@kensio/yulin 1.20.17 → 1.21.1

package/dist/service/cloudwatch/sim-cloudwatch-commands.js

@@ -14,6 +14,7 @@ import { SimCloudWatchGetMetricData } from "./command/query/sim-cloudwatch-get-m
 import { SimCloudWatchGetMetricStatistics } from "./command/query/sim-cloudwatch-get-metric-statistics.js";
 import { SimCloudWatchListMetrics } from "./command/query/sim-cloudwatch-list-metrics.js";
 import { SimCloudWatchMetricStore } from "./metric/sim-cloudwatch-metric-store.js";
+import { SimCloudWatchServiceWriter } from "./write/sim-cloudwatch-service-writer.js";
 /**
  * The collaborators one simulated CloudWatch scope is built from.
  *
@@ -24,6 +25,7 @@ import { SimCloudWatchMetricStore } from "./metric/sim-cloudwatch-metric-store.j
  */
 export class SimCloudWatchCommands {
     metrics;
+    serviceWriter;
     putMetricData;
     listMetrics;
     getMetricStatistics;
@@ -39,6 +41,10 @@ export class SimCloudWatchCommands {
         const iam = simIamInRegion(properties.iam, accountRegionScope.regionName);
         const authorizer = new SimCloudWatchAuthorizer({ iam, accountRegionScope });
         const metrics = new SimCloudWatchMetricStore();
+        this.serviceWriter = new SimCloudWatchServiceWriter({
+            metrics,
+            clock: background,
+        });
         const alarms = new SimCloudWatchAlarmStore();
         const alarmActions = new SimCloudWatchAlarmActions({
             targets: alarmTargets,

package/dist/service/cloudwatch/sim-cloudwatch.d.ts

@@ -5,6 +5,7 @@ import type { SimCloudWatchRequestOptions } from "./command/sim-cloudwatch-reque
 import type { SimCloudWatchAlarmActionFailure } from "./alarm/action/sim-cloudwatch-alarm-action-failures.js";
 import type { SimCloudWatchAlarm } from "./alarm/sim-cloudwatch-alarm.js";
 import type { SimCloudWatchMetric } from "./metric/sim-cloudwatch-metric.js";
+import type { SimCloudWatchServiceWriter } from "./write/sim-cloudwatch-service-writer.js";
 import { type SimCloudWatchProperties } from "./sim-cloudwatch-commands.js";
 /**
  * Simulated CloudWatch metrics. Handles SDK commands. Emulates AWS behaviour
@@ -28,6 +29,14 @@ export declare class SimCloudWatch {
      * without going through a Command and its authorization.
      */
     allMetrics(): readonly SimCloudWatchMetric[];
+    /**
+     * How the rest of the simulation publishes the metrics AWS publishes.
+     *
+     * A simulated service counting its own work reaches the metric store through
+     * here rather than through `PutMetricData`, which refuses a reserved `AWS/`
+     * namespace exactly as an account does.
+     */
+    serviceWriter(): SimCloudWatchServiceWriter;
     /**
      * Every alarm in this scope, in the order each was created.
      *

package/dist/service/cloudwatch/sim-cloudwatch.js

@@ -31,6 +31,16 @@ export class SimCloudWatch {
     allMetrics() {
         return this.#commands.metrics.all;
     }
+    /**
+     * How the rest of the simulation publishes the metrics AWS publishes.
+     *
+     * A simulated service counting its own work reaches the metric store through
+     * here rather than through `PutMetricData`, which refuses a reserved `AWS/`
+     * namespace exactly as an account does.
+     */
+    serviceWriter() {
+        return this.#commands.serviceWriter;
+    }
     /**
      * Every alarm in this scope, in the order each was created.
      *

