@kensio/yulin 1.18.2 → 1.19.1

package/dist/service/cognito/user-pool/user/sim-cognito-user.d.ts

@@ -2,6 +2,7 @@ import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoFederatedIdentity } from "../idp/sim-cognito-federated-identity.js";
 import { SimCognitoUserMfa } from "./mfa/sim-cognito-user-mfa.js";
 import { SimCognitoUserPasswordReset } from "./sim-cognito-user-password-reset.js";
+import { SimCognitoUserWebAuthn } from "./web-authn/sim-cognito-user-web-authn.js";
 import type { SimCognitoAttributeType, SimCognitoUserAttributes } from "./sim-cognito-user-attributes.js";
 import { SimCognitoUserPassword } from "./sim-cognito-user-password.js";
 import { SimCognitoUserStatus } from "./sim-cognito-user-status.js";
@@ -44,6 +45,7 @@ export declare class SimCognitoUser {
     private readonly userAttributes;
     private readonly confirmation;
     private readonly userMfa;
+    private readonly userWebAuthn;
     private readonly reset;
     private readonly federatedIdentity;
     private userStatus;
@@ -51,13 +53,9 @@ export declare class SimCognitoUser {
     private isEnabled;
     private modifiedDate;
     constructor(properties: SimCognitoUserProperties);
-    /**
-     * When the user last changed.
-     */
+    /** When the user last changed. */
     get lastModifiedDate(): Date;
-    /**
-     * Where the user is in the status lifecycle.
-     */
+    /** Where the user is in the status lifecycle. */
     get status(): SimCognitoUserStatus;
     /**
      * Whether the user may authenticate at all.
@@ -106,6 +104,11 @@ export declare class SimCognitoUser {
      * `UserLastModifiedDate` on, as every other change to a user does.
      */
     get mfa(): SimCognitoUserMfa;
+    /**
+     * The passkeys this user has registered. A passkey is a first factor rather
+     * than a second one, so it sits beside `mfa` rather than among it.
+     */
+    get webAuthn(): SimCognitoUserWebAuthn;
     /**
      * The password reset this user can go through, which is what a forgotten
      * password is replaced by and what an administrator can force.
@@ -134,9 +137,7 @@ export declare class SimCognitoUser {
      * issued, so a caller can try again with the right one.
      */
     confirmSignUp(code: string | undefined): void;
-    /**
-     * Confirm the sign-up without a code, as `AdminConfirmSignUp` does.
-     */
+    /** Confirm the sign-up without a code, as `AdminConfirmSignUp` does. */
     confirm(): void;
     /**
      * Mark the named attributes verified, where this user has them.
@@ -155,17 +156,11 @@ export declare class SimCognitoUser {
      * message for the user to read it from.
      */
     hasPassword(candidate: string | undefined): boolean;
-    /**
-     * Apply an attribute update to this user.
-     */
+    /** Apply an attribute update to this user. */
     updateAttributes(requested: readonly SimCognitoAttributeType[] | undefined): void;
-    /**
-     * Let the user authenticate again.
-     */
+    /** Let the user authenticate again. */
     enable(): void;
-    /**
-     * Stop the user authenticating.
-     */
+    /** Stop the user authenticating. */
     disable(): void;
     /**
      * Move the user to a status, and let the code it holds follow.

