@kensio/yulin 1.18.2 → 1.19.1

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-ceremony.js

@@ -0,0 +1,67 @@
+import { createHash } from "node:crypto";
+import { SimCognitoInvalidParameterException } from "../../../error/sim-cognito.error.js";
+import { SimCognitoWebAuthnRelyingPartyMismatchException } from "../../../error/sim-cognito-web-authn.error.js";
+import { requireSimCognitoWebAuthnClientData, } from "./sim-cognito-web-authn-client-data.js";
+/**
+ * How many bytes of authenticator data come before the flags, which is the
+ * hash of the relying party id.
+ */
+const relyingPartyHashBytes = 32;
+/**
+ * A member of a credential that has to be there, as the base64url it is.
+ */
+function requireMember(value, member, field) {
+    if (typeof value !== "string" || value === "") {
+        throw new SimCognitoInvalidParameterException(`${field} ${member} must be the base64url string a browser's own ` +
+            `credential serialization carries it as`);
+    }
+    return value;
+}
+/**
+ * Refuse authenticator data signed for another relying party.
+ */
+function requireRelyingParty(authenticatorData, relyingPartyId) {
+    const signedFor = authenticatorData.subarray(0, relyingPartyHashBytes);
+    if (!signedFor.equals(createHash("sha256").update(relyingPartyId).digest())) {
+        throw new SimCognitoWebAuthnRelyingPartyMismatchException(`The credential was signed for another relying party, and this user ` +
+            `pool registers passkeys against ${relyingPartyId}.`);
+    }
+}
+/**
+ * The credential document a request carried, or a refusal where it is not one.
+ */
+function requireDocument(value, field) {
+    if (typeof value !== "object" || value === null) {
+        throw new SimCognitoInvalidParameterException(`${field} must be the credential a browser serializes from ` +
+            `navigator.credentials, carrying an id and a response`);
+    }
+    return value;
+}
+/**
+ * Read the credential a request carried, and hold it to the ceremony the pool
+ * is part way through.
+ *
+ * A credential arrives as the JSON a browser produces from a
+ * `PublicKeyCredential`, so it is read rather than trusted: the client data
+ * says which ceremony it answers, which challenge, and where it was collected,
+ * and the authenticator data says which relying party it was signed for. What
+ * this leaves to the caller is the signature, which needs the public key of
+ * the credential being presented.
+ */
+export function requireSimCognitoWebAuthnCeremony(request) {
+    const { field } = request;
+    const document = requireDocument(request.credential, field);
+    const response = requireDocument(document["response"], field);
+    const clientDataJson = Buffer.from(requireMember(response["clientDataJSON"], "clientDataJSON", field), "base64url");
+    const authenticatorData = Buffer.from(requireMember(response["authenticatorData"], "authenticatorData", field), "base64url");
+    requireSimCognitoWebAuthnClientData(clientDataJson, request);
+    requireRelyingParty(authenticatorData, request.relyingPartyId);
+    return {
+        credentialId: requireMember(document["id"], "id", field),
+        clientDataJson,
+        authenticatorData,
+        document,
+        response,
+    };
+}
+//# sourceMappingURL=sim-cognito-web-authn-ceremony.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-ceremony.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-ceremony.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-ceremony.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EAAE,+CAA+C,EAAE,MAAM,+CAA+C,CAAC;AAChH,OAAO,EACL,mCAAmC,GAEpC,MAAM,wCAAwC,CAAC;AAEhD;;;GAGG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAyBjC;;GAEG;AACH,SAAS,aAAa,CAAC,KAAc,EAAE,MAAc,EAAE,KAAa;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,IAAI,MAAM,gDAAgD;YAChE,wCAAwC,CAC3C,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,iBAAyB,EACzB,cAAsB;IAEtB,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAEvE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,+CAA+C,CACvD,qEAAqE;YACnE,mCAAmC,cAAc,GAAG,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CACtB,KAAc,EACd,KAAa;IAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,oDAAoD;YAC1D,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAC/C,OAA0C;IAE1C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1B,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAChC,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAClE,WAAW,CACZ,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CACnC,aAAa,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,EACxE,WAAW,CACZ,CAAC;IAEF,mCAAmC,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC7D,mBAAmB,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAE/D,OAAO;QACL,YAAY,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC;QACxD,cAAc;QACd,iBAAiB;QACjB,QAAQ;QACR,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-client-data.d.ts

@@ -0,0 +1,24 @@
+/**
+ * What the client data of a ceremony has to say.
