@kensio/yulin 1.21.0 → 1.21.2

package/dist/service/cognito/command/auth/sim-cognito-respond-to-challenge.d.ts

@@ -1,7 +1,9 @@
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
 import type { SimCognitoChallengeResponses } from "./sim-cognito-challenge-responses.js";
 import type { SimRespondToAuthChallengeCommand, SimRespondToAuthChallengeCommandOutput } from "./auth.command.js";
 interface SimCognitoRespondToChallengeProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly authResolver: SimCognitoAuthResolver;
     readonly responses: SimCognitoChallengeResponses;
 }
@@ -13,6 +15,7 @@ interface SimCognitoRespondToChallengeProperties {
  * as real Cognito needs none for it.
  */
 export declare class SimCognitoRespondToChallenge {
+    private readonly poolMetrics;
     private readonly authResolver;
     private readonly responses;
     private readonly unsimulatedOptions;

package/dist/service/cognito/command/auth/sim-cognito-respond-to-challenge.js

@@ -1,3 +1,4 @@
+import { countedSimCognitoAuth } from "../../metric/sim-cognito-counted-request.js";
 import { SimCognitoAuthParameters } from "./sim-cognito-auth-parameters.js";
 import { SimCognitoUnsimulatedAuthOptions } from "./sim-cognito-unsimulated-auth-options.js";
 /**
@@ -8,10 +9,12 @@ import { SimCognitoUnsimulatedAuthOptions } from "./sim-cognito-unsimulated-auth
  * as real Cognito needs none for it.
  */
 export class SimCognitoRespondToChallenge {
+    poolMetrics;
     authResolver;
     responses;
     unsimulatedOptions = new SimCognitoUnsimulatedAuthOptions();
     constructor(properties) {
+        this.poolMetrics = properties.poolMetrics;
         this.authResolver = properties.authResolver;
         this.responses = properties.responses;
     }
@@ -22,12 +25,15 @@ export class SimCognitoRespondToChallenge {
         const { input } = command;
         const { pool, client } = this.authResolver.client(input.ClientId);
         this.unsimulatedOptions.refuseInResponse(input);
-        return await this.responses.handle(input.ChallengeName, {
+        // A challenge response is an authentication request of its own, the way
+        // real Cognito counts one, so it is counted here rather than where the
+        // sign-in it belongs to started.
+        return await countedSimCognitoAuth(this.poolMetrics, "SignIn", { pool, client }, async () => await this.responses.handle(input.ChallengeName, {
             pool,
             client,
             parameters: new SimCognitoAuthParameters("ChallengeResponses", input.ChallengeResponses),
             session: input.Session,
             clientMetadata: input.ClientMetadata,
-        });
+        }));
     }
 }

package/dist/service/cognito/command/hosted/hosted-auth.command.d.ts

@@ -50,6 +50,25 @@ export interface SimCognitoAuthorizeInput {
      * issued when the passkey was asked for.
      */
     readonly passkey_session?: string | undefined;
+    /**
+     * The subject the identity provider is signing in, as the stand-in page for
+     * that provider posted it.
+     *
+     * Real Cognito redirects the browser to the provider itself here, and the
+     * provider answers with whoever signed in at it. A test says who that is
+     * with `signInAs`, and a browser on a served domain says it on the page the
+     * simulation stands in with. This is that page coming back.
+     */
+    readonly subject?: string | undefined;
+    /**
+     * One claim the provider would have asserted, under its own claim name.
+     *
+     * The stand-in page draws a field per claim the provider's `AttributeMapping`
+     * reads, so the names are the pool's rather than this simulation's, and they
+     * are prefixed to keep them apart from the authorize parameters they are
+     * posted beside.
+     */
+    readonly [claim: `claim_${string}`]: string | undefined;
 }
 /**
  * Where a hosted endpoint sends the browser next.