package/dist/service/cognito/user-pool/user/sim-cognito-user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,UAAU,wBAAwB;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAEvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAEnD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,cAAc;IACzB,SAAgB,QAAQ,EAAE,kBAAkB,CAAC;IAC7C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8B;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0C;IAC5E,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,YAAY,CAAO;IAE3B,YAAY,UAAU,EAAE,wBAAwB,EA+B/C;IAED;;OAEG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;;;;;;OAOG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;IACH,IAAI,UAAU,IAAI,SAAS,uBAAuB,EAAE,CAMnD;IAED;;;;;;OAMG;IACH,IAAI,QAAQ,IAAI,2BAA2B,GAAG,SAAS,CAEtD;IAED;;;;;OAKG;IACH,IAAI,eAAe,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjD;IAED;;;;;;;;OAQG;IACH,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED;;;;OAIG;IACH,IAAI,GAAG,IAAI,iBAAiB,CAE3B;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,2BAA2B,CAE/C;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAGlE;IAED;;;;;;OAMG;IACH,sBAAsB,IAAI,IAAI,CAI7B;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAI5C;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAGd;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAG/C;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElD;IAED;;OAEG;IACH,gBAAgB,CACd,SAAS,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,GACxD,IAAI,CAGN;IAED;;OAEG;IACH,MAAM,IAAI,IAAI,CAGb;IAED;;OAEG;IACH,OAAO,IAAI,IAAI,CAGd;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,KAAK;CAGd"}
+{"version":3,"file":"sim-cognito-user.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,UAAU,wBAAwB;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAEvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAEnD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,cAAc;IACzB,SAAgB,QAAQ,EAAE,kBAAkB,CAAC;IAC7C,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8B;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0C;IAC5E,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,YAAY,CAAqC;IACzD,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,YAAY,CAAO;IAE3B,YAAY,UAAU,EAAE,wBAAwB,EAkC/C;IAED,kCAAkC;IAClC,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED,iDAAiD;IACjD,IAAI,MAAM,IAAI,oBAAoB,CAEjC;IAED;;;;;;;OAOG;IACH,IAAI,OAAO,IAAI,OAAO,CAErB;IAED;;;;;OAKG;IACH,IAAI,UAAU,IAAI,SAAS,uBAAuB,EAAE,CAMnD;IAED;;;;;;OAMG;IACH,IAAI,QAAQ,IAAI,2BAA2B,GAAG,SAAS,CAEtD;IAED;;;;;OAKG;IACH,IAAI,eAAe,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjD;IAED;;;;;;;;OAQG;IACH,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED;;;;OAIG;IACH,IAAI,GAAG,IAAI,iBAAiB,CAE3B;IAED;;;OAGG;IACH,IAAI,QAAQ,IAAI,sBAAsB,CAErC;IAED;;;OAGG;IACH,IAAI,aAAa,IAAI,2BAA2B,CAE/C;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAGlE;IAED;;;;;;OAMG;IACH,sBAAsB,IAAI,IAAI,CAI7B;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAI5C;IAED,wEAAwE;IACxE,OAAO,IAAI,IAAI,CAGd;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAG/C;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElD;IAED,8CAA8C;IAC9C,gBAAgB,CACd,SAAS,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,GACxD,IAAI,CAGN;IAED,uCAAuC;IACvC,MAAM,IAAI,IAAI,CAGb;IAED,oCAAoC;IACpC,OAAO,IAAI,IAAI,CAGd;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,KAAK;CAGd"}

package/dist/service/cognito/user-pool/user/sim-cognito-user.js

@@ -1,6 +1,7 @@
 import { SimCognitoUserMfa } from "./mfa/sim-cognito-user-mfa.js";
 import { SimCognitoUserConfirmation } from "./sim-cognito-user-confirmation.js";
 import { SimCognitoUserPasswordReset } from "./sim-cognito-user-password-reset.js";
+import { SimCognitoUserWebAuthn } from "./web-authn/sim-cognito-user-web-authn.js";
 import { SimCognitoUserPassword } from "./sim-cognito-user-password.js";
 import { SimCognitoUserStatus } from "./sim-cognito-user-status.js";
 /**
@@ -23,6 +24,7 @@ export class SimCognitoUser {
     userAttributes;
     confirmation;
     userMfa;
+    userWebAuthn;
     reset;
     federatedIdentity;
     userStatus;
@@ -41,12 +43,16 @@ export class SimCognitoUser {
         this.clock = properties.clock;
         this.creationDate = this.clock.now();
         this.modifiedDate = this.creationDate;
+        // Everything a user holds separately tells it when it has changed, so the
+        // user's last modified date moves on wherever the change was made.
+        const changed = () => {
+            this.touch();
+        };
         this.userMfa = new SimCognitoUserMfa({
             attributes: this.userAttributes.values,
-            changed: () => {
-                this.touch();
-            },
+            changed,
         });
+        this.userWebAuthn = new SimCognitoUserWebAuthn({ changed });
         this.reset = new SimCognitoUserPasswordReset({
             confirmation: this.confirmation,
             status: () => this.userStatus,
@@ -56,20 +62,14 @@ export class SimCognitoUser {
             chosen: (password) => {
                 this.setPassword(password, true);
             },
-            changed: () => {
-                this.touch();
-            },
+            changed,
         });
     }
-    /**
-     * When the user last changed.
-     */
+    /** When the user last changed. */
     get lastModifiedDate() {
         return this.modifiedDate;
     }
-    /**
-     * Where the user is in the status lifecycle.
-     */
+    /** Where the user is in the status lifecycle. */
     get status() {
         return this.userStatus;
     }
@@ -136,6 +136,13 @@ export class SimCognitoUser {
     get mfa() {
         return this.userMfa;
     }
+    /**
+     * The passkeys this user has registered. A passkey is a first factor rather
+     * than a second one, so it sits beside `mfa` rather than among it.
+     */
+    get webAuthn() {
+        return this.userWebAuthn;
+    }
     /**
      * The password reset this user can go through, which is what a forgotten
      * password is replaced by and what an administrator can force.
