@kensio/yulin 1.21.0 → 1.21.2

package/dist/service/cognito/command/sim-cognito-commands.js

@@ -2,6 +2,7 @@ import { SimCognitoUserPoolClientFactory } from "../user-pool/client/sim-cognito
 import { SimCognitoGroupFactory } from "../user-pool/group/sim-cognito-group-factory.js";
 import { SimCognitoRegistrations } from "../user-pool/sim-cognito-registrations.js";
 import { SimCognitoUserPoolFactory } from "../user-pool/sim-cognito-user-pool-factory.js";
+import { SimCognitoPoolMetrics } from "../metric/sim-cognito-pool-metrics.js";
 import { SimCognitoPoolMessenger } from "../user-pool/message/sim-cognito-pool-messenger.js";
 import { SimCognitoPoolEmailDelivery } from "../user-pool/message/sim-cognito-pool-email-delivery.js";
 import { SimCognitoUserPoolTriggers } from "../user-pool/trigger/sim-cognito-user-pool-triggers.js";
@@ -21,6 +22,7 @@ import { SimCognitoListGroups } from "./group/sim-cognito-list-groups.js";
 import { SimCognitoUserPoolClientCommands } from "./client/sim-cognito-user-pool-client-commands.js";
 import { SimCognitoListUsers } from "./user/sim-cognito-list-users.js";
 import { SimCognitoPasswordResetCommands } from "./user/sim-cognito-password-reset-commands.js";
+import { SimCognitoConfirmSignUpCommands } from "./user/sim-cognito-confirm-sign-up-commands.js";
 import { SimCognitoSignUpCommands } from "./user/sim-cognito-sign-up-commands.js";
 import { SimCognitoTokenUser } from "./user/sim-cognito-token-user.js";
 import { SimCognitoUserCommands } from "./user/sim-cognito-user-commands.js";
@@ -48,6 +50,7 @@ export class SimCognitoCommands {
     userMfa;
     webAuthn;
     signUp;
+    confirmSignUp;
     passwordReset;
     userUpdates;
     listUsers;
@@ -74,7 +77,14 @@ export class SimCognitoCommands {
         this.webAcls = properties.webAcls;
         const authorizer = new SimCognitoAuthorizer({ iam, accountRegionScope });
         const resolver = new SimCognitoRequestResolver({ pools, authorizer });
-        const authResolver = new SimCognitoAuthResolver({ resolver, pools });
+        const poolMetrics = new SimCognitoPoolMetrics({
+            metrics: properties.metrics,
+        });
+        const authResolver = new SimCognitoAuthResolver({
+            resolver,
+            pools,
+            poolMetrics,
+        });
         const userFactory = new SimCognitoUserFactory({ clock });
         // One trigger runner serves every command, because a pool's LambdaConfig
         // is one set of functions whichever operation reaches it.
@@ -127,6 +137,7 @@ export class SimCognitoCommands {
         });
         this.listClients = new SimCognitoListUserPoolClients({ pools, authorizer });
         this.users = new SimCognitoUserCommands({
+            poolMetrics,
             resolver,
             tokenUser,
             userFactory,
@@ -140,12 +151,18 @@ export class SimCognitoCommands {
         });
         this.webAuthn = new SimCognitoWebAuthnCommands({ tokenUser, clock });
         this.signUp = new SimCognitoSignUpCommands({
+            poolMetrics,
             authResolver,
-            resolver,
             userFactory,
             triggers,
             messenger,
         });
+        this.confirmSignUp = new SimCognitoConfirmSignUpCommands({
+            authResolver,
+            resolver,
+            triggers,
+            messenger,
+        });
         this.passwordReset = new SimCognitoPasswordResetCommands({
             authResolver,
             resolver,
@@ -169,6 +186,7 @@ export class SimCognitoCommands {
             tokenIssuer,
             messenger,
             firstFactor,
+            poolMetrics,
         });
         this.domains = new SimCognitoDomainCommands({
             pools,
@@ -184,8 +202,10 @@ export class SimCognitoCommands {
         // create pool users the same way a sign-up does, so they are given the
         // same collaborators rather than ones of their own.
         this.hosted = new SimCognitoHostedCommands({
+            poolMetrics,
             tokenIssuer,
             userFactory,
+            triggers,
             challenge: firstFactor,
             clock,
         });

package/dist/service/cognito/command/user/sim-cognito-confirm-sign-up-commands.d.ts