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.d.ts

@@ -36,7 +36,7 @@ export declare class SimCognitoAuthorizeEndpoint {
      * `presentedSession` is the managed login session the browser carried, which
      * the serving layer reads out of the `cognito` cookie.
      */
-    handle(pool: SimCognitoUserPool, input: SimCognitoAuthorizeInput, presentedSession?: string): SimCognitoHostedRedirect;
+    handle(pool: SimCognitoUserPool, input: SimCognitoAuthorizeInput, presentedSession?: string): Promise<SimCognitoHostedRedirect>;
     private redirectWithCode;
 }
 export {};

package/dist/service/cognito/command/hosted/sim-cognito-authorize-endpoint.js

@@ -35,7 +35,7 @@ export class SimCognitoAuthorizeEndpoint {
      * `presentedSession` is the managed login session the browser carried, which
      * the serving layer reads out of the `cognito` cookie.
      */
-    handle(pool, input, presentedSession) {
+    async handle(pool, input, presentedSession) {
         const client = this.hostedClient.forAuthorize(pool, input.client_id);
         const redirectUri = this.hostedClient.requiredRedirectUri(client, input.redirect_uri);
         // Everything from here on is refused by sending the browser back to the
@@ -45,7 +45,7 @@ export class SimCognitoAuthorizeEndpoint {
         this.hostedClient.requireCodeGrant(client, true);
         this.request.requireChallengeMethod(input);
         const scopes = new SimCognitoGrantedScopes(client, input.scope);
-        const signedIn = this.signIn.signIn(pool, client, input, presentedSession);
+        const signedIn = await this.signIn.signIn(pool, client, input, presentedSession);
         const { user } = signedIn;
         const code = new SimCognitoAuthorizationCode({
             username: user.username,
@@ -54,6 +54,7 @@ export class SimCognitoAuthorizeEndpoint {
             scopes: scopes.values,
             issuedAt: this.clock.now(),
             codeChallenge: input.code_challenge,
+            federated: signedIn.federated,
         });
         pool.auth.addAuthorizationCode(code);
         return {

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.d.ts

@@ -1,13 +1,21 @@
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
+import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoUserFactory } from "../../user-pool/user/sim-cognito-user-factory.js";
 import type { SimCognitoFirstFactorChallenge } from "../auth/sim-cognito-first-factor-challenge.js";
 import { SimCognitoAuthorizeEndpoint } from "./sim-cognito-authorize-endpoint.js";
 import { SimCognitoLogoutEndpoint } from "./sim-cognito-logout-endpoint.js";
 import { SimCognitoTokenEndpoint } from "./sim-cognito-token-endpoint.js";
 interface SimCognitoHostedCommandsProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly tokenIssuer: SimCognitoTokenIssuer;
     readonly userFactory: SimCognitoUserFactory;
+    /**
+     * The trigger runner the API operations use, which a federated sign-in runs
+     * the pool's sign-up and sign-in triggers through.
+     */
+    readonly triggers: SimCognitoUserPoolTriggers;
     /**
      * What asks a user for a passkey, shared with the API sign-ins so a passkey
      * at the hosted domain answers the same kind of challenge.

package/dist/service/cognito/command/hosted/sim-cognito-hosted-commands.js

@@ -17,15 +17,23 @@ export class SimCognitoHostedCommands {
     token;
     logout = new SimCognitoLogoutEndpoint();
     constructor(properties) {
-        const { tokenIssuer, userFactory, challenge, clock } = properties;
+        const { tokenIssuer, userFactory, triggers, challenge, clock } = properties;
         this.authorize = new SimCognitoAuthorizeEndpoint({
             signIn: new SimCognitoHostedSignIn({
-                federatedSignIn: new SimCognitoFederatedSignIn({ userFactory }),
+                federatedSignIn: new SimCognitoFederatedSignIn({
+                    userFactory,
+                    triggers,
+                }),
                 challenge,
                 clock,
+                triggers,
             }),
             clock,
         });
-        this.token = new SimCognitoTokenEndpoint({ tokenIssuer, clock });
+        this.token = new SimCognitoTokenEndpoint({
+            poolMetrics: properties.poolMetrics,
+            tokenIssuer,
+            clock,
+        });
     }
 }

package/dist/service/cognito/command/hosted/sim-cognito-hosted-passkey-sign-in.d.ts