@@ -177,9 +184,7 @@ export class SimCognitoUser {
         this.confirmation.require(code);
         this.moveTo(SimCognitoUserStatus.confirmed);
     }
-    /**
-     * Confirm the sign-up without a code, as `AdminConfirmSignUp` does.
-     */
+    /** Confirm the sign-up without a code, as `AdminConfirmSignUp` does. */
     confirm() {
         this.userStatus.requireConfirmable();
         this.moveTo(SimCognitoUserStatus.confirmed);
@@ -206,23 +211,17 @@ export class SimCognitoUser {
     hasPassword(candidate) {
         return this.userPassword?.matches(candidate) ?? false;
     }
-    /**
-     * Apply an attribute update to this user.
-     */
+    /** Apply an attribute update to this user. */
     updateAttributes(requested) {
         this.userAttributes.update(requested);
         this.touch();
     }
-    /**
-     * Let the user authenticate again.
-     */
+    /** Let the user authenticate again. */
     enable() {
         this.isEnabled = true;
         this.touch();
     }
-    /**
-     * Stop the user authenticating.
-     */
+    /** Stop the user authenticating. */
     disable() {
         this.isEnabled = false;
         this.touch();

package/dist/service/cognito/user-pool/user/sim-cognito-user.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAKnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAwBpE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,cAAc;IACT,QAAQ,CAAqB;IAC7B,GAAG,CAAS;IACZ,YAAY,CAAO;IAElB,KAAK,CAAW;IAChB,cAAc,CAA2B;IACzC,YAAY,CAA6B;IACzC,OAAO,CAAoB;IAC3B,KAAK,CAA8B;IACnC,iBAAiB,CAA0C;IACpE,UAAU,CAAuB;IACjC,YAAY,CAAqC;IACjD,SAAS,GAAG,IAAI,CAAC;IACjB,YAAY,CAAO;IAE3B,YAAY,UAAoC;QAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC7C,IAAI,CAAC,UAAU;YACb,UAAU,CAAC,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,CAAC;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACnC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM;YACtC,OAAO,EAAE,GAAS,EAAE;gBAClB,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,2BAA2B,CAAC;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM,EAAE,GAAyB,EAAE,CAAC,IAAI,CAAC,UAAU;YACnD,KAAK,EAAE,CAAC,MAAM,EAAQ,EAAE;gBACtB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;YACD,MAAM,EAAE,CAAC,QAAQ,EAAQ,EAAE;gBACzB,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,EAAE,GAAS,EAAE;gBAClB,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,IAAI,UAAU;QACZ,OAAO;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;YAChC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC/C,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO;SAC/B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAgB,EAAE,SAA8B;QAC1D,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IACH,sBAAsB;QACpB,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAwB;QACpC,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAwB;QACvC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAA6B;QACvC,OAAO,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,SAAyD;QAEzD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,MAA4B;QACzC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/user/sim-cognito-user.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAwBpE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,cAAc;IACT,QAAQ,CAAqB;IAC7B,GAAG,CAAS;IACZ,YAAY,CAAO;IAElB,KAAK,CAAW;IAChB,cAAc,CAA2B;IACzC,YAAY,CAA6B;IACzC,OAAO,CAAoB;IAC3B,YAAY,CAAyB;IACrC,KAAK,CAA8B;IACnC,iBAAiB,CAA0C;IACpE,UAAU,CAAuB;IACjC,YAAY,CAAqC;IACjD,SAAS,GAAG,IAAI,CAAC;IACjB,YAAY,CAAO;IAE3B,YAAY,UAAoC;QAC9C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,UAAU,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC7C,IAAI,CAAC,UAAU;YACb,UAAU,CAAC,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,CAAC;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC,CAAC;QAEF,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACnC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM;YACtC,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,2BAA2B,CAAC;YAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM,EAAE,GAAyB,EAAE,CAAC,IAAI,CAAC,UAAU;YACnD,KAAK,EAAE,CAAC,MAAM,EAAQ,EAAE;gBACtB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;YACD,MAAM,EAAE,CAAC,QAAQ,EAAQ,EAAE;gBACzB,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC;YACD,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,iDAAiD;IACjD,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,IAAI,UAAU;QACZ,OAAO;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;YAChC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC/C,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO;SAC/B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAgB,EAAE,SAA8B;QAC1D,IAAI,CAAC,YAAY,GAAG,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IACH,sBAAsB;QACpB,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAwB;QACpC,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,wEAAwE;IACxE,OAAO;QACL,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAwB;QACvC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAA6B;QACvC,OAAO,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;IACxD,CAAC;IAED,8CAA8C;IAC9C,gBAAgB,CACd,SAAyD;QAEzD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,uCAAuC;IACvC,MAAM;QACJ,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,oCAAoC;IACpC,OAAO;QACL,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,MAA4B;QACzC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-user-web-authn.d.ts

@@ -0,0 +1,73 @@
+import { type SimCognitoWebAuthnRegistrationRequest } from "./sim-cognito-web-authn-creation-options.js";
+import type { SimCognitoWebAuthnCredential } from "./sim-cognito-web-authn-credential.js";
+import { SimCognitoWebAuthnDevice } from "./sim-cognito-web-authn-device.js";
+import type { SimCognitoWebAuthnCreationOptions, SimCognitoWebAuthnCredentialDocument } from "./sim-cognito-web-authn-document.js";
+interface SimCognitoUserWebAuthnProperties {
+    /** What to call when the user's passkeys change. */
+    readonly changed: () => void;
+}
+/**
+ * The passkeys one simulated user has, and the registration it is part way
+ * through.