@@ -0,0 +1,74 @@
+import type { SimCognitoPoolMessenger } from "../../user-pool/message/sim-cognito-pool-messenger.js";
+import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
+import type { SimCognitoAuthResolver } from "../auth/sim-cognito-auth-resolver.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCognitoRequestResolver } from "../sim-cognito-request-resolver.js";
+import type { SimAdminConfirmSignUpCommand, SimAdminConfirmSignUpCommandOutput, SimConfirmSignUpCommand, SimConfirmSignUpCommandOutput, SimResendConfirmationCodeCommand, SimResendConfirmationCodeCommandOutput } from "./sign-up.command.js";
+interface SimCognitoConfirmSignUpCommandsProperties {
+    readonly authResolver: SimCognitoAuthResolver;
+    readonly resolver: SimCognitoRequestResolver;
+    readonly triggers: SimCognitoUserPoolTriggers;
+    readonly messenger: SimCognitoPoolMessenger;
+}
+interface SimCognitoCommandOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * Confirming a sign-up, and the code that confirms one.
+ *
+ * Held apart from the registration commands because the two halves of signing
+ * up share nothing but the pool: registering makes a user and sends it a code,
+ * and confirming reads a code back and runs `PostConfirmation`. An
+ * administrator can do the second without the first ever having sent
+ * anything.
+ */
+export declare class SimCognitoConfirmSignUpCommands {
+    private readonly authResolver;
+    private readonly resolver;
+    private readonly triggers;
+    private readonly messenger;
+    private readonly unsimulatedOptions;
+    constructor(properties: SimCognitoConfirmSignUpCommandsProperties);
+    /**
+     * Confirm a sign-up with the code the pool issued.
+     *
+     * The user reaches `CONFIRMED` and can sign in from then on. The pool's
+     * `AutoVerifiedAttributes` are marked verified here, because answering with
+     * the code is what shows the address the code went to is the user's. The
+     * pool's `PostConfirmation` trigger runs last, on the confirmed user.
+     */
+    confirmSignUp(command: SimConfirmSignUpCommand): Promise<SimConfirmSignUpCommandOutput>;
+    /**
+     * Issue a fresh confirmation code for a user waiting to be confirmed.
+     *
+     * The code the user had stops working, as it does on real Cognito, so a
+     * test holding the earlier one has to read the new one from the pool. The
+     * pool records a second message carrying the fresh code, and a
+     * `CustomMessage` handler tells this occasion from a sign-up by its
+     * `CustomMessage_ResendCode` trigger source.
+     */
+    resendConfirmationCode(command: SimResendConfirmationCodeCommand): Promise<SimResendConfirmationCodeCommandOutput>;
+    /**
+     * Confirm a sign-up as an administrator, with no code involved.
+     *
+     * Nothing is verified by this. Real Cognito leaves `email_verified` and
+     * `phone_number_verified` alone here even on a pool with
+     * `AutoVerifiedAttributes`, because an admin confirming a user says nothing
+     * about whether the address is really theirs.
+     *
+     * The `PostConfirmation` trigger still runs, and reports the same
+     * `PostConfirmation_ConfirmSignUp` source `ConfirmSignUp` does, because the
+     * user being confirmed signed itself up either way. There is no app client
+     * in the request, so the handler reads `CLIENT_ID_NOT_APPLICABLE`.
+     */
+    adminConfirmSignUp(command: SimAdminConfirmSignUpCommand, options?: SimCognitoCommandOptions): Promise<SimAdminConfirmSignUpCommandOutput>;
+    /**
+     * Resolve the user a client-side sign-up operation names.
+     *
+     * The `SECRET_HASH` covers the username, so it is checked as soon as the
+     * username is known and before anything looks the user up, which is the
+     * order the sign-in commands check it in too.
+     */
+    private signingUpUser;
+}
+export {};

package/dist/service/cognito/command/user/sim-cognito-confirm-sign-up-commands.js