+ */
+export interface SimCognitoWebAuthnClientDataRequest {
+    /** The input the credential arrived in, which a refusal names. */
+    readonly field: string;
+    /** Which half of the ceremony this is. */
+    readonly type: "webauthn.create" | "webauthn.get";
+    /** The challenge the pool issued, which the credential has to answer. */
+    readonly challenge: string;
+    /** The domain the credential has to have been collected for. */
+    readonly relyingPartyId: string;
+}
+/**
+ * Refuse client data that answers something other than the challenge this pool
+ * issued, or that was collected somewhere the relying party does not cover.
+ *
+ * The client data is what the authenticator signed over, so what it says about
+ * the ceremony is worth as much as the signature that covers it. A credential
+ * collected at another origin is what a relying party check is for, and one
+ * carrying another challenge is a replay.
+ */
+export declare function requireSimCognitoWebAuthnClientData(clientDataJson: Buffer, request: SimCognitoWebAuthnClientDataRequest): void;
+//# sourceMappingURL=sim-cognito-web-authn-client-data.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-client-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-client-data.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-client-data.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAAC;IAElD,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,gEAAgE;IAChE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AA0BD;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,mCAAmC,GAC3C,IAAI,CAwBN"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-client-data.js

@@ -0,0 +1,45 @@
+import { SimCognitoInvalidParameterException } from "../../../error/sim-cognito.error.js";
+import { SimCognitoWebAuthnChallengeNotFoundException, SimCognitoWebAuthnOriginNotAllowedException, } from "../../../error/sim-cognito-web-authn.error.js";
+/**
+ * The client data a credential carries, parsed as the JSON it is.
+ */
+function clientDataOf(clientDataJson, field) {
+    try {
+        const parsed = JSON.parse(clientDataJson.toString("utf8"));
+        if (typeof parsed === "object" && parsed !== null) {
+            return parsed;
+        }
+    }
+    catch {
+        // Falls through to the refusal below, which says the same thing about an
+        // unparseable client data as about one that is not an object.
+    }
+    throw new SimCognitoInvalidParameterException(`${field} response.clientDataJSON is not the JSON object a browser ` +
+        `collects for a WebAuthn ceremony`);
+}
+/**
+ * Refuse client data that answers something other than the challenge this pool
+ * issued, or that was collected somewhere the relying party does not cover.
+ *
+ * The client data is what the authenticator signed over, so what it says about
+ * the ceremony is worth as much as the signature that covers it. A credential
+ * collected at another origin is what a relying party check is for, and one
+ * carrying another challenge is a replay.
+ */
+export function requireSimCognitoWebAuthnClientData(clientDataJson, request) {
+    const { field, type, challenge, relyingPartyId } = request;
+    const clientData = clientDataOf(clientDataJson, field);
+    if (clientData["type"] !== type) {
+        throw new SimCognitoInvalidParameterException(`${field} response.clientDataJSON is for ` +
+            `'${String(clientData["type"])}' rather than '${type}'`);
+    }
+    if (clientData["challenge"] !== challenge) {
+        throw new SimCognitoWebAuthnChallengeNotFoundException("The credential answers a challenge this user pool did not issue, or " +
+            "one it has already spent.");
+    }
+    if (clientData["origin"] !== `https://${relyingPartyId}`) {
+        throw new SimCognitoWebAuthnOriginNotAllowedException(`The credential was collected at '${String(clientData["origin"])}', ` +
+            `which is not an origin of the relying party ${relyingPartyId}.`);
+    }
+}
+//# sourceMappingURL=sim-cognito-web-authn-client-data.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-client-data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-client-data.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-client-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EACL,4CAA4C,EAC5C,2CAA2C,GAC5C,MAAM,+CAA+C,CAAC;AAmBvD;;GAEG;AACH,SAAS,YAAY,CACnB,cAAsB,EACtB,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,MAAiC,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,8DAA8D;IAChE,CAAC;IAED,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,4DAA4D;QAClE,kCAAkC,CACrC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CACjD,cAAsB,EACtB,OAA4C;IAE5C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAC3D,MAAM,UAAU,GAAG,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAEvD,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,mCAAmC,CAC3C,GAAG,KAAK,kCAAkC;YACxC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,kBAAkB,IAAI,GAAG,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,4CAA4C,CACpD,sEAAsE;YACpE,2BAA2B,CAC9B,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,WAAW,cAAc,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,2CAA2C,CACnD,oCAAoC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK;YACnE,+CAA+C,cAAc,GAAG,CACnE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-creation-options.d.ts

@@ -0,0 +1,28 @@
+import type { SimCognitoWebAuthnCreationOptions, SimCognitoWebAuthnCredentialDescriptor } from "./sim-cognito-web-authn-document.js";
+/**
+ * What a pool needs to know before it can ask for a passkey.
