@kensio/yulin 1.20.17 → 1.21.1

package/dist/service/cognito/command/user/sim-cognito-confirm-sign-up-commands.js

@@ -0,0 +1,110 @@
+import { requireSimCognitoSecretHash } from "../../user-pool/auth/sim-cognito-secret-hash.js";
+import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
+import { requireSimCognitoUsername } from "../../user-pool/user/sim-cognito-username.js";
+import { SimCognitoUnsimulatedSignUpOptions } from "./sim-cognito-unsimulated-sign-up-options.js";
+/**
+ * Confirming a sign-up, and the code that confirms one.
+ *
+ * Held apart from the registration commands because the two halves of signing
+ * up share nothing but the pool: registering makes a user and sends it a code,
+ * and confirming reads a code back and runs `PostConfirmation`. An
+ * administrator can do the second without the first ever having sent
+ * anything.
+ */
+export class SimCognitoConfirmSignUpCommands {
+    authResolver;
+    resolver;
+    triggers;
+    messenger;
+    unsimulatedOptions = new SimCognitoUnsimulatedSignUpOptions();
+    constructor(properties) {
+        this.authResolver = properties.authResolver;
+        this.resolver = properties.resolver;
+        this.triggers = properties.triggers;
+        this.messenger = properties.messenger;
+    }
+    /**
+     * Confirm a sign-up with the code the pool issued.
+     *
+     * The user reaches `CONFIRMED` and can sign in from then on. The pool's
+     * `AutoVerifiedAttributes` are marked verified here, because answering with
+     * the code is what shows the address the code went to is the user's. The
+     * pool's `PostConfirmation` trigger runs last, on the confirmed user.
+     */
+    async confirmSignUp(command) {
+        const { input } = command;
+        const { pool, client } = this.authResolver.client(input.ClientId);
+        this.unsimulatedOptions.refuseInConfirm(input);
+        const user = this.signingUpUser(pool, client, input);
+        user.confirmSignUp(input.ConfirmationCode);
+        user.verifyAttributes(pool.settings.autoVerifiedAttributes.names);
+        await this.triggers.postConfirmation(SimCognitoTriggerOccasion.confirmSignUp, {
+            pool,
+            client,
+            user,
+            clientMetadata: input.ClientMetadata,
+        });
+        return { $metadata: {} };
+    }
+    /**
+     * Issue a fresh confirmation code for a user waiting to be confirmed.
+     *
+     * The code the user had stops working, as it does on real Cognito, so a
+     * test holding the earlier one has to read the new one from the pool. The
+     * pool records a second message carrying the fresh code, and a
+     * `CustomMessage` handler tells this occasion from a sign-up by its
+     * `CustomMessage_ResendCode` trigger source.
+     */
+    async resendConfirmationCode(command) {
+        const { input } = command;
+        const { pool, client } = this.authResolver.client(input.ClientId);
+        this.unsimulatedOptions.refuseInResend(input);
+        const user = this.signingUpUser(pool, client, input);
+        user.resendConfirmationCode();
+        await this.messenger.send({
+            pool,
+            user,
+            client,
+            occasion: "ResendCode",
+            code: user.confirmationCode,
+            clientMetadata: input.ClientMetadata,
+        });
+        return { $metadata: {} };
+    }
+    /**
+     * Confirm a sign-up as an administrator, with no code involved.
+     *
+     * Nothing is verified by this. Real Cognito leaves `email_verified` and
+     * `phone_number_verified` alone here even on a pool with
+     * `AutoVerifiedAttributes`, because an admin confirming a user says nothing
+     * about whether the address is really theirs.
+     *
+     * The `PostConfirmation` trigger still runs, and reports the same
+     * `PostConfirmation_ConfirmSignUp` source `ConfirmSignUp` does, because the
+     * user being confirmed signed itself up either way. There is no app client
+     * in the request, so the handler reads `CLIENT_ID_NOT_APPLICABLE`.
+     */
+    async adminConfirmSignUp(command, options) {
+        const { input } = command;
+        const { pool, user } = this.resolver.poolUser("cognito-idp:AdminConfirmSignUp", input, options);
+        user.confirm();
+        await this.triggers.postConfirmation(SimCognitoTriggerOccasion.confirmSignUp, {
+            pool,
+            user,
+            clientMetadata: input.ClientMetadata,
+        });
+        return { $metadata: {} };
+    }
+    /**
+     * Resolve the user a client-side sign-up operation names.
+     *
+     * The `SECRET_HASH` covers the username, so it is checked as soon as the
+     * username is known and before anything looks the user up, which is the
+     * order the sign-in commands check it in too.
+     */
+    signingUpUser(pool, client, input) {
+        const username = requireSimCognitoUsername(input.Username);
+        requireSimCognitoSecretHash(username, client, input.SecretHash);
+        return pool.requireUser(username);
+    }
+}