@@ -0,0 +1,110 @@
+import { requireSimCognitoSecretHash } from "../../user-pool/auth/sim-cognito-secret-hash.js";
+import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
+import { requireSimCognitoUsername } from "../../user-pool/user/sim-cognito-username.js";
+import { SimCognitoUnsimulatedSignUpOptions } from "./sim-cognito-unsimulated-sign-up-options.js";
+/**
+ * Confirming a sign-up, and the code that confirms one.
+ *
+ * Held apart from the registration commands because the two halves of signing
+ * up share nothing but the pool: registering makes a user and sends it a code,
+ * and confirming reads a code back and runs `PostConfirmation`. An
+ * administrator can do the second without the first ever having sent
+ * anything.
+ */
+export class SimCognitoConfirmSignUpCommands {
+    authResolver;
+    resolver;
+    triggers;
+    messenger;
+    unsimulatedOptions = new SimCognitoUnsimulatedSignUpOptions();
+    constructor(properties) {
+        this.authResolver = properties.authResolver;
+        this.resolver = properties.resolver;
+        this.triggers = properties.triggers;
+        this.messenger = properties.messenger;
+    }
+    /**
+     * Confirm a sign-up with the code the pool issued.
+     *
+     * The user reaches `CONFIRMED` and can sign in from then on. The pool's
+     * `AutoVerifiedAttributes` are marked verified here, because answering with
+     * the code is what shows the address the code went to is the user's. The
+     * pool's `PostConfirmation` trigger runs last, on the confirmed user.
+     */
+    async confirmSignUp(command) {
+        const { input } = command;
+        const { pool, client } = this.authResolver.client(input.ClientId);
+        this.unsimulatedOptions.refuseInConfirm(input);
+        const user = this.signingUpUser(pool, client, input);
+        user.confirmSignUp(input.ConfirmationCode);
+        user.verifyAttributes(pool.settings.autoVerifiedAttributes.names);
+        await this.triggers.postConfirmation(SimCognitoTriggerOccasion.confirmSignUp, {
+            pool,
+            client,
+            user,
+            clientMetadata: input.ClientMetadata,
+        });
+        return { $metadata: {} };
+    }
+    /**
+     * Issue a fresh confirmation code for a user waiting to be confirmed.
+     *
+     * The code the user had stops working, as it does on real Cognito, so a
+     * test holding the earlier one has to read the new one from the pool. The
+     * pool records a second message carrying the fresh code, and a
+     * `CustomMessage` handler tells this occasion from a sign-up by its
+     * `CustomMessage_ResendCode` trigger source.
+     */
+    async resendConfirmationCode(command) {
+        const { input } = command;
+        const { pool, client } = this.authResolver.client(input.ClientId);
+        this.unsimulatedOptions.refuseInResend(input);
+        const user = this.signingUpUser(pool, client, input);
+        user.resendConfirmationCode();
+        await this.messenger.send({
+            pool,
+            user,
+            client,
+            occasion: "ResendCode",
+            code: user.confirmationCode,
+            clientMetadata: input.ClientMetadata,
+        });
+        return { $metadata: {} };
+    }
+    /**
+     * Confirm a sign-up as an administrator, with no code involved.
+     *
+     * Nothing is verified by this. Real Cognito leaves `email_verified` and
+     * `phone_number_verified` alone here even on a pool with
+     * `AutoVerifiedAttributes`, because an admin confirming a user says nothing
+     * about whether the address is really theirs.
+     *
+     * The `PostConfirmation` trigger still runs, and reports the same
+     * `PostConfirmation_ConfirmSignUp` source `ConfirmSignUp` does, because the
+     * user being confirmed signed itself up either way. There is no app client
+     * in the request, so the handler reads `CLIENT_ID_NOT_APPLICABLE`.
+     */
+    async adminConfirmSignUp(command, options) {
+        const { input } = command;
+        const { pool, user } = this.resolver.poolUser("cognito-idp:AdminConfirmSignUp", input, options);
+        user.confirm();
+        await this.triggers.postConfirmation(SimCognitoTriggerOccasion.confirmSignUp, {
+            pool,
+            user,
+            clientMetadata: input.ClientMetadata,
+        });
+        return { $metadata: {} };
+    }
+    /**
+     * Resolve the user a client-side sign-up operation names.
+     *
+     * The `SECRET_HASH` covers the username, so it is checked as soon as the
+     * username is known and before anything looks the user up, which is the
+     * order the sign-in commands check it in too.
+     */
+    signingUpUser(pool, client, input) {
+        const username = requireSimCognitoUsername(input.Username);
+        requireSimCognitoSecretHash(username, client, input.SecretHash);
+        return pool.requireUser(username);
+    }
+}

