@vardario/cognito-client 5.0.0 → 5.2.0

package/lib/browser.js

@@ -26,15 +26,15 @@ var COMMON_EXCEPTIONS = [
   "ThrottlingException" /* ThrottlingException */,
   "ValidationError" /* ValidationError */
 ];
-var AssociateSoftwareTokenException = /* @__PURE__ */ ((AssociateSoftwareTokenException2) => {
-  AssociateSoftwareTokenException2["ConcurrentModificationException"] = "ConcurrentModificationException";
-  AssociateSoftwareTokenException2["ForbiddenException"] = "ForbiddenException";
-  AssociateSoftwareTokenException2["InternalErrorException"] = "InternalErrorException";
-  AssociateSoftwareTokenException2["InvalidParameterException"] = "InvalidParameterException";
-  AssociateSoftwareTokenException2["NotAuthorizedException"] = "NotAuthorizedException";
-  AssociateSoftwareTokenException2["ResourceNotFoundException"] = "ResourceNotFoundException";
-  AssociateSoftwareTokenException2["SoftwareTokenMFANotFoundException"] = "SoftwareTokenMFANotFoundException";
-  return AssociateSoftwareTokenException2;
+var AssociateSoftwareTokenException = /* @__PURE__ */ ((AssociateSoftwareTokenException3) => {
+  AssociateSoftwareTokenException3["ConcurrentModificationException"] = "ConcurrentModificationException";
+  AssociateSoftwareTokenException3["ForbiddenException"] = "ForbiddenException";
+  AssociateSoftwareTokenException3["InternalErrorException"] = "InternalErrorException";
+  AssociateSoftwareTokenException3["InvalidParameterException"] = "InvalidParameterException";
+  AssociateSoftwareTokenException3["NotAuthorizedException"] = "NotAuthorizedException";
+  AssociateSoftwareTokenException3["ResourceNotFoundException"] = "ResourceNotFoundException";
+  AssociateSoftwareTokenException3["SoftwareTokenMFANotFoundException"] = "SoftwareTokenMFANotFoundException";
+  return AssociateSoftwareTokenException3;
 })(AssociateSoftwareTokenException || {});
 var ChangePasswordException = /* @__PURE__ */ ((ChangePasswordException3) => {
   ChangePasswordException3["ForbiddenException"] = "ForbiddenException";
@@ -158,17 +158,17 @@ var ForgotPasswordException = /* @__PURE__ */ ((ForgotPasswordException3) => {
   ForgotPasswordException3["UserNotFoundException"] = "UserNotFoundException";
   return ForgotPasswordException3;
 })(ForgotPasswordException || {});
-var GetUserException = /* @__PURE__ */ ((GetUserException2) => {
-  GetUserException2["ForbiddenException"] = "ForbiddenException";
-  GetUserException2["InternalErrorException"] = "InternalErrorException";
-  GetUserException2["InvalidParameterException"] = "InvalidParameterException";
-  GetUserException2["NotAuthorizedException"] = "NotAuthorizedException";
-  GetUserException2["PasswordResetRequiredException"] = "PasswordResetRequiredException";
-  GetUserException2["ResourceNotFoundException"] = "ResourceNotFoundException";
-  GetUserException2["TooManyRequestsException"] = "TooManyRequestsException";
-  GetUserException2["UserNotConfirmedException"] = "UserNotConfirmedException";
-  GetUserException2["UserNotFoundException"] = "UserNotFoundException";
-  return GetUserException2;
+var GetUserException = /* @__PURE__ */ ((GetUserException3) => {
+  GetUserException3["ForbiddenException"] = "ForbiddenException";
+  GetUserException3["InternalErrorException"] = "InternalErrorException";
+  GetUserException3["InvalidParameterException"] = "InvalidParameterException";
+  GetUserException3["NotAuthorizedException"] = "NotAuthorizedException";
+  GetUserException3["PasswordResetRequiredException"] = "PasswordResetRequiredException";
+  GetUserException3["ResourceNotFoundException"] = "ResourceNotFoundException";
+  GetUserException3["TooManyRequestsException"] = "TooManyRequestsException";