package/dist/service/cognito/command/user/sim-cognito-sign-up-commands.d.ts

@@ -1,20 +1,16 @@
-import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCognitoPoolMessenger } from "../../user-pool/message/sim-cognito-pool-messenger.js";
 import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoUserFactory } from "../../user-pool/user/sim-cognito-user-factory.js";
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimCognitoAuthResolver } from "../auth/sim-cognito-auth-resolver.js";
-import type { SimCognitoRequestResolver } from "../sim-cognito-request-resolver.js";
-import type { SimAdminConfirmSignUpCommand, SimAdminConfirmSignUpCommandOutput, SimConfirmSignUpCommand, SimConfirmSignUpCommandOutput, SimResendConfirmationCodeCommand, SimResendConfirmationCodeCommandOutput, SimSignUpCommand, SimSignUpCommandOutput } from "./sign-up.command.js";
+import type { SimSignUpCommand, SimSignUpCommandOutput } from "./sign-up.command.js";
 interface SimCognitoSignUpCommandsProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly authResolver: SimCognitoAuthResolver;
-    readonly resolver: SimCognitoRequestResolver;
     readonly userFactory: SimCognitoUserFactory;
     readonly triggers: SimCognitoUserPoolTriggers;
     readonly messenger: SimCognitoPoolMessenger;
 }
-interface SimCognitoCommandOptions {
-    readonly caller?: SimAwsCaller;
-}
 /**
  * The commands a user signs itself up with, and the one an admin confirms it
  * with.
@@ -30,8 +26,8 @@ interface SimCognitoCommandOptions {
  * and the message the pool would have sent it in is recorded on the pool.
  */
 export declare class SimCognitoSignUpCommands {
+    private readonly poolMetrics;
     private readonly authResolver;
-    private readonly resolver;
     private readonly userFactory;
     private readonly triggers;
     private readonly messenger;
@@ -58,46 +54,6 @@ export declare class SimCognitoSignUpCommands {
      * a code, so real Cognito sends it none.
      */
     signUp(command: SimSignUpCommand): Promise<SimSignUpCommandOutput>;
-    /**
-     * Confirm a sign-up with the code the pool issued.
-     *
-     * The user reaches `CONFIRMED` and can sign in from then on. The pool's
-     * `AutoVerifiedAttributes` are marked verified here, because answering with
-     * the code is what shows the address the code went to is the user's. The
-     * pool's `PostConfirmation` trigger runs last, on the confirmed user.
-     */
-    confirmSignUp(command: SimConfirmSignUpCommand): Promise<SimConfirmSignUpCommandOutput>;
-    /**
-     * Issue a fresh confirmation code for a user waiting to be confirmed.
-     *
-     * The code the user had stops working, as it does on real Cognito, so a
-     * test holding the earlier one has to read the new one from the pool. The
-     * pool records a second message carrying the fresh code, and a
-     * `CustomMessage` handler tells this occasion from a sign-up by its
-     * `CustomMessage_ResendCode` trigger source.
-     */
-    resendConfirmationCode(command: SimResendConfirmationCodeCommand): Promise<SimResendConfirmationCodeCommandOutput>;
-    /**
-     * Confirm a sign-up as an administrator, with no code involved.
-     *
-     * Nothing is verified by this. Real Cognito leaves `email_verified` and
-     * `phone_number_verified` alone here even on a pool with
-     * `AutoVerifiedAttributes`, because an admin confirming a user says nothing
-     * about whether the address is really theirs.
-     *
-     * The `PostConfirmation` trigger still runs, and reports the same
-     * `PostConfirmation_ConfirmSignUp` source `ConfirmSignUp` does, because the
-     * user being confirmed signed itself up either way. There is no app client
-     * in the request, so the handler reads `CLIENT_ID_NOT_APPLICABLE`.
-     */
-    adminConfirmSignUp(command: SimAdminConfirmSignUpCommand, options?: SimCognitoCommandOptions): Promise<SimAdminConfirmSignUpCommandOutput>;
-    /**
-     * Resolve the user a client-side sign-up operation names.
-     *
-     * The `SECRET_HASH` covers the username, so it is checked as soon as the
-     * username is known and before anything looks the user up, which is the
-     * order the sign-in commands check it in too.
-     */
-    private signingUpUser;
+    private registered;
 }
 export {};