package/dist/service/cognito/command/user/sim-cognito-sign-up-commands.d.ts

@@ -1,20 +1,16 @@
-import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCognitoPoolMessenger } from "../../user-pool/message/sim-cognito-pool-messenger.js";
 import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoUserFactory } from "../../user-pool/user/sim-cognito-user-factory.js";
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimCognitoAuthResolver } from "../auth/sim-cognito-auth-resolver.js";
-import type { SimCognitoRequestResolver } from "../sim-cognito-request-resolver.js";
-import type { SimAdminConfirmSignUpCommand, SimAdminConfirmSignUpCommandOutput, SimConfirmSignUpCommand, SimConfirmSignUpCommandOutput, SimResendConfirmationCodeCommand, SimResendConfirmationCodeCommandOutput, SimSignUpCommand, SimSignUpCommandOutput } from "./sign-up.command.js";
+import type { SimSignUpCommand, SimSignUpCommandOutput } from "./sign-up.command.js";
 interface SimCognitoSignUpCommandsProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly authResolver: SimCognitoAuthResolver;
-    readonly resolver: SimCognitoRequestResolver;
     readonly userFactory: SimCognitoUserFactory;
     readonly triggers: SimCognitoUserPoolTriggers;
     readonly messenger: SimCognitoPoolMessenger;
 }
-interface SimCognitoCommandOptions {
-    readonly caller?: SimAwsCaller;
-}
 /**
  * The commands a user signs itself up with, and the one an admin confirms it
  * with.
@@ -30,8 +26,8 @@ interface SimCognitoCommandOptions {
  * and the message the pool would have sent it in is recorded on the pool.
  */
 export declare class SimCognitoSignUpCommands {
+    private readonly poolMetrics;
     private readonly authResolver;
-    private readonly resolver;
     private readonly userFactory;
     private readonly triggers;
     private readonly messenger;
@@ -58,46 +54,6 @@ export declare class SimCognitoSignUpCommands {
      * a code, so real Cognito sends it none.
      */
     signUp(command: SimSignUpCommand): Promise<SimSignUpCommandOutput>;
-    /**
-     * Confirm a sign-up with the code the pool issued.
-     *
-     * The user reaches `CONFIRMED` and can sign in from then on. The pool's
-     * `AutoVerifiedAttributes` are marked verified here, because answering with
-     * the code is what shows the address the code went to is the user's. The
-     * pool's `PostConfirmation` trigger runs last, on the confirmed user.
-     */
-    confirmSignUp(command: SimConfirmSignUpCommand): Promise<SimConfirmSignUpCommandOutput>;
-    /**
-     * Issue a fresh confirmation code for a user waiting to be confirmed.
-     *
-     * The code the user had stops working, as it does on real Cognito, so a
-     * test holding the earlier one has to read the new one from the pool. The
-     * pool records a second message carrying the fresh code, and a
-     * `CustomMessage` handler tells this occasion from a sign-up by its
-     * `CustomMessage_ResendCode` trigger source.
-     */
-    resendConfirmationCode(command: SimResendConfirmationCodeCommand): Promise<SimResendConfirmationCodeCommandOutput>;
-    /**
-     * Confirm a sign-up as an administrator, with no code involved.
-     *
-     * Nothing is verified by this. Real Cognito leaves `email_verified` and
-     * `phone_number_verified` alone here even on a pool with
-     * `AutoVerifiedAttributes`, because an admin confirming a user says nothing
-     * about whether the address is really theirs.
-     *
-     * The `PostConfirmation` trigger still runs, and reports the same
-     * `PostConfirmation_ConfirmSignUp` source `ConfirmSignUp` does, because the
-     * user being confirmed signed itself up either way. There is no app client
-     * in the request, so the handler reads `CLIENT_ID_NOT_APPLICABLE`.
-     */
-    adminConfirmSignUp(command: SimAdminConfirmSignUpCommand, options?: SimCognitoCommandOptions): Promise<SimAdminConfirmSignUpCommandOutput>;
-    /**
-     * Resolve the user a client-side sign-up operation names.
-     *
-     * The `SECRET_HASH` covers the username, so it is checked as soon as the
-     * username is known and before anything looks the user up, which is the
-     * order the sign-in commands check it in too.
-     */
-    private signingUpUser;
+    private registered;
 }
 export {};

