@vardario/cognito-client 5.1.0 → 5.2.0

package/lib/browser.js

@@ -603,8 +603,47 @@ function uint8ArrayToHexString(bytes) {
   return bytes.reduce((str, byte) => str + byte.toString(16).padStart(2, "0"), "");
 }
 function uint8ArrayToBase64String(bytes) {
+  if (bytes instanceof ArrayBuffer) {
+    const byteArray = new Uint8Array(bytes);
+    return btoa(String.fromCharCode(...byteArray));
+  }
   return btoa(String.fromCharCode(...bytes));
 }
+function uint8ArrayToBase64UrlString(bytes) {
+  if (bytes === void 0) {
+    return void 0;
+  }
+  const base64String = uint8ArrayToBase64String(bytes);
+  return base64String.replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function base64UrlToUint8Array(base64) {
+  const binary = atob(base64.replace(/-/g, "+").replace(/_/g, "/"));
+  const len = binary.length;
+  const bytes = new Uint8Array(len);
+  for (let i = 0; i < len; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+function publicKeyCredentialToJSON(cred) {
+  return removeUndefined({
+    authenticatorAttachment: cred.authenticatorAttachment,
+    clientExtensionResults: cred.getClientExtensionResults(),
+    id: cred.id,
+    rawId: uint8ArrayToBase64UrlString(cred.rawId),
+    response: {
+      attestationObject: uint8ArrayToBase64UrlString(cred.response.attestationObject),
+      authenticatorData: cred.response.authenticatorData ? uint8ArrayToBase64UrlString(cred.response.authenticatorData) : void 0,
+      clientDataJSON: uint8ArrayToBase64UrlString(cred.response.clientDataJSON),
+      publicKey: cred.response.getPublicKey ? uint8ArrayToBase64UrlString(cred.response.getPublicKey()) : void 0,
+      publicKeyAlgorithm: cred.response.getPublicKeyAlgorithm ? cred.response.getPublicKeyAlgorithm() : void 0,
+      transports: cred.response.getTransports ? cred.response.getTransports() : void 0,
+      signature: cred.response.signature ? uint8ArrayToBase64UrlString(cred.response.