@@ -1,4 +1,5 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
 import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
@@ -21,6 +22,7 @@ interface SimCognitoHostedPasskeySignInProperties {
      */
     readonly challenge: SimCognitoFirstFactorChallenge;
     readonly clock: SimClock;
+    readonly triggers: SimCognitoUserPoolTriggers;
 }
 /**
  * Signing one of a pool's own users in at the authorize endpoint with a
@@ -45,12 +47,20 @@ interface SimCognitoHostedPasskeySignInProperties {
 export declare class SimCognitoHostedPasskeySignIn {
     private readonly challenge;
     private readonly clock;
+    private readonly triggers;
     constructor(properties: SimCognitoHostedPasskeySignInProperties);
     /**
      * Ask this user for a passkey, or refuse where the pool allows none and
      * where the user has registered none.
+     *
+     * `PreAuthentication` runs here rather than where the credential comes back,
+     * because this is the request that starts the sign-in. A `USER_AUTH`
+     * sign-in runs it in the same place, on the `InitiateAuth` that asks for a
+     * factor, and the challenge response that answers runs it no second time.
+     * Only a request that has been asked holds a session to answer with, so
+     * every passkey sign-in passes through here exactly once.
      */
-    ask(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, username: string): never;
+    ask(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, username: string): Promise<never>;
     /**
      * The user the presented credential signs in, having checked that this
      * user's passkey signed the challenge the pool issued.

package/dist/service/cognito/command/hosted/sim-cognito-hosted-passkey-sign-in.js

@@ -26,16 +26,27 @@ import { simCognitoWebAuthnChallenge } from "../auth/sim-cognito-available-chall
 export class SimCognitoHostedPasskeySignIn {
     challenge;
     clock;
+    triggers;
     constructor(properties) {
         this.challenge = properties.challenge;
         this.clock = properties.clock;
+        this.triggers = properties.triggers;
     }
     /**
      * Ask this user for a passkey, or refuse where the pool allows none and
      * where the user has registered none.
+     *
+     * `PreAuthentication` runs here rather than where the credential comes back,
+     * because this is the request that starts the sign-in. A `USER_AUTH`
+     * sign-in runs it in the same place, on the `InitiateAuth` that asks for a
+     * factor, and the challenge response that answers runs it no second time.
+     * Only a request that has been asked holds a session to answer with, so
+     * every passkey sign-in passes through here exactly once.
      */
-    ask(pool, client, username) {
-        const user = this.signingIn(pool, client, username);
+    async ask(pool, client, username) {
+        const user = requireSimCognitoSignInUser(pool, client, username);
+        await this.triggers.preAuthentication({ pool, client, user });
+        requireSimCognitoReadyToSignIn(user);
         const asked = this.challenge.issue({ pool, client, user }, simCognitoWebAuthnChallenge, "passkey");
         throw new SimCognitoPasskeyRequired(username, String(asked.Session));
     }

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.d.ts

@@ -1,5 +1,6 @@
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoUser } from "../../user-pool/user/sim-cognito-user.js";
 import type { SimCognitoHostedCredentials } from "./sim-cognito-hosted-credentials.js";
 /**
@@ -17,10 +18,19 @@ import type { SimCognitoHostedCredentials } from "./sim-cognito-hosted-credentia
  * reach one is refused here with a message saying which.
  */
 export declare class SimCognitoHostedPasswordSignIn {
+    private readonly triggers;
+    constructor(properties: {
+        readonly triggers: SimCognitoUserPoolTriggers;
+    });
     /**
      * The user these credentials sign in, having checked the password.
+     *
+     * `PreAuthentication` runs once the user is known and before the password is
+     * checked, which is where the API sign-ins run it and where real managed
+     * login reports it from `/login`. A wrong password reaches the handler too,
+     * because the trigger is given the user to decide about.
      */
-    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, credentials: SimCognitoHostedCredentials): SimCognitoUser;
+    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, credentials: SimCognitoHostedCredentials): Promise<SimCognitoUser>;
     /**
      * Refuse a sign-in real managed login answers with a page of its own.
      *

package/dist/service/cognito/command/hosted/sim-cognito-hosted-password-sign-in.js