+  GetUserException3["UserNotConfirmedException"] = "UserNotConfirmedException";
+  GetUserException3["UserNotFoundException"] = "UserNotFoundException";
+  return GetUserException3;
 })(GetUserException || {});
 var GetIdException = /* @__PURE__ */ ((GetIdException2) => {
   GetIdException2["ExternalServiceException"] = "ExternalServiceException";
@@ -283,16 +283,16 @@ var RespondToAuthChallengeException = /* @__PURE__ */ ((RespondToAuthChallengeEx
   RespondToAuthChallengeException3["UserNotFoundException"] = "UserNotFoundException";
   return RespondToAuthChallengeException3;
 })(RespondToAuthChallengeException || {});
-var SetUserMFAPreferenceException = /* @__PURE__ */ ((SetUserMFAPreferenceException2) => {
-  SetUserMFAPreferenceException2["ForbiddenException"] = "ForbiddenException";
-  SetUserMFAPreferenceException2["InternalErrorException"] = "InternalErrorException";
-  SetUserMFAPreferenceException2["InvalidParameterException"] = "InvalidParameterException";
-  SetUserMFAPreferenceException2["NotAuthorizedException"] = "NotAuthorizedException";
-  SetUserMFAPreferenceException2["PasswordResetRequiredException"] = "PasswordResetRequiredException";
-  SetUserMFAPreferenceException2["ResourceNotFoundException"] = "ResourceNotFoundException";
-  SetUserMFAPreferenceException2["UserNotConfirmedException"] = "UserNotConfirmedException";
-  SetUserMFAPreferenceException2["UserNotFoundException"] = "UserNotFoundException";
-  return SetUserMFAPreferenceException2;
+var SetUserMFAPreferenceException = /* @__PURE__ */ ((SetUserMFAPreferenceException3) => {
+  SetUserMFAPreferenceException3["ForbiddenException"] = "ForbiddenException";
+  SetUserMFAPreferenceException3["InternalErrorException"] = "InternalErrorException";
+  SetUserMFAPreferenceException3["InvalidParameterException"] = "InvalidParameterException";
+  SetUserMFAPreferenceException3["NotAuthorizedException"] = "NotAuthorizedException";
+  SetUserMFAPreferenceException3["PasswordResetRequiredException"] = "PasswordResetRequiredException";
+  SetUserMFAPreferenceException3["ResourceNotFoundException"] = "ResourceNotFoundException";
+  SetUserMFAPreferenceException3["UserNotConfirmedException"] = "UserNotConfirmedException";
+  SetUserMFAPreferenceException3["UserNotFoundException"] = "UserNotFoundException";
+  return SetUserMFAPreferenceException3;
 })(SetUserMFAPreferenceException || {});
 var SignUpException = /* @__PURE__ */ ((SignUpException3) => {
   SignUpException3["CodeDeliveryFailureException"] = "CodeDeliveryFailureException";
@@ -378,18 +378,18 @@ var UpdateDeviceStatusException = /* @__PURE__ */ ((UpdateDeviceStatusException2
   UpdateDeviceStatusException2["UserNotFoundException"] = "UserNotFoundException";
   return UpdateDeviceStatusException2;
 })(UpdateDeviceStatusException || {});
-var ListDevicesException = /* @__PURE__ */ ((ListDevicesException2) => {
-  ListDevicesException2["ForbiddenException"] = "ForbiddenException";
-  ListDevicesException2["InternalErrorException"] = "InternalErrorException";
-  ListDevicesException2["InvalidParameterException"] = "InvalidParameterException";
-  ListDevicesException2["InvalidUserPoolConfigurationException"] = "InvalidUserPoolConfigurationException";
-  ListDevicesException2["NotAuthorizedException"] = "NotAuthorizedException";
-  ListDevicesException2["PasswordResetRequiredException"] = "PasswordResetRequiredException";
-  ListDevicesException2["ResourceNotFoundException"] = "ResourceNotFoundException";
-  ListDevicesException2["TooManyRequestsException"] = "TooManyRequestsException";
-  ListDevicesException2["UserNotConfirmedException"] = "UserNotConfirmedException";
-  ListDevicesException2["UserNotFoundException"] = "UserNotFoundException";
-  return ListDevicesException2;