+ */
+export interface SimCognitoWebAuthnRegistrationRequest {
+    /** The domain the passkey is registered against. */
+    readonly relyingPartyId: string;
+    /** The pool's own name, which a browser shows the person. */
+    readonly relyingPartyName: string;
+    /** The user handle the authenticator stores, which is the user's `sub`. */
+    readonly userHandle: string;
+    /** The name the authenticator shows for the account. */
+    readonly username: string;
+    /** Whether the authenticator has to check who is holding it. */
+    readonly userVerification: string;
+}
+/**
+ * The options a passkey is created from, which a browser passes straight to
+ * `navigator.credentials.create()`.
+ *
+ * The challenge is fresh for every registration, and is what the authenticator
+ * signs over. The passkeys the user already has are excluded, so an
+ * authenticator already holding one makes another rather than replacing it,
+ * and the key is asked to be discoverable so a later sign-in can present it
+ * without being told which user is signing in.
+ */
+export declare function simCognitoWebAuthnCreationOptions(request: SimCognitoWebAuthnRegistrationRequest, excluded: readonly SimCognitoWebAuthnCredentialDescriptor[]): SimCognitoWebAuthnCreationOptions;
+//# sourceMappingURL=sim-cognito-web-authn-creation-options.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-creation-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-creation-options.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-creation-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iCAAiC,EACjC,sCAAsC,EACvC,MAAM,qCAAqC,CAAC;AAc7C;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD,oDAAoD;IACpD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,6DAA6D;IAC7D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,gEAAgE;IAChE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,qCAAqC,EAC9C,QAAQ,EAAE,SAAS,sCAAsC,EAAE,GAC1D,iCAAiC,CAqBnC"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-creation-options.js

@@ -0,0 +1,41 @@
+import { simCognitoWebAuthnAlgorithm, simCognitoWebAuthnChallenge, } from "./sim-cognito-web-authn-signing.js";
+/**
+ * How long a browser is given to finish a ceremony, in milliseconds.
+ *
+ * This is the authenticator's own prompt timeout rather than the app client's
+ * `AuthSessionValidity`, which is what bounds the sign-in around it.
+ */
+const ceremonyTimeout = 60_000;
+/**
+ * The options a passkey is created from, which a browser passes straight to
+ * `navigator.credentials.create()`.
+ *
+ * The challenge is fresh for every registration, and is what the authenticator
+ * signs over. The passkeys the user already has are excluded, so an
+ * authenticator already holding one makes another rather than replacing it,
+ * and the key is asked to be discoverable so a later sign-in can present it
+ * without being told which user is signing in.
+ */
+export function simCognitoWebAuthnCreationOptions(request, excluded) {
+    return {
+        challenge: simCognitoWebAuthnChallenge(),
+        rp: { id: request.relyingPartyId, name: request.relyingPartyName },
+        user: {
+            id: Buffer.from(request.userHandle).toString("base64url"),
+            name: request.username,
+            displayName: request.username,
+        },
+        pubKeyCredParams: [
+            { type: "public-key", alg: simCognitoWebAuthnAlgorithm },
+        ],
+        timeout: ceremonyTimeout,
+        excludeCredentials: excluded,
+        authenticatorSelection: {
+            residentKey: "required",
+            requireResidentKey: true,
+            userVerification: request.userVerification,
+        },
+        attestation: "none",
+    };
+}
+//# sourceMappingURL=sim-cognito-web-authn-creation-options.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-creation-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-creation-options.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-creation-options.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,oCAAoC,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC;AAsB/B;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAC/C,OAA8C,EAC9C,QAA2D;IAE3D,OAAO;QACL,SAAS,EAAE,2BAA2B,EAAE;QACxC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,gBAAgB,EAAE;QAClE,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YACzD,IAAI,EAAE,OAAO,CAAC,QAAQ;YACtB,WAAW,EAAE,OAAO,CAAC,QAAQ;SAC9B;QACD,gBAAgB,EAAE;YAChB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,2BAA2B,EAAE;SACzD;QACD,OAAO,EAAE,eAAe;QACxB,kBAAkB,EAAE,QAAQ;QAC5B,sBAAsB,EAAE;YACtB,WAAW,EAAE,UAAU;YACvB,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C;QACD,WAAW,EAAE,MAAM;KACpB,CAAC;AACJ,CAAC"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-credential.d.ts

@@ -0,0 +1,69 @@
+import type { KeyObject } from "node:crypto";
+import type { SimCognitoWebAuthnCeremony } from "./sim-cognito-web-authn-ceremony.js";
+import type { SimCognitoWebAuthnCredentialDescriptor } from "./sim-cognito-web-authn-document.js";
+/**
+ * One registered passkey as `ListWebAuthnCredentials` reports it.