package/dist/service/cloudwatch/write/sim-cloudwatch-service-writer.d.ts

@@ -0,0 +1,58 @@
+import type { SimClock } from "../../../util/clock/sim-clock.js";
+import { type SimCloudWatchDimensionInput } from "../metric/sim-cloudwatch-dimension.js";
+import type { SimCloudWatchMetricStore } from "../metric/sim-cloudwatch-metric-store.js";
+import type { SimCloudWatchUnit } from "../metric/sim-cloudwatch-unit.js";
+/**
+ * One observation of a metric AWS publishes.
+ *
+ * The dimensions are written the way an SDK command writes them, with a
+ * capital `Name` and `Value`, because a test seeding a datapoint reaches for
+ * the same shape it passes to `PutMetricData` and `PutMetricAlarm`.
+ */
+export interface SimCloudWatchServiceDatum {
+    readonly namespace: string;
+    readonly metricName: string;
+    readonly dimensions: readonly SimCloudWatchDimensionInput[];
+    readonly value: number;
+    readonly unit?: SimCloudWatchUnit | undefined;
+    /**
+     * When the observation was made. The simulation's clock stamps one that
+     * arrives without it.
+     */
+    readonly timestamp?: number | undefined;
+}
+interface SimCloudWatchServiceWriterProperties {
+    readonly metrics: SimCloudWatchMetricStore;
+    readonly clock: SimClock;
+}
+/**
+ * How a metric AWS publishes reaches the store.
+ *
+ * This is not the CloudWatch API. A simulated service counting its own work is
+ * the account's own machinery rather than a caller making a request, so
+ * nothing here authorizes one. Real CloudWatch does not put Lambda's own
+ * `Invocations` through `PutMetricData` either.
+ *
+ * The reserved namespace rule is the point of the separation. `PutMetricData`
+ * refuses a namespace beginning `AWS/`, exactly as an account does, and the
+ * services whose metrics those are reach the store through here instead.
+ *
+ * A test reaches it too, through `cloudWatch().serviceWriter()`, to stand up a
+ * datapoint for a metric nothing in the simulation publishes. That is how an
+ * alarm on one is driven to a state change.
+ */
+export declare class SimCloudWatchServiceWriter {
+    #private;
+    constructor(properties: SimCloudWatchServiceWriterProperties);
+    /**
+     * Record one observation of each metric given.
+     *
+     * A whole batch goes in together so one invocation's metrics land at the
+     * same instant, whatever the clock does next.
+     *
+     * Dimensions are read the way a command reads them, which is what keys a
+     * seeded datapoint to the same metric a query and an alarm look for.
+     */
+    publish(data: readonly SimCloudWatchServiceDatum[]): void;
+}
+export {};

package/dist/service/cloudwatch/write/sim-cloudwatch-service-writer.js

@@ -0,0 +1,53 @@
+import { requiredSimCloudWatchDimensions, } from "../metric/sim-cloudwatch-dimension.js";
+/**
+ * How a metric AWS publishes reaches the store.
+ *
+ * This is not the CloudWatch API. A simulated service counting its own work is
+ * the account's own machinery rather than a caller making a request, so
+ * nothing here authorizes one. Real CloudWatch does not put Lambda's own
+ * `Invocations` through `PutMetricData` either.
+ *
+ * The reserved namespace rule is the point of the separation. `PutMetricData`
+ * refuses a namespace beginning `AWS/`, exactly as an account does, and the
+ * services whose metrics those are reach the store through here instead.
+ *
+ * A test reaches it too, through `cloudWatch().serviceWriter()`, to stand up a
+ * datapoint for a metric nothing in the simulation publishes. That is how an
+ * alarm on one is driven to a state change.
+ */
+export class SimCloudWatchServiceWriter {
+    #metrics;
+    #clock;
+    constructor(properties) {
+        this.#metrics = properties.metrics;
+        this.#clock = properties.clock;
+    }
+    /**
+     * Record one observation of each metric given.
+     *
+     * A whole batch goes in together so one invocation's metrics land at the
+     * same instant, whatever the clock does next.
+     *
+     * Dimensions are read the way a command reads them, which is what keys a
+     * seeded datapoint to the same metric a query and an alarm look for.
+     */
+    publish(data) {
+        const now = this.#clock.now().getTime();
+        for (const datum of data) {
+            this.#metrics
+                .ensure({
+                namespace: datum.namespace,
+                metricName: datum.metricName,
+                dimensions: requiredSimCloudWatchDimensions(datum.dimensions),
+            })
+                .record({
+                timestamp: datum.timestamp ?? now,
+                sampleCount: 1,
+                sum: datum.value,
+                minimum: datum.value,
+                maximum: datum.value,
+                unit: datum.unit,
+            });
+        }
+    }
+}

package/dist/service/cognito/command/auth/sim-cognito-admin-respond-to-challenge.d.ts