package/dist/service/cognito/command/user/sim-cognito-sign-up-commands.js

@@ -1,6 +1,7 @@
 import { requireSimCognitoSecretHash } from "../../user-pool/auth/sim-cognito-secret-hash.js";
 import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
 import { requireSimCognitoUsername } from "../../user-pool/user/sim-cognito-username.js";
+import { countedSimCognitoCompletion } from "../../metric/sim-cognito-counted-request.js";
 import { simCognitoValidationData } from "../sim-cognito-validation-data.js";
 import { SimCognitoUnsimulatedSignUpOptions } from "./sim-cognito-unsimulated-sign-up-options.js";
 /**
@@ -18,15 +19,15 @@ import { SimCognitoUnsimulatedSignUpOptions } from "./sim-cognito-unsimulated-si
  * and the message the pool would have sent it in is recorded on the pool.
  */
 export class SimCognitoSignUpCommands {
+    poolMetrics;
     authResolver;
-    resolver;
     userFactory;
     triggers;
     messenger;
     unsimulatedOptions = new SimCognitoUnsimulatedSignUpOptions();
     constructor(properties) {
+        this.poolMetrics = properties.poolMetrics;
         this.authResolver = properties.authResolver;
-        this.resolver = properties.resolver;
         this.userFactory = properties.userFactory;
         this.triggers = properties.triggers;
         this.messenger = properties.messenger;
@@ -52,8 +53,11 @@ export class SimCognitoSignUpCommands {
      * a code, so real Cognito sends it none.
      */
     async signUp(command) {
+        const scope = this.authResolver.client(command.input.ClientId);
+        return await countedSimCognitoCompletion(this.poolMetrics, "SignUp", scope, async () => await this.registered(command, scope));
+    }
+    async registered(command, { pool, client }) {
         const { input } = command;
-        const { pool, client } = this.authResolver.client(input.ClientId);
         this.unsimulatedOptions.refuseInSignUp(input);
         pool.settings.adminCreateUserConfig.requireSelfServiceSignUp();
         const requested = requireSimCognitoUsername(input.Username);
@@ -103,88 +107,4 @@ export class SimCognitoSignUpCommands {
             UserSub: user.sub,
         };
     }
-    /**
-     * Confirm a sign-up with the code the pool issued.
-     *
-     * The user reaches `CONFIRMED` and can sign in from then on. The pool's
-     * `AutoVerifiedAttributes` are marked verified here, because answering with
-     * the code is what shows the address the code went to is the user's. The
-     * pool's `PostConfirmation` trigger runs last, on the confirmed user.
-     */
-    async confirmSignUp(command) {
-        const { input } = command;
-        const { pool, client } = this.authResolver.client(input.ClientId);
-        this.unsimulatedOptions.refuseInConfirm(input);
-        const user = this.signingUpUser(pool, client, input);
-        user.confirmSignUp(input.ConfirmationCode);
-        user.verifyAttributes(pool.settings.autoVerifiedAttributes.names);
-        await this.triggers.postConfirmation(SimCognitoTriggerOccasion.confirmSignUp, {
-            pool,
-            client,
-            user,
-            clientMetadata: input.ClientMetadata,
-        });
-        return { $metadata: {} };
-    }
-    /**
-     * Issue a fresh confirmation code for a user waiting to be confirmed.
-     *
-     * The code the user had stops working, as it does on real Cognito, so a
-     * test holding the earlier one has to read the new one from the pool. The
-     * pool records a second message carrying the fresh code, and a
-     * `CustomMessage` handler tells this occasion from a sign-up by its
-     * `CustomMessage_ResendCode` trigger source.
-     */
-    async resendConfirmationCode(command) {
-        const { input } = command;