+var ListDevicesException = /* @__PURE__ */ ((ListDevicesException3) => {
+  ListDevicesException3["ForbiddenException"] = "ForbiddenException";
+  ListDevicesException3["InternalErrorException"] = "InternalErrorException";
+  ListDevicesException3["InvalidParameterException"] = "InvalidParameterException";
+  ListDevicesException3["InvalidUserPoolConfigurationException"] = "InvalidUserPoolConfigurationException";
+  ListDevicesException3["NotAuthorizedException"] = "NotAuthorizedException";
+  ListDevicesException3["PasswordResetRequiredException"] = "PasswordResetRequiredException";
+  ListDevicesException3["ResourceNotFoundException"] = "ResourceNotFoundException";
+  ListDevicesException3["TooManyRequestsException"] = "TooManyRequestsException";
+  ListDevicesException3["UserNotConfirmedException"] = "UserNotConfirmedException";
+  ListDevicesException3["UserNotFoundException"] = "UserNotFoundException";
+  return ListDevicesException3;
 })(ListDevicesException || {});
 var RevokeTokenException = /* @__PURE__ */ ((RevokeTokenException3) => {
   RevokeTokenException3["ForbiddenException"] = "ForbiddenException";
@@ -498,6 +498,24 @@ var AssociateSoftwareTokenError = class extends CognitoError {
     this.cognitoException = cognitoException;
   }
 };
+var SetUserMFAPreferenceError = class extends CognitoError {
+  constructor(message, cognitoException) {
+    super(message, "SetUserMFAPreferenceError", cognitoException);
+    this.cognitoException = cognitoException;
+  }
+};
+var ListDevicesError = class extends CognitoError {
+  constructor(message, cognitoException) {
+    super(message, "ListDevicesError", cognitoException);
+    this.cognitoException = cognitoException;
+  }
+};
+var GetUserError = class extends CognitoError {
+  constructor(message, cognitoException) {
+    super(message, "GetUserError", cognitoException);
+    this.cognitoException = cognitoException;
+  }
+};
 
 // src/bigint-math.ts
 var abs = (n) => n < 0n ? -n : n;
@@ -585,8 +603,47 @@ function uint8ArrayToHexString(bytes) {
   return bytes.reduce((str, byte) => str + byte.toString(16).padStart(2, "0"), "");
 }
 function uint8ArrayToBase64String(bytes) {
+  if (bytes instanceof ArrayBuffer) {
+    const byteArray = new Uint8Array(bytes);
+    return btoa(String.fromCharCode(...byteArray));
+  }
   return btoa(String.fromCharCode(...bytes));
 }
+function uint8ArrayToBase64UrlString(bytes) {
+  if (bytes === void 0) {
+    return void 0;
+  }
+  const base64String = uint8ArrayToBase64String(bytes);
+  return base64String.replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function base64UrlToUint8Array(base64) {
+  const binary = atob(base64.replace(/-/g, "+").replace(/_/g, "/"));
+  const len = binary.length;
+  const bytes = new Uint8Array(len);
+  for (let i = 0; i < len; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+function publicKeyCredentialToJSON(cred) {
+  return removeUndefined({
+    authenticatorAttachment: cred.authenticatorAttachment,
+    clientExtensionResults: cred.getClientExtensionResults(),
+    id: cred.id,
+    rawId: uint8ArrayToBase64UrlString(cred.rawId),
+    response: {
+      attestationObject: uint8ArrayToBase64UrlString(cred.response.attestationObject),
+      authenticatorData: cred.response.authenticatorData ? uint8ArrayToBase64UrlString(cred.response.authenticatorData) : void 0,
+      clientDataJSON: uint8ArrayToBase64UrlString(cred.response.clientDataJSON),
+      publicKey: cred.response.getPublicKey ? uint8ArrayToBase64UrlString(cred.response.getPublicKey()) : void 0,
+      publicKeyAlgorithm: cred.response.getPublicKeyAlgorithm ? cred.response.getPublicKeyAlgorithm() : void 0,
+      transports: cred.response.getTransports ? cred.response.getTransports() : void 0,
