@kensio/yulin 1.7.0 → 1.9.0

package/dist/service/cognito/command/auth/sim-cognito-new-password-response.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-new-password-response.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-new-password-response.ts"],"names":[],"mappings":"AACA,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AAExF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAmBxF;;;;;;;;GAQG;AACH,MAAM,OAAO,6BAA6B;IACvB,YAAY,CAAyB;IACrC,WAAW,CAAwB;IACnC,KAAK,CAAW;IAChB,MAAM,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAE/D,YAAY,UAAmD;QAC7D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;YACvC,SAAS,EAAE,OAAO,CAAC,OAAO;YAC1B,QAAQ;YACR,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,wEAAwE;QACxE,uCAAuC;QACvC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,CAAC,WAAW,CACd,IAAI,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CACtD,cAAc,EACd,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAChC,EACD,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEjC,OAAO;YACL,SAAS,EAAE,EAAE;YACb,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAClC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAC/C;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-new-password-response.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-new-password-response.ts"],"names":[],"mappings":"AACA,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AAExF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AAEpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAoBxF;;;;;;;;GAQG;AACH,MAAM,OAAO,6BAA6B;IACvB,YAAY,CAAyB;IACrC,WAAW,CAAwB;IACnC,QAAQ,CAA6B;IACrC,KAAK,CAAW;IAChB,MAAM,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAE/D,YAAY,UAAmD;QAC7D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,CACV,OAA2C;QAE3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;YACvC,SAAS,EAAE,OAAO,CAAC,OAAO;YAC1B,QAAQ;YACR,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,wEAAwE;QACxE,uCAAuC;QACvC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,CAAC,WAAW,CACd,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAC/D,cAAc,EACd,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAChC,EACD,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAEjC,4EAA4E;QAC5E,uEAAuE;QACvE,QAAQ;QACR,MAAM,aAAa,GAAG;YACpB,SAAS,EAAE,EAAE;YACb,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAClC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;gBAC3B,IAAI;gBACJ,MAAM;gBACN,IAAI;gBACJ,QAAQ,EAAE,yBAAyB,CAAC,0BAA0B;gBAC9D,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC,CACH;SACF,CAAC;QAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACrC,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;QAEH,OAAO,aAAa,CAAC;IACvB,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-password-sign-in.d.ts

@@ -1,6 +1,7 @@
 import type { SimCognitoUserPoolClient } from "../../user-pool/client/sim-cognito-user-pool-client.js";
 import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
 import type { SimCognitoTokenIssuer } from "../../user-pool/token/sim-cognito-token-issuer.js";
+import type { SimCognitoUserPoolTriggers } from "../../user-pool/trigger/sim-cognito-user-pool-triggers.js";
 import type { SimCognitoAuthParameters } from "./sim-cognito-auth-parameters.js";
 import type { SimCognitoAuthResolver } from "./sim-cognito-auth-resolver.js";
 import type { SimCognitoNewPasswordChallenge } from "./sim-cognito-new-password-challenge.js";
@@ -9,6 +10,7 @@ interface SimCognitoPasswordSignInProperties {
     readonly authResolver: SimCognitoAuthResolver;
     readonly tokenIssuer: SimCognitoTokenIssuer;
     readonly challenge: SimCognitoNewPasswordChallenge;
+    readonly triggers: SimCognitoUserPoolTriggers;
 }
 /**
  * What a sign-in request has resolved before the flow runs.
@@ -17,6 +19,11 @@ export interface SimCognitoAuthRequest {
     readonly pool: SimCognitoUserPool;
     readonly client: SimCognitoUserPoolClient;
     readonly parameters: SimCognitoAuthParameters;
+    /**
+     * The `ClientMetadata` the request carried, which is what a Lambda trigger
+     * reads as its validation data or its client metadata.
+     */
+    readonly clientMetadata?: Readonly<Record<string, string>> | undefined;
 }
 /**
  * Signing a user in with a username and password.
@@ -31,12 +38,23 @@ export declare class SimCognitoPasswordSignIn {
     private readonly authResolver;
     private readonly tokenIssuer;
     private readonly challenge;
+    private readonly triggers;
     private readonly result;
     constructor(properties: SimCognitoPasswordSignInProperties);
     /**
      * Sign the user in, or answer with the challenge it has to get past first.
+     *
+     * The pool's `PreAuthentication` trigger runs once the user is known and
+     * before its password is checked, which is the order real Cognito runs it in:
+     * the trigger is given the user to decide about, and deciding is what it is
+     * for, so a wrong password reaches it too.
+     *
+     * `PostAuthentication` runs only where tokens were issued. A user answered
+     * with the `NEW_PASSWORD_REQUIRED` challenge has not signed in yet, and runs
+     * it when it answers the challenge instead. `PreTokenGeneration` runs between
+     * the two, where the token issuer settles the claims.
      */
-    handle(request: SimCognitoAuthRequest): SimCognitoAuthenticationOutput;
+    handle(request: SimCognitoAuthRequest): Promise<SimCognitoAuthenticationOutput>;
 }
 export {};
 //# sourceMappingURL=sim-cognito-password-sign-in.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-password-sign-in.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-password-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-password-sign-in.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAE/F,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAC9F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;CACpD;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;CAC/C;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,YAAY,UAAU,EAAE,kCAAkC,EAIzD;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,8BAA8B,CAiBrE;CACF"}
+{"version":3,"file":"sim-cognito-password-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-password-sign-in.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAE/F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AAE5G,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAC9F,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAE9C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,YAAY,UAAU,EAAE,kCAAkC,EAKzD;IAED;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,8BAA8B,CAAC,CA0CzC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-password-sign-in.js