+ *
+ * https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_WebAuthnCredentialDescription.html
+ */
+export interface SimCognitoWebAuthnCredentialDescription {
+    readonly CredentialId?: string | undefined;
+    readonly FriendlyCredentialName?: string | undefined;
+    readonly RelyingPartyId?: string | undefined;
+    readonly AuthenticatorAttachment?: string | undefined;
+    readonly AuthenticatorTransports?: readonly string[] | undefined;
+    readonly CreatedAt?: Date | undefined;
+}
+interface SimCognitoWebAuthnCredentialProperties {
+    readonly credentialId: string;
+    readonly publicKey: KeyObject;
+    readonly relyingPartyId: string;
+    readonly authenticatorAttachment: string;
+    readonly transports: readonly string[];
+    readonly createdAt: Date;
+}
+/**
+ * One passkey a user has registered, as the pool holds it.
+ *
+ * What the pool keeps is the public half: an identifier the authenticator
+ * allocated, the key that identifier's signatures can be checked against, and
+ * the relying party the pair was registered for. The private half never
+ * reaches a pool, on real Cognito or here.
+ *
+ * `FriendlyCredentialName` is the relying party id. Real Cognito reads the
+ * authenticator's own model out of the attestation and names the credential
+ * after it, which needs a device this simulation does not have.
+ */
+export declare class SimCognitoWebAuthnCredential {
+    readonly credentialId: string;
+    readonly relyingPartyId: string;
+    readonly authenticatorAttachment: string;
+    readonly transports: readonly string[];
+    readonly createdAt: Date;
+    /**
+     * The key this credential's signatures are checked against. It is the public
+     * half of the pair the authenticator made, and it is what a sign-in
+     * presenting the passkey reads.
+     */
+    readonly publicKey: KeyObject;
+    constructor(properties: SimCognitoWebAuthnCredentialProperties);
+    /**
+     * Whether this passkey is what signed a ceremony.
+     *
+     * The signature covers the authenticator data and a hash of the client data,
+     * so a credential replayed with either of them changed fails here even
+     * though both were read successfully.
+     */
+    signed(ceremony: SimCognitoWebAuthnCeremony, signature: Buffer): boolean;
+    /**
+     * This credential as a ceremony's options name it, which is what a
+     * registration excludes and a sign-in allows.
+     */
+    descriptor(): SimCognitoWebAuthnCredentialDescriptor;
+    /**
+     * This credential as `ListWebAuthnCredentials` reports it.
+     */
+    toOutput(): SimCognitoWebAuthnCredentialDescription;
+}
+export {};
+//# sourceMappingURL=sim-cognito-web-authn-credential.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-credential.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-credential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,qCAAqC,CAAC;AAGlG;;;;GAIG;AACH,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACvC;AAED,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,4BAA4B;IACvC,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,cAAc,EAAE,MAAM,CAAC;IACvC,SAAgB,uBAAuB,EAAE,MAAM,CAAC;IAChD,SAAgB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,SAAgB,SAAS,EAAE,IAAI,CAAC;IAEhC;;;;OAIG;IACH,SAAgB,SAAS,EAAE,SAAS,CAAC;IAErC,YAAY,UAAU,EAAE,sCAAsC,EAO7D;IAED;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAOvE;IAED;;;OAGG;IACH,UAAU,IAAI,sCAAsC,CAMnD;IAED;;OAEG;IACH,QAAQ,IAAI,uCAAuC,CASlD;CACF"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-credential.js

@@ -0,0 +1,69 @@
+import { simCognitoWebAuthnVerified } from "./sim-cognito-web-authn-signing.js";
+/**
+ * One passkey a user has registered, as the pool holds it.
