
+import type { SimCognitoWebAuthnRequestOptions } from "../user/web-authn/sim-cognito-web-authn-document.js";
 interface SimCognitoAuthSessionProperties {
     readonly username: string;
-    readonly clientId: string;
+    /**
+     * The app client the sign-in is running through, which is what says how
+     * long the session lasts: its `AuthSessionValidity`.
+     */
+    readonly client: SimCognitoUserPoolClient;
     readonly challengeName: string;
     readonly issuedAt: Date;
     /**
@@ -13,13 +19,24 @@ interface SimCognitoAuthSessionProperties {
      * app is showing.
      */
     readonly code?: string | undefined;
+    /**
+     * The options a `WEB_AUTHN` challenge asked a passkey to be presented
+     * against, for the challenge that asked.
+     *
+     * They live here for the same reason a code does. The challenge issued them,
+     * and a credential answering them can only complete the sign-in they belong
+     * to.
+     */
+    readonly webAuthnOptions?: SimCognitoWebAuthnRequestOptions | undefined;
 }
 /**
  * One challenge session, which is what an unfinished authentication carries
  * between the request that started it and the response that completes it.
  *
  * The session is opaque, single use, and tied to the user and app client that
- * got it: a session from one sign-in cannot complete another.
+ * got it: a session from one sign-in cannot complete another. How long it can
+ * be answered for is the app client's `AuthSessionValidity`, which is three
+ * minutes on a client that asked for none.
  */
 export declare class SimCognitoAuthSession {
     readonly id: string;
@@ -27,13 +44,27 @@ export declare class SimCognitoAuthSession {
     readonly clientId: string;
     readonly challengeName: string;
     readonly issuedAt: Date;
+    /**
+     * When this session runs out, which the app client's `AuthSessionValidity`
+     * decides. It is settled here rather than read back off the client, so a
+     * client updated mid-sign-in does not move the deadline of a challenge it
+     * has already issued.
+     */
+    readonly expiresAt: Date;
     /** The code this challenge sent, where it sent one. */
     readonly code: string | undefined;
+    /** What this challenge asked a passkey to be presented against. */
+    readonly webAuthnOptions: SimCognitoWebAuthnRequestOptions | undefined;
     constructor(properties: SimCognitoAuthSessionProperties);
     /**
      * Whether this session has run out by a given moment.
      */
     isExpiredAt(now: Date): boolean;
+    /**
+     * The options this challenge asked a passkey to be presented against, or a
+     * refusal where it asked for no passkey at all.
+     */
+    requireWebAuthnOptions(): SimCognitoWebAuthnRequestOptions;
     /**
      * Whether this session belongs to a user and app client.
      */

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-session.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-auth-session.ts"],"names":[],"mappings":"AAaA,UAAU,+BAA+B;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAExB;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,aAAa,EAAE,MAAM,CAAC;IACtC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAE/B,uDAAuD;IACvD,SAAgB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,YAAY,UAAU,EAAE,+BAA+B,EAOtD;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAM9B;IAED;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAEtC;CACF"}
+{"version":3,"file":"sim-cognito-auth-session.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-auth-session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAC;AAI5G,UAAU,+BAA+B;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAExB;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,gCAAgC,GAAG,SAAS,CAAC;CACzE;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,aAAa,EAAE,MAAM,CAAC;IACtC,SAAgB,QAAQ,EAAE,IAAI,CAAC;IAE/B;;;;;OAKG;IACH,SAAgB,SAAS,EAAE,IAAI,CAAC;IAEhC,uDAAuD;IACvD,SAAgB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,mEAAmE;IACnE,SAAgB,eAAe,EAAE,gCAAgC,GAAG,SAAS,CAAC;IAE9E,YAAY,UAAU,EAAE,+BAA+B,EAWtD;IAED;;OAEG;IACH,WAAW,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAE9B;IAED;;;OAGG;IACH,sBAAsB,IAAI,gCAAgC,CAQzD;IAED;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErD;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAEtC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session.js