@@ -1,4 +1,5 @@
-import { requireSimCognitoSignIn, requireSimCognitoSignInUser, } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { requireSimCognitoConfirmed, requireSimCognitoSignIn, requireSimCognitoSignInUser, } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
 import { SimCognitoAuthenticationResult } from "./sim-cognito-authentication-result.js";
 /**
  * Signing a user in with a username and password.
@@ -13,27 +14,61 @@ export class SimCognitoPasswordSignIn {
     authResolver;
     tokenIssuer;
     challenge;
+    triggers;
     result = new SimCognitoAuthenticationResult();
     constructor(properties) {
         this.authResolver = properties.authResolver;
         this.tokenIssuer = properties.tokenIssuer;
         this.challenge = properties.challenge;
+        this.triggers = properties.triggers;
     }
     /**
      * Sign the user in, or answer with the challenge it has to get past first.
+     *
+     * The pool's `PreAuthentication` trigger runs once the user is known and
+     * before its password is checked, which is the order real Cognito runs it in:
+     * the trigger is given the user to decide about, and deciding is what it is
+     * for, so a wrong password reaches it too.
+     *
+     * `PostAuthentication` runs only where tokens were issued. A user answered
+     * with the `NEW_PASSWORD_REQUIRED` challenge has not signed in yet, and runs
+     * it when it answers the challenge instead. `PreTokenGeneration` runs between
+     * the two, where the token issuer settles the claims.
      */
-    handle(request) {
-        const { pool, client, parameters } = request;
+    async handle(request) {
+        const { pool, client, parameters, clientMetadata } = request;
         const username = this.authResolver.username(client, parameters);
         const user = requireSimCognitoSignInUser(pool, client, username);
+        await this.triggers.preAuthentication({
+            pool,
+            client,
+            user,
+            clientMetadata,
+        });
         requireSimCognitoSignIn(user, parameters.require("PASSWORD"));
+        requireSimCognitoConfirmed(user);
         if (user.status.mustChangePassword) {
             return this.challenge.issue({ pool, clientId: client.id, user });
         }
-        return {
+        // `ClientMetadata` reaches PreAuthentication and PostAuthentication, and
+        // not the token trigger: real Cognito does not pass an InitiateAuth or
+        // AdminInitiateAuth request's on to that one.
+        const authenticated = {
             $metadata: {},
-            AuthenticationResult: this.result.of(this.tokenIssuer.issue({ pool, client, user })),
+            AuthenticationResult: this.result.of(await this.tokenIssuer.issue({
+                pool,
+                client,
+                user,
+                occasion: SimCognitoTriggerOccasion.tokenGeneration,
+            })),
         };
+        await this.triggers.postAuthentication({
+            pool,
+            client,
+            user,
+            clientMetadata,
+        });
+        return authenticated;
     }
 }
 //# sourceMappingURL=sim-cognito-password-sign-in.js.map

package/dist/service/cognito/command/auth/sim-cognito-password-sign-in.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-password-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-password-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAIrD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAqBxF;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAClB,YAAY,CAAyB;IACrC,WAAW,CAAwB;IACnC,SAAS,CAAiC;IAC1C,MAAM,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAE/D,YAAY,UAA8C;QACxD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAA8B;QACnC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAE9D,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,OAAO;YACL,SAAS,EAAE,EAAE;YACb,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAClC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAC/C;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-password-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-password-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,6CAA6C,CAAC;AAIrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AAEpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AA4BxF;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAClB,YAAY,CAAyB;IACrC,WAAW,CAAwB;IACnC,SAAS,CAAiC;IAC1C,QAAQ,CAA6B;IACrC,MAAM,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAE/D,YAAY,UAA8C;QACxD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,MAAM,CACV,OAA8B;QAE9B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEjE,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACpC,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;QAEH,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,0BAA0B,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,8CAA8C;QAC9C,MAAM,aAAa,GAAG;YACpB,SAAS,EAAE,EAAE;YACb,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAClC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;gBAC3B,IAAI;gBACJ,MAAM;gBACN,IAAI;gBACJ,QAAQ,EAAE,yBAAyB,CAAC,eAAe;aACpD,CAAC,CACH;SACF,CAAC;QAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACrC,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;QAEH,OAAO,aAAa,CAAC;IACvB,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-refresh-sign-in.d.ts

@@ -13,6 +13,10 @@ interface SimCognitoRefreshSignInProperties {
  * it is, which is why one presented to another app client is refused. Nothing
  * new comes back with the tokens, because real Cognito issues no new refresh
  * token here, so a client keeps the one it has until that expires.
+ *
+ * The pool's `PreTokenGeneration` trigger runs for the reissued tokens, as it
+ * does on real Cognito, so a claim it changed since the sign-in is on the token
+ * a refresh answers with rather than being stale for the life of the session.
  */
 export declare class SimCognitoRefreshSignIn {
     private readonly tokenIssuer;
@@ -22,7 +26,7 @@ export declare class SimCognitoRefreshSignIn {
     /**
      * Refresh a session, or refuse the token it was asked for with.
      */
-    handle(request: SimCognitoAuthRequest): SimCognitoAuthenticationOutput;
+    handle(request: SimCognitoAuthRequest): Promise<SimCognitoAuthenticationOutput>;
 }
 export {};
 //# sourceMappingURL=sim-cognito-refresh-sign-in.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-refresh-sign-in.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-refresh-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-refresh-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAGpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAG/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,iCAAiC;IACzC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,YAAY,UAAU,EAAE,iCAAiC,EAGxD;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,8BAA8B,CA4BrE;CACF"}
+{"version":3,"file":"sim-cognito-refresh-sign-in.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-refresh-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAGpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAI/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAExE,UAAU,iCAAiC;IACzC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAE/D,YAAY,UAAU,EAAE,iCAAiC,EAGxD;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,8BAA8B,CAAC,CAoCzC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-refresh-sign-in.js