-        const { pool, client } = this.authResolver.client(input.ClientId);
-        this.unsimulatedOptions.refuseInResend(input);
-        const user = this.signingUpUser(pool, client, input);
-        user.resendConfirmationCode();
-        await this.messenger.send({
-            pool,
-            user,
-            client,
-            occasion: "ResendCode",
-            code: user.confirmationCode,
-            clientMetadata: input.ClientMetadata,
-        });
-        return { $metadata: {} };
-    }
-    /**
-     * Confirm a sign-up as an administrator, with no code involved.
-     *
-     * Nothing is verified by this. Real Cognito leaves `email_verified` and
-     * `phone_number_verified` alone here even on a pool with
-     * `AutoVerifiedAttributes`, because an admin confirming a user says nothing
-     * about whether the address is really theirs.
-     *
-     * The `PostConfirmation` trigger still runs, and reports the same
-     * `PostConfirmation_ConfirmSignUp` source `ConfirmSignUp` does, because the
-     * user being confirmed signed itself up either way. There is no app client
-     * in the request, so the handler reads `CLIENT_ID_NOT_APPLICABLE`.
-     */
-    async adminConfirmSignUp(command, options) {
-        const { input } = command;
-        const { pool, user } = this.resolver.poolUser("cognito-idp:AdminConfirmSignUp", input, options);
-        user.confirm();
-        await this.triggers.postConfirmation(SimCognitoTriggerOccasion.confirmSignUp, {
-            pool,
-            user,
-            clientMetadata: input.ClientMetadata,
-        });
-        return { $metadata: {} };
-    }
-    /**
-     * Resolve the user a client-side sign-up operation names.
-     *
-     * The `SECRET_HASH` covers the username, so it is checked as soon as the
-     * username is known and before anything looks the user up, which is the
-     * order the sign-in commands check it in too.
-     */
-    signingUpUser(pool, client, input) {
-        const username = requireSimCognitoUsername(input.Username);
-        requireSimCognitoSecretHash(username, client, input.SecretHash);
-        return pool.requireUser(username);
-    }
 }

package/dist/service/cognito/command/user/sim-cognito-user-commands.d.ts

@@ -2,11 +2,13 @@ import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCognitoPoolMessenger } from "../../user-pool/message/sim-cognito-pool-messenger.js";
 import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoUserFactory } from "../../user-pool/user/sim-cognito-user-factory.js";
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimCognitoRequestResolver } from "../sim-cognito-request-resolver.js";
 import type { SimCognitoTokenUser } from "./sim-cognito-token-user.js";
 import type { SimGetUserCommand, SimGetUserCommandOutput } from "./user-mfa.command.js";
 import type { SimAdminCreateUserCommand, SimAdminCreateUserCommandOutput, SimAdminDeleteUserCommand, SimAdminDeleteUserCommandOutput, SimAdminGetUserCommand, SimAdminGetUserCommandOutput } from "./user.command.js";
 interface SimCognitoUserCommandsProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly resolver: SimCognitoRequestResolver;
     readonly tokenUser: SimCognitoTokenUser;
     readonly userFactory: SimCognitoUserFactory;
@@ -23,6 +25,7 @@ interface SimCognitoCommandOptions {
  * own.
  */
 export declare class SimCognitoUserCommands {
+    private readonly poolMetrics;
     private readonly resolver;
     private readonly tokenUser;
     private readonly userFactory;
@@ -75,5 +78,6 @@ export declare class SimCognitoUserCommands {
      * Delete a user from a pool.
      */
     delete(command: SimAdminDeleteUserCommand, options?: SimCognitoCommandOptions): SimAdminDeleteUserCommandOutput;
+    private created;
 }
 export {};

