@kensio/yulin 1.20.17 → 1.21.1

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.js

@@ -17,15 +17,23 @@ export class SimCognitoHostedCommands {
     token;
     logout = new SimCognitoLogoutEndpoint();
     constructor(properties) {
-        const { tokenIssuer, userFactory, challenge, clock } = properties;
+        const { tokenIssuer, userFactory, triggers, challenge, clock } = properties;
         this.authorize = new SimCognitoAuthorizeEndpoint({
             signIn: new SimCognitoHostedSignIn({
-                federatedSignIn: new SimCognitoFederatedSignIn({ userFactory }),
+                federatedSignIn: new SimCognitoFederatedSignIn({
+                    userFactory,
+                    triggers,
+                }),
                 challenge,
                 clock,
+                triggers,
             }),
             clock,
         });
-        this.token = new SimCognitoTokenEndpoint({ tokenIssuer, clock });
+        this.token = new SimCognitoTokenEndpoint({
+            poolMetrics: properties.poolMetrics,
+            tokenIssuer,
+            clock,
+        });
     }
 }

package/dist/service/cognito/command/hosted/sim-cognito-hosted-passkey-sign-in.d.ts

@@ -1,4 +1,5 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
 import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
@@ -21,6 +22,7 @@ interface SimCognitoHostedPasskeySignInProperties {
      */
     readonly challenge: SimCognitoFirstFactorChallenge;
     readonly clock: SimClock;
+    readonly triggers: SimCognitoUserPoolTriggers;
 }
 /**
  * Signing one of a pool's own users in at the authorize endpoint with a
@@ -45,12 +47,20 @@ interface SimCognitoHostedPasskeySignInProperties {
 export declare class SimCognitoHostedPasskeySignIn {
     private readonly challenge;
     private readonly clock;
+    private readonly triggers;
     constructor(properties: SimCognitoHostedPasskeySignInProperties);
     /**
      * Ask this user for a passkey, or refuse where the pool allows none and
      * where the user has registered none.
+     *
+     * `PreAuthentication` runs here rather than where the credential comes back,
+     * because this is the request that starts the sign-in. A `USER_AUTH`
+     * sign-in runs it in the same place, on the `InitiateAuth` that asks for a
+     * factor, and the challenge response that answers runs it no second time.
+     * Only a request that has been asked holds a session to answer with, so
+     * every passkey sign-in passes through here exactly once.
      */
-    ask(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, username: string): never;
+    ask(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, username: string): Promise<never>;
     /**
      * The user the presented credential signs in, having checked that this
      * user's passkey signed the challenge the pool issued.

package/dist/service/cognito/command/hosted/sim-cognito-hosted-passkey-sign-in.js

@@ -26,16 +26,27 @@ import { simCognitoWebAuthnChallenge } from "../auth/sim-cognito-available-chall
 export class SimCognitoHostedPasskeySignIn {
     challenge;
     clock;
+    triggers;
     constructor(properties) {
         this.challenge = properties.challenge;
         this.clock = properties.clock;
+        this.triggers = properties.triggers;
     }
     /**
      * Ask this user for a passkey, or refuse where the pool allows none and
      * where the user has registered none.
+     *
+     * `PreAuthentication` runs here rather than where the credential comes back,
+     * because this is the request that starts the sign-in. A `USER_AUTH`
+     * sign-in runs it in the same place, on the `InitiateAuth` that asks for a
+     * factor, and the challenge response that answers runs it no second time.
+     * Only a request that has been asked holds a session to answer with, so
+     * every passkey sign-in passes through here exactly once.
      */
-    ask(pool, client, username) {
-        const user = this.signingIn(pool, client, username);
+    async ask(pool, client, username) {
+        const user = requireSimCognitoSignInUser(pool, client, username);
+        await this.triggers.preAuthentication({ pool, client, user });
+        requireSimCognitoReadyToSignIn(user);
         const asked = this.challenge.issue({ pool, client, user }, simCognitoWebAuthnChallenge, "passkey");
         throw new SimCognitoPasskeyRequired(username, String(asked.Session));
     }