@@ -1,5 +1,6 @@
 import { requireSimCognitoSecretHash } from "../../user-pool/auth/sim-cognito-secret-hash.js";
 import { requireSimCognitoEnabled } from "../../user-pool/auth/sim-cognito-sign-in.js";
+import { SimCognitoTriggerOccasion } from "../../user-pool/trigger/sim-cognito-trigger-occasion.js";
 import { requireSimCognitoUsername } from "../../user-pool/user/sim-cognito-username.js";
 import { SimCognitoAuthenticationResult } from "./sim-cognito-authentication-result.js";
 /**
@@ -9,6 +10,10 @@ import { SimCognitoAuthenticationResult } from "./sim-cognito-authentication-res
  * it is, which is why one presented to another app client is refused. Nothing
  * new comes back with the tokens, because real Cognito issues no new refresh
  * token here, so a client keeps the one it has until that expires.
+ *
+ * The pool's `PreTokenGeneration` trigger runs for the reissued tokens, as it
+ * does on real Cognito, so a claim it changed since the sign-in is on the token
+ * a refresh answers with rather than being stale for the life of the session.
  */
 export class SimCognitoRefreshSignIn {
     tokenIssuer;
@@ -21,7 +26,7 @@ export class SimCognitoRefreshSignIn {
     /**
      * Refresh a session, or refuse the token it was asked for with.
      */
-    handle(request) {
+    async handle(request) {
         const { pool, client, parameters } = request;
         const refreshToken = pool.auth.requireRefreshToken({
             value: parameters.require("REFRESH_TOKEN"),
@@ -33,9 +38,17 @@ export class SimCognitoRefreshSignIn {
         requireSimCognitoSecretHash(refreshToken.username, client, parameters.find("SECRET_HASH"));
         const user = pool.requireUser(requireSimCognitoUsername(refreshToken.username));
         requireSimCognitoEnabled(user);
+        // A refresh runs through `InitiateAuth`, whose `ClientMetadata` real
+        // Cognito does not pass to the token trigger, so none travels with these
+        // tokens.
         return {
             $metadata: {},
-            AuthenticationResult: this.result.of(this.tokenIssuer.reissue({ pool, client, user })),
+            AuthenticationResult: this.result.of(await this.tokenIssuer.reissue({
+                pool,
+                client,
+                user,
+                occasion: SimCognitoTriggerOccasion.refreshTokenGeneration,
+            })),
         };
     }
 }

package/dist/service/cognito/command/auth/sim-cognito-refresh-sign-in.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-refresh-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-refresh-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAEvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AASxF;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IACjB,WAAW,CAAwB;IACnC,KAAK,CAAW;IAChB,MAAM,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAE/D,YAAY,UAA6C;QACvD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAA8B;QACnC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;YACjD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC;YAC1C,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,yEAAyE;QACzE,qEAAqE;QACrE,2BAA2B,CACzB,YAAY,CAAC,QAAQ,EACrB,MAAM,EACN,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAC/B,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAC3B,yBAAyB,CAAC,YAAY,CAAC,QAAQ,CAAC,CACjD,CAAC;QAEF,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAE/B,OAAO;YACL,SAAS,EAAE,EAAE;YACb,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAClC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACjD;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-refresh-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-refresh-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iDAAiD,CAAC;AAC9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAEvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AASxF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,uBAAuB;IACjB,WAAW,CAAwB;IACnC,KAAK,CAAW;IAChB,MAAM,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAE/D,YAAY,UAA6C;QACvD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAA8B;QAE9B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;YACjD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC;YAC1C,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,yEAAyE;QACzE,qEAAqE;QACrE,2BAA2B,CACzB,YAAY,CAAC,QAAQ,EACrB,MAAM,EACN,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAC/B,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAC3B,yBAAyB,CAAC,YAAY,CAAC,QAAQ,CAAC,CACjD,CAAC;QAEF,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAE/B,qEAAqE;QACrE,yEAAyE;QACzE,UAAU;QACV,OAAO;YACL,SAAS,EAAE,EAAE;YACb,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAClC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;gBAC7B,IAAI;gBACJ,MAAM;gBACN,IAAI;gBACJ,QAAQ,EAAE,yBAAyB,CAAC,sBAAsB;aAC3D,CAAC,CACH;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-respond-to-challenge.d.ts

@@ -20,7 +20,7 @@ export declare class SimCognitoRespondToChallenge {
     /**
      * Answer a challenge.
      */
-    handle(command: SimRespondToAuthChallengeCommand): SimRespondToAuthChallengeCommandOutput;
+    handle(command: SimRespondToAuthChallengeCommand): Promise<SimRespondToAuthChallengeCommandOutput>;
 }
 export {};
 //# sourceMappingURL=sim-cognito-respond-to-challenge.d.ts.map

package/dist/service/cognito/command/auth/sim-cognito-respond-to-challenge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-respond-to-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-respond-to-challenge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,OAAO,KAAK,EACV,gCAAgC,EAChC,sCAAsC,EACvC,MAAM,mBAAmB,CAAC;AAE3B,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;CACrD;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA0C;IAE7E,YAAY,UAAU,EAAE,sCAAsC,EAG7D;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,gCAAgC,GACxC,sCAAsC,CAgBxC;CACF"}
+{"version":3,"file":"sim-cognito-respond-to-challenge.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-respond-to-challenge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAE7E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAE5F,OAAO,KAAK,EACV,gCAAgC,EAChC,sCAAsC,EACvC,MAAM,mBAAmB,CAAC;AAE3B,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;CACrD;AAED;;;;;;GAMG;AACH,qBAAa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA0C;IAE7E,YAAY,UAAU,EAAE,sCAAsC,EAG7D;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,sCAAsC,CAAC,CAiBjD;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-respond-to-challenge.js