+ *
+ * `StartWebAuthnRegistration` issues the challenge a passkey is created
+ * against, and `CompleteWebAuthnRegistration` hands back the credential the
+ * authenticator made from it. The challenge is spent either way, so a
+ * credential cannot be replayed into a second registration.
+ *
+ * The device the credential comes from is here too, because a test has no
+ * browser and no phone. What it holds is only the private half. What the pool
+ * keeps of a registration is the public key, the relying party and the
+ * identifier, and all of it is checked before any of it is stored.
+ *
+ * Registering or deleting a passkey moves the user's `UserLastModifiedDate`
+ * on, as every other change to a user does. Whether real Cognito moves it for
+ * a passkey was not checked against a live account.
+ */
+export declare class SimCognitoUserWebAuthn {
+    #private;
+    constructor(properties: SimCognitoUserWebAuthnProperties);
+    /**
+     * The stand-in authenticator this user's passkeys live on, which is what
+     * makes one and what presents one.
+     */
+    get device(): SimCognitoWebAuthnDevice;
+    /**
+     * The passkeys this user has registered, oldest first.
+     */
+    get credentials(): readonly SimCognitoWebAuthnCredential[];
+    /**
+     * Ask for a passkey, and remember the challenge it has to be created
+     * against.
+     *
+     * A second call replaces the first, as real Cognito replaces one: the
+     * challenge a browser was part way through answering is spent whether or not
+     * a credential ever came back for it.
+     */
+    startRegistration(request: SimCognitoWebAuthnRegistrationRequest): SimCognitoWebAuthnCreationOptions;
+    /**
+     * Register the passkey a browser created, having checked it answers the
+     * challenge this user was issued.
+     */
+    completeRegistration(credential: unknown, now: Date): void;
+    /**
+     * Forget a passkey, or refuse an identifier this user has none for.
+     */
+    remove(credentialId: string | undefined): void;
+    /**
+     * The credential this user's authenticator would have made for the
+     * registration it has been given options for.
+     *
+     * This is the simulator's own accessor, for a test that has no browser to
+     * run the ceremony in. Real Cognito hands the options to a browser and the
+     * browser hands back the credential.
+     */
+    registrationCredential(): SimCognitoWebAuthnCredentialDocument;
+    /**
+     * The registration this user is part way through, or a refusal saying it is
+     * part way through none.
+     */
+    private requirePending;
+}
+export {};
+//# sourceMappingURL=sim-cognito-user-web-authn.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-user-web-authn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-web-authn.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-user-web-authn.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,qCAAqC,EAC3C,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,KAAK,EACV,iCAAiC,EACjC,oCAAoC,EACrC,MAAM,qCAAqC,CAAC;AAE7C,UAAU,gCAAgC;IACxC,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,sBAAsB;;IAajC,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;;OAGG;IACH,IAAI,MAAM,IAAI,wBAAwB,CAErC;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,SAAS,4BAA4B,EAAE,CAEzD;IAED;;;;;;;OAOG;IACH,iBAAiB,CACf,OAAO,EAAE,qCAAqC,GAC7C,iCAAiC,CASnC;IAED;;;OAGG;IACH,oBAAoB,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI,CAazD;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAU7C;IAED;;;;;;;OAOG;IACH,sBAAsB,IAAI,oCAAoC,CAE7D;IAED;;;OAGG;IACH,OAAO,CAAC,cAAc;CAWvB"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-user-web-authn.js

@@ -0,0 +1,113 @@
+import { SimCognitoResourceNotFoundException } from "../../../error/sim-cognito.error.js";
+import { SimCognitoWebAuthnChallengeNotFoundException } from "../../../error/sim-cognito-web-authn.error.js";
+import { simCognitoWebAuthnRegistered } from "./sim-cognito-web-authn-attested-key.js";
+import { simCognitoWebAuthnCreationOptions, } from "./sim-cognito-web-authn-creation-options.js";
+import { SimCognitoWebAuthnDevice } from "./sim-cognito-web-authn-device.js";
+/**
+ * The passkeys one simulated user has, and the registration it is part way
+ * through.