@@ -1,19 +1,14 @@
 import { randomBytes } from "node:crypto";
-/**
- * How long a challenge session lasts.
- *
- * Real Cognito gives an app client an `AuthSessionValidity` of three minutes
- * unless the client says otherwise, and `CreateUserPoolClient` refuses that
- * input here, so three minutes is what every session gets.
- */
-const sessionMinutes = 3;
+import { SimCognitoNotAuthorizedException } from "../../error/sim-cognito.error.js";
 const sessionBytes = 48;
 /**
  * One challenge session, which is what an unfinished authentication carries
  * between the request that started it and the response that completes it.
  *
  * The session is opaque, single use, and tied to the user and app client that
- * got it: a session from one sign-in cannot complete another.
+ * got it: a session from one sign-in cannot complete another. How long it can
+ * be answered for is the app client's `AuthSessionValidity`, which is three
+ * minutes on a client that asked for none.
  */
 export class SimCognitoAuthSession {
     id;
@@ -21,22 +16,42 @@ export class SimCognitoAuthSession {
     clientId;
     challengeName;
     issuedAt;
+    /**
+     * When this session runs out, which the app client's `AuthSessionValidity`
+     * decides. It is settled here rather than read back off the client, so a
+     * client updated mid-sign-in does not move the deadline of a challenge it
+     * has already issued.
+     */
+    expiresAt;
     /** The code this challenge sent, where it sent one. */
     code;
+    /** What this challenge asked a passkey to be presented against. */
+    webAuthnOptions;
     constructor(properties) {
         this.id = randomBytes(sessionBytes).toString("base64url");
         this.username = properties.username;
-        this.clientId = properties.clientId;
+        this.clientId = properties.client.id;
         this.challengeName = properties.challengeName;
         this.issuedAt = properties.issuedAt;
+        this.expiresAt = properties.client.authSessionValidity.expiryOf(properties.issuedAt);
         this.code = properties.code;
+        this.webAuthnOptions = properties.webAuthnOptions;
     }
     /**
      * Whether this session has run out by a given moment.
      */
     isExpiredAt(now) {
-        const expiresAt = new Date(this.issuedAt.getTime() + sessionMinutes * 60 * 1000);
-        return now.getTime() >= expiresAt.getTime();
+        return now.getTime() >= this.expiresAt.getTime();
+    }
+    /**
+     * The options this challenge asked a passkey to be presented against, or a
+     * refusal where it asked for no passkey at all.
+     */
+    requireWebAuthnOptions() {
+        if (this.webAuthnOptions === undefined) {
+            throw new SimCognitoNotAuthorizedException("Invalid session for the user.");
+        }
+        return this.webAuthnOptions;
     }
     /**
      * Whether this session belongs to a user and app client.

package/dist/service/cognito/user-pool/auth/sim-cognito-auth-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-auth-session.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,YAAY,GAAG,EAAE,CAAC;AAoBxB;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IAChB,EAAE,CAAS;IACX,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,aAAa,CAAS;IACtB,QAAQ,CAAO;IAE/B,uDAAuD;IACvC,IAAI,CAAqB;IAEzC,YAAY,UAA2C;QACrD,IAAI,CAAC,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,EAAE,GAAG,IAAI,CACrD,CAAC;QAEF,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAgB,EAAE,QAAgB;QAC1C,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAClE,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAqB;QAC3B,OAAO,IAAI,CAAC,aAAa,KAAK,aAAa,CAAC;IAC9C,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-auth-session.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAIpF,MAAM,YAAY,GAAG,EAAE,CAAC;AAmCxB;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChB,EAAE,CAAS;IACX,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,aAAa,CAAS;IACtB,QAAQ,CAAO;IAE/B;;;;;OAKG;IACa,SAAS,CAAO;IAEhC,uDAAuD;IACvC,IAAI,CAAqB;IAEzC,mEAAmE;IACnD,eAAe,CAA+C;IAE9E,YAAY,UAA2C;QACrD,IAAI,CAAC,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAC7D,UAAU,CAAC,QAAQ,CACpB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAS;QACnB,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,sBAAsB;QACpB,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,gCAAgC,CACxC,+BAA+B,CAChC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,QAAgB,EAAE,QAAgB;QAC1C,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAClE,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAqB;QAC3B,OAAO,IAAI,CAAC,aAAa,KAAK,aAAa,CAAC;IAC9C,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.d.ts

@@ -62,6 +62,11 @@ export declare class SimCognitoPoolAuth {
      * Resolve the challenge session a response carries, or refuse.
      */
     requireSession(request: SimCognitoAuthSessionRequest): SimCognitoAuthSession;
+    /**
+     * The `WEB_AUTHN` challenge session a test is reading a credential for, or a
+     * refusal where this pool has no such session.
+     */
+    requireWebAuthnSession(sessionId: string): SimCognitoAuthSession;
     /**
      * Forget a challenge session that has been used.
      */

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-pool-auth.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAEvF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAkB;;IAC7B;;OAEG;IACH,SAAgB,iBAAiB,kCAAyC;IAE1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IACzE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAI3D;;;;;OAKG;IACH,IAAI,MAAM,IAAI,wBAAwB,GAAG,SAAS,CAEjD;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,IAAI,IAAI,CAEnB;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,2BAA2B,GAAG,IAAI,CAE5D;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,2BAA2B,GAAG,SAAS,CAEzC;IAED;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAE/C;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,4BAA4B,GAAG,qBAAqB,CAE3E;IAED;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;;OAGG;IACH,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,CAExE;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAEvB;IAED;;OAEG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,qBAAqB,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;OAEG;IACH,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,IAAI,CAEnE;IAED;;;OAGG;IACH,uBAAuB,CACrB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,6BAA6B,GAAG,SAAS,CAE3C;IAED;;OAEG;IACH,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEtD;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE9B;CACF"}
+{"version":3,"file":"sim-cognito-pool-auth.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAChG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAEvF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,OAAO,EAEL,KAAK,6BAA6B,EACnC,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAkB;;IAC7B;;OAEG;IACH,SAAgB,iBAAiB,kCAAyC;IAE1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4C;IACzE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAI3D;;;;;OAKG;IACH,IAAI,MAAM,IAAI,wBAAwB,GAAG,SAAS,CAEjD;IAED;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAEhD;IAED;;OAEG;IACH,YAAY,IAAI,IAAI,CAEnB;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,2BAA2B,GAAG,IAAI,CAE5D;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,2BAA2B,GAAG,SAAS,CAEzC;IAED;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAE/C;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,4BAA4B,GAAG,qBAAqB,CAE3E;IAED;;;OAGG;IACH,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,qBAAqB,CAU/D;IAED;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAElD;IAED;;;OAGG;IACH,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,CAExE;IAED;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAO,EAAE,6BAA6B,GACrC,qBAAqB,CAEvB;IAED;;OAEG;IACH,gBAAgB,CACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,qBAAqB,GAAG,SAAS,CAEnC;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAEhE;IAED;;OAEG;IACH,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,IAAI,CAEnE;IAED;;;OAGG;IACH,uBAAuB,CACrB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,IAAI,GACR,6BAA6B,GAAG,SAAS,CAE3C;IAED;;OAEG;IACH,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEtD;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE9B;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.js

@@ -1,3 +1,4 @@
+import { SimCognitoNotAuthorizedException } from "../../error/sim-cognito.error.js";
 import { SimCognitoIdentityProviderStore } from "../idp/sim-cognito-identity-provider-store.js";
 import { SimCognitoAuthSessionStore, } from "./sim-cognito-auth-session-store.js";
 import { SimCognitoAuthorizationCodeStore } from "./sim-cognito-authorization-code-store.js";
@@ -73,6 +74,17 @@ export class SimCognitoPoolAuth {
     requireSession(request) {
         return this.sessions.require(request);
     }
+    /**
+     * The `WEB_AUTHN` challenge session a test is reading a credential for, or a
+     * refusal where this pool has no such session.
+     */
+    requireWebAuthnSession(sessionId) {
+        const session = this.sessions.find(sessionId);
+        if (session === undefined) {
+            throw new SimCognitoNotAuthorizedException("Invalid session for the user.");
+        }
+        return session;
+    }
     /**
      * Forget a challenge session that has been used.
      */

package/dist/service/cognito/user-pool/auth/sim-cognito-pool-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-pool-auth.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAGhG,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAG7F,OAAO,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAClG,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;OAEG;IACa,iBAAiB,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAEzD,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,YAAY,GAAG,IAAI,kCAAkC,EAAE,CAAC;IACxD,KAAK,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAC/C,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D,OAAO,CAAuC;IAE9C;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAiC;QACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAyB,EACzB,GAAS;QAET,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAA8B;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAqC;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAA8B;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,oBAAoB,CAAC,KAA4B,EAAE,SAAe;QAChE,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,KAAyB;QAEzB,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,OAAsC;QAC3D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,uBAAuB,CACrB,KAAyB,EACzB,GAAS;QAET,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,KAAyB;QAC9C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,QAAgB;QACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-pool-auth.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-pool-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,+BAA+B,EAAE,MAAM,+CAA+C,CAAC;AAGhG,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAG7F,OAAO,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAC;AAClG,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAkB;IAC7B;;OAEG;IACa,iBAAiB,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAEzD,QAAQ,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAC5C,YAAY,GAAG,IAAI,kCAAkC,EAAE,CAAC;IACxD,KAAK,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAC/C,MAAM,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAE3D,OAAO,CAAuC;IAE9C;;;;;OAKG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAgC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAiC;QACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,sBAAsB,CACpB,KAAyB,EACzB,GAAS;QAET,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAA8B;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAqC;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,sBAAsB,CAAC,SAAiB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,gCAAgC,CACxC,+BAA+B,CAChC,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAA8B;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAA4B;QAC1C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,oBAAoB,CAAC,KAA4B,EAAE,SAAe;QAChE,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,KAA4B;QACzC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,mBAAmB,CACjB,OAAsC;QAEtC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,KAAyB;QAEzB,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,OAAsC;QAC3D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,uBAAuB,CACrB,KAAyB,EACzB,GAAS;QAET,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,KAAyB;QAC9C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,QAAgB;QACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;CACF"}

package/dist/service/cognito/user-pool/auth/sim-cognito-sign-in.d.ts

@@ -46,4 +46,14 @@ export declare function requireSimCognitoPasswordSet(user: SimCognitoUser): void
  * for the user to read it from.
  */
 export declare function requireSimCognitoSignIn(user: SimCognitoUser, password: string): void;
+/**
+ * Refuse a user that cannot start a sign-in at all, whatever it is signing in
+ * with.
+ *
+ * A disabled user, one that has not confirmed its sign-up and one whose
+ * password an administrator has reset are each refused the way they are for a
+ * password sign-in. A factor that is not a password reaches these three on its
+ * own, because there is no password check to reach them from.
+ */
+export declare function requireSimCognitoReadyToSignIn(user: SimCognitoUser): void;
 //# sourceMappingURL=sim-cognito-sign-in.d.ts.map

package/dist/service/cognito/user-pool/auth/sim-cognito-sign-in.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-sign-in.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlE;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,MAAM,GACf,cAAc,CAgBhB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAInE;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAIrE;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAMvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,GACf,IAAI,CAQN"}
+{"version":3,"file":"sim-cognito-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-sign-in.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlE;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,MAAM,GACf,cAAc,CAgBhB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAInE;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAIrE;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAMvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,GACf,IAAI,CAQN;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAIzE"}

package/dist/service/cognito/user-pool/auth/sim-cognito-sign-in.js

@@ -72,4 +72,18 @@ export function requireSimCognitoSignIn(user, password) {
         throw new SimCognitoNotAuthorizedException("Incorrect username or password.");
     }
 }
+/**
+ * Refuse a user that cannot start a sign-in at all, whatever it is signing in
+ * with.
+ *
+ * A disabled user, one that has not confirmed its sign-up and one whose
+ * password an administrator has reset are each refused the way they are for a
+ * password sign-in. A factor that is not a password reaches these three on its
+ * own, because there is no password check to reach them from.
+ */
+export function requireSimCognitoReadyToSignIn(user) {
+    requireSimCognitoEnabled(user);
+    requireSimCognitoConfirmed(user);
+    requireSimCognitoPasswordSet(user);
+}
 //# sourceMappingURL=sim-cognito-sign-in.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-sign-in.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAwB,EACxB,MAAgC,EAChC,QAAgB;IAEhB,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAElD,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC,kBAAkB,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAElC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,gCAAgC,CACxC,iCAAiC,CAClC,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAoB;IAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,gCAAgC,CAAC,mBAAmB,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAoB;IAC7D,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,mCAAmC,CAAC,wBAAwB,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAoB;IAC/D,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAClC,MAAM,IAAI,wCAAwC,CAChD,uCAAuC,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAoB,EACpB,QAAgB;IAEhB,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAE/B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,gCAAgC,CACxC,iCAAiC,CAClC,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"sim-cognito-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,wCAAwC,EACxC,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAwB,EACxB,MAAgC,EAChC,QAAgB;IAEhB,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAElD,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC,kBAAkB,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAElC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,gCAAgC,CACxC,iCAAiC,CAClC,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAoB;IAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,gCAAgC,CAAC,mBAAmB,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAoB;IAC7D,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,mCAAmC,CAAC,wBAAwB,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAoB;IAC/D,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAClC,MAAM,IAAI,wCAAwC,CAChD,uCAAuC,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAoB,EACpB,QAAgB;IAEhB,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAE/B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,gCAAgC,CACxC,iCAAiC,CAClC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAAC,IAAoB;IACjE,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/B,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACjC,4BAA4B,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC"}

package/dist/service/cognito/user-pool/client/sim-cognito-auth-session-validity.d.ts

@@ -0,0 +1,27 @@
+/**
+ * How long the challenge sessions of one simulated app client last.
+ *
+ * A sign-in that is answered with a challenge carries a session between the
+ * request that started it and the response that finishes it, and this is the
+ * window the response has to arrive in. Cognito counts it in whole minutes,
+ * gives a client that asked for none three of them, and takes between three
+ * and fifteen.
+ *
+ * It is worth setting in a test that has anything to say about a session
+ * running out: three minutes of simulated time is quick to pass, and a
+ * fifteen-minute client is what makes the expiry visible as a choice rather
+ * than a constant.
+ */
+export declare class SimCognitoAuthSessionValidity {
+    /**
+     * The validity in minutes, as Cognito reports it on the client.
+     */
+    readonly minutes: number;
+    constructor(requested?: number);
+    private static minutesIn;
+    /**
+     * When a session issued at a moment runs out.
+     */
+    expiryOf(issuedAt: Date): Date;
+}
+//# sourceMappingURL=sim-cognito-auth-session-validity.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-auth-session-validity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-session-validity.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-auth-session-validity.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;GAaG;AACH,qBAAa,6BAA6B;IACxC;;OAEG;IACH,SAAgB,OAAO,EAAE,MAAM,CAAC;IAEhC,YAAY,SAAS,CAAC,EAAE,MAAM,EAE7B;IAED,OAAO,CAAC,MAAM,CAAC,SAAS;IAsBxB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAK7B;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-auth-session-validity.js

@@ -0,0 +1,55 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * How long a challenge session lasts when the app client says nothing, which
+ * is the default real Cognito applies.
+ */
+const defaultMinutes = 3;
+const leastMinutes = 3;
+const mostMinutes = 15;
+const secondsPerMinute = 60;
+const millisecondsPerSecond = 1000;
+/**
+ * How long the challenge sessions of one simulated app client last.
+ *
+ * A sign-in that is answered with a challenge carries a session between the
+ * request that started it and the response that finishes it, and this is the
+ * window the response has to arrive in. Cognito counts it in whole minutes,
+ * gives a client that asked for none three of them, and takes between three
+ * and fifteen.
+ *
+ * It is worth setting in a test that has anything to say about a session
+ * running out: three minutes of simulated time is quick to pass, and a
+ * fifteen-minute client is what makes the expiry visible as a choice rather
+ * than a constant.
+ */
+export class SimCognitoAuthSessionValidity {
+    /**
+     * The validity in minutes, as Cognito reports it on the client.
+     */
+    minutes;
+    constructor(requested) {
+        this.minutes = SimCognitoAuthSessionValidity.minutesIn(requested);
+    }
+    static minutesIn(requested) {
+        if (requested === undefined) {
+            return defaultMinutes;
+        }
+        if (!Number.isSafeInteger(requested)) {
+            throw new SimCognitoInvalidParameterException("AuthSessionValidity must be a whole number of minutes");
+        }
+        if (requested < leastMinutes || requested > mostMinutes) {
+            throw new SimCognitoInvalidParameterException(`AuthSessionValidity of ${String(requested)} minutes is outside the ` +
+                `range Cognito allows: between ${String(leastMinutes)} and ` +
+                `${String(mostMinutes)} minutes`);
+        }
+        return requested;
+    }
+    /**
+     * When a session issued at a moment runs out.
+     */
+    expiryOf(issuedAt) {
+        return new Date(issuedAt.getTime() +
+            this.minutes * secondsPerMinute * millisecondsPerSecond);
+    }
+}
+//# sourceMappingURL=sim-cognito-auth-session-validity.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-auth-session-validity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-auth-session-validity.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-auth-session-validity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;;GAGG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,6BAA6B;IACxC;;OAEG;IACa,OAAO,CAAS;IAEhC,YAAY,SAAkB;QAC5B,IAAI,CAAC,OAAO,GAAG,6BAA6B,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,SAA6B;QACpD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,mCAAmC,CAC3C,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,GAAG,YAAY,IAAI,SAAS,GAAG,WAAW,EAAE,CAAC;YACxD,MAAM,IAAI,mCAAmC,CAC3C,0BAA0B,MAAM,CAAC,SAAS,CAAC,0BAA0B;gBACnE,iCAAiC,MAAM,CAAC,YAAY,CAAC,OAAO;gBAC5D,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CACnC,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAc;QACrB,OAAO,IAAI,IAAI,CACb,QAAQ,CAAC,OAAO,EAAE;YAChB,IAAI,CAAC,OAAO,GAAG,gBAAgB,GAAG,qBAAqB,CAC1D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.d.ts

@@ -1,3 +1,4 @@
+import { SimCognitoAuthSessionValidity } from "./sim-cognito-auth-session-validity.js";
 import { SimCognitoExplicitAuthFlows } from "./sim-cognito-explicit-auth-flows.js";
 import { SimCognitoOAuthSettings, type SimCognitoOAuthSettingsType } from "./sim-cognito-oauth-settings.js";
 import { SimCognitoPreventUserExistenceErrors } from "./sim-cognito-prevent-user-existence-errors.js";
@@ -12,6 +13,7 @@ import { SimCognitoTokenValidity, type SimCognitoTokenValidityInput } from "./si
  */
 export interface SimCognitoUserPoolClientSettingsProperties extends SimCognitoTokenValidityInput, SimCognitoOAuthSettingsType {
     readonly ClientName?: string | undefined;
+    readonly AuthSessionValidity?: number | undefined;
     readonly ExplicitAuthFlows?: readonly string[] | undefined;
     readonly PreventUserExistenceErrors?: string | undefined;
     readonly RefreshTokenRotation?: SimCognitoRefreshTokenRotationType | undefined;
@@ -30,6 +32,10 @@ export declare class SimCognitoUserPoolClientSettings {
     readonly explicitAuthFlows: SimCognitoExplicitAuthFlows;
     readonly preventUserExistenceErrors: SimCognitoPreventUserExistenceErrors;
     readonly tokenValidity: SimCognitoTokenValidity;
+    /**
+     * How long a challenge this client issued can be answered for.
+     */
+    readonly authSessionValidity: SimCognitoAuthSessionValidity;
     /**
      * Whether this client rotates its refresh tokens, which decides what
      * renews a session made through it.

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client-settings.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,KAAK,2BAA2B,EACjC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AACtG,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACxC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,KAAK,4BAA4B,EAClC,MAAM,iCAAiC,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,WAAW,0CACf,SAAQ,4BAA4B,EAAE,2BAA2B;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAC1B,kCAAkC,GAClC,SAAS,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,qBAAa,gCAAgC;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,0BAA0B,EAAE,oCAAoC,CAAC;IACjF,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IAEvD;;;OAGG;IACH,SAAgB,oBAAoB,EAAE,8BAA8B,CAAC;IAErE;;OAEG;IACH,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAE/C,YAAY,UAAU,EAAE,0CAA0C,EAgBjE;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-client-settings.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-settings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,KAAK,2BAA2B,EACjC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AACtG,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACxC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,KAAK,4BAA4B,EAClC,MAAM,iCAAiC,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,WAAW,0CACf,SAAQ,4BAA4B,EAAE,2BAA2B;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAC1B,kCAAkC,GAClC,SAAS,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,qBAAa,gCAAgC;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,0BAA0B,EAAE,oCAAoC,CAAC;IACjF,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IAEvD;;OAEG;IACH,SAAgB,mBAAmB,EAAE,6BAA6B,CAAC;IAEnE;;;OAGG;IACH,SAAgB,oBAAoB,EAAE,8BAA8B,CAAC;IAErE;;OAEG;IACH,SAAgB,KAAK,EAAE,uBAAuB,CAAC;IAE/C,YAAY,UAAU,EAAE,0CAA0C,EAmBjE;CACF"}