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.d.ts

@@ -1,5 +1,6 @@
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
 import type { SimCognitoHostedCredentials } from "./sim-cognito-hosted-credentials.js";
 /**
@@ -17,10 +18,19 @@ import type { SimCognitoHostedCredentials } from "./sim-cognito-hosted-credentia
  * reach one is refused here with a message saying which.
  */
 export declare class SimCognitoHostedPasswordSignIn {
+    private readonly triggers;
+    constructor(properties: {
+        readonly triggers: SimCognitoUserPoolTriggers;
+    });
     /**
      * The user these credentials sign in, having checked the password.
+     *
+     * `PreAuthentication` runs once the user is known and before the password is
+     * checked, which is where the API sign-ins run it and where real managed
+     * login reports it from `/login`. A wrong password reaches the handler too,
+     * because the trigger is given the user to decide about.
      */
-    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, credentials: SimCognitoHostedCredentials): SimCognitoUser;
+    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, credentials: SimCognitoHostedCredentials): Promise<SimCognitoUser>;
     /**
      * Refuse a sign-in real managed login answers with a page of its own.
      *

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.js

@@ -16,12 +16,22 @@ import { simCognitoChallengeFactor } from "../auth/sim-cognito-mfa-factor-choice
  * reach one is refused here with a message saying which.
  */
 export class SimCognitoHostedPasswordSignIn {
+    triggers;
+    constructor(properties) {
+        this.triggers = properties.triggers;
+    }
     /**
      * The user these credentials sign in, having checked the password.
+     *
+     * `PreAuthentication` runs once the user is known and before the password is
+     * checked, which is where the API sign-ins run it and where real managed
+     * login reports it from `/login`. A wrong password reaches the handler too,
+     * because the trigger is given the user to decide about.
      */
-    signIn(pool, client, credentials) {
+    async signIn(pool, client, credentials) {
         const { username, password } = credentials;
         const user = requireSimCognitoSignInUser(pool, client, username);
+        await this.triggers.preAuthentication({ pool, client, user });
         requireSimCognitoSignIn(user, password);
         requireSimCognitoConfirmed(user);
         requireSimCognitoPasswordSet(user);

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.d.ts

@@ -2,6 +2,7 @@ import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoFederatedSignIn } from "../../user-pool/idp/sim-cognito-federated-sign-in.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoFirstFactorChallenge } from "../auth/sim-cognito-first-factor-challenge.js";
 import type { SimCognitoHostedSignedIn } from "./sim-cognito-hosted-signed-in.js";
 import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
@@ -13,6 +14,11 @@ interface SimCognitoHostedSignInProperties {
      */
     readonly challenge: SimCognitoFirstFactorChallenge;
     readonly clock: SimClock;
+    /**
+     * The trigger runner the API sign-ins use, which a sign-in at this endpoint
+     * runs the pool's `PreAuthentication` through.
+     */
+    readonly triggers: SimCognitoUserPoolTriggers;
 }
 /**
  * Which user an authorize request signs in.
@@ -36,7 +42,7 @@ export declare class SimCognitoHostedSignIn {
      * The user this request signs in, at a provider, in the pool itself, or from
      * the managed login session the browser presented.
      */
-    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput, presentedSession: string | undefined): SimCognitoHostedSignedIn;
+    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput, presentedSession: string | undefined): Promise<SimCognitoHostedSignedIn>;
     /**
      * Sign in one of the pool's own users, with a passkey, with a password, or
      * from the session the browser is already holding.