package/dist/service/cognito/command/user/sim-cognito-sign-up-commands.js

@@ -1,6 +1,7 @@
 import { requireSimCognitoSecretHash } from "../../user-pool/auth/sim-cognito-secret-hash.js";
 import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
 import { requireSimCognitoUsername } from "../../user-pool/user/sim-cognito-username.js";
+import { countedSimCognitoCompletion } from "../../metric/sim-cognito-counted-request.js";
 import { simCognitoValidationData } from "../sim-cognito-validation-data.js";
 import { SimCognitoUnsimulatedSignUpOptions } from "./sim-cognito-unsimulated-sign-up-options.js";
 /**
@@ -18,15 +19,15 @@ import { SimCognitoUnsimulatedSignUpOptions } from "./sim-cognito-unsimulated-si
  * and the message the pool would have sent it in is recorded on the pool.
  */
 export class SimCognitoSignUpCommands {
+    poolMetrics;
     authResolver;
-    resolver;
     userFactory;
     triggers;
     messenger;
     unsimulatedOptions = new SimCognitoUnsimulatedSignUpOptions();
     constructor(properties) {
+        this.poolMetrics = properties.poolMetrics;
         this.authResolver = properties.authResolver;
-        this.resolver = properties.resolver;
         this.userFactory = properties.userFactory;
         this.triggers = properties.triggers;
         this.messenger = properties.messenger;
@@ -52,8 +53,11 @@ export class SimCognitoSignUpCommands {
      * a code, so real Cognito sends it none.
      */
     async signUp(command) {
+        const scope = this.authResolver.client(command.input.ClientId);
+        return await countedSimCognitoCompletion(this.poolMetrics, "SignUp", scope, async () => await this.registered(command, scope));
+    }
+    async registered(command, { pool, client }) {
         const { input } = command;
-        const { pool, client } = this.authResolver.client(input.ClientId);
         this.unsimulatedOptions.refuseInSignUp(input);
         pool.settings.adminCreateUserConfig.requireSelfServiceSignUp();
         const requested = requireSimCognitoUsername(input.Username);
@@ -103,88 +107,4 @@ export class SimCognitoSignUpCommands {
             UserSub: user.sub,
         };
     }
-    /**
-     * Confirm a sign-up with the code the pool issued.
-     *
-     * The user reaches `CONFIRMED` and can sign in from then on. The pool's
-     * `AutoVerifiedAttributes` are marked verified here, because answering with
-     * the code is what shows the address the code went to is the user's. The
-     * pool's `PostConfirmation` trigger runs last, on the confirmed user.
-     */
-    async confirmSignUp(command) {
-        const { input } = command;
-        const { pool, client } = this.authResolver.client(input.ClientId);
-        this.unsimulatedOptions.refuseInConfirm(input);
-        const user = this.signingUpUser(pool, client, input);
-        user.confirmSignUp(input.ConfirmationCode);
-        user.verifyAttributes(pool.settings.autoVerifiedAttributes.names);
-        await this.triggers.postConfirmation(SimCognitoTriggerOccasion.confirmSignUp, {
-            pool,
-            client,
-            user,
-            clientMetadata: input.ClientMetadata,
-        });
-        return { $metadata: {} };
-    }
-    /**
-     * Issue a fresh confirmation code for a user waiting to be confirmed.
-     *
-     * The code the user had stops working, as it does on real Cognito, so a
-     * test holding the earlier one has to read the new one from the pool. The
-     * pool records a second message carrying the fresh code, and a
-     * `CustomMessage` handler tells this occasion from a sign-up by its
-     * `CustomMessage_ResendCode` trigger source.
-     */
-    async resendConfirmationCode(command) {
-        const { input } = command;
-        const { pool, client } = this.authResolver.client(input.ClientId);
-        this.unsimulatedOptions.refuseInResend(input);
-        const user = this.signingUpUser(pool, client, input);
-        user.resendConfirmationCode();
-        await this.messenger.send({
-            pool,
-            user,
-            client,
-            occasion: "ResendCode",
-            code: user.confirmationCode,
-            clientMetadata: input.ClientMetadata,
-        });
-        return { $metadata: {} };
-    }
-    /**
-     * Confirm a sign-up as an administrator, with no code involved.
-     *
-     * Nothing is verified by this. Real Cognito leaves `email_verified` and
-     * `phone_number_verified` alone here even on a pool with
-     * `AutoVerifiedAttributes`, because an admin confirming a user says nothing
-     * about whether the address is really theirs.
-     *
-     * The `PostConfirmation` trigger still runs, and reports the same
-     * `PostConfirmation_ConfirmSignUp` source `ConfirmSignUp` does, because the
-     * user being confirmed signed itself up either way. There is no app client
-     * in the request, so the handler reads `CLIENT_ID_NOT_APPLICABLE`.
-     */
-    async adminConfirmSignUp(command, options) {
-        const { input } = command;
-        const { pool, user } = this.resolver.poolUser("cognito-idp:AdminConfirmSignUp", input, options);
-        user.confirm();
-        await this.triggers.postConfirmation(SimCognitoTriggerOccasion.confirmSignUp, {
-            pool,
-            user,
-            clientMetadata: input.ClientMetadata,
-        });
-        return { $metadata: {} };
-    }
-    /**
-     * Resolve the user a client-side sign-up operation names.
-     *
-     * The `SECRET_HASH` covers the username, so it is checked as soon as the
-     * username is known and before anything looks the user up, which is the
-     * order the sign-in commands check it in too.
-     */
-    signingUpUser(pool, client, input) {
-        const username = requireSimCognitoUsername(input.Username);
-        requireSimCognitoSecretHash(username, client, input.SecretHash);
-        return pool.requireUser(username);
-    }
 }