+      signature: cred.response.signature ? uint8ArrayToBase64UrlString(cred.response.signature) : void 0,
+      userHandle: cred.response.userHandle ? uint8ArrayToBase64UrlString(cred.response.userHandle) : void 0
+    },
+    type: cred.type
+  });
+}
 var N = BigInt(
   "0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF"
 );
@@ -702,6 +759,24 @@ async function hmac(algorithm, key, data) {
   const signature = await crypto.subtle.sign("HMAC", cryptoKey, data);
   return new Uint8Array(signature);
 }
+function removeUndefined(obj) {
+  if (Array.isArray(obj)) {
+    return obj.map((item) => removeUndefined(item)).filter((item) => item !== void 0);
+  }
+  if (obj !== null && typeof obj === "object") {
+    return Object.entries(obj).reduce(
+      (acc, [key, value]) => {
+        const cleaned = removeUndefined(value);
+        if (cleaned !== void 0) {
+          acc[key] = cleaned;
+        }
+        return acc;
+      },
+      {}
+    );
+  }
+  return obj !== void 0 ? obj : void 0;
+}
 
 // src/cognito-client.ts
 var ServiceTarget = /* @__PURE__ */ ((ServiceTarget2) => {
@@ -722,6 +797,10 @@ var ServiceTarget = /* @__PURE__ */ ((ServiceTarget2) => {
   ServiceTarget2["VerifySoftwareToken"] = "VerifySoftwareToken";
   ServiceTarget2["ListDevices"] = "ListDevices";
   ServiceTarget2["SetUserMFAPreference"] = "SetUserMFAPreference";
+  ServiceTarget2["StartWebAuthnRegistration"] = "StartWebAuthnRegistration";
+  ServiceTarget2["CompleteWebAuthnRegistration"] = "CompleteWebAuthnRegistration";
+  ServiceTarget2["DeleteWebAuthnCredential"] = "DeleteWebAuthnCredential";
+  ServiceTarget2["ListWebAuthnCredentials"] = "ListWebAuthnCredentials";
   return ServiceTarget2;
 })(ServiceTarget || {});
 var IdentityProvider = /* @__PURE__ */ ((IdentityProvider2) => {
@@ -790,11 +869,24 @@ async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
       throw new VerifyUserAttributeError(errorMessage, cognitoException);
     case "GlobalSignOut" /* GlobalSignOut */:
       throw new GlobalSignOutError(errorMessage, cognitoException);
+    case "AssociateSoftwareToken" /* AssociateSoftwareToken */:
+      throw new AssociateSoftwareTokenError(errorMessage, cognitoException);
     case "VerifySoftwareToken" /* VerifySoftwareToken */:
       throw new VerifySoftwareTokenError(errorMessage, cognitoException);
+    case "SetUserMFAPreference" /* SetUserMFAPreference */:
+      throw new SetUserMFAPreferenceError(errorMessage, cognitoException);
+    case "ListDevices" /* ListDevices */:
+      throw new ListDevicesError(errorMessage, cognitoException);
+    case "GetUser" /* GetUser */:
+      throw new GetUserError(errorMessage, cognitoException);
   }
 }
 var CognitoClient = class {
+  cognitoEndpoint;
+  cognitoPoolName;
+  userPoolClientId;
+  oAuth;
+  clientSecret;
   constructor({ userPoolId, userPoolClientId, endpoint, oAuth2: oAuth, clientSecret }) {
     const [cognitoPoolRegion, cognitoPoolName] = userPoolId.split("_");
     this.cognitoEndpoint = (endpoint || `https://cognito-idp.${cognitoPoolRegion}.amazonaws.com`).replace(/\/$/, "");
@@ -811,6 +903,20 @@ var CognitoClient = class {
       accessToken
     };
   }
+  async initiateAuth(request) {
+    const cognitoResponse = await cognitoRequest(
+      {
+        ...request,
+        ClientId: this.userPoolClientId
+      },
+      "InitiateAuth" /* InitiateAuth */,
+      this.cognitoEndpoint
+    );
+    if (cognitoResponse.AuthenticationResult) {
+      cognitoResponse.AuthenticationResult = adaptExpiresIn(cognitoResponse.AuthenticationResult);
+    }
+    return cognitoResponse;
+  }
   /**
    *
    * Performs user authentication with username and password through ALLOW_USER_SRP_AUTH .