+ *
+ * What the pool keeps is the public half: an identifier the authenticator
+ * allocated, the key that identifier's signatures can be checked against, and
+ * the relying party the pair was registered for. The private half never
+ * reaches a pool, on real Cognito or here.
+ *
+ * `FriendlyCredentialName` is the relying party id. Real Cognito reads the
+ * authenticator's own model out of the attestation and names the credential
+ * after it, which needs a device this simulation does not have.
+ */
+export class SimCognitoWebAuthnCredential {
+    credentialId;
+    relyingPartyId;
+    authenticatorAttachment;
+    transports;
+    createdAt;
+    /**
+     * The key this credential's signatures are checked against. It is the public
+     * half of the pair the authenticator made, and it is what a sign-in
+     * presenting the passkey reads.
+     */
+    publicKey;
+    constructor(properties) {
+        this.credentialId = properties.credentialId;
+        this.relyingPartyId = properties.relyingPartyId;
+        this.authenticatorAttachment = properties.authenticatorAttachment;
+        this.transports = properties.transports;
+        this.createdAt = properties.createdAt;
+        this.publicKey = properties.publicKey;
+    }
+    /**
+     * Whether this passkey is what signed a ceremony.
+     *
+     * The signature covers the authenticator data and a hash of the client data,
+     * so a credential replayed with either of them changed fails here even
+     * though both were read successfully.
+     */
+    signed(ceremony, signature) {
+        return simCognitoWebAuthnVerified(this.publicKey, ceremony.authenticatorData, ceremony.clientDataJson, signature);
+    }
+    /**
+     * This credential as a ceremony's options name it, which is what a
+     * registration excludes and a sign-in allows.
+     */
+    descriptor() {
+        return {
+            type: "public-key",
+            id: this.credentialId,
+            transports: this.transports,
+        };
+    }
+    /**
+     * This credential as `ListWebAuthnCredentials` reports it.
+     */
+    toOutput() {
+        return {
+            CredentialId: this.credentialId,
+            FriendlyCredentialName: this.relyingPartyId,
+            RelyingPartyId: this.relyingPartyId,
+            AuthenticatorAttachment: this.authenticatorAttachment,
+            AuthenticatorTransports: this.transports,
+            CreatedAt: this.createdAt,
+        };
+    }
+}
+//# sourceMappingURL=sim-cognito-web-authn-credential.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-credential.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-credential.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAyBhF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,4BAA4B;IACvB,YAAY,CAAS;IACrB,cAAc,CAAS;IACvB,uBAAuB,CAAS;IAChC,UAAU,CAAoB;IAC9B,SAAS,CAAO;IAEhC;;;;OAIG;IACa,SAAS,CAAY;IAErC,YAAY,UAAkD;QAC5D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,uBAAuB,GAAG,UAAU,CAAC,uBAAuB,CAAC;QAClE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,QAAoC,EAAE,SAAiB;QAC5D,OAAO,0BAA0B,CAC/B,IAAI,CAAC,SAAS,EACd,QAAQ,CAAC,iBAAiB,EAC1B,QAAQ,CAAC,cAAc,EACvB,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,EAAE,EAAE,IAAI,CAAC,YAAY;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,sBAAsB,EAAE,IAAI,CAAC,cAAc;YAC3C,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,uBAAuB,EAAE,IAAI,CAAC,UAAU;YACxC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-device.d.ts

@@ -0,0 +1,39 @@
+import type { SimCognitoWebAuthnCreationOptions, SimCognitoWebAuthnCredentialDocument, SimCognitoWebAuthnRequestOptions } from "./sim-cognito-web-authn-document.js";
+/**
+ * The authenticator standing in for a user's own device.
+ *
+ * WebAuthn has two sides. The pool holds public keys and checks signatures,
+ * and a phone or a laptop holds the private keys and produces them. There is
+ * neither in a test, so this is the simulator's own, in the way
+ * `SimCognitoUserPool.softwareTokenCode` reads the code a user's authenticator
+ * app would be showing.
+ *
+ * The keys are real ECDSA keys over P-256 and the signatures are real, so a
+ * credential this produces is accepted because it verifies. A test that would
+ * rather hold its own key can build the credential document itself. It is the
+ * JSON a browser serializes a `PublicKeyCredential` to, and nothing here reads
+ * a field a browser leaves out.
+ */
+export declare class SimCognitoWebAuthnDevice {
+    #private;
+    /**
+     * Create a passkey for a registration's options, as
+     * `navigator.credentials.create()` would.