package/dist/service/cognito/command/user/sim-cognito-user-commands.js

@@ -1,5 +1,7 @@
 import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
 import { requireSimCognitoUsername } from "../../user-pool/user/sim-cognito-username.js";
+import { countedSimCognitoCompletion } from "../../metric/sim-cognito-counted-request.js";
+import { simCognitoAdminClientDimension } from "../../metric/sim-cognito-metrics.js";
 import { SimCognitoUnsimulatedUserOptions } from "./sim-cognito-unsimulated-user-options.js";
 import { simCognitoValidationData } from "../sim-cognito-validation-data.js";
 import { SimCognitoUserView } from "./sim-cognito-user-view.js";
@@ -10,6 +12,7 @@ import { SimCognitoUserView } from "./sim-cognito-user-view.js";
  * own.
  */
 export class SimCognitoUserCommands {
+    poolMetrics;
     resolver;
     tokenUser;
     userFactory;
@@ -18,6 +21,7 @@ export class SimCognitoUserCommands {
     view = new SimCognitoUserView();
     unsimulatedOptions = new SimCognitoUnsimulatedUserOptions();
     constructor(properties) {
+        this.poolMetrics = properties.poolMetrics;
         this.resolver = properties.resolver;
         this.tokenUser = properties.tokenUser;
         this.userFactory = properties.userFactory;
@@ -50,8 +54,41 @@ export class SimCognitoUserCommands {
      * changing nothing.
      */
     async create(command, options) {
+        const pool = this.resolver.pool("cognito-idp:AdminCreateUser", command.input.UserPoolId, options);
+        // A user an administrator registers reaches the pool through no app
+        // client, and real Cognito reports it under a fixed name in that place.
+        return await countedSimCognitoCompletion(this.poolMetrics, "SignUp", { pool, client: { id: simCognitoAdminClientDimension } }, async () => await this.created(command, pool));
+    }
+    /**
+     * Read a user by username.
+     */
+    get(command, options) {
+        const user = this.resolver.user("cognito-idp:AdminGetUser", command.input, options);
+        return { $metadata: {}, ...this.view.describe(user) };
+    }
+    /**
+     * Read the user an access token was issued to.
+     *
+     * This is the client-side read, so the access token is the whole of the
+     * authorization and no IAM policy is evaluated, as real Cognito evaluates
+     * none for it. What it reports is narrower than `AdminGetUser`: the user's
+     * attributes and the factors it has registered, and nothing about its
+     * status.
+     */
+    getUser(command) {
+        const { user } = this.tokenUser.require(command.input.AccessToken, "GetUser");
+        return { $metadata: {}, ...this.view.self(user) };
+    }
+    /**
+     * Delete a user from a pool.
+     */
+    delete(command, options) {
+        const { pool, user } = this.resolver.poolUser("cognito-idp:AdminDeleteUser", command.input, options);
+        pool.removeUser(user);
+        return { $metadata: {} };
+    }
+    async created(command, pool) {
         const { input } = command;
-        const pool = this.resolver.pool("cognito-idp:AdminCreateUser", input.UserPoolId, options);
         const requested = requireSimCognitoUsername(input.Username);
         this.unsimulatedOptions.refuseInCreate(input);
         // A pool signing users in by email or phone number stores a generated
@@ -83,32 +120,4 @@ export class SimCognitoUserCommands {
         }
         return { $metadata: {}, User: this.view.entry(user) };
     }
-    /**
-     * Read a user by username.
-     */
-    get(command, options) {
-        const user = this.resolver.user("cognito-idp:AdminGetUser", command.input, options);
-        return { $metadata: {}, ...this.view.describe(user) };
-    }
-    /**
-     * Read the user an access token was issued to.
-     *
-     * This is the client-side read, so the access token is the whole of the
-     * authorization and no IAM policy is evaluated, as real Cognito evaluates
-     * none for it. What it reports is narrower than `AdminGetUser`: the user's
-     * attributes and the factors it has registered, and nothing about its
-     * status.
-     */
-    getUser(command) {
-        const { user } = this.tokenUser.require(command.input.AccessToken, "GetUser");
-        return { $metadata: {}, ...this.view.self(user) };
-    }
-    /**
-     * Delete a user from a pool.
-     */
-    delete(command, options) {
-        const { pool, user } = this.resolver.poolUser("cognito-idp:AdminDeleteUser", command.input, options);
-        pool.removeUser(user);
-        return { $metadata: {} };
-    }
 }