@@ -824,20 +930,15 @@ var CognitoClient = class {
   async authenticateUserSrp(username, password) {
     const smallA = await generateSmallA();
     const A = generateA(smallA);
-    const initUserSrpAuthResponse = await cognitoRequest(
-      {
-        AuthFlow: "USER_SRP_AUTH",
-        ClientId: this.userPoolClientId,
-        AuthParameters: {
-          USERNAME: username,
-          SRP_A: A.toString(16),
-          SECRET_HASH: this.clientSecret && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
-        },
-        ClientMetadata: {}
+    const initUserSrpAuthResponse = await this.initiateAuth({
+      AuthFlow: "USER_SRP_AUTH",
+      AuthParameters: {
+        USERNAME: username,
+        SRP_A: A.toString(16),
+        SECRET_HASH: this.clientSecret && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
       },
-      "InitiateAuth" /* InitiateAuth */,
-      this.cognitoEndpoint
-    );
+      ClientMetadata: {}
+    });
     if (initUserSrpAuthResponse.ChallengeName !== "PASSWORD_VERIFIER") {
       return initUserSrpAuthResponse;
     }
@@ -893,7 +994,6 @@ var CognitoClient = class {
   async authenticateUser(username, password) {
     const initiateAuthPayload = {
       AuthFlow: "USER_PASSWORD_AUTH",
-      ClientId: this.userPoolClientId,
       AuthParameters: {
         USERNAME: username,
         PASSWORD: password,
@@ -901,19 +1001,78 @@ var CognitoClient = class {
       },
       ClientMetadata: {}
     };
-    const initUserPasswordAuthResponse = await cognitoRequest(
-      initiateAuthPayload,
-      "InitiateAuth" /* InitiateAuth */,
-      this.cognitoEndpoint
-    );
+    const initUserPasswordAuthResponse = await this.initiateAuth(initiateAuthPayload);
     if (!initUserPasswordAuthResponse.AuthenticationResult) {
       return initUserPasswordAuthResponse;
     }
-    initUserPasswordAuthResponse.AuthenticationResult = adaptExpiresIn(
-      initUserPasswordAuthResponse.AuthenticationResult
-    );
     return initUserPasswordAuthResponse;
   }
+  /**
+   * Initiates the authentication process for a user using a preferred challenge, such as WEB_AUTHN.
+   */
+  async authenticateWebAuthn(username) {
+    const webAuthnPayload = {
+      AuthFlow: "USER_AUTH",
+      AuthParameters: {
+        USERNAME: username,
+        PREFERRED_CHALLENGE: "WEB_AUTHN"
+      }
+    };
+    const authResponse = await this.initiateAuth(webAuthnPayload);
+    if (authResponse.ChallengeName !== "WEB_AUTHN") {
+      throw new InitAuthError(
+        "Authentication failed, expected WEB_AUTHN challenge but received: " + authResponse.ChallengeName,
+        "InternalErrorException" /* InternalErrorException */
+      );
+    }
+    const credentialRequestOptions = JSON.parse(authResponse.ChallengeParameters.CREDENTIAL_REQUEST_OPTIONS);
+    credentialRequestOptions.challenge = base64UrlToUint8Array(credentialRequestOptions.challenge);
+    credentialRequestOptions.allowCredentials = (credentialRequestOptions.allowCredentials || []).map(
+      (allowCred) => ({
+        ...allowCred,
+        id: base64UrlToUint8Array(allowCred.id)
+      })
+    );
+    const credentials = await navigator.credentials.get({
+      publicKey: credentialRequestOptions
+    });
+    const challengeResponse = await this.respondToAuthChallenge({
+      ChallengeName: "WEB_AUTHN",
+      ChallengeResponses: {
+        USERNAME: username,
+        CREDENTIAL: JSON.stringify(publicKeyCredentialToJSON(credentials)),
+        SECRET_HASH: this.clientSecret && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+      },
+      Session: authResponse.Session
+    });
+    if (challengeResponse.AuthenticationResult) {
+      challengeResponse.AuthenticationResult = adaptExpiresIn(challengeResponse.AuthenticationResult);
+    }
+    return challengeResponse;
+  }
+  /**
+   * Registers a new WebAuthn device for the current user.