@@ -16,12 +16,22 @@ import { simCognitoChallengeFactor } from "../auth/sim-cognito-mfa-factor-choice
  * reach one is refused here with a message saying which.
  */
 export class SimCognitoHostedPasswordSignIn {
+    triggers;
+    constructor(properties) {
+        this.triggers = properties.triggers;
+    }
     /**
      * The user these credentials sign in, having checked the password.
+     *
+     * `PreAuthentication` runs once the user is known and before the password is
+     * checked, which is where the API sign-ins run it and where real managed
+     * login reports it from `/login`. A wrong password reaches the handler too,
+     * because the trigger is given the user to decide about.
      */
-    signIn(pool, client, credentials) {
+    async signIn(pool, client, credentials) {
         const { username, password } = credentials;
         const user = requireSimCognitoSignInUser(pool, client, username);
+        await this.triggers.preAuthentication({ pool, client, user });
         requireSimCognitoSignIn(user, password);
         requireSimCognitoConfirmed(user);
         requireSimCognitoPasswordSet(user);

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.d.ts

@@ -2,6 +2,7 @@ import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoFederatedSignIn } from "../../user-pool/idp/sim-cognito-federated-sign-in.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoFirstFactorChallenge } from "../auth/sim-cognito-first-factor-challenge.js";
 import type { SimCognitoHostedSignedIn } from "./sim-cognito-hosted-signed-in.js";
 import type { SimCognitoAuthorizeInput } from "./hosted-auth.command.js";
@@ -13,6 +14,11 @@ interface SimCognitoHostedSignInProperties {
      */
     readonly challenge: SimCognitoFirstFactorChallenge;
     readonly clock: SimClock;
+    /**
+     * The trigger runner the API sign-ins use, which a sign-in at this endpoint
+     * runs the pool's `PreAuthentication` through.
+     */
+    readonly triggers: SimCognitoUserPoolTriggers;
 }
 /**
  * Which user an authorize request signs in.
@@ -36,7 +42,7 @@ export declare class SimCognitoHostedSignIn {
      * The user this request signs in, at a provider, in the pool itself, or from
      * the managed login session the browser presented.
      */
-    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput, presentedSession: string | undefined): SimCognitoHostedSignedIn;
+    signIn(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoAuthorizeInput, presentedSession: string | undefined): Promise<SimCognitoHostedSignedIn>;
     /**
      * Sign in one of the pool's own users, with a passkey, with a password, or
      * from the session the browser is already holding.