package/dist/service/cognito/error/sim-cognito-managed-login.error.d.ts

@@ -43,3 +43,26 @@ export declare class SimCognitoPasskeyRequired extends SimCognitoOAuthError {
  * passkey on.
  */
 export declare function isSimCognitoPasskeyRequired(error: unknown): error is SimCognitoPasskeyRequired;
+/**
+ * An authorize request naming an identity provider that nobody is signed in
+ * at, and presenting no user of its own.
+ *
+ * Real Cognito redirects the browser to the provider's own sign-in page here,
+ * and the provider answers with whoever signed in at it. Nothing in this
+ * simulation calls a provider, so a served domain answers with a page standing
+ * in for that one, and the person says who is signing in. A test skips the
+ * page by saying it with `signInAs` first.
+ *
+ * It is an OAuth error so that every other caller treats it as one, in the
+ * same way `SimCognitoManagedLoginRequired` is.
+ */
+export declare class SimCognitoProviderSignInRequired extends SimCognitoOAuthError {
+    /** The provider the page stands in for. */
+    readonly providerName: string;
+    constructor(providerName: string);
+}
+/**
+ * Whether an authorize request was one a provider's own sign-in page would
+ * have answered.
+ */
+export declare function isSimCognitoProviderSignInRequired(error: unknown): error is SimCognitoProviderSignInRequired;

package/dist/service/cognito/error/sim-cognito-managed-login.error.js

@@ -66,3 +66,39 @@ export class SimCognitoPasskeyRequired extends SimCognitoOAuthError {
 export function isSimCognitoPasskeyRequired(error) {
     return error instanceof SimCognitoPasskeyRequired;
 }
+/**
+ * An authorize request naming an identity provider that nobody is signed in
+ * at, and presenting no user of its own.
+ *
+ * Real Cognito redirects the browser to the provider's own sign-in page here,
+ * and the provider answers with whoever signed in at it. Nothing in this
+ * simulation calls a provider, so a served domain answers with a page standing
+ * in for that one, and the person says who is signing in. A test skips the
+ * page by saying it with `signInAs` first.
+ *
+ * It is an OAuth error so that every other caller treats it as one, in the
+ * same way `SimCognitoManagedLoginRequired` is.
+ */
+export class SimCognitoProviderSignInRequired extends SimCognitoOAuthError {
+    /** The provider the page stands in for. */
+    providerName;
+    constructor(providerName) {
+        super({
+            code: "invalid_request",
+            description: `Nobody is signed in at the ${providerName} identity provider. Real ` +
+                `Cognito would send the user to the provider's own sign-in page, ` +
+                `which this simulation has no equivalent of. Say who is signed in ` +
+                `there with signInAs, or post a subject to the page a served domain ` +
+                `answers this request with.`,
+            redirectable: false,
+        });
+        this.providerName = providerName;
+    }
+}
+/**
+ * Whether an authorize request was one a provider's own sign-in page would
+ * have answered.
+ */
+export function isSimCognitoProviderSignInRequired(error) {
+    return error instanceof SimCognitoProviderSignInRequired;
+}