@@ -1,8 +1,10 @@
 import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
 import type { SimCognitoChallengeResponses } from "./sim-cognito-challenge-responses.js";
 import type { SimAdminRespondToAuthChallengeCommand, SimAdminRespondToAuthChallengeCommandOutput } from "./auth.command.js";
 interface SimCognitoAdminRespondToChallengeProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly authResolver: SimCognitoAuthResolver;
     readonly responses: SimCognitoChallengeResponses;
 }
@@ -17,6 +19,7 @@ interface SimCognitoCommandOptions {
  * pool.
  */
 export declare class SimCognitoAdminRespondToChallenge {
+    private readonly poolMetrics;
     private readonly authResolver;
     private readonly responses;
     private readonly unsimulatedOptions;

package/dist/service/cognito/command/auth/sim-cognito-admin-respond-to-challenge.js

@@ -1,3 +1,4 @@
+import { countedSimCognitoAuth } from "../../metric/sim-cognito-counted-request.js";
 import { SimCognitoAuthParameters } from "./sim-cognito-auth-parameters.js";
 import { SimCognitoUnsimulatedAuthOptions } from "./sim-cognito-unsimulated-auth-options.js";
 /**
@@ -8,10 +9,12 @@ import { SimCognitoUnsimulatedAuthOptions } from "./sim-cognito-unsimulated-auth
  * pool.
  */
 export class SimCognitoAdminRespondToChallenge {
+    poolMetrics;
     authResolver;
     responses;
     unsimulatedOptions = new SimCognitoUnsimulatedAuthOptions();
     constructor(properties) {
+        this.poolMetrics = properties.poolMetrics;
         this.authResolver = properties.authResolver;
         this.responses = properties.responses;
     }
@@ -22,12 +25,15 @@ export class SimCognitoAdminRespondToChallenge {
         const { input } = command;
         const { pool, client } = this.authResolver.poolClient("cognito-idp:AdminRespondToAuthChallenge", input, options);
         this.unsimulatedOptions.refuseInAdminResponse(input);
-        return await this.responses.handle(input.ChallengeName, {
+        // Counted here rather than in the shared responder, so that a response
+        // counts as the one request it is, the way `RespondToAuthChallenge`
+        // counts its own.
+        return await countedSimCognitoAuth(this.poolMetrics, "SignIn", { pool, client }, async () => await this.responses.handle(input.ChallengeName, {
             pool,
             client,
             parameters: new SimCognitoAuthParameters("ChallengeResponses", input.ChallengeResponses),
             session: input.Session,
             clientMetadata: input.ClientMetadata,
-        });
+        }));
     }
 }

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.d.ts

@@ -6,6 +6,7 @@ import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cog
 import type { SimCognitoRequestResolver } from "../sim-cognito-request-resolver.js";
 import { SimCognitoAdminInitiateAuth } from "./sim-cognito-admin-initiate-auth.js";
 import { SimCognitoAdminRespondToChallenge } from "./sim-cognito-admin-respond-to-challenge.js";
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import { SimCognitoGetTokensFromRefreshToken } from "./sim-cognito-get-tokens-from-refresh-token.js";
 import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
 import type { SimCognitoFirstFactorChallenge } from "./sim-cognito-first-factor-challenge.js";
@@ -34,6 +35,8 @@ interface SimCognitoAuthCommandsProperties {
      * a passkey presented at either answers the same kind of challenge.
      */
     readonly firstFactor: SimCognitoFirstFactorChallenge;
+    /** What counts this pool's requests into `AWS/Cognito`. */
+    readonly poolMetrics: SimCognitoPoolMetrics;
 }
 /**
  * The authentication command handlers of one simulated Cognito scope.

package/dist/service/cognito/command/auth/sim-cognito-auth-commands.js

@@ -57,6 +57,7 @@ export class SimCognitoAuthCommands {
             triggers,
         });
         const flowRunner = new SimCognitoAuthFlowRunner({
+            poolMetrics: properties.poolMetrics,
             passwordSignIn,
             refreshSignIn: new SimCognitoRefreshSignIn({ refreshedTokens, clock }),
             userAuthSignIn: new SimCognitoUserAuthSignIn({
@@ -86,6 +87,7 @@ export class SimCognitoAuthCommands {
             flowRunner,
         });
         this.adminRespondToChallenge = new SimCognitoAdminRespondToChallenge({
+            poolMetrics: properties.poolMetrics,
             authResolver,
             responses,
         });
@@ -94,10 +96,12 @@ export class SimCognitoAuthCommands {
             flowRunner,
         });
         this.respondToChallenge = new SimCognitoRespondToChallenge({
+            poolMetrics: properties.poolMetrics,
             authResolver,
             responses,
         });
         this.getTokensFromRefreshToken = new SimCognitoGetTokensFromRefreshToken({
+            poolMetrics: properties.poolMetrics,
             authResolver,
             refreshedTokens,
             clock,