package/dist/service/cognito/command/user/sim-cognito-user-commands.d.ts

@@ -2,11 +2,13 @@ import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCognitoPoolMessenger } from "../../user-pool/message/sim-cognito-pool-messenger.js";
 import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoUserFactory } from "../../user-pool/user/sim-cognito-user-factory.js";
+import type { SimCognitoPoolMetrics } from "../../metric/sim-cognito-pool-metrics.js";
 import type { SimCognitoRequestResolver } from "../sim-cognito-request-resolver.js";
 import type { SimCognitoTokenUser } from "./sim-cognito-token-user.js";
 import type { SimGetUserCommand, SimGetUserCommandOutput } from "./user-mfa.command.js";
 import type { SimAdminCreateUserCommand, SimAdminCreateUserCommandOutput, SimAdminDeleteUserCommand, SimAdminDeleteUserCommandOutput, SimAdminGetUserCommand, SimAdminGetUserCommandOutput } from "./user.command.js";
 interface SimCognitoUserCommandsProperties {
+    readonly poolMetrics: SimCognitoPoolMetrics;
     readonly resolver: SimCognitoRequestResolver;
     readonly tokenUser: SimCognitoTokenUser;
     readonly userFactory: SimCognitoUserFactory;
@@ -23,6 +25,7 @@ interface SimCognitoCommandOptions {
  * own.
  */
 export declare class SimCognitoUserCommands {
+    private readonly poolMetrics;
     private readonly resolver;
     private readonly tokenUser;
     private readonly userFactory;
@@ -75,5 +78,6 @@ export declare class SimCognitoUserCommands {
      * Delete a user from a pool.
      */
     delete(command: SimAdminDeleteUserCommand, options?: SimCognitoCommandOptions): SimAdminDeleteUserCommandOutput;
+    private created;
 }
 export {};