@@ -19,16 +19,17 @@ export class SimCognitoRespondToChallenge {
     /**
      * Answer a challenge.
      */
-    handle(command) {
+    async handle(command) {
         const { input } = command;
         const { pool, client } = this.authResolver.client(input.ClientId);
         this.unsimulatedOptions.refuseInResponse(input);
         requireSimCognitoNewPasswordChallenge(input.ChallengeName);
-        return this.newPassword.handle({
+        return await this.newPassword.handle({
             pool,
             client,
             parameters: new SimCognitoAuthParameters("ChallengeResponses", input.ChallengeResponses),
             session: input.Session,
+            clientMetadata: input.ClientMetadata,
         });
     }
 }

package/dist/service/cognito/command/auth/sim-cognito-respond-to-challenge.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-respond-to-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-respond-to-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,EAAE,qCAAqC,EAAE,MAAM,iCAAiC,CAAC;AAExF,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAW7F;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,YAAY,CAAyB;IACrC,WAAW,CAAgC;IAC3C,kBAAkB,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAE7E,YAAY,UAAkD;QAC5D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,MAAM,CACJ,OAAyC;QAEzC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAElE,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAChD,qCAAqC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAE3D,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YAC7B,IAAI;YACJ,MAAM;YACN,UAAU,EAAE,IAAI,wBAAwB,CACtC,oBAAoB,EACpB,KAAK,CAAC,kBAAkB,CACzB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-respond-to-challenge.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-respond-to-challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,EAAE,qCAAqC,EAAE,MAAM,iCAAiC,CAAC;AAExF,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAW7F;;;;;;GAMG;AACH,MAAM,OAAO,4BAA4B;IACtB,YAAY,CAAyB;IACrC,WAAW,CAAgC;IAC3C,kBAAkB,GAAG,IAAI,gCAAgC,EAAE,CAAC;IAE7E,YAAY,UAAkD;QAC5D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAyC;QAEzC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAElE,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAChD,qCAAqC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAE3D,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YACnC,IAAI;YACJ,MAAM;YACN,UAAU,EAAE,IAAI,wBAAwB,CACtC,oBAAoB,EACpB,KAAK,CAAC,kBAAkB,CACzB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.d.ts

@@ -6,6 +6,11 @@ import type { SimAdminInitiateAuthCommandInput, SimAdminRespondToAuthChallengeCo
  * can be honoured here, so a request carrying one is refused rather than
  * signed in as if it had not.
  *
+ * `ClientMetadata` is not among them. It is what a sign-in passes to a Lambda
+ * trigger, and the pool's triggers now receive it, so a request carrying it is
+ * honoured rather than refused. A pool with no trigger to hand it to ignores it,
+ * which is what real Cognito does with it too.
+ *
  * The admin operations and the client ones name the caller's device and
  * address differently, `ContextData` against `UserContextData`, so each
  * refusal names the input the caller actually wrote.

package/dist/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-unsimulated-auth-options.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gCAAgC,EAChC,0CAA0C,EAC1C,2BAA2B,EAC3B,qCAAqC,EACtC,MAAM,mBAAmB,CAAC;AAW3B;;;;;;;;;;GAUG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAE9B;IACF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAE5B;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkD;IAC7E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAEvB;IAEF,OAAO,CAAC,MAAM,CAAC,YAAY;IAgB3B;;OAEG;IACH,qBAAqB,CAAC,KAAK,EAAE,gCAAgC,GAAG,IAAI,CAYnE;IAED;;;OAGG;IACH,qBAAqB,CACnB,KAAK,EAAE,0CAA0C,GAChD,IAAI,CAON;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,GAAG,IAAI,CAYzD;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,qCAAqC,GAAG,IAAI,CAOnE;CACF"}
+{"version":3,"file":"sim-cognito-unsimulated-auth-options.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gCAAgC,EAChC,0CAA0C,EAC1C,2BAA2B,EAC3B,qCAAqC,EACtC,MAAM,mBAAmB,CAAC;AAU3B;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAE9B;IACF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAE5B;IACF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkD;IAC7E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAEvB;IAEF,OAAO,CAAC,MAAM,CAAC,YAAY;IAW3B;;OAEG;IACH,qBAAqB,CAAC,KAAK,EAAE,gCAAgC,GAAG,IAAI,CAYnE;IAED;;;OAGG;IACH,qBAAqB,CACnB,KAAK,EAAE,0CAA0C,GAChD,IAAI,CAON;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,GAAG,IAAI,CAYzD;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,qCAAqC,GAAG,IAAI,CAOnE;CACF"}

package/dist/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.js

@@ -6,6 +6,11 @@ import { SimCognitoUnsimulatedInput } from "../sim-cognito-unsimulated-input.js"
  * can be honoured here, so a request carrying one is refused rather than
  * signed in as if it had not.
  *
+ * `ClientMetadata` is not among them. It is what a sign-in passes to a Lambda
+ * trigger, and the pool's triggers now receive it, so a request carrying it is
+ * honoured rather than refused. A pool with no trigger to hand it to ignores it,
+ * which is what real Cognito does with it too.
+ *
  * The admin operations and the client ones name the caller's device and
  * address differently, `ContextData` against `UserContextData`, so each
  * refusal names the input the caller actually wrote.
@@ -16,7 +21,6 @@ export class SimCognitoUnsimulatedAuthOptions {
     initiation = new SimCognitoUnsimulatedInput("InitiateAuth");
     response = new SimCognitoUnsimulatedInput("RespondToAuthChallenge");
     static refuseShared(unsimulated, input) {
-        unsimulated.refuse("ClientMetadata", input.ClientMetadata, "passing data to a Lambda trigger");
         unsimulated.refuse("AnalyticsMetadata", input.AnalyticsMetadata, "Pinpoint analytics");
     }
     /**