package/dist/service/cognito/error/sim-cognito-throttle.error.d.ts

@@ -0,0 +1,13 @@
+import { SimCognitoError } from "./sim-cognito.error.js";
+/**
+ * Simulated Cognito TooManyRequestsException error.
+ *
+ * Real Cognito answers this when a pool has turned a request away for rate
+ * limiting. Its own limits belong to the account and are mostly undocumented.
+ * Working one out here would be inventing a number, so a test says how many
+ * requests a pool should turn away and the pool turns away that many.
+ */
+export declare class SimCognitoTooManyRequestsException extends SimCognitoError {
+    readonly name = "TooManyRequestsException";
+    constructor(message: string);
+}

package/dist/service/cognito/error/sim-cognito-throttle.error.js

@@ -0,0 +1,15 @@
+import { SimCognitoError } from "./sim-cognito.error.js";
+/**
+ * Simulated Cognito TooManyRequestsException error.
+ *
+ * Real Cognito answers this when a pool has turned a request away for rate
+ * limiting. Its own limits belong to the account and are mostly undocumented.
+ * Working one out here would be inventing a number, so a test says how many
+ * requests a pool should turn away and the pool turns away that many.
+ */
+export class SimCognitoTooManyRequestsException extends SimCognitoError {
+    name = "TooManyRequestsException";
+    constructor(message) {
+        super(message, { httpStatusCode: 400 });
+    }
+}

package/dist/service/cognito/index.d.ts

@@ -65,5 +65,7 @@ export { SimCognitoAuthSession } from "./user-pool/auth/sim-cognito-auth-session
 export { SimCognitoIssuedToken } from "./user-pool/auth/sim-cognito-issued-token.js";
 export { SimCognitoPoolAuth } from "./user-pool/auth/sim-cognito-pool-auth.js";
 export { SimCognitoWebAuthnChallengeNotFoundException, SimCognitoWebAuthnConfigurationMissingException, SimCognitoWebAuthnCredentialNotSupportedException, SimCognitoWebAuthnOriginNotAllowedException, SimCognitoWebAuthnRelyingPartyMismatchException, } from "./error/sim-cognito-web-authn.error.js";
+export { SimCognitoTooManyRequestsException } from "./error/sim-cognito-throttle.error.js";
+export { SimCognitoRequestThrottle, type SimCognitoThrottledOperation, } from "./user-pool/auth/sim-cognito-request-throttle.js";
 export { isSimCognitoOAuthError, SimCognitoOAuthError, type SimCognitoOAuthErrorCode, } from "./error/sim-cognito-oauth.error.js";
 export { SimCognitoAliasExistsException, SimCognitoCodeMismatchException, SimCognitoDuplicateProviderException, SimCognitoEnableSoftwareTokenMfaException, SimCognitoError, SimCognitoExpiredCodeException, SimCognitoGroupExistsException, SimCognitoInvalidParameterException, SimCognitoInvalidPasswordException, SimCognitoNotAuthorizedException, SimCognitoPasswordResetRequiredException, SimCognitoResourceNotFoundException, SimCognitoSoftwareTokenMfaNotFoundException, SimCognitoUsernameExistsException, SimCognitoUserNotConfirmedException, SimCognitoUserNotFoundException, SimCognitoUserPoolAlreadyExists, SimCognitoUserPoolClientAlreadyExists, } from "./error/sim-cognito.error.js";