package/dist/service/cognito/command/user/sim-cognito-user-commands.js

@@ -1,5 +1,7 @@
 import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
 import { requireSimCognitoUsername } from "../../user-pool/user/sim-cognito-username.js";
+import { countedSimCognitoCompletion } from "../../metric/sim-cognito-counted-request.js";
+import { simCognitoAdminClientDimension } from "../../metric/sim-cognito-metrics.js";
 import { SimCognitoUnsimulatedUserOptions } from "./sim-cognito-unsimulated-user-options.js";
 import { simCognitoValidationData } from "../sim-cognito-validation-data.js";
 import { SimCognitoUserView } from "./sim-cognito-user-view.js";
@@ -10,6 +12,7 @@ import { SimCognitoUserView } from "./sim-cognito-user-view.js";
  * own.
  */
 export class SimCognitoUserCommands {
+    poolMetrics;
     resolver;
     tokenUser;
     userFactory;
@@ -18,6 +21,7 @@ export class SimCognitoUserCommands {
     view = new SimCognitoUserView();
     unsimulatedOptions = new SimCognitoUnsimulatedUserOptions();
     constructor(properties) {
+        this.poolMetrics = properties.poolMetrics;
         this.resolver = properties.resolver;
         this.tokenUser = properties.tokenUser;
         this.userFactory = properties.userFactory;
@@ -50,8 +54,41 @@ export class SimCognitoUserCommands {
      * changing nothing.
      */
     async create(command, options) {
+        const pool = this.resolver.pool("cognito-idp:AdminCreateUser", command.input.UserPoolId, options);
+        // A user an administrator registers reaches the pool through no app
+        // client, and real Cognito reports it under a fixed name in that place.
+        return await countedSimCognitoCompletion(this.poolMetrics, "SignUp", { pool, client: { id: simCognitoAdminClientDimension } }, async () => await this.created(command, pool));
+    }
+    /**
+     * Read a user by username.
+     */
+    get(command, options) {
+        const user = this.resolver.user("cognito-idp:AdminGetUser", command.input, options);
+        return { $metadata: {}, ...this.view.describe(user) };
+    }
+    /**
+     * Read the user an access token was issued to.
+     *
+     * This is the client-side read, so the access token is the whole of the
+     * authorization and no IAM policy is evaluated, as real Cognito evaluates
+     * none for it. What it reports is narrower than `AdminGetUser`: the user's
+     * attributes and the factors it has registered, and nothing about its
+     * status.
+     */
+    getUser(command) {
+        const { user } = this.tokenUser.require(command.input.AccessToken, "GetUser");
+        return { $metadata: {}, ...this.view.self(user) };
+    }
+    /**
+     * Delete a user from a pool.
+     */
+    delete(command, options) {
+        const { pool, user } = this.resolver.poolUser("cognito-idp:AdminDeleteUser", command.input, options);
+        pool.removeUser(user);
+        return { $metadata: {} };
+    }
+    async created(command, pool) {
         const { input } = command;
-        const pool = this.resolver.pool("cognito-idp:AdminCreateUser", input.UserPoolId, options);
         const requested = requireSimCognitoUsername(input.Username);
         this.unsimulatedOptions.refuseInCreate(input);
         // A pool signing users in by email or phone number stores a generated
@@ -83,32 +120,4 @@ export class SimCognitoUserCommands {
         }
         return { $metadata: {}, User: this.view.entry(user) };
     }
-    /**
-     * Read a user by username.
-     */
-    get(command, options) {
-        const user = this.resolver.user("cognito-idp:AdminGetUser", command.input, options);
-        return { $metadata: {}, ...this.view.describe(user) };
-    }
-    /**
-     * Read the user an access token was issued to.
-     *
-     * This is the client-side read, so the access token is the whole of the
-     * authorization and no IAM policy is evaluated, as real Cognito evaluates
-     * none for it. What it reports is narrower than `AdminGetUser`: the user's
-     * attributes and the factors it has registered, and nothing about its
-     * status.
-     */
-    getUser(command) {
-        const { user } = this.tokenUser.require(command.input.AccessToken, "GetUser");
-        return { $metadata: {}, ...this.view.self(user) };
-    }
-    /**
-     * Delete a user from a pool.
-     */
-    delete(command, options) {
-        const { pool, user } = this.resolver.poolUser("cognito-idp:AdminDeleteUser", command.input, options);
-        pool.removeUser(user);
-        return { $metadata: {} };
-    }
 }