+   * This method initiates the WebAuthn registration process by requesting the necessary options from Cognito,
+   * then creates a new public key credential using the WebAuthn API, and finally
+   * completes the registration by sending the credential back to Cognito.
+   *
+   * @param accessToken Access token of the current user.
+   */
+  async registerWebAuthnDevice(accessToken) {
+    const { CredentialCreationOptions } = await this.startWebAuthnRegistration({
+      AccessToken: accessToken
+    });
+    const credentials = await navigator.credentials.create({
+      publicKey: CredentialCreationOptions
+    });
+    if (!(credentials instanceof PublicKeyCredential)) {
+      throw new Error("Invalid credentials returned from WebAuthn API");
+    }
+    await this.completeWebAuthnRegistration({
+      AccessToken: accessToken,
+      Credential: credentials
+    });
+  }
   /**
    * Returns a new session based on the given refresh token.
    *
@@ -925,18 +1084,13 @@ var CognitoClient = class {
   async refreshSession(refreshToken, username) {
     const refreshTokenPayload = {
       AuthFlow: "REFRESH_TOKEN_AUTH",
-      ClientId: this.userPoolClientId,
       AuthParameters: {
         REFRESH_TOKEN: refreshToken,
         SECRET_HASH: this.clientSecret && username && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
       },
       ClientMetadata: {}
     };
-    const { AuthenticationResult } = await cognitoRequest(
-      refreshTokenPayload,
-      "InitiateAuth" /* InitiateAuth */,
-      this.cognitoEndpoint
-    );
+    const { AuthenticationResult } = await this.initiateAuth(refreshTokenPayload);
     if (!AuthenticationResult) {
       throw new InitAuthError(
         "Authentication failed, no authentication result returned",
@@ -946,7 +1100,7 @@ var CognitoClient = class {
     if (!AuthenticationResult.RefreshToken) {
       AuthenticationResult.RefreshToken = refreshToken;
     }
-    return adaptExpiresIn(AuthenticationResult);
+    return AuthenticationResult;
   }
   /**
    *
@@ -1001,15 +1155,40 @@ var CognitoClient = class {
     };
     await cognitoRequest(changePasswordPayload, "ChangePassword" /* ChangePassword */, this.cognitoEndpoint);
   }
+  /**
+   * Gets the user information.
+   * @param accessToken Access token of the current user.
+   * @returns User information.
+   */
   async getUser(accessToken) {
     const getUserPayload = {
       AccessToken: accessToken
     };
     return cognitoRequest(getUserPayload, "GetUser" /* GetUser */, this.cognitoEndpoint);
   }
+  /**
+   * Associates a software token with the user.
+   * @param params Request to associate a software token with the user.
+   * @param params.AccessToken Access token of the current user.
+   * @param params.Session Optional session identifier for the authentication process.
+   * @param params.ClientMetadata Optional metadata to pass to the service.
+   * @param params.UserContextData Optional user context data.
+   * @param params.AnalyticsMetadata Optional analytics metadata.
+   * @param params.FriendlyDeviceName Optional friendly name for the device.
+   * @returns
+   */
   async associateSoftwareToken(params) {
     return cognitoRequest(params, "AssociateSoftwareToken" /* AssociateSoftwareToken */, this.cognitoEndpoint);
   }
+  /**
+   * Verifies a software token.
+   * @param params Request to verify a software token.
+   * @param params.AccessToken Access token of the current user.
+   * @param params.FriendlyDeviceName Optional friendly name for the device.
+   * @param params.Session Optional session identifier for the authentication process.
+   * @param params.UserCode The user code to verify.
+   * @returns
+   */
   async verifySoftwareToken(params) {
     return cognitoRequest(params, "VerifySoftwareToken" /* VerifySoftwareToken */, this.cognitoEndpoint);
   }
@@ -1152,6 +1331,59 @@ var CognitoClient = class {
     };
     await cognitoRequest(resendConfirmationCodeRequest, "ResendConfirmationCode" /* ResendConfirmationCode */, this.cognitoEndpoint);
   }
+  async startWebAuthnRegistration(request) {
+    const response = await cognitoRequest(request, "StartWebAuthnRegistration" /* StartWebAuthnRegistration */, this.cognitoEndpoint);
+    response.CredentialCreationOptions.challenge = base64UrlToUint8Array(
+      response.CredentialCreationOptions.challenge
+    );
+    response.CredentialCreationOptions.user.id = base64UrlToUint8Array(
+      response.CredentialCreationOptions.user.id
+    );
+    response.CredentialCreationOptions.excludeCredentials = (response.CredentialCreationOptions.excludeCredentials || []).map((excludeCred) => ({
+      ...excludeCred,
+      id: base64UrlToUint8Array(excludeCred.id)
+    }));
+    return response;
+  }
+  /**
+   * Completes registration of a passkey authenticator for the currently signed-in user.
+   * @param request Request to complete WebAuthn registration.
+   * @param request.AccessToken Access token of the current user.
+   * @param request.Credential The credential object returned by the WebAuthn API.
+   */
+  async completeWebAuthnRegistration(request) {
+    await cognitoRequest(
+      {
+        AccessToken: request.AccessToken,
+        Credential: publicKeyCredentialToJSON(request.Credential)
+      },
+      "CompleteWebAuthnRegistration" /* CompleteWebAuthnRegistration */,
+      this.cognitoEndpoint
+    );
+  }
+  /**
+   * Deletes a registered passkey, or WebAuthn, authenticator for the currently signed-in user.
+   *
+   * @param request Request to delete a WebAuthn credential.
+   * @param request.AccessToken Access token of the current user.
+   * @param request.CredentialId The ID of the credential to delete.
+   */
+  async deleteWebAuthnCredential(request) {
+    await cognitoRequest(request, "DeleteWebAuthnCredential" /* DeleteWebAuthnCredential */, this.cognitoEndpoint);
+  }
+  /**
+   * Lists all registered WebAuthn credentials for the currently signed-in user.
+   *
+   * @param request Request to list WebAuthn credentials.
+   * @param request.AccessToken Access token of the current user.
+   * @param request.MaxResults Maximum number of credentials to return.
+   * @param request.NextToken Pagination token to continue listing credentials.
+   * @returns
+   */
+  async listWebAuthnCredentials(request) {
+    const response = await cognitoRequest(request, "ListWebAuthnCredentials" /* ListWebAuthnCredentials */, this.cognitoEndpoint);
+    return response;
+  }
   /**
    * Returns a link to Cognito`s Hosted UI for OAuth2 authentication.
    * This method works in conjunction with @see handleCodeFlow .
@@ -1265,12 +1497,14 @@ export {
   GetCredentialsForIdentityException,
   GetIdException,
   GetUserAttributeVerificationException,
+  GetUserError,
   GetUserException,
   GlobalSignOutError,
   GlobalSignOutException,
   IdentityProvider,
   InitAuthError,
   InitiateAuthException,
+  ListDevicesError,
   ListDevicesException,
   ResendConfirmationCodeError,
   ResendConfirmationException,
@@ -1279,6 +1513,7 @@ export {
   RevokeTokenError,
   RevokeTokenException,
   ServiceTarget,
+  SetUserMFAPreferenceError,
   SetUserMFAPreferenceException,
   SignUpError,
   SignUpException,
@@ -1290,5 +1525,30 @@ export {
   VerifyUserAttributeError,
   VerifyUserAttributeException,
   adaptExpiresIn,
-  cognitoRequest
+  base64UrlToUint8Array,
+  calculateHKDF,
+  calculateS,
+  calculateSecretHash,
+  calculateSignature,
+  calculateU,
+  cognitoRequest,
+  decodeJwt,
+  digest,
+  formatTimestamp,
+  generateA,
+  generateSmallA,
+  getPasswordAuthenticationKey,
+  hashBuffer,
+  hashHexString,
+  hmac,
+  padHex,
+  publicKeyCredentialToJSON,
+  randomBytes,
+  removeUndefined,
+  uint8ArrayFromBase64String,
+  uint8ArrayFromHexString,
+  uint8ArrayFromString,
+  uint8ArrayToBase64String,
+  uint8ArrayToBase64UrlString,
+  uint8ArrayToHexString
 };