package/dist/service/cognito/command/auth/sim-cognito-auth-flow-runner.d.ts

@@ -1,9 +1,11 @@
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimCognitoAuthFlow } from "./sim-cognito-auth-flow.js";
 import type { SimCognitoPasswordSignIn, SimCognitoAuthRequest } from "./sim-cognito-password-sign-in.js";
 import type { SimCognitoRefreshSignIn } from "./sim-cognito-refresh-sign-in.js";
 import type { SimCognitoUserAuthSignIn } from "./sim-cognito-user-auth-sign-in.js";
 import type { SimCognitoAuthenticationOutput } from "./auth.command.js";
 interface SimCognitoAuthFlowRunnerProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly passwordSignIn: SimCognitoPasswordSignIn;
     readonly refreshSignIn: SimCognitoRefreshSignIn;
     readonly userAuthSignIn: SimCognitoUserAuthSignIn;
@@ -21,13 +23,21 @@ interface SimCognitoAuthFlowRunnerProperties {
  * issues tokens.
  */
 export declare class SimCognitoAuthFlowRunner {
+    private readonly poolMetrics;
     private readonly passwordSignIn;
     private readonly refreshSignIn;
     private readonly userAuthSignIn;
     constructor(properties: SimCognitoAuthFlowRunnerProperties);
     /**
-     * Run a flow the app client is configured for.
+     * Run a flow the app client is configured for, and count the request.
+     *
+     * Real Cognito keeps a token refresh out of `SignInSuccesses` and counts it
+     * under `TokenRefreshSuccesses` instead, so which metric a request lands in
+     * follows the flow it ran. A request answered with a challenge issued no
+     * tokens and counts as a 0, and so does one the pool refused outright. The
+     * response that finishes a challenged sign-in is counted where it completes.
      */
     run(flow: SimCognitoAuthFlow, request: SimCognitoAuthRequest): Promise<SimCognitoAuthenticationOutput>;
+    private ran;
 }
 export {};

package/dist/service/cognito/command/auth/sim-cognito-auth-flow-runner.js

@@ -1,3 +1,4 @@
+import { countedSimCognitoAuth } from "../../metric/sim-cognito-counted-request.js";
 /**
  * Runs whichever flow a request resolved to.
  *
@@ -11,18 +12,29 @@
  * issues tokens.
  */
 export class SimCognitoAuthFlowRunner {
+    poolMetrics;
     passwordSignIn;
     refreshSignIn;
     userAuthSignIn;
     constructor(properties) {
+        this.poolMetrics = properties.poolMetrics;
         this.passwordSignIn = properties.passwordSignIn;
         this.refreshSignIn = properties.refreshSignIn;
         this.userAuthSignIn = properties.userAuthSignIn;
     }
     /**
-     * Run a flow the app client is configured for.
+     * Run a flow the app client is configured for, and count the request.
+     *
+     * Real Cognito keeps a token refresh out of `SignInSuccesses` and counts it
+     * under `TokenRefreshSuccesses` instead, so which metric a request lands in
+     * follows the flow it ran. A request answered with a challenge issued no
+     * tokens and counts as a 0, and so does one the pool refused outright. The
+     * response that finishes a challenged sign-in is counted where it completes.
      */
     async run(flow, request) {
+        return await countedSimCognitoAuth(this.poolMetrics, flow.exchangesRefreshToken ? "TokenRefresh" : "SignIn", request, async () => await this.ran(flow, request));
+    }
+    async ran(flow, request) {
         if (flow.exchangesRefreshToken) {
             return await this.refreshSignIn.handle(request);
         }