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.js

@@ -1,4 +1,5 @@
 import { SimCognitoManagedLoginRequired } from "../../error/sim-cognito-managed-login.error.js";
+import { requireSimCognitoSigningInAt } from "../../user-pool/idp/sim-cognito-presented-external-user.js";
 import { SimCognitoAuthorizeRequest } from "./sim-cognito-authorize-request.js";
 import { SimCognitoBrowserSession } from "./sim-cognito-browser-session.js";
 import { SimCognitoHostedCredentials } from "./sim-cognito-hosted-credentials.js";
@@ -18,29 +19,39 @@ export class SimCognitoHostedSignIn {
     federatedSignIn;
     clock;
     request = new SimCognitoAuthorizeRequest();
-    passwordSignIn = new SimCognitoHostedPasswordSignIn();
+    passwordSignIn;
     passkeySignIn;
     browserSession = new SimCognitoBrowserSession();
     constructor(properties) {
         this.federatedSignIn = properties.federatedSignIn;
         this.clock = properties.clock;
+        this.passwordSignIn = new SimCognitoHostedPasswordSignIn({
+            triggers: properties.triggers,
+        });
         this.passkeySignIn = new SimCognitoHostedPasskeySignIn({
             challenge: properties.challenge,
             clock: properties.clock,
+            triggers: properties.triggers,
         });
     }
     /**
      * The user this request signs in, at a provider, in the pool itself, or from
      * the managed login session the browser presented.
      */
-    signIn(pool, client, input, presentedSession) {
+    async signIn(pool, client, input, presentedSession) {
         const provider = this.request.signInProvider(pool, client, input);
         if (provider === undefined) {
             return this.localSignIn(pool, client, input, presentedSession);
         }
         const now = this.clock.now();
-        const user = this.federatedSignIn.signIn({ pool, provider, now });
-        return this.browserSession.start(pool, user, now);
+        const user = await this.federatedSignIn.signIn({
+            pool,
+            client,
+            provider,
+            externalUser: requireSimCognitoSigningInAt(provider, input),
+            now,
+        });
+        return this.browserSession.start(pool, user, now).asFederated();
     }
     /**
      * Sign in one of the pool's own users, with a passkey, with a password, or
@@ -54,7 +65,7 @@ export class SimCognitoHostedSignIn {
      * the sign-in form is shown for. The serving layer answers with that page,
      * from this refusal.
      */
-    localSignIn(pool, client, input, presentedSession) {
+    async localSignIn(pool, client, input, presentedSession) {
         const now = this.clock.now();
         const { username, credential } = input;
         if (username !== undefined && credential !== undefined) {
@@ -65,7 +76,7 @@ export class SimCognitoHostedSignIn {
             }), now);
         }
         if (username !== undefined && input.passkey !== undefined) {
-            this.passkeySignIn.ask(pool, client, username);
+            await this.passkeySignIn.ask(pool, client, username);
         }
         const credentials = SimCognitoHostedCredentials.in(input);
         if (credentials === undefined) {
@@ -75,7 +86,7 @@ export class SimCognitoHostedSignIn {
             }
             return returning;
         }
-        const user = this.passwordSignIn.signIn(pool, client, credentials);
+        const user = await this.passwordSignIn.signIn(pool, client, credentials);
         return this.browserSession.start(pool, user, now);
     }
 }

package/dist/service/cognito/command/hosted/sim-cognito-hosted-signed-in.d.ts

@@ -3,18 +3,35 @@ import type { SimCognitoSessionChange } from "./sim-cognito-session-change.js";
 interface SimCognitoHostedSignedInProperties {
     readonly user: SimCognitoUser;
     readonly session: SimCognitoSessionChange;
+    /**
+     * Whether this request signed the user in at an identity provider.
+     *
+     * The tokens a federated sign-in hands out report a `PreTokenGeneration`
+     * source of their own, and the code the endpoint issues is what carries the
+     * answer as far as the token endpoint.
+     */
+    readonly federated?: boolean | undefined;
 }
 /**
  * Who an authorize request signed in, and what it did to the browser's managed
  * login session on the way.
  *
- * The two travel together because the endpoint needs both: the user is who the
- * authorization code is issued for, and the session change is what the
- * response tells the browser to hold.
+ * These travel together because the endpoint needs all of them. The user is
+ * who the authorization code is issued for, the session change is what the
+ * response tells the browser to hold, and the federated flag is what the code
+ * remembers about how the sign-in happened.
  */
 export declare class SimCognitoHostedSignedIn {
     readonly user: SimCognitoUser;
     readonly session: SimCognitoSessionChange;
+    readonly federated: boolean;
     constructor(properties: SimCognitoHostedSignedInProperties);
+    /**
+     * The same sign-in, marked as having happened at an identity provider.
+     *
+     * The browser session is started the same way whichever way the user signed
+     * in, so this is applied afterwards by the one path that federates.
+     */
+    asFederated(): SimCognitoHostedSignedIn;
 }
 export {};