package/dist/service/cognito/error/sim-cognito-managed-login.error.d.ts

@@ -43,3 +43,26 @@ export declare class SimCognitoPasskeyRequired extends SimCognitoOAuthError {
  * passkey on.
  */
 export declare function isSimCognitoPasskeyRequired(error: unknown): error is SimCognitoPasskeyRequired;
+/**
+ * An authorize request naming an identity provider that nobody is signed in
+ * at, and presenting no user of its own.
+ *
+ * Real Cognito redirects the browser to the provider's own sign-in page here,
+ * and the provider answers with whoever signed in at it. Nothing in this
+ * simulation calls a provider, so a served domain answers with a page standing
+ * in for that one, and the person says who is signing in. A test skips the
+ * page by saying it with `signInAs` first.
+ *
+ * It is an OAuth error so that every other caller treats it as one, in the
+ * same way `SimCognitoManagedLoginRequired` is.
+ */
+export declare class SimCognitoProviderSignInRequired extends SimCognitoOAuthError {
+    /** The provider the page stands in for. */
+    readonly providerName: string;
+    constructor(providerName: string);
+}
+/**
+ * Whether an authorize request was one a provider's own sign-in page would
+ * have answered.
+ */
+export declare function isSimCognitoProviderSignInRequired(error: unknown): error is SimCognitoProviderSignInRequired;

package/dist/service/cognito/error/sim-cognito-managed-login.error.js

@@ -66,3 +66,39 @@ export class SimCognitoPasskeyRequired extends SimCognitoOAuthError {
 export function isSimCognitoPasskeyRequired(error) {
     return error instanceof SimCognitoPasskeyRequired;
 }
+/**
+ * An authorize request naming an identity provider that nobody is signed in
+ * at, and presenting no user of its own.
+ *
+ * Real Cognito redirects the browser to the provider's own sign-in page here,
+ * and the provider answers with whoever signed in at it. Nothing in this
+ * simulation calls a provider, so a served domain answers with a page standing
+ * in for that one, and the person says who is signing in. A test skips the
+ * page by saying it with `signInAs` first.
+ *
+ * It is an OAuth error so that every other caller treats it as one, in the
+ * same way `SimCognitoManagedLoginRequired` is.
+ */
+export class SimCognitoProviderSignInRequired extends SimCognitoOAuthError {
+    /** The provider the page stands in for. */
+    providerName;
+    constructor(providerName) {
+        super({
+            code: "invalid_request",
+            description: `Nobody is signed in at the ${providerName} identity provider. Real ` +
+                `Cognito would send the user to the provider's own sign-in page, ` +
+                `which this simulation has no equivalent of. Say who is signed in ` +
+                `there with signInAs, or post a subject to the page a served domain ` +
+                `answers this request with.`,
+            redirectable: false,
+        });
+        this.providerName = providerName;
+    }
+}
+/**
+ * Whether an authorize request was one a provider's own sign-in page would
+ * have answered.
+ */
+export function isSimCognitoProviderSignInRequired(error) {
+    return error instanceof SimCognitoProviderSignInRequired;
+}