+     *
+     * `attestationObject` is where a real authenticator states which device it
+     * is, wrapped in CBOR. Nothing reads one here, and the public key travels in
+     * `publicKey`, the field a browser's own JSON serialization carries it in,
+     * so the attestation is the signed authenticator data and no more.
+     */
+    create(options: SimCognitoWebAuthnCreationOptions): SimCognitoWebAuthnCredentialDocument;
+    /**
+     * Present a passkey for a sign-in's options, as
+     * `navigator.credentials.get()` would.
+     */
+    present(options: SimCognitoWebAuthnRequestOptions, userHandle: string): SimCognitoWebAuthnCredentialDocument;
+    /**
+     * Forget a passkey, because the pool that held its public half has.
+     */
+    forget(credentialId: string): void;
+}
+//# sourceMappingURL=sim-cognito-web-authn-device.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-device.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-device.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iCAAiC,EACjC,oCAAoC,EACpC,gCAAgC,EACjC,MAAM,qCAAqC,CAAC;AAwC7C;;;;;;;;;;;;;;GAcG;AACH,qBAAa,wBAAwB;;IAGnC;;;;;;;;OAQG;IACH,MAAM,CACJ,OAAO,EAAE,iCAAiC,GACzC,oCAAoC,CAoBtC;IAED;;;OAGG;IACH,OAAO,CACL,OAAO,EAAE,gCAAgC,EACzC,UAAU,EAAE,MAAM,GACjB,oCAAoC,CAuBtC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAEjC;CACF"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-device.js

@@ -0,0 +1,90 @@
+import { SimCognitoWebAuthnKeys } from "./sim-cognito-web-authn-keys.js";
+import { simCognitoWebAuthnPublicKey } from "./sim-cognito-web-authn-public-key.js";
+import { simCognitoWebAuthnAlgorithm, simCognitoWebAuthnAuthenticatorData, simCognitoWebAuthnClientData, simCognitoWebAuthnCredentialId, simCognitoWebAuthnKeyPair, simCognitoWebAuthnSignature, } from "./sim-cognito-web-authn-signing.js";
+/**
+ * How a passkey made here says it is attached, which is what a platform
+ * authenticator such as a phone or a laptop reports.
+ */
+const attachment = "platform";
+/**
+ * How a passkey made here says it can be reached.
+ */
+const transports = ["internal", "hybrid"];
+/**
+ * A credential around the response one ceremony produced.
+ */
+function credentialOf(credentialId, response) {
+    return {
+        id: credentialId,
+        rawId: credentialId,
+        type: "public-key",
+        authenticatorAttachment: attachment,
+        response,
+        clientExtensionResults: {},
+    };
+}
+/**
+ * The authenticator standing in for a user's own device.
+ *
+ * WebAuthn has two sides. The pool holds public keys and checks signatures,
+ * and a phone or a laptop holds the private keys and produces them. There is
+ * neither in a test, so this is the simulator's own, in the way
+ * `SimCognitoUserPool.softwareTokenCode` reads the code a user's authenticator
+ * app would be showing.
+ *
+ * The keys are real ECDSA keys over P-256 and the signatures are real, so a
+ * credential this produces is accepted because it verifies. A test that would
+ * rather hold its own key can build the credential document itself. It is the
+ * JSON a browser serializes a `PublicKeyCredential` to, and nothing here reads
+ * a field a browser leaves out.
+ */
+export class SimCognitoWebAuthnDevice {
+    #keys = new SimCognitoWebAuthnKeys();
+    /**
+     * Create a passkey for a registration's options, as
+     * `navigator.credentials.create()` would.
+     *
+     * `attestationObject` is where a real authenticator states which device it
+     * is, wrapped in CBOR. Nothing reads one here, and the public key travels in
+     * `publicKey`, the field a browser's own JSON serialization carries it in,
+     * so the attestation is the signed authenticator data and no more.
+     */
+    create(options) {
+        const { publicKey, privateKey } = simCognitoWebAuthnKeyPair();
+        const credentialId = simCognitoWebAuthnCredentialId();
+        const signed = simCognitoWebAuthnAuthenticatorData(options.rp.id, 0);
+        const collected = simCognitoWebAuthnClientData("webauthn.create", options.challenge, options.rp.id);
+        this.#keys.add(credentialId, privateKey);
+        return credentialOf(credentialId, {
+            clientDataJSON: collected.toString("base64url"),
+            attestationObject: signed.toString("base64url"),
+            authenticatorData: signed.toString("base64url"),
+            publicKey: simCognitoWebAuthnPublicKey(publicKey),
+            publicKeyAlgorithm: simCognitoWebAuthnAlgorithm,
+            transports: [...transports],
+        });
+    }
+    /**
+     * Present a passkey for a sign-in's options, as
+     * `navigator.credentials.get()` would.