package/dist/service/cognito/command/hosted/sim-cognito-hosted-signed-in.js

@@ -2,15 +2,31 @@
  * Who an authorize request signed in, and what it did to the browser's managed
  * login session on the way.
  *
- * The two travel together because the endpoint needs both: the user is who the
- * authorization code is issued for, and the session change is what the
- * response tells the browser to hold.
+ * These travel together because the endpoint needs all of them. The user is
+ * who the authorization code is issued for, the session change is what the
+ * response tells the browser to hold, and the federated flag is what the code
+ * remembers about how the sign-in happened.
  */
 export class SimCognitoHostedSignedIn {
     user;
     session;
+    federated;
     constructor(properties) {
         this.user = properties.user;
         this.session = properties.session;
+        this.federated = properties.federated ?? false;
+    }
+    /**
+     * The same sign-in, marked as having happened at an identity provider.
+     *
+     * The browser session is started the same way whichever way the user signed
+     * in, so this is applied afterwards by the one path that federates.
+     */
+    asFederated() {
+        return new SimCognitoHostedSignedIn({
+            user: this.user,
+            session: this.session,
+            federated: true,
+        });
     }
 }

package/dist/service/cognito/command/hosted/sim-cognito-token-endpoint.d.ts

@@ -1,8 +1,10 @@
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
 import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
 import type { SimCognitoTokenInput, SimCognitoTokenOutput } from "./hosted-auth.command.js";
 interface SimCognitoTokenEndpointProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly tokenIssuer: SimCognitoTokenIssuer;
     readonly clock: SimClock;
 }

package/dist/service/cognito/command/hosted/sim-cognito-token-grants.d.ts

@@ -1,9 +1,11 @@
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
 import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
 import type { SimCognitoTokenInput, SimCognitoTokenOutput } from "./hosted-auth.command.js";
 interface SimCognitoTokenGrantsProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly tokenIssuer: SimCognitoTokenIssuer;
     readonly clock: SimClock;
 }
@@ -16,6 +18,7 @@ interface SimCognitoTokenGrantsProperties {
  * pool the same way.
  */
 export declare class SimCognitoTokenGrants {
+    private readonly poolMetrics;
     private readonly tokenIssuer;
     private readonly clock;
     private readonly presented;
@@ -27,6 +30,11 @@ export declare class SimCognitoTokenGrants {
      * The code is spent whether or not the rest of the request turns out to be
      * right, as real Cognito spends one, so nothing can be retried with a code
      * that has already been presented.
+     *
+     * The `PreTokenGeneration` source says which sign-in the grant came from.
+     * A code from an identity provider reports `TokenGeneration_HostedAuth`, and
+     * one from the pool's own sign-in form reports the
+     * `TokenGeneration_Authentication` its API sign-in reports.
      */
     exchangeCode(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoTokenInput): Promise<SimCognitoTokenOutput>;
     /**