package/dist/service/cognito/index.js

@@ -57,5 +57,7 @@ export { SimCognitoAuthSession } from "./user-pool/auth/sim-cognito-auth-session
 export { SimCognitoIssuedToken } from "./user-pool/auth/sim-cognito-issued-token.js";
 export { SimCognitoPoolAuth } from "./user-pool/auth/sim-cognito-pool-auth.js";
 export { SimCognitoWebAuthnChallengeNotFoundException, SimCognitoWebAuthnConfigurationMissingException, SimCognitoWebAuthnCredentialNotSupportedException, SimCognitoWebAuthnOriginNotAllowedException, SimCognitoWebAuthnRelyingPartyMismatchException, } from "./error/sim-cognito-web-authn.error.js";
+export { SimCognitoTooManyRequestsException } from "./error/sim-cognito-throttle.error.js";
+export { SimCognitoRequestThrottle, } from "./user-pool/auth/sim-cognito-request-throttle.js";
 export { isSimCognitoOAuthError, SimCognitoOAuthError, } from "./error/sim-cognito-oauth.error.js";
 export { SimCognitoAliasExistsException, SimCognitoCodeMismatchException, SimCognitoDuplicateProviderException, SimCognitoEnableSoftwareTokenMfaException, SimCognitoError, SimCognitoExpiredCodeException, SimCognitoGroupExistsException, SimCognitoInvalidParameterException, SimCognitoInvalidPasswordException, SimCognitoNotAuthorizedException, SimCognitoPasswordResetRequiredException, SimCognitoResourceNotFoundException, SimCognitoSoftwareTokenMfaNotFoundException, SimCognitoUsernameExistsException, SimCognitoUserNotConfirmedException, SimCognitoUserNotFoundException, SimCognitoUserPoolAlreadyExists, SimCognitoUserPoolClientAlreadyExists, } from "./error/sim-cognito.error.js";

package/dist/service/cognito/metric/sim-cognito-counted-request.d.ts

@@ -0,0 +1,50 @@
+import type { SimCognitoRequestThrottle, SimCognitoThrottledOperation } from "../user-pool/auth/sim-cognito-request-throttle.js";
+import type { SimCognitoPoolMetrics } from "./sim-cognito-pool-metrics.js";
+/**
+ * What an authentication request answers with, as the count reads it.
+ */
+interface SimCognitoAuthenticationOutcome {
+    readonly AuthenticationResult?: unknown;
+}
+/**
+ * The pool and app client a counted request ran against.
+ *
+ * The client id is a string rather than a client, because a request an
+ * administrator made reaches the pool through no app client and is reported
+ * under a fixed name instead.
+ */
+export interface SimCognitoCountedScope {
+    readonly pool: {
+        readonly id: string;
+        readonly auth: {
+            readonly throttle: SimCognitoRequestThrottle;
+        };
+    };
+    readonly client: {
+        readonly id: string;
+    };
+}
+/**
+ * Run an authentication request and count whether it issued tokens.
+ *
+ * Real Cognito counts a sign-in successful once tokens have been issued, so a
+ * request answered with a challenge counts as a 0 and the response that
+ * finishes it counts as a 1.
+ */
+export declare function countedSimCognitoAuth<T extends SimCognitoAuthenticationOutcome>(metrics: SimCognitoPoolMetrics, operation: SimCognitoThrottledOperation, scope: SimCognitoCountedScope, run: () => Promise<T>): Promise<T>;
+/**
+ * Run a request that hands back no session and count whether it finished.
+ *
+ * A registration answers with a user rather than with tokens, so finishing is
+ * the whole of what makes one a success.
+ */
+export declare function countedSimCognitoCompletion<T>(metrics: SimCognitoPoolMetrics, operation: SimCognitoThrottledOperation, scope: SimCognitoCountedScope, run: () => Promise<T>): Promise<T>;
+/**
+ * Run a token grant and count it as a federation where it is one.
+ *
+ * A code from an identity provider becomes a `FederationSuccesses` at the
+ * tokens it is exchanged for. A code from the pool's own sign-in form is not a
+ * federation and counts nothing here.
+ */
+export declare function countedSimCognitoFederation<T>(metrics: SimCognitoPoolMetrics, scope: SimCognitoCountedScope, federated: boolean, run: () => Promise<T>): Promise<T>;
+export {};