package/dist/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-unsimulated-auth-options.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAiBjF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gCAAgC;IAC1B,eAAe,GAAG,IAAI,0BAA0B,CAC/D,mBAAmB,CACpB,CAAC;IACe,aAAa,GAAG,IAAI,0BAA0B,CAC7D,6BAA6B,CAC9B,CAAC;IACe,UAAU,GAAG,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAC5D,QAAQ,GAAG,IAAI,0BAA0B,CACxD,wBAAwB,CACzB,CAAC;IAEM,MAAM,CAAC,YAAY,CACzB,WAAuC,EACvC,KAAqC;QAErC,WAAW,CAAC,MAAM,CAChB,gBAAgB,EAChB,KAAK,CAAC,cAAc,EACpB,kCAAkC,CACnC,CAAC;QACF,WAAW,CAAC,MAAM,CAChB,mBAAmB,EACnB,KAAK,CAAC,iBAAiB,EACvB,oBAAoB,CACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,KAAuC;QAC3D,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,CAAC,MAAM,CACzB,aAAa,EACb,KAAK,CAAC,WAAW,EACjB,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,MAAM,CACzB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,qBAAqB,CACnB,KAAiD;QAEjD,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,aAAa,CAAC,MAAM,CACvB,aAAa,EACb,KAAK,CAAC,WAAW,EACjB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAkC;QACjD,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,MAAM,CACpB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,CACpB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,wCAAwC,CACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAA4C;QAC3D,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAClB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,gEAAgE,CACjE,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-unsimulated-auth-options.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/auth/sim-cognito-unsimulated-auth-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAgBjF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,gCAAgC;IAC1B,eAAe,GAAG,IAAI,0BAA0B,CAC/D,mBAAmB,CACpB,CAAC;IACe,aAAa,GAAG,IAAI,0BAA0B,CAC7D,6BAA6B,CAC9B,CAAC;IACe,UAAU,GAAG,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAC5D,QAAQ,GAAG,IAAI,0BAA0B,CACxD,wBAAwB,CACzB,CAAC;IAEM,MAAM,CAAC,YAAY,CACzB,WAAuC,EACvC,KAAqC;QAErC,WAAW,CAAC,MAAM,CAChB,mBAAmB,EACnB,KAAK,CAAC,iBAAiB,EACvB,oBAAoB,CACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,KAAuC;QAC3D,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,CAAC,MAAM,CACzB,aAAa,EACb,KAAK,CAAC,WAAW,EACjB,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,MAAM,CACzB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,qBAAqB,CACnB,KAAiD;QAEjD,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,aAAa,CAAC,MAAM,CACvB,aAAa,EACb,KAAK,CAAC,WAAW,EACjB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAkC;QACjD,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,CAAC,MAAM,CACpB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,CACpB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,wCAAwC,CACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAA4C;QAC3D,gCAAgC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAClB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,gEAAgE,CACjE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/client/sim-cognito-unsimulated-client-options.d.ts

@@ -1,16 +1,18 @@
-import type { SimCreateUserPoolClientCommandInput } from "./user-pool-client.command.js";
+import type { SimCognitoUserPoolClientSettingsInput } from "./user-pool-client.command.js";
 /**
- * Refuses the CreateUserPoolClient inputs this simulation does not model.
+ * Refuses the app client inputs this simulation does not model.
  *
  * Storing any of them would suggest an app client that works here would work
- * there.
+ * there. `CreateUserPoolClient` and `UpdateUserPoolClient` take the same
+ * settings, so both refuse the same ones and each says its own name.
  */
 export declare class SimCognitoUnsimulatedUserPoolClientOptions {
     private readonly unsimulated;
     private readonly managedLogin;
+    constructor(operation: string);
     /**
      * Refuse a request carrying an input this simulation cannot honour.
      */
-    refuseIn(input: SimCreateUserPoolClientCommandInput): void;
+    refuseIn(input: SimCognitoUserPoolClientSettingsInput): void;
 }
 //# sourceMappingURL=sim-cognito-unsimulated-client-options.d.ts.map

package/dist/service/cognito/command/client/sim-cognito-unsimulated-client-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-unsimulated-client-options.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-unsimulated-client-options.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAEzF;;;;;GAKG;AACH,qBAAa,0CAA0C;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAE1B;IACF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA2C;IAExE;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,mCAAmC,GAAG,IAAI,CA4CzD;CACF"}
+{"version":3,"file":"sim-cognito-unsimulated-client-options.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-unsimulated-client-options.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+BAA+B,CAAC;AAE3F;;;;;;GAMG;AACH,qBAAa,0CAA0C;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoC;IAEjE,YAAY,SAAS,EAAE,MAAM,EAG5B;IAED;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,qCAAqC,GAAG,IAAI,CA4C3D;CACF"}

package/dist/service/cognito/command/client/sim-cognito-unsimulated-client-options.js

@@ -1,14 +1,19 @@
 import { SimCognitoUnsimulatedInput } from "../sim-cognito-unsimulated-input.js";
 import { SimCognitoUnsimulatedManagedLogin } from "./sim-cognito-unsimulated-managed-login.js";
 /**
- * Refuses the CreateUserPoolClient inputs this simulation does not model.
+ * Refuses the app client inputs this simulation does not model.
  *
  * Storing any of them would suggest an app client that works here would work
- * there.
+ * there. `CreateUserPoolClient` and `UpdateUserPoolClient` take the same
+ * settings, so both refuse the same ones and each says its own name.
  */
 export class SimCognitoUnsimulatedUserPoolClientOptions {
-    unsimulated = new SimCognitoUnsimulatedInput("CreateUserPoolClient");
-    managedLogin = new SimCognitoUnsimulatedManagedLogin();
+    unsimulated;
+    managedLogin;
+    constructor(operation) {
+        this.unsimulated = new SimCognitoUnsimulatedInput(operation);
+        this.managedLogin = new SimCognitoUnsimulatedManagedLogin(operation);
+    }
     /**
      * Refuse a request carrying an input this simulation cannot honour.
      */