package/dist/service/cognito/command/hosted/sim-cognito-token-grants.js

@@ -1,3 +1,4 @@
+import { countedSimCognitoFederation } from "../../metric/sim-cognito-counted-request.js";
 import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
 import { SimCognitoGrantedTokens } from "./sim-cognito-granted-tokens.js";
 import { SimCognitoPresentedGrant } from "./sim-cognito-presented-grant.js";
@@ -10,11 +11,13 @@ import { SimCognitoPresentedGrant } from "./sim-cognito-presented-grant.js";
  * pool the same way.
  */
 export class SimCognitoTokenGrants {
+    poolMetrics;
     tokenIssuer;
     clock;
     presented = new SimCognitoPresentedGrant();
     granted = new SimCognitoGrantedTokens();
     constructor(properties) {
+        this.poolMetrics = properties.poolMetrics;
         this.tokenIssuer = properties.tokenIssuer;
         this.clock = properties.clock;
     }
@@ -24,6 +27,11 @@ export class SimCognitoTokenGrants {
      * The code is spent whether or not the rest of the request turns out to be
      * right, as real Cognito spends one, so nothing can be retried with a code
      * that has already been presented.
+     *
+     * The `PreTokenGeneration` source says which sign-in the grant came from.
+     * A code from an identity provider reports `TokenGeneration_HostedAuth`, and
+     * one from the pool's own sign-in form reports the
+     * `TokenGeneration_Authentication` its API sign-in reports.
      */
     async exchangeCode(pool, client, input) {
         const code = this.presented.code({
@@ -33,14 +41,15 @@ export class SimCognitoTokenGrants {
             now: this.clock.now(),
         });
         const user = this.presented.user(pool, code.username);
-        const issued = await this.tokenIssuer.issue({
+        return await countedSimCognitoFederation(this.poolMetrics, { pool, client }, code.federated, async () => this.granted.body(await this.tokenIssuer.issue({
             pool,
             client,
             user,
-            occasion: SimCognitoTriggerOccasion.tokenGeneration,
+            occasion: code.federated
+                ? SimCognitoTriggerOccasion.hostedTokenGeneration
+                : SimCognitoTriggerOccasion.tokenGeneration,
             scopes: code.scopes,
-        });
-        return this.granted.body(issued, code.scopes);
+        }), code.scopes));
     }
     /**
      * Sign fresh tokens for an application that presented a refresh token.

package/dist/service/cognito/command/sim-cognito-commands.d.ts

@@ -4,6 +4,7 @@ import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-
 import { SimCognitoRegistrations } from "../user-pool/sim-cognito-registrations.js";
 import type { SimCognitoUserPoolStore } from "../user-pool/sim-cognito-user-pool-store.js";
 import type { SimAwsMessageLog } from "../../aws/message/sim-aws-message-log.js";
+import type { SimCloudWatchServiceWriter } from "../../cloudwatch/write/sim-cloudwatch-service-writer.js";
 import type { SimCognitoEmailSenders } from "../user-pool/message/sim-cognito-email-senders.js";
 import type { SimCognitoTriggerFunctions } from "../user-pool/trigger/sim-cognito-trigger-functions.js";
 import type { SimCognitoDomainRegistry } from "../registry/sim-cognito-domain-registry.js";
@@ -19,6 +20,7 @@ import { SimCognitoListGroups } from "./group/sim-cognito-list-groups.js";
 import { SimCognitoUserPoolClientCommands } from "./client/sim-cognito-user-pool-client-commands.js";
 import { SimCognitoListUsers } from "./user/sim-cognito-list-users.js";
 import { SimCognitoPasswordResetCommands } from "./user/sim-cognito-password-reset-commands.js";
+import { SimCognitoConfirmSignUpCommands } from "./user/sim-cognito-confirm-sign-up-commands.js";
 import { SimCognitoSignUpCommands } from "./user/sim-cognito-sign-up-commands.js";
 import { SimCognitoUserCommands } from "./user/sim-cognito-user-commands.js";
 import { SimCognitoUserMfaCommands } from "./user/sim-cognito-user-mfa-commands.js";
@@ -37,6 +39,8 @@ interface SimCognitoCommandsProperties {
     readonly emailSenders: SimCognitoEmailSenders;
     readonly webAcls: SimWafProtection;
     readonly messageLog: SimAwsMessageLog;
+    /** Where this scope's `AWS/Cognito` metrics go, if anywhere. */
+    readonly metrics?: SimCloudWatchServiceWriter | undefined;
 }
 /**
  * The command handlers of one simulated Cognito scope.
@@ -55,6 +59,7 @@ export declare class SimCognitoCommands {
     readonly userMfa: SimCognitoUserMfaCommands;
     readonly webAuthn: SimCognitoWebAuthnCommands;
     readonly signUp: SimCognitoSignUpCommands;
+    readonly confirmSignUp: SimCognitoConfirmSignUpCommands;
     readonly passwordReset: SimCognitoPasswordResetCommands;
     readonly userUpdates: SimCognitoUserUpdateCommands;
     readonly listUsers: SimCognitoListUsers;