package/dist/service/cognito/command/auth/sim-cognito-auth-resolver.d.ts

@@ -1,11 +1,13 @@
 import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoClientInPool, SimCognitoUserPoolStore } from "../../user-pool/sim-cognito-user-pool-store.js";
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimCognitoRequestResolver } from "../sim-cognito-request-resolver.js";
 import type { SimCognitoAuthParameters } from "./sim-cognito-auth-parameters.js";
 interface SimCognitoAuthResolverProperties {
     readonly resolver: SimCognitoRequestResolver;
     readonly pools: SimCognitoUserPoolStore;
+    readonly poolMetrics: SimCognitoPoolMetrics;
 }
 interface SimCognitoCommandOptions {
     readonly caller?: SimAwsCaller;
@@ -29,6 +31,7 @@ export type SimCognitoAuthenticatingClient = SimCognitoClientInPool;
 export declare class SimCognitoAuthResolver {
     private readonly resolver;
     private readonly pools;
+    private readonly poolMetrics;
     constructor(properties: SimCognitoAuthResolverProperties);
     /**
      * Resolve the pool and app client an admin request names, once the caller

package/dist/service/cognito/command/auth/sim-cognito-auth-resolver.js

@@ -1,5 +1,6 @@
 import { requireSimCognitoSecretHash } from "../../user-pool/auth/sim-cognito-secret-hash.js";
 import { requireSimCognitoUserPoolClientId } from "../../user-pool/client/sim-cognito-user-pool-client-id.js";
+import { simCognitoInvalidClientDimension } from "../../metric/sim-cognito-metrics.js";
 /**
  * Resolves what an authentication request names before the flow itself runs.
  *
@@ -10,9 +11,11 @@ import { requireSimCognitoUserPoolClientId } from "../../user-pool/client/sim-co
 export class SimCognitoAuthResolver {
     resolver;
     pools;
+    poolMetrics;
     constructor(properties) {
         this.resolver = properties.resolver;
         this.pools = properties.pools;
+        this.poolMetrics = properties.poolMetrics;
     }
     /**
      * Resolve the pool and app client an admin request names, once the caller
@@ -23,10 +26,19 @@ export class SimCognitoAuthResolver {
      */
     poolClient(action, input, options) {
         const pool = this.resolver.pool(action, input.UserPoolId, options);
-        return {
-            pool,
-            client: pool.requireClient(requireSimCognitoUserPoolClientId(input.ClientId)),
-        };
+        try {
+            return {
+                pool,
+                client: pool.requireClient(requireSimCognitoUserPoolClientId(input.ClientId)),
+            };
+        }
+        catch (error) {
+            // Real Cognito counts a request naming an app client the pool has none
+            // of, reporting a fixed name in the client's place rather than the id
+            // the request gave. The request still fails.
+            this.poolMetrics.count("SignIn", pool.id, simCognitoInvalidClientDimension, false);
+            throw error;
+        }
     }
     /**
      * Resolve the pool and app client a client-side request names, which is by

package/dist/service/cognito/command/auth/sim-cognito-get-tokens-from-refresh-token.d.ts

@@ -1,8 +1,10 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
 import type { SimCognitoRefreshedTokens } from "./sim-cognito-refreshed-tokens.js";
 import type { SimGetTokensFromRefreshTokenCommand, SimGetTokensFromRefreshTokenCommandOutput } from "./auth.command.js";
 interface SimCognitoGetTokensFromRefreshTokenProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly authResolver: SimCognitoAuthResolver;
     readonly refreshedTokens: SimCognitoRefreshedTokens;
     readonly clock: SimClock;
@@ -21,6 +23,7 @@ interface SimCognitoGetTokensFromRefreshTokenProperties {
  * than a hash computed over a username it does not have.
  */
 export declare class SimCognitoGetTokensFromRefreshToken {
+    private readonly poolMetrics;
     private readonly authResolver;
     private readonly refreshedTokens;
     private readonly clock;
@@ -28,7 +31,11 @@ export declare class SimCognitoGetTokensFromRefreshToken {
     constructor(properties: SimCognitoGetTokensFromRefreshTokenProperties);
     /**
      * Renew a session from the refresh token it holds.
+     *
+     * Real Cognito counts this under `TokenRefreshSuccesses`, the same metric an
+     * `InitiateAuth` running `REFRESH_TOKEN_AUTH` lands in.
      */
     handle(command: SimGetTokensFromRefreshTokenCommand): Promise<SimGetTokensFromRefreshTokenCommandOutput>;
+    private renewed;
 }
 export {};

package/dist/service/cognito/command/auth/sim-cognito-get-tokens-from-refresh-token.js