+ *
+ * `StartWebAuthnRegistration` issues the challenge a passkey is created
+ * against, and `CompleteWebAuthnRegistration` hands back the credential the
+ * authenticator made from it. The challenge is spent either way, so a
+ * credential cannot be replayed into a second registration.
+ *
+ * The device the credential comes from is here too, because a test has no
+ * browser and no phone. What it holds is only the private half. What the pool
+ * keeps of a registration is the public key, the relying party and the
+ * identifier, and all of it is checked before any of it is stored.
+ *
+ * Registering or deleting a passkey moves the user's `UserLastModifiedDate`
+ * on, as every other change to a user does. Whether real Cognito moves it for
+ * a passkey was not checked against a live account.
+ */
+export class SimCognitoUserWebAuthn {
+    #device = new SimCognitoWebAuthnDevice();
+    #credentials = new Map();
+    /**
+     * The options the registration this user is part way through was issued
+     * with, which carry both the challenge and the relying party it answers to.
+     */
+    #pending;
+    /** What to tell the user when its passkeys change. */
+    #changed;
+    constructor(properties) {
+        this.#changed = properties.changed;
+    }
+    /**
+     * The stand-in authenticator this user's passkeys live on, which is what
+     * makes one and what presents one.
+     */
+    get device() {
+        return this.#device;
+    }
+    /**
+     * The passkeys this user has registered, oldest first.
+     */
+    get credentials() {
+        return this.#credentials.values().toArray();
+    }
+    /**
+     * Ask for a passkey, and remember the challenge it has to be created
+     * against.
+     *
+     * A second call replaces the first, as real Cognito replaces one: the
+     * challenge a browser was part way through answering is spent whether or not
+     * a credential ever came back for it.
+     */
+    startRegistration(request) {
+        const options = simCognitoWebAuthnCreationOptions(request, this.credentials.map((each) => each.descriptor()));
+        this.#pending = options;
+        return options;
+    }
+    /**
+     * Register the passkey a browser created, having checked it answers the
+     * challenge this user was issued.
+     */
+    completeRegistration(credential, now) {
+        // The challenge is spent before the credential is read, so a refused one
+        // cannot be retried against the same challenge. Real Cognito issues one
+        // challenge per registration, and StartWebAuthnRegistration is what issues
+        // another.
+        const pending = this.requirePending();
+        this.#pending = undefined;
+        const registered = simCognitoWebAuthnRegistered(pending, credential, now);
+        this.#credentials.set(registered.credentialId, registered);
+        this.#changed();
+    }
+    /**
+     * Forget a passkey, or refuse an identifier this user has none for.
+     */
+    remove(credentialId) {
+        if (credentialId === undefined || !this.#credentials.delete(credentialId)) {
+            throw new SimCognitoResourceNotFoundException(`This user has no registered passkey with the credential id ` +
+                `'${String(credentialId)}'`);
+        }
+        this.#device.forget(credentialId);
+        this.#changed();
+    }
+    /**
+     * The credential this user's authenticator would have made for the
+     * registration it has been given options for.
+     *
+     * This is the simulator's own accessor, for a test that has no browser to
+     * run the ceremony in. Real Cognito hands the options to a browser and the
+     * browser hands back the credential.
+     */
+    registrationCredential() {
+        return this.#device.create(this.requirePending());
+    }
+    /**
+     * The registration this user is part way through, or a refusal saying it is
+     * part way through none.