package/dist/service/cognito/command/hosted/sim-cognito-hosted-sign-in.js

@@ -1,4 +1,5 @@
 import { SimCognitoManagedLoginRequired } from "../../error/sim-cognito-managed-login.error.js";
+import { requireSimCognitoSigningInAt } from "../../user-pool/idp/sim-cognito-presented-external-user.js";
 import { SimCognitoAuthorizeRequest } from "./sim-cognito-authorize-request.js";
 import { SimCognitoBrowserSession } from "./sim-cognito-browser-session.js";
 import { SimCognitoHostedCredentials } from "./sim-cognito-hosted-credentials.js";
@@ -18,29 +19,39 @@ export class SimCognitoHostedSignIn {
     federatedSignIn;
     clock;
     request = new SimCognitoAuthorizeRequest();
-    passwordSignIn = new SimCognitoHostedPasswordSignIn();
+    passwordSignIn;
     passkeySignIn;
     browserSession = new SimCognitoBrowserSession();
     constructor(properties) {
         this.federatedSignIn = properties.federatedSignIn;
         this.clock = properties.clock;
+        this.passwordSignIn = new SimCognitoHostedPasswordSignIn({
+            triggers: properties.triggers,
+        });
         this.passkeySignIn = new SimCognitoHostedPasskeySignIn({
             challenge: properties.challenge,
             clock: properties.clock,
+            triggers: properties.triggers,
         });
     }
     /**
      * The user this request signs in, at a provider, in the pool itself, or from
      * the managed login session the browser presented.
      */
-    signIn(pool, client, input, presentedSession) {
+    async signIn(pool, client, input, presentedSession) {
         const provider = this.request.signInProvider(pool, client, input);
         if (provider === undefined) {
             return this.localSignIn(pool, client, input, presentedSession);
         }
         const now = this.clock.now();
-        const user = this.federatedSignIn.signIn({ pool, provider, now });
-        return this.browserSession.start(pool, user, now);
+        const user = await this.federatedSignIn.signIn({
+            pool,
+            client,
+            provider,
+            externalUser: requireSimCognitoSigningInAt(provider, input),
+            now,
+        });
+        return this.browserSession.start(pool, user, now).asFederated();
     }
     /**
      * Sign in one of the pool's own users, with a passkey, with a password, or
@@ -54,7 +65,7 @@ export class SimCognitoHostedSignIn {
      * the sign-in form is shown for. The serving layer answers with that page,
      * from this refusal.
      */
-    localSignIn(pool, client, input, presentedSession) {
+    async localSignIn(pool, client, input, presentedSession) {
         const now = this.clock.now();
         const { username, credential } = input;
         if (username !== undefined && credential !== undefined) {
@@ -65,7 +76,7 @@ export class SimCognitoHostedSignIn {
             }), now);
         }
         if (username !== undefined && input.passkey !== undefined) {
-            this.passkeySignIn.ask(pool, client, username);
+            await this.passkeySignIn.ask(pool, client, username);
         }
         const credentials = SimCognitoHostedCredentials.in(input);
         if (credentials === undefined) {
@@ -75,7 +86,7 @@ export class SimCognitoHostedSignIn {
             }
             return returning;
         }
-        const user = this.passwordSignIn.signIn(pool, client, credentials);
+        const user = await this.passwordSignIn.signIn(pool, client, credentials);
         return this.browserSession.start(pool, user, now);
     }
 }

package/dist/service/cognito/command/hosted/sim-cognito-hosted-signed-in.d.ts

@@ -3,18 +3,35 @@ import type { SimCognitoSessionChange } from "./sim-cognito-session-change.js";
 interface SimCognitoHostedSignedInProperties {
     readonly user: SimCognitoUser;
     readonly session: SimCognitoSessionChange;
+    /**
+     * Whether this request signed the user in at an identity provider.
+     *
+     * The tokens a federated sign-in hands out report a `PreTokenGeneration`
+     * source of their own, and the code the endpoint issues is what carries the
+     * answer as far as the token endpoint.
+     */
+    readonly federated?: boolean | undefined;
 }
 /**
  * Who an authorize request signed in, and what it did to the browser's managed
  * login session on the way.
  *
- * The two travel together because the endpoint needs both: the user is who the
- * authorization code is issued for, and the session change is what the
- * response tells the browser to hold.
+ * These travel together because the endpoint needs all of them. The user is
+ * who the authorization code is issued for, the session change is what the
+ * response tells the browser to hold, and the federated flag is what the code
+ * remembers about how the sign-in happened.
  */
 export declare class SimCognitoHostedSignedIn {
     readonly user: SimCognitoUser;
     readonly session: SimCognitoSessionChange;
+    readonly federated: boolean;
     constructor(properties: SimCognitoHostedSignedInProperties);
+    /**
+     * The same sign-in, marked as having happened at an identity provider.
+     *
+     * The browser session is started the same way whichever way the user signed
+     * in, so this is applied afterwards by the one path that federates.
+     */
+    asFederated(): SimCognitoHostedSignedIn;
 }
 export {};