package/dist/service/cognito/command/client/sim-cognito-unsimulated-client-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-unsimulated-client-options.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-unsimulated-client-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAG/F;;;;;GAKG;AACH,MAAM,OAAO,0CAA0C;IACpC,WAAW,GAAG,IAAI,0BAA0B,CAC3D,sBAAsB,CACvB,CAAC;IACe,YAAY,GAAG,IAAI,iCAAiC,EAAE,CAAC;IAExE;;OAEG;IACH,QAAQ,CAAC,KAA0C;QACjD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAElC,IAAI,CAAC,WAAW,CAAC,YAAY,CAC3B,uBAAuB,EACvB,KAAK,CAAC,qBAAqB,EAC3B,IAAI,EACJ,kBAAkB,CACnB,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,cAAc,EACd,KAAK,CAAC,YAAY,EAClB,iDAAiD,CAClD,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,wBAAwB,EACxB,KAAK,CAAC,sBAAsB,EAC5B,2BAA2B,CAC5B,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,qBAAqB,EACrB,KAAK,CAAC,mBAAmB,EACzB,qCAAqC,CACtC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,0CAA0C,EAC1C,KAAK,CAAC,wCAAwC,EAC9C,gCAAgC,CACjC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,sBAAsB,EACtB,KAAK,CAAC,oBAAoB,EAC1B,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,gBAAgB,EAChB,KAAK,CAAC,cAAc,EACpB,kCAAkC,CACnC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,kCAAkC,CACnC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-unsimulated-client-options.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-unsimulated-client-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAG/F;;;;;;GAMG;AACH,MAAM,OAAO,0CAA0C;IACpC,WAAW,CAA6B;IACxC,YAAY,CAAoC;IAEjE,YAAY,SAAiB;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,YAAY,GAAG,IAAI,iCAAiC,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAA4C;QACnD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAElC,IAAI,CAAC,WAAW,CAAC,YAAY,CAC3B,uBAAuB,EACvB,KAAK,CAAC,qBAAqB,EAC3B,IAAI,EACJ,kBAAkB,CACnB,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,cAAc,EACd,KAAK,CAAC,YAAY,EAClB,iDAAiD,CAClD,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,wBAAwB,EACxB,KAAK,CAAC,sBAAsB,EAC5B,2BAA2B,CAC5B,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,qBAAqB,EACrB,KAAK,CAAC,mBAAmB,EACzB,qCAAqC,CACtC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,0CAA0C,EAC1C,KAAK,CAAC,wCAAwC,EAC9C,gCAAgC,CACjC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,sBAAsB,EACtB,KAAK,CAAC,oBAAoB,EAC1B,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,gBAAgB,EAChB,KAAK,CAAC,cAAc,EACpB,kCAAkC,CACnC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,iBAAiB,EACjB,KAAK,CAAC,eAAe,EACrB,kCAAkC,CACnC,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/client/sim-cognito-unsimulated-managed-login.d.ts

@@ -1,4 +1,4 @@
-import type { SimCreateUserPoolClientCommandInput } from "./user-pool-client.command.js";
+import type { SimCognitoUserPoolClientSettingsInput } from "./user-pool-client.command.js";
 /**
  * Refuses the managed login inputs of an app client.
  *
@@ -8,10 +8,11 @@ import type { SimCreateUserPoolClientCommandInput } from "./user-pool-client.com
  */
 export declare class SimCognitoUnsimulatedManagedLogin {
     private readonly unsimulated;
+    constructor(operation: string);
     /**
      * Refuse a request carrying a managed login setting.
      */
-    refuseIn(input: SimCreateUserPoolClientCommandInput): void;
+    refuseIn(input: SimCognitoUserPoolClientSettingsInput): void;
     /**
      * Refuse a client federating to an external identity provider.
      *

package/dist/service/cognito/command/client/sim-cognito-unsimulated-managed-login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-unsimulated-managed-login.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-unsimulated-managed-login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAUzF;;;;;;GAMG;AACH,qBAAa,iCAAiC;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAE1B;IAEF;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,mCAAmC,GAAG,IAAI,CAkCzD;IAED;;;;;OAKG;IACH,OAAO,CAAC,gCAAgC;CAsBzC"}
+{"version":3,"file":"sim-cognito-unsimulated-managed-login.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-unsimulated-managed-login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+BAA+B,CAAC;AAU3F;;;;;;GAMG;AACH,qBAAa,iCAAiC;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IAEzD,YAAY,SAAS,EAAE,MAAM,EAE5B;IAED;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,qCAAqC,GAAG,IAAI,CAkC3D;IAED;;;;;OAKG;IACH,OAAO,CAAC,gCAAgC;CAkBzC"}

package/dist/service/cognito/command/client/sim-cognito-unsimulated-managed-login.js

@@ -15,7 +15,10 @@ const cognitoIdentityProvider = "COGNITO";
  * settings mean anything here.
  */
 export class SimCognitoUnsimulatedManagedLogin {
-    unsimulated = new SimCognitoUnsimulatedInput("CreateUserPoolClient");
+    unsimulated;
+    constructor(operation) {
+        this.unsimulated = new SimCognitoUnsimulatedInput(operation);
+    }
     /**
      * Refuse a request carrying a managed login setting.
      */
@@ -34,15 +37,12 @@ export class SimCognitoUnsimulatedManagedLogin {
      * A client supporting only `COGNITO` is asking for the pool's own users,
      * which is what this simulation has, so that one is allowed through.
      */
-    refuseSupportedIdentityProviders(providers) {
-        if (providers === undefined) {
-            return;
-        }
+    refuseSupportedIdentityProviders(providers = []) {
         const federated = providers.filter((provider) => provider !== cognitoIdentityProvider);
         if (federated.length === 0) {
             return;
         }
-        throw new SimCognitoInvalidParameterException(`CreateUserPoolClient SupportedIdentityProviders ` +
+        throw new SimCognitoInvalidParameterException(`${this.unsimulated.operation} SupportedIdentityProviders ` +
             `'${federated.join(", ")}' is not simulated: federated sign-in ` +
             `happens at the provider rather than in this simulation. Only ` +
             `'${cognitoIdentityProvider}' is supported.`);