+     */
+    present(options, userHandle) {
+        const [credentialId, key] = this.#keys.requireOneOf(options.allowCredentials.map((each) => each.id));
+        key.signCount += 1;
+        const signed = simCognitoWebAuthnAuthenticatorData(options.rpId, key.signCount);
+        const collected = simCognitoWebAuthnClientData("webauthn.get", options.challenge, options.rpId);
+        return credentialOf(credentialId, {
+            clientDataJSON: collected.toString("base64url"),
+            authenticatorData: signed.toString("base64url"),
+            signature: simCognitoWebAuthnSignature(key.privateKey, signed, collected),
+            userHandle,
+        });
+    }
+    /**
+     * Forget a passkey, because the pool that held its public half has.
+     */
+    forget(credentialId) {
+        this.#keys.forget(credentialId);
+    }
+}
+//# sourceMappingURL=sim-cognito-web-authn-device.js.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-device.js","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-device.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,EACnC,4BAA4B,EAC5B,8BAA8B,EAC9B,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,oCAAoC,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,GAAG,UAAU,CAAC;AAE9B;;GAEG;AACH,MAAM,UAAU,GAAsB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AAE7D;;GAEG;AACH,SAAS,YAAY,CACnB,YAAoB,EACpB,QAA0D;IAE1D,OAAO;QACL,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,YAAY;QAClB,uBAAuB,EAAE,UAAU;QACnC,QAAQ;QACR,sBAAsB,EAAE,EAAE;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,wBAAwB;IAC1B,KAAK,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAE9C;;;;;;;;OAQG;IACH,MAAM,CACJ,OAA0C;QAE1C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,yBAAyB,EAAE,CAAC;QAC9D,MAAM,YAAY,GAAG,8BAA8B,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,mCAAmC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,4BAA4B,CAC5C,iBAAiB,EACjB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,EAAE,CAAC,EAAE,CACd,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAEzC,OAAO,YAAY,CAAC,YAAY,EAAE;YAChC,cAAc,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC/C,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC/C,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC/C,SAAS,EAAE,2BAA2B,CAAC,SAAS,CAAC;YACjD,kBAAkB,EAAE,2BAA2B;YAC/C,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,OAAO,CACL,OAAyC,EACzC,UAAkB;QAElB,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CACjD,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAChD,CAAC;QAEF,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC;QAEnB,MAAM,MAAM,GAAG,mCAAmC,CAChD,OAAO,CAAC,IAAI,EACZ,GAAG,CAAC,SAAS,CACd,CAAC;QACF,MAAM,SAAS,GAAG,4BAA4B,CAC5C,cAAc,EACd,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,IAAI,CACb,CAAC;QAEF,OAAO,YAAY,CAAC,YAAY,EAAE;YAChC,cAAc,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC/C,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC/C,SAAS,EAAE,2BAA2B,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC;YACzE,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAoB;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;CACF"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-document.d.ts

@@ -0,0 +1,111 @@
+/**
+ * A value as an SDK document input carries one, which is JSON and no more.
+ *
+ * `Credential` on `CompleteWebAuthnRegistration` is a document rather than a
+ * shape the API names, so a credential built here is written to be assignable
+ * to one. That is what lets a test pass the credential straight to the SDK
+ * Command without casting it first.
+ */
+export type SimCognitoWebAuthnDocumentValue = null | boolean | number | string | SimCognitoWebAuthnDocumentValue[] | {
+    [member: string]: SimCognitoWebAuthnDocumentValue;
+};
+/**
+ * The relying party a credential is created for.
+ */
+export interface SimCognitoWebAuthnRelyingParty {
+    readonly id: string;
+    readonly name: string;
+}
+/**
+ * The user a credential is created for, as WebAuthn names one: an opaque
+ * handle the authenticator stores, and the names it shows a person.
+ */
+export interface SimCognitoWebAuthnUserEntity {
+    readonly id: string;
+    readonly name: string;
+    readonly displayName: string;
+}
+/**
+ * One credential named in a ceremony's options, either to exclude from a
+ * registration or to allow at a sign-in.