package/dist/service/cognito/command/hosted/sim-cognito-hosted-signed-in.js

@@ -2,15 +2,31 @@
  * Who an authorize request signed in, and what it did to the browser's managed
  * login session on the way.
  *
- * The two travel together because the endpoint needs both: the user is who the
- * authorization code is issued for, and the session change is what the
- * response tells the browser to hold.
+ * These travel together because the endpoint needs all of them. The user is
+ * who the authorization code is issued for, the session change is what the
+ * response tells the browser to hold, and the federated flag is what the code
+ * remembers about how the sign-in happened.
  */
 export class SimCognitoHostedSignedIn {
     user;
     session;
+    federated;
     constructor(properties) {
         this.user = properties.user;
         this.session = properties.session;
+        this.federated = properties.federated ?? false;
+    }
+    /**
+     * The same sign-in, marked as having happened at an identity provider.
+     *
+     * The browser session is started the same way whichever way the user signed
+     * in, so this is applied afterwards by the one path that federates.
+     */
+    asFederated() {
+        return new SimCognitoHostedSignedIn({
+            user: this.user,
+            session: this.session,
+            federated: true,
+        });
     }
 }

package/dist/service/cognito/command/hosted/sim-cognito-token-endpoint.d.ts

@@ -1,8 +1,10 @@
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
 import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
 import type { SimCognitoTokenInput, SimCognitoTokenOutput } from "./hosted-auth.command.js";
 interface SimCognitoTokenEndpointProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly tokenIssuer: SimCognitoTokenIssuer;
     readonly clock: SimClock;
 }

package/dist/service/cognito/command/hosted/sim-cognito-token-grants.d.ts

@@ -1,9 +1,11 @@
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
 import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
 import type { SimCognitoTokenInput, SimCognitoTokenOutput } from "./hosted-auth.command.js";
 interface SimCognitoTokenGrantsProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly tokenIssuer: SimCognitoTokenIssuer;
     readonly clock: SimClock;
 }
@@ -16,6 +18,7 @@ interface SimCognitoTokenGrantsProperties {
  * pool the same way.
  */
 export declare class SimCognitoTokenGrants {
+    private readonly poolMetrics;
     private readonly tokenIssuer;
     private readonly clock;
     private readonly presented;
@@ -27,6 +30,11 @@ export declare class SimCognitoTokenGrants {
      * The code is spent whether or not the rest of the request turns out to be
      * right, as real Cognito spends one, so nothing can be retried with a code
      * that has already been presented.
+     *
+     * The `PreTokenGeneration` source says which sign-in the grant came from.
+     * A code from an identity provider reports `TokenGeneration_HostedAuth`, and
+     * one from the pool's own sign-in form reports the
+     * `TokenGeneration_Authentication` its API sign-in reports.
      */
     exchangeCode(pool: SimCognitoUserPool, client: SimCognitoUserPoolClient, input: SimCognitoTokenInput): Promise<SimCognitoTokenOutput>;
     /**