@@ -1,5 +1,6 @@
 import { requireSimCognitoRefreshTokenInput } from "../../user-pool/auth/sim-cognito-refresh-token-input.js";
 import { requireSimCognitoClientSecret } from "../../user-pool/client/sim-cognito-client-secret.js";
+import { countedSimCognitoAuth } from "../../metric/sim-cognito-counted-request.js";
 import { SimCognitoUnsimulatedInput } from "../sim-cognito-unsimulated-input.js";
 /**
  * The GetTokensFromRefreshToken command.
@@ -15,21 +16,30 @@ import { SimCognitoUnsimulatedInput } from "../sim-cognito-unsimulated-input.js"
  * than a hash computed over a username it does not have.
  */
 export class SimCognitoGetTokensFromRefreshToken {
+    poolMetrics;
     authResolver;
     refreshedTokens;
     clock;
     unsimulated = new SimCognitoUnsimulatedInput("GetTokensFromRefreshToken");
     constructor(properties) {
+        this.poolMetrics = properties.poolMetrics;
         this.authResolver = properties.authResolver;
         this.refreshedTokens = properties.refreshedTokens;
         this.clock = properties.clock;
     }
     /**
      * Renew a session from the refresh token it holds.
+     *
+     * Real Cognito counts this under `TokenRefreshSuccesses`, the same metric an
+     * `InitiateAuth` running `REFRESH_TOKEN_AUTH` lands in.
      */
     async handle(command) {
         const { input } = command;
-        const { pool, client } = this.authResolver.client(input.ClientId);
+        const scope = this.authResolver.client(input.ClientId);
+        return await countedSimCognitoAuth(this.poolMetrics, "TokenRefresh", scope, async () => await this.renewed(command, scope));
+    }
+    async renewed(command, { pool, client }) {
+        const { input } = command;
         this.unsimulated.refuse("DeviceKey", input.DeviceKey, "device remembering, which signs a known device in without its second factor");
         requireSimCognitoClientSecret(client, input.ClientSecret);
         const refreshToken = pool.auth.requireRefreshToken({

package/dist/service/cognito/command/auth/sim-cognito-respond-to-challenge.d.ts

@@ -1,7 +1,9 @@
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
 import type { SimCognitoChallengeResponses } from "./sim-cognito-challenge-responses.js";
 import type { SimRespondToAuthChallengeCommand, SimRespondToAuthChallengeCommandOutput } from "./auth.command.js";
 interface SimCognitoRespondToChallengeProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly authResolver: SimCognitoAuthResolver;
     readonly responses: SimCognitoChallengeResponses;
 }
@@ -13,6 +15,7 @@ interface SimCognitoRespondToChallengeProperties {
  * as real Cognito needs none for it.
  */
 export declare class SimCognitoRespondToChallenge {
+    private readonly poolMetrics;
     private readonly authResolver;
     private readonly responses;
     private readonly unsimulatedOptions;

package/dist/service/cognito/command/auth/sim-cognito-respond-to-challenge.js

@@ -1,3 +1,4 @@
+import { countedSimCognitoAuth } from "../../metric/sim-cognito-counted-request.js";
 import { SimCognitoAuthParameters } from "./sim-cognito-auth-parameters.js";
 import { SimCognitoUnsimulatedAuthOptions } from "./sim-cognito-unsimulated-auth-options.js";
 /**
@@ -8,10 +9,12 @@ import { SimCognitoUnsimulatedAuthOptions } from "./sim-cognito-unsimulated-auth
  * as real Cognito needs none for it.
  */
 export class SimCognitoRespondToChallenge {
+    poolMetrics;
     authResolver;
     responses;
     unsimulatedOptions = new SimCognitoUnsimulatedAuthOptions();
     constructor(properties) {
+        this.poolMetrics = properties.poolMetrics;
         this.authResolver = properties.authResolver;
         this.responses = properties.responses;
     }
@@ -22,12 +25,15 @@ export class SimCognitoRespondToChallenge {
         const { input } = command;
         const { pool, client } = this.authResolver.client(input.ClientId);
         this.unsimulatedOptions.refuseInResponse(input);
-        return await this.responses.handle(input.ChallengeName, {
+        // A challenge response is an authentication request of its own, the way
+        // real Cognito counts one, so it is counted here rather than where the
+        // sign-in it belongs to started.
+        return await countedSimCognitoAuth(this.poolMetrics, "SignIn", { pool, client }, async () => await this.responses.handle(input.ChallengeName, {
             pool,
             client,
             parameters: new SimCognitoAuthParameters("ChallengeResponses", input.ChallengeResponses),
             session: input.Session,
             clientMetadata: input.ClientMetadata,
-        });
+        }));
     }
 }