package/dist/service/cognito/command/client/sim-cognito-unsimulated-managed-login.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-unsimulated-managed-login.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-unsimulated-managed-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAGjF;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,OAAO,iCAAiC;IAC3B,WAAW,GAAG,IAAI,0BAA0B,CAC3D,sBAAsB,CACvB,CAAC;IAEF;;OAEG;IACH,QAAQ,CAAC,KAA0C;QACjD,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAExE,IAAI,CAAC,WAAW,CAAC,YAAY,CAC3B,iCAAiC,EACjC,KAAK,CAAC,+BAA+B,EACrC,KAAK,EACL,8CAA8C,CAC/C,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,mBAAmB,EACnB,KAAK,CAAC,iBAAiB,EACvB,oCAAoC,CACrC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,oBAAoB,EACpB,KAAK,CAAC,kBAAkB,EACxB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,cAAc,EACd,KAAK,CAAC,YAAY,EAClB,yBAAyB,CAC1B,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,YAAY,EACZ,KAAK,CAAC,UAAU,EAChB,yBAAyB,CAC1B,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,oBAAoB,EACpB,KAAK,CAAC,kBAAkB,EACxB,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,gCAAgC,CACtC,SAAwC;QAExC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAChC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,uBAAuB,CACnD,CAAC;QAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,kDAAkD;YAChD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;YAChE,+DAA+D;YAC/D,IAAI,uBAAuB,iBAAiB,CAC/C,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-unsimulated-managed-login.js","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-unsimulated-managed-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAGjF;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,OAAO,iCAAiC;IAC3B,WAAW,CAA6B;IAEzD,YAAY,SAAiB;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAA4C;QACnD,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAExE,IAAI,CAAC,WAAW,CAAC,YAAY,CAC3B,iCAAiC,EACjC,KAAK,CAAC,+BAA+B,EACrC,KAAK,EACL,8CAA8C,CAC/C,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,mBAAmB,EACnB,KAAK,CAAC,iBAAiB,EACvB,oCAAoC,CACrC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,oBAAoB,EACpB,KAAK,CAAC,kBAAkB,EACxB,cAAc,CACf,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,cAAc,EACd,KAAK,CAAC,YAAY,EAClB,yBAAyB,CAC1B,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,YAAY,EACZ,KAAK,CAAC,UAAU,EAChB,yBAAyB,CAC1B,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,CACrB,oBAAoB,EACpB,KAAK,CAAC,kBAAkB,EACxB,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,gCAAgC,CACtC,SAAS,GAAsB,EAAE;QAEjC,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAChC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,uBAAuB,CACnD,CAAC;QAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,mCAAmC,CAC3C,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,8BAA8B;YACzD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;YAChE,+DAA+D;YAC/D,IAAI,uBAAuB,iBAAiB,CAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/command/client/sim-cognito-user-pool-client-commands.d.ts

@@ -2,7 +2,7 @@ import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
 import type { SimCognitoUserPoolClientFactory } from "../../user-pool/client/sim-cognito-user-pool-client-factory.js";
 import type { SimCognitoUserPoolStore } from "../../user-pool/sim-cognito-user-pool-store.js";
 import type { SimCognitoAuthorizer } from "../authorize/sim-cognito-authorizer.js";
-import type { SimCreateUserPoolClientCommand, SimCreateUserPoolClientCommandOutput, SimDeleteUserPoolClientCommand, SimDeleteUserPoolClientCommandOutput, SimDescribeUserPoolClientCommand, SimDescribeUserPoolClientCommandOutput } from "./user-pool-client.command.js";
+import type { SimCreateUserPoolClientCommand, SimCreateUserPoolClientCommandOutput, SimDeleteUserPoolClientCommand, SimDeleteUserPoolClientCommandOutput, SimDescribeUserPoolClientCommand, SimDescribeUserPoolClientCommandOutput, SimUpdateUserPoolClientCommand, SimUpdateUserPoolClientCommandOutput } from "./user-pool-client.command.js";
 interface SimCognitoUserPoolClientCommandsProperties {
     readonly pools: SimCognitoUserPoolStore;
     readonly clientFactory: SimCognitoUserPoolClientFactory;
@@ -12,7 +12,8 @@ interface SimCognitoCommandOptions {
     readonly caller?: SimAwsCaller;
 }
 /**
- * The commands that create, describe and delete a simulated app client.
+ * The commands that create, describe, change and delete a simulated app
+ * client.
  *
  * Each one authorizes against the pool's ARN, because an app client has no
  * ARN of its own.
@@ -22,12 +23,31 @@ export declare class SimCognitoUserPoolClientCommands {
     private readonly clientFactory;
     private readonly authorizer;
     private readonly view;
-    private readonly unsimulatedOptions;
+    private readonly unsimulatedCreateOptions;
+    private readonly unsimulatedUpdateOptions;
     constructor(properties: SimCognitoUserPoolClientCommandsProperties);
     /**
      * Create an app client in a pool.
      */
     create(command: SimCreateUserPoolClientCommand, options?: SimCognitoCommandOptions): SimCreateUserPoolClientCommandOutput;
+    /**
+     * Change an app client's settings.
+     *
+     * The settings are replaced by what the request holds, as real Cognito
+     * replaces them, so one the request leaves out goes back to the default
+     * `CreateUserPoolClient` would have given it. A request naming only
+     * `ClientName` therefore sends the authentication flows and the token
+     * lifetimes back to their defaults.
+     *
+     * The client's secret is not a setting and survives untouched.
+     * `UpdateUserPoolClient` has no `GenerateSecret` input on real Cognito, so
+     * a client created without a secret never gains one.
+     *
+     * `ClientName` is the one setting an omitted request keeps rather than
+     * resets. A client has to have a name, and `CreateUserPoolClient` requires
+     * one, so there is no default for an update to go back to.
+     */
+    update(command: SimUpdateUserPoolClientCommand, options?: SimCognitoCommandOptions): SimUpdateUserPoolClientCommandOutput;
     /**
      * Describe an app client's settings, including its secret.
      */