package/dist/service/cognito/command/hosted/sim-cognito-token-grants.js

@@ -1,3 +1,4 @@
+import { countedSimCognitoFederation } from "../../metric/sim-cognito-counted-request.js";
 import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
 import { SimCognitoGrantedTokens } from "./sim-cognito-granted-tokens.js";
 import { SimCognitoPresentedGrant } from "./sim-cognito-presented-grant.js";
@@ -10,11 +11,13 @@ import { SimCognitoPresentedGrant } from "./sim-cognito-presented-grant.js";
  * pool the same way.
  */
 export class SimCognitoTokenGrants {
+    poolMetrics;
     tokenIssuer;
     clock;
     presented = new SimCognitoPresentedGrant();
     granted = new SimCognitoGrantedTokens();
     constructor(properties) {
+        this.poolMetrics = properties.poolMetrics;
         this.tokenIssuer = properties.tokenIssuer;
         this.clock = properties.clock;
     }
@@ -24,6 +27,11 @@ export class SimCognitoTokenGrants {
      * The code is spent whether or not the rest of the request turns out to be
      * right, as real Cognito spends one, so nothing can be retried with a code
      * that has already been presented.
+     *
+     * The `PreTokenGeneration` source says which sign-in the grant came from.
+     * A code from an identity provider reports `TokenGeneration_HostedAuth`, and
+     * one from the pool's own sign-in form reports the
+     * `TokenGeneration_Authentication` its API sign-in reports.
      */
     async exchangeCode(pool, client, input) {
         const code = this.presented.code({
@@ -33,14 +41,15 @@ export class SimCognitoTokenGrants {
             now: this.clock.now(),
         });
         const user = this.presented.user(pool, code.username);
-        const issued = await this.tokenIssuer.issue({
+        return await countedSimCognitoFederation(this.poolMetrics, { pool, client }, code.federated, async () => this.granted.body(await this.tokenIssuer.issue({
             pool,
             client,
             user,
-            occasion: SimCognitoTriggerOccasion.tokenGeneration,
+            occasion: code.federated
+                ? SimCognitoTriggerOccasion.hostedTokenGeneration
+                : SimCognitoTriggerOccasion.tokenGeneration,
             scopes: code.scopes,
-        });
-        return this.granted.body(issued, code.scopes);
+        }), code.scopes));
     }
     /**
      * Sign fresh tokens for an application that presented a refresh token.

package/dist/service/cognito/command/sim-cognito-commands.d.ts

@@ -4,6 +4,7 @@ import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-
 import { SimCognitoRegistrations } from "../user-pool/sim-cognito-registrations.js";
 import type { SimCognitoUserPoolStore } from "../user-pool/sim-cognito-user-pool-store.js";
 import type { SimAwsMessageLog } from "../../aws/message/sim-aws-message-log.js";
+import type { SimCloudWatchServiceWriter } from "../../cloudwatch/write/sim-cloudwatch-service-writer.js";
 import type { SimCognitoEmailSenders } from "../user-pool/message/sim-cognito-email-senders.js";
 import type { SimCognitoTriggerFunctions } from "../user-pool/trigger/sim-cognito-trigger-functions.js";
 import type { SimCognitoDomainRegistry } from "../registry/sim-cognito-domain-registry.js";
@@ -19,6 +20,7 @@ import { SimCognitoListGroups } from "./group/sim-cognito-list-groups.js";
 import { SimCognitoUserPoolClientCommands } from "./client/sim-cognito-user-pool-client-commands.js";
 import { SimCognitoListUsers } from "./user/sim-cognito-list-users.js";
 import { SimCognitoPasswordResetCommands } from "./user/sim-cognito-password-reset-commands.js";
+import { SimCognitoConfirmSignUpCommands } from "./user/sim-cognito-confirm-sign-up-commands.js";
 import { SimCognitoSignUpCommands } from "./user/sim-cognito-sign-up-commands.js";
 import { SimCognitoUserCommands } from "./user/sim-cognito-user-commands.js";
 import { SimCognitoUserMfaCommands } from "./user/sim-cognito-user-mfa-commands.js";
@@ -37,6 +39,8 @@ interface SimCognitoCommandsProperties {
     readonly emailSenders: SimCognitoEmailSenders;
     readonly webAcls: SimWafProtection;
     readonly messageLog: SimAwsMessageLog;
+    /** Where this scope's `AWS/Cognito` metrics go, if anywhere. */
+    readonly metrics?: SimCloudWatchServiceWriter | undefined;
 }
 /**
  * The command handlers of one simulated Cognito scope.
@@ -55,6 +59,7 @@ export declare class SimCognitoCommands {
     readonly userMfa: SimCognitoUserMfaCommands;
     readonly webAuthn: SimCognitoWebAuthnCommands;
     readonly signUp: SimCognitoSignUpCommands;
+    readonly confirmSignUp: SimCognitoConfirmSignUpCommands;
     readonly passwordReset: SimCognitoPasswordResetCommands;
     readonly userUpdates: SimCognitoUserUpdateCommands;
     readonly listUsers: SimCognitoListUsers;