+     */
+    requirePending() {
+        if (this.#pending === undefined) {
+            throw new SimCognitoWebAuthnChallengeNotFoundException("No passkey registration is in progress for this user: call " +
+                "StartWebAuthnRegistration for the challenge a credential is " +
+                "created against.");
+        }
+        return this.#pending;
+    }
+}
+//# sourceMappingURL=sim-cognito-user-web-authn.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-user-web-authn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-user-web-authn.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-user-web-authn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EAAE,4CAA4C,EAAE,MAAM,+CAA+C,CAAC;AAC7G,OAAO,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,EACL,iCAAiC,GAElC,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAW7E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,sBAAsB;IACxB,OAAO,GAAG,IAAI,wBAAwB,EAAE,CAAC;IACzC,YAAY,GAAG,IAAI,GAAG,EAAwC,CAAC;IAExE;;;OAGG;IACH,QAAQ,CAAgD;IAExD,sDAAsD;IAC7C,QAAQ,CAAa;IAE9B,YAAY,UAA4C;QACtD,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;;OAOG;IACH,iBAAiB,CACf,OAA8C;QAE9C,MAAM,OAAO,GAAG,iCAAiC,CAC/C,OAAO,EACP,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAClD,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QAExB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,oBAAoB,CAAC,UAAmB,EAAE,GAAS;QACjD,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,WAAW;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtC,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAE1B,MAAM,UAAU,GAAG,4BAA4B,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QAE1E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAgC;QACrC,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,mCAAmC,CAC3C,6DAA6D;gBAC3D,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAC9B,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,cAAc;QACpB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,4CAA4C,CACpD,6DAA6D;gBAC3D,8DAA8D;gBAC9D,kBAAkB,CACrB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-assertion.d.ts

@@ -0,0 +1,22 @@
+import type { SimCognitoWebAuthnCredential } from "./sim-cognito-web-authn-credential.js";
+import type { SimCognitoWebAuthnCredentialDescriptor, SimCognitoWebAuthnRequestOptions } from "./sim-cognito-web-authn-document.js";
+/**
+ * The options a passkey is presented against, which a browser passes straight
+ * to `navigator.credentials.get()`.
+ *
+ * The passkeys the user has are named under `allowCredentials`, so an
+ * authenticator holding several knows which of them this pool would take.
+ */
+export declare function simCognitoWebAuthnRequestOptions(relyingPartyId: string, userVerification: string, allowed: readonly SimCognitoWebAuthnCredentialDescriptor[]): SimCognitoWebAuthnRequestOptions;
+/**
+ * The passkey a credential presented, having checked that it is one of this
+ * user's and that this user's key signed it.
+ *
+ * The ceremony is read the way a registration's is, and the signature is then
+ * checked against the public key the pool stored. A credential naming a
+ * passkey this user does not have, and one signed by another key, are both
+ * refused as `NotAuthorizedException`, which is what real Cognito answers a
+ * sign-in it will not complete with.
+ */
+export declare function requireSimCognitoWebAuthnAssertion(credentials: readonly SimCognitoWebAuthnCredential[], credential: unknown, options: SimCognitoWebAuthnRequestOptions): SimCognitoWebAuthnCredential;
+//# sourceMappingURL=sim-cognito-web-authn-assertion.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-assertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-assertion.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-assertion.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,KAAK,EACV,sCAAsC,EACtC,gCAAgC,EACjC,MAAM,qCAAqC,CAAC;AAQ7C;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,cAAc,EAAE,MAAM,EACtB,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,SAAS,sCAAsC,EAAE,GACzD,gCAAgC,CAQlC;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAChD,WAAW,EAAE,SAAS,4BAA4B,EAAE,EACpD,UAAU,EAAE,OAAO,EACnB,OAAO,EAAE,gCAAgC,GACxC,4BAA4B,CA8B9B"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-assertion.js

@@ -0,0 +1,53 @@
+import { SimCognitoNotAuthorizedException } from "../../../error/sim-cognito.error.js";
+import { requireSimCognitoWebAuthnCeremony } from "./sim-cognito-web-authn-ceremony.js";
+import { simCognitoWebAuthnChallenge } from "./sim-cognito-web-authn-signing.js";
+/**
+ * How long a browser is given to present a passkey, in milliseconds.
+ */
+const ceremonyTimeout = 60_000;
+/**
+ * The options a passkey is presented against, which a browser passes straight
+ * to `navigator.credentials.get()`.
+ *
+ * The passkeys the user has are named under `allowCredentials`, so an
+ * authenticator holding several knows which of them this pool would take.
+ */
+export function simCognitoWebAuthnRequestOptions(relyingPartyId, userVerification, allowed) {
+    return {
+        challenge: simCognitoWebAuthnChallenge(),
+        rpId: relyingPartyId,
+        timeout: ceremonyTimeout,
+        allowCredentials: allowed,
+        userVerification,
+    };
+}
+/**
+ * The passkey a credential presented, having checked that it is one of this
+ * user's and that this user's key signed it.
+ *
+ * The ceremony is read the way a registration's is, and the signature is then
+ * checked against the public key the pool stored. A credential naming a
+ * passkey this user does not have, and one signed by another key, are both
+ * refused as `NotAuthorizedException`, which is what real Cognito answers a
+ * sign-in it will not complete with.