package/dist/service/cognito/command/hosted/hosted-auth.command.d.ts

@@ -50,6 +50,25 @@ export interface SimCognitoAuthorizeInput {
      * issued when the passkey was asked for.
      */
     readonly passkey_session?: string | undefined;
+    /**
+     * The subject the identity provider is signing in, as the stand-in page for
+     * that provider posted it.
+     *
+     * Real Cognito redirects the browser to the provider itself here, and the
+     * provider answers with whoever signed in at it. A test says who that is
+     * with `signInAs`, and a browser on a served domain says it on the page the
+     * simulation stands in with. This is that page coming back.
+     */
+    readonly subject?: string | undefined;
+    /**
+     * One claim the provider would have asserted, under its own claim name.
+     *
+     * The stand-in page draws a field per claim the provider's `AttributeMapping`
+     * reads, so the names are the pool's rather than this simulation's, and they
+     * are prefixed to keep them apart from the authorize parameters they are
+     * posted beside.
+     */
+    readonly [claim: `claim_${string}`]: string | undefined;
 }
 /**
  * Where a hosted endpoint sends the browser next.

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.d.ts

@@ -36,7 +36,7 @@ export declare class SimCognitoAuthorizeEndpoint {
      * `presentedSession` is the managed login session the browser carried, which
      * the serving layer reads out of the `cognito` cookie.
      */
-    handle(pool: SimCognitoUserPool, input: SimCognitoAuthorizeInput, presentedSession?: string): SimCognitoHostedRedirect;
+    handle(pool: SimCognitoUserPool, input: SimCognitoAuthorizeInput, presentedSession?: string): Promise<SimCognitoHostedRedirect>;
     private redirectWithCode;
 }
 export {};

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.js

@@ -35,7 +35,7 @@ export class SimCognitoAuthorizeEndpoint {
      * `presentedSession` is the managed login session the browser carried, which
      * the serving layer reads out of the `cognito` cookie.
      */
-    handle(pool, input, presentedSession) {
+    async handle(pool, input, presentedSession) {
         const client = this.hostedClient.forAuthorize(pool, input.client_id);
         const redirectUri = this.hostedClient.requiredRedirectUri(client, input.redirect_uri);
         // Everything from here on is refused by sending the browser back to the
@@ -45,7 +45,7 @@ export class SimCognitoAuthorizeEndpoint {
         this.hostedClient.requireCodeGrant(client, true);
         this.request.requireChallengeMethod(input);
         const scopes = new SimCognitoGrantedScopes(client, input.scope);
-        const signedIn = this.signIn.signIn(pool, client, input, presentedSession);
+        const signedIn = await this.signIn.signIn(pool, client, input, presentedSession);
         const { user } = signedIn;
         const code = new SimCognitoAuthorizationCode({
             username: user.username,
@@ -54,6 +54,7 @@ export class SimCognitoAuthorizeEndpoint {
             scopes: scopes.values,
             issuedAt: this.clock.now(),
             codeChallenge: input.code_challenge,
+            federated: signedIn.federated,
         });
         pool.auth.addAuthorizationCode(code);
         return {

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.d.ts

@@ -1,13 +1,21 @@
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
+import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoUserFactory } from "../../user-pool/user/sim-cognito-user-factory.js";
 import type { SimCognitoFirstFactorChallenge } from "../auth/sim-cognito-first-factor-challenge.js";
 import { SimCognitoAuthorizeEndpoint } from "./sim-cognito-authorize-endpoint.js";
 import { SimCognitoLogoutEndpoint } from "./sim-cognito-logout-endpoint.js";
 import { SimCognitoTokenEndpoint } from "./sim-cognito-token-endpoint.js";
 interface SimCognitoHostedCommandsProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly tokenIssuer: SimCognitoTokenIssuer;
     readonly userFactory: SimCognitoUserFactory;
+    /**
+     * The trigger runner the API operations use, which a federated sign-in runs
+     * the pool's sign-up and sign-in triggers through.
+     */
+    readonly triggers: SimCognitoUserPoolTriggers;
     /**
      * What asks a user for a passkey, shared with the API sign-ins so a passkey
      * at the hosted domain answers the same kind of challenge.