package/dist/service/cognito/command/sim-cognito-commands.js

@@ -2,6 +2,7 @@ import { SimCognitoUserPoolClientFactory } from "../user-pool/client/sim-cognito
 import { SimCognitoGroupFactory } from "../user-pool/group/sim-cognito-group-factory.js";
 import { SimCognitoRegistrations } from "../user-pool/sim-cognito-registrations.js";
 import { SimCognitoUserPoolFactory } from "../user-pool/sim-cognito-user-pool-factory.js";
+import { SimCognitoPoolMetrics } from "../metric/sim-cognito-pool-metrics.js";
 import { SimCognitoPoolMessenger } from "../user-pool/message/sim-cognito-pool-messenger.js";
 import { SimCognitoPoolEmailDelivery } from "../user-pool/message/sim-cognito-pool-email-delivery.js";
 import { SimCognitoUserPoolTriggers } from "../user-pool/trigger/sim-cognito-user-pool-triggers.js";
@@ -21,6 +22,7 @@ import { SimCognitoListGroups } from "./group/sim-cognito-list-groups.js";
 import { SimCognitoUserPoolClientCommands } from "./client/sim-cognito-user-pool-client-commands.js";
 import { SimCognitoListUsers } from "./user/sim-cognito-list-users.js";
 import { SimCognitoPasswordResetCommands } from "./user/sim-cognito-password-reset-commands.js";
+import { SimCognitoConfirmSignUpCommands } from "./user/sim-cognito-confirm-sign-up-commands.js";
 import { SimCognitoSignUpCommands } from "./user/sim-cognito-sign-up-commands.js";
 import { SimCognitoTokenUser } from "./user/sim-cognito-token-user.js";
 import { SimCognitoUserCommands } from "./user/sim-cognito-user-commands.js";
@@ -48,6 +50,7 @@ export class SimCognitoCommands {
     userMfa;
     webAuthn;
     signUp;
+    confirmSignUp;
     passwordReset;
     userUpdates;
     listUsers;
@@ -74,7 +77,14 @@ export class SimCognitoCommands {
         this.webAcls = properties.webAcls;
         const authorizer = new SimCognitoAuthorizer({ iam, accountRegionScope });
         const resolver = new SimCognitoRequestResolver({ pools, authorizer });
-        const authResolver = new SimCognitoAuthResolver({ resolver, pools });
+        const poolMetrics = new SimCognitoPoolMetrics({
+            metrics: properties.metrics,
+        });
+        const authResolver = new SimCognitoAuthResolver({
+            resolver,
+            pools,
+            poolMetrics,
+        });
         const userFactory = new SimCognitoUserFactory({ clock });
         // One trigger runner serves every command, because a pool's LambdaConfig
         // is one set of functions whichever operation reaches it.
@@ -127,6 +137,7 @@ export class SimCognitoCommands {
         });
         this.listClients = new SimCognitoListUserPoolClients({ pools, authorizer });
         this.users = new SimCognitoUserCommands({
+            poolMetrics,
             resolver,
             tokenUser,
             userFactory,
@@ -140,12 +151,18 @@ export class SimCognitoCommands {
         });
         this.webAuthn = new SimCognitoWebAuthnCommands({ tokenUser, clock });
         this.signUp = new SimCognitoSignUpCommands({
+            poolMetrics,
             authResolver,
-            resolver,
             userFactory,
             triggers,
             messenger,
         });
+        this.confirmSignUp = new SimCognitoConfirmSignUpCommands({
+            authResolver,
+            resolver,
+            triggers,
+            messenger,
+        });
         this.passwordReset = new SimCognitoPasswordResetCommands({
             authResolver,
             resolver,
@@ -169,6 +186,7 @@ export class SimCognitoCommands {
             tokenIssuer,
             messenger,
             firstFactor,
+            poolMetrics,
         });
         this.domains = new SimCognitoDomainCommands({
             pools,
@@ -184,8 +202,10 @@ export class SimCognitoCommands {
         // create pool users the same way a sign-up does, so they are given the
         // same collaborators rather than ones of their own.
         this.hosted = new SimCognitoHostedCommands({
+            poolMetrics,
             tokenIssuer,
             userFactory,
+            triggers,
             challenge: firstFactor,
             clock,
         });

package/dist/service/cognito/command/user/sim-cognito-confirm-sign-up-commands.d.ts