+ */
+export function requireSimCognitoWebAuthnAssertion(credentials, credential, options) {
+    const ceremony = requireSimCognitoWebAuthnCeremony({
+        credential,
+        field: "CREDENTIAL",
+        type: "webauthn.get",
+        challenge: options.challenge,
+        relyingPartyId: options.rpId,
+    });
+    const presented = credentials.find((each) => each.credentialId === ceremony.credentialId);
+    if (presented === undefined) {
+        throw new SimCognitoNotAuthorizedException("The credential presents a passkey this user has not registered.");
+    }
+    const signature = ceremony.response["signature"];
+    if (typeof signature !== "string" ||
+        !presented.signed(ceremony, Buffer.from(signature, "base64url"))) {
+        throw new SimCognitoNotAuthorizedException("The credential was not signed by this passkey.");
+    }
+    return presented;
+}
+//# sourceMappingURL=sim-cognito-web-authn-assertion.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-assertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-assertion.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-assertion.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAMxF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF;;GAEG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAC9C,cAAsB,EACtB,gBAAwB,EACxB,OAA0D;IAE1D,OAAO;QACL,SAAS,EAAE,2BAA2B,EAAE;QACxC,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,eAAe;QACxB,gBAAgB,EAAE,OAAO;QACzB,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kCAAkC,CAChD,WAAoD,EACpD,UAAmB,EACnB,OAAyC;IAEzC,MAAM,QAAQ,GAAG,iCAAiC,CAAC;QACjD,UAAU;QACV,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,IAAI;KAC7B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,CACtD,CAAC;IAEF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,gCAAgC,CACxC,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEjD,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,gCAAgC,CACxC,gDAAgD,CACjD,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-attested-key.d.ts

@@ -0,0 +1,15 @@
+import { SimCognitoWebAuthnCredential } from "./sim-cognito-web-authn-credential.js";
+import type { SimCognitoWebAuthnCreationOptions } from "./sim-cognito-web-authn-document.js";
+/**
+ * The passkey a pool keeps out of the credential a registration carried.
+ *
+ * The credential is read against the options the registration was issued with,
+ * which say which challenge it has to answer and which relying party it has to
+ * have been signed for. A browser reports the public key as
+ * `response.publicKey`, base64url of its SubjectPublicKeyInfo, and names the
+ * algorithm beside it. That is what is read here rather than the attestation
+ * object, which a real relying party parses out of CBOR and this simulation
+ * does not.
+ */
+export declare function simCognitoWebAuthnRegistered(pending: SimCognitoWebAuthnCreationOptions, credential: unknown, createdAt: Date): SimCognitoWebAuthnCredential;
+//# sourceMappingURL=sim-cognito-web-authn-attested-key.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-attested-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-attested-key.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-attested-key.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAiD7F;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,iCAAiC,EAC1C,UAAU,EAAE,OAAO,EACnB,SAAS,EAAE,IAAI,GACd,4BAA4B,CAoB9B"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-attested-key.js

@@ -0,0 +1,68 @@
+import { SimCognitoWebAuthnCredentialNotSupportedException } from "../../../error/sim-cognito-web-authn.error.js";
+import { requireSimCognitoWebAuthnCeremony } from "./sim-cognito-web-authn-ceremony.js";
+import { SimCognitoWebAuthnCredential } from "./sim-cognito-web-authn-credential.js";
+import { simCognitoWebAuthnKeyFrom } from "./sim-cognito-web-authn-public-key.js";
+import { simCognitoWebAuthnAlgorithm } from "./sim-cognito-web-authn-signing.js";
+/**
+ * How a credential says it is attached when it says nothing, which is what a
+ * phone or a laptop reports.
+ */
+const defaultAttachment = "platform";
+/**
+ * The public key a credential carries, or a refusal where the pool cannot read
+ * one.
+ */
+function publicKeyOf(response) {
+    const encoded = response["publicKey"];
+    const publicKey = typeof encoded === "string"
+        ? simCognitoWebAuthnKeyFrom(encoded)
+        : undefined;
+    if (publicKey === undefined ||
+        response["publicKeyAlgorithm"] !== simCognitoWebAuthnAlgorithm) {
+        throw new SimCognitoWebAuthnCredentialNotSupportedException("The credential carries no public key this user pool can use: the " +
+            "registration asked for ECDSA over P-256, which a browser reports " +
+            "as response.publicKey with a publicKeyAlgorithm of " +
+            `${String(simCognitoWebAuthnAlgorithm)}.`);
+    }
+    return publicKey;
+}
+/**
+ * The strings of a credential member that is meant to be a list of them.
+ */
+function stringsOf(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter((each) => typeof each === "string");
+}
+/**
+ * The passkey a pool keeps out of the credential a registration carried.