package/dist/service/cognito/command/client/sim-cognito-user-pool-client-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-user-pool-client-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,gEAAgE,CAAC;AAItH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAGnF,OAAO,KAAK,EACV,8BAA8B,EAC9B,oCAAoC,EACpC,8BAA8B,EAC9B,oCAAoC,EACpC,gCAAgC,EAChC,sCAAsC,EACvC,MAAM,+BAA+B,CAAC;AAEvC,UAAU,0CAA0C;IAClD,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,+BAA+B,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;CAC3C;AAED,UAAU,wBAAwB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;GAKG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAChD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsC;IAC3D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CACgB;IAEnD,YAAY,UAAU,EAAE,0CAA0C,EAIjE;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,8BAA8B,EACvC,OAAO,CAAC,EAAE,wBAAwB,GACjC,oCAAoC,CAuBtC;IAED;;OAEG;IACH,QAAQ,CACN,OAAO,EAAE,gCAAgC,EACzC,OAAO,CAAC,EAAE,wBAAwB,GACjC,sCAAsC,CAaxC;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,8BAA8B,EACvC,OAAO,CAAC,EAAE,wBAAwB,GACjC,oCAAoC,CAYtC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;CAWvB"}
+{"version":3,"file":"sim-cognito-user-pool-client-commands.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/command/client/sim-cognito-user-pool-client-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,gEAAgE,CAAC;AAKtH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AAC9F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAGnF,OAAO,KAAK,EACV,8BAA8B,EAC9B,oCAAoC,EACpC,8BAA8B,EAC9B,oCAAoC,EACpC,gCAAgC,EAChC,sCAAsC,EACtC,8BAA8B,EAC9B,oCAAoC,EACrC,MAAM,+BAA+B,CAAC;AAEvC,UAAU,0CAA0C;IAClD,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,+BAA+B,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;CAC3C;AAED,UAAU,wBAAwB;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;IAChD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsC;IAC3D,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CACgC;IACzE,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CACgC;IAEzE,YAAY,UAAU,EAAE,0CAA0C,EAIjE;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,8BAA8B,EACvC,OAAO,CAAC,EAAE,wBAAwB,GACjC,oCAAoC,CAmBtC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CACJ,OAAO,EAAE,8BAA8B,EACvC,OAAO,CAAC,EAAE,wBAAwB,GACjC,oCAAoC,CAsBtC;IAED;;OAEG;IACH,QAAQ,CACN,OAAO,EAAE,gCAAgC,EACzC,OAAO,CAAC,EAAE,wBAAwB,GACjC,sCAAsC,CAaxC;IAED;;OAEG;IACH,MAAM,CACJ,OAAO,EAAE,8BAA8B,EACvC,OAAO,CAAC,EAAE,wBAAwB,GACjC,oCAAoC,CAYtC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;CAWvB"}

package/dist/service/cognito/command/client/sim-cognito-user-pool-client-commands.js

@@ -1,9 +1,11 @@
 import { requireSimCognitoUserPoolClientId } from "../../user-pool/client/sim-cognito-user-pool-client-id.js";
+import { SimCognitoUserPoolClientSettings } from "../../user-pool/client/sim-cognito-user-pool-client-settings.js";
 import { requireSimCognitoUserPoolId } from "../../user-pool/sim-cognito-user-pool-id.js";
 import { SimCognitoUnsimulatedUserPoolClientOptions } from "./sim-cognito-unsimulated-client-options.js";
 import { SimCognitoUserPoolClientView } from "./sim-cognito-user-pool-client-view.js";
 /**
- * The commands that create, describe and delete a simulated app client.
+ * The commands that create, describe, change and delete a simulated app
+ * client.
  *
  * Each one authorizes against the pool's ARN, because an app client has no
  * ARN of its own.
@@ -13,7 +15,8 @@ export class SimCognitoUserPoolClientCommands {
     clientFactory;
     authorizer;
     view = new SimCognitoUserPoolClientView();
-    unsimulatedOptions = new SimCognitoUnsimulatedUserPoolClientOptions();
+    unsimulatedCreateOptions = new SimCognitoUnsimulatedUserPoolClientOptions("CreateUserPoolClient");
+    unsimulatedUpdateOptions = new SimCognitoUnsimulatedUserPoolClientOptions("UpdateUserPoolClient");
     constructor(properties) {
         this.pools = properties.pools;
         this.clientFactory = properties.clientFactory;
@@ -25,19 +28,43 @@ export class SimCognitoUserPoolClientCommands {
     create(command, options) {
         const { input } = command;
         const pool = this.authorizedPool("cognito-idp:CreateUserPoolClient", input.UserPoolId, options);
-        this.unsimulatedOptions.refuseIn(input);
+        this.unsimulatedCreateOptions.refuseIn(input);
         const client = this.clientFactory.make({
             pool,
-            name: input.ClientName,
             generateSecret: input.GenerateSecret,
-            explicitAuthFlows: input.ExplicitAuthFlows,
-            preventUserExistenceErrors: input.PreventUserExistenceErrors,
-            tokenValidity: input,
-            unsimulatedSettings: input,
+            settings: new SimCognitoUserPoolClientSettings(input),
         });
         pool.addClient(client);
         return { $metadata: {}, UserPoolClient: this.view.describe(client) };
     }
+    /**
+     * Change an app client's settings.
+     *
+     * The settings are replaced by what the request holds, as real Cognito
+     * replaces them, so one the request leaves out goes back to the default
+     * `CreateUserPoolClient` would have given it. A request naming only
+     * `ClientName` therefore sends the authentication flows and the token
+     * lifetimes back to their defaults.
+     *
+     * The client's secret is not a setting and survives untouched.
+     * `UpdateUserPoolClient` has no `GenerateSecret` input on real Cognito, so
+     * a client created without a secret never gains one.
+     *
+     * `ClientName` is the one setting an omitted request keeps rather than
+     * resets. A client has to have a name, and `CreateUserPoolClient` requires
+     * one, so there is no default for an update to go back to.
+     */
+    update(command, options) {
+        const { input } = command;
+        const pool = this.authorizedPool("cognito-idp:UpdateUserPoolClient", input.UserPoolId, options);
+        this.unsimulatedUpdateOptions.refuseIn(input);
+        const client = pool.requireClient(requireSimCognitoUserPoolClientId(input.ClientId));
+        client.update(new SimCognitoUserPoolClientSettings({
+            ...input,
+            ClientName: input.ClientName ?? client.name,
+        }));
+        return { $metadata: {}, UserPoolClient: this.view.describe(client) };
+    }
     /**
      * Describe an app client's settings, including its secret.
      */