@@ -0,0 +1,74 @@
+import type { SimCognitoPoolMessenger } from "../../user-pool/message/sim-cognito-pool-messenger.js";
+import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
+import type { SimCognitoAuthResolver } from "../auth/sim-cognito-auth-resolver.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCognitoRequestResolver } from "../sim-cognito-request-resolver.js";
+import type { SimAdminConfirmSignUpCommand, SimAdminConfirmSignUpCommandOutput, SimConfirmSignUpCommand, SimConfirmSignUpCommandOutput, SimResendConfirmationCodeCommand, SimResendConfirmationCodeCommandOutput } from "./sign-up.command.js";
+interface SimCognitoConfirmSignUpCommandsProperties {
+    readonly authResolver: SimCognitoAuthResolver;
+    readonly resolver: SimCognitoRequestResolver;
+    readonly triggers: SimCognitoUserPoolTriggers;
+    readonly messenger: SimCognitoPoolMessenger;
+}
+interface SimCognitoCommandOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * Confirming a sign-up, and the code that confirms one.
+ *
+ * Held apart from the registration commands because the two halves of signing
+ * up share nothing but the pool: registering makes a user and sends it a code,
+ * and confirming reads a code back and runs `PostConfirmation`. An
+ * administrator can do the second without the first ever having sent
+ * anything.
+ */
+export declare class SimCognitoConfirmSignUpCommands {
+    private readonly authResolver;
+    private readonly resolver;
+    private readonly triggers;
+    private readonly messenger;
+    private readonly unsimulatedOptions;
+    constructor(properties: SimCognitoConfirmSignUpCommandsProperties);
+    /**
+     * Confirm a sign-up with the code the pool issued.
+     *
+     * The user reaches `CONFIRMED` and can sign in from then on. The pool's
+     * `AutoVerifiedAttributes` are marked verified here, because answering with
+     * the code is what shows the address the code went to is the user's. The
+     * pool's `PostConfirmation` trigger runs last, on the confirmed user.
+     */
+    confirmSignUp(command: SimConfirmSignUpCommand): Promise<SimConfirmSignUpCommandOutput>;
+    /**
+     * Issue a fresh confirmation code for a user waiting to be confirmed.
+     *
+     * The code the user had stops working, as it does on real Cognito, so a
+     * test holding the earlier one has to read the new one from the pool. The
+     * pool records a second message carrying the fresh code, and a
+     * `CustomMessage` handler tells this occasion from a sign-up by its
+     * `CustomMessage_ResendCode` trigger source.
+     */
+    resendConfirmationCode(command: SimResendConfirmationCodeCommand): Promise<SimResendConfirmationCodeCommandOutput>;
+    /**
+     * Confirm a sign-up as an administrator, with no code involved.
+     *
+     * Nothing is verified by this. Real Cognito leaves `email_verified` and
+     * `phone_number_verified` alone here even on a pool with
+     * `AutoVerifiedAttributes`, because an admin confirming a user says nothing
+     * about whether the address is really theirs.
+     *
+     * The `PostConfirmation` trigger still runs, and reports the same
+     * `PostConfirmation_ConfirmSignUp` source `ConfirmSignUp` does, because the
+     * user being confirmed signed itself up either way. There is no app client
+     * in the request, so the handler reads `CLIENT_ID_NOT_APPLICABLE`.
+     */
+    adminConfirmSignUp(command: SimAdminConfirmSignUpCommand, options?: SimCognitoCommandOptions): Promise<SimAdminConfirmSignUpCommandOutput>;
+    /**
+     * Resolve the user a client-side sign-up operation names.
+     *
+     * The `SECRET_HASH` covers the username, so it is checked as soon as the
+     * username is known and before anything looks the user up, which is the
+     * order the sign-in commands check it in too.
+     */
+    private signingUpUser;
+}
+export {};