+ */
+export interface SimCognitoWebAuthnCredentialDescriptor {
+    readonly type: "public-key";
+    readonly id: string;
+    readonly transports: readonly string[];
+}
+/**
+ * What `StartWebAuthnRegistration` answers with, which a browser passes
+ * straight to `navigator.credentials.create()`.
+ *
+ * https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_StartWebAuthnRegistration.html
+ */
+export interface SimCognitoWebAuthnCreationOptions {
+    readonly challenge: string;
+    readonly rp: SimCognitoWebAuthnRelyingParty;
+    readonly user: SimCognitoWebAuthnUserEntity;
+    readonly pubKeyCredParams: readonly {
+        readonly type: "public-key";
+        readonly alg: number;
+    }[];
+    readonly timeout: number;
+    readonly excludeCredentials: readonly SimCognitoWebAuthnCredentialDescriptor[];
+    readonly authenticatorSelection: {
+        readonly residentKey: string;
+        readonly requireResidentKey: boolean;
+        readonly userVerification: string;
+    };
+    readonly attestation: string;
+}
+/**
+ * What a `WEB_AUTHN` challenge carries, which a browser passes straight to
+ * `navigator.credentials.get()`.
+ */
+export interface SimCognitoWebAuthnRequestOptions {
+    readonly challenge: string;
+    readonly rpId: string;
+    readonly timeout: number;
+    readonly allowCredentials: readonly SimCognitoWebAuthnCredentialDescriptor[];
+    readonly userVerification: string;
+}
+/**
+ * The half of a credential an authenticator fills in when it creates one.
+ *
+ * `attestationObject` is where a real authenticator states what kind of device
+ * it is. Nothing here reads one, and the public key is read from `publicKey`
+ * instead, which is the field a browser's own JSON serialization carries it
+ * in.
+ */
+export interface SimCognitoWebAuthnAttestationResponse {
+    [member: string]: SimCognitoWebAuthnDocumentValue;
+    readonly clientDataJSON: string;
+    readonly attestationObject: string;
+    readonly authenticatorData: string;
+    readonly publicKey: string;
+    readonly publicKeyAlgorithm: number;
+    readonly transports: string[];
+}
+/**
+ * The half of a credential an authenticator fills in when it presents one.
+ */
+export interface SimCognitoWebAuthnAssertionResponse {
+    [member: string]: SimCognitoWebAuthnDocumentValue;
+    readonly clientDataJSON: string;
+    readonly authenticatorData: string;
+    readonly signature: string;
+    readonly userHandle: string;
+}
+/**
+ * A credential as a browser serializes one, which is what
+ * `CompleteWebAuthnRegistration` and a `WEB_AUTHN` challenge response carry.
+ */
+export interface SimCognitoWebAuthnCredentialDocument {
+    [member: string]: SimCognitoWebAuthnDocumentValue;
+    readonly id: string;
+    readonly rawId: string;
+    readonly type: "public-key";
+    readonly authenticatorAttachment: string;
+    readonly response: SimCognitoWebAuthnAttestationResponse | SimCognitoWebAuthnAssertionResponse;
+    readonly clientExtensionResults: Record<string, never>;
+}
+//# sourceMappingURL=sim-cognito-web-authn-document.d.ts.map

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-web-authn-document.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-document.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,MAAM,+BAA+B,GACvC,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,+BAA+B,EAAE,GACjC;IAAE,CAAC,MAAM,EAAE,MAAM,GAAG,+BAA+B,CAAA;CAAE,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,8BAA8B,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,SAAS;QAClC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;QAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,EAAE,CAAC;IACJ,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,EAAE,SAAS,sCAAsC,EAAE,CAAC;IAC/E,QAAQ,CAAC,sBAAsB,EAAE;QAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;QACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,SAAS,sCAAsC,EAAE,CAAC;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qCAAqC;IACpD,CAAC,MAAM,EAAE,MAAM,GAAG,+BAA+B,CAAC;IAClD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,CAAC,MAAM,EAAE,MAAM,GAAG,+BAA+B,CAAC;IAClD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,oCAAoC;IACnD,CAAC,MAAM,EAAE,MAAM,GAAG,+BAA+B,CAAC;IAClD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,QAAQ,EACb,qCAAqC,GACrC,mCAAmC,CAAC;IACxC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CACxD"}

package/dist/service/cognito/user-pool/user/web-authn/sim-cognito-web-authn-document.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-cognito-web-authn-document.js.map