+ *
+ * The credential is read against the options the registration was issued with,
+ * which say which challenge it has to answer and which relying party it has to
+ * have been signed for. A browser reports the public key as
+ * `response.publicKey`, base64url of its SubjectPublicKeyInfo, and names the
+ * algorithm beside it. That is what is read here rather than the attestation
+ * object, which a real relying party parses out of CBOR and this simulation
+ * does not.
+ */
+export function simCognitoWebAuthnRegistered(pending, credential, createdAt) {
+    const relyingPartyId = pending.rp.id;
+    const ceremony = requireSimCognitoWebAuthnCeremony({
+        credential,
+        field: "Credential",
+        type: "webauthn.create",
+        challenge: pending.challenge,
+        relyingPartyId,
+    });
+    const attachment = ceremony.document["authenticatorAttachment"];
+    return new SimCognitoWebAuthnCredential({
+        credentialId: ceremony.credentialId,
+        publicKey: publicKeyOf(ceremony.response),
+        relyingPartyId,
+        authenticatorAttachment: typeof attachment === "string" ? attachment : defaultAttachment,
+        transports: stringsOf(ceremony.response["transports"]),
+        createdAt,
+    });
+}
+//# sourceMappingURL=sim-cognito-web-authn-attested-key.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-attested-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-attested-key.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-attested-key.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iDAAiD,EAAE,MAAM,+CAA+C,CAAC;AAClH,OAAO,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAErF,OAAO,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF;;;GAGG;AACH,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC;;;GAGG;AACH,SAAS,WAAW,CAAC,QAA2C;IAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,SAAS,GACb,OAAO,OAAO,KAAK,QAAQ;QACzB,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC;QACpC,CAAC,CAAC,SAAS,CAAC;IAEhB,IACE,SAAS,KAAK,SAAS;QACvB,QAAQ,CAAC,oBAAoB,CAAC,KAAK,2BAA2B,EAC9D,CAAC;QACD,MAAM,IAAI,iDAAiD,CACzD,mEAAmE;YACjE,mEAAmE;YACnE,qDAAqD;YACrD,GAAG,MAAM,CAAC,2BAA2B,CAAC,GAAG,CAC5C,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAQ,KAA4B,CAAC,MAAM,CACzC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAA0C,EAC1C,UAAmB,EACnB,SAAe;IAEf,MAAM,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,iCAAiC,CAAC;QACjD,UAAU;QACV,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc;KACf,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IAEhE,OAAO,IAAI,4BAA4B,CAAC;QACtC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzC,cAAc;QACd,uBAAuB,EACrB,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB;QACjE,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACtD,SAAS;KACV,CAAC,CAAC;AACL,CAAC"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-ceremony.d.ts

@@ -0,0 +1,33 @@
+import { type SimCognitoWebAuthnClientDataRequest } from "./sim-cognito-web-authn-client-data.js";
+/**
+ * What a caller sent, once it has been read as a credential.
+ */
+export interface SimCognitoWebAuthnCeremony {
+    readonly credentialId: string;
+    readonly clientDataJson: Buffer;
+    readonly authenticatorData: Buffer;
+    /** The credential document itself, once it has been read as an object. */
+    readonly document: Readonly<Record<string, unknown>>;
+    /** The `response` half of it, which holds what the authenticator produced. */
+    readonly response: Readonly<Record<string, unknown>>;
+}
+/**
+ * What a request carried, and what the pool expects it to answer.
+ */
+export interface SimCognitoWebAuthnCeremonyRequest extends SimCognitoWebAuthnClientDataRequest {
+    /** The credential document the request carried, as it arrived. */
+    readonly credential: unknown;
+}
+/**
+ * Read the credential a request carried, and hold it to the ceremony the pool
+ * is part way through.
+ *
+ * A credential arrives as the JSON a browser produces from a
+ * `PublicKeyCredential`, so it is read rather than trusted: the client data
+ * says which ceremony it answers, which challenge, and where it was collected,
+ * and the authenticator data says which relying party it was signed for. What
+ * this leaves to the caller is the signature, which needs the public key of
+ * the credential being presented.
+ */
+export declare function requireSimCognitoWebAuthnCeremony(request: SimCognitoWebAuthnCeremonyRequest): SimCognitoWebAuthnCeremony;
+//# sourceMappingURL=sim-cognito-web-authn-ceremony.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-ceremony.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-ceremony.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-ceremony.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,wCAAwC,CAAC;AAQhD;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAErD,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,iCAAkC,SAAQ,mCAAmC;IAC5F,kEAAkE;IAClE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAkDD;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,iCAAiC,GACzC,0BAA0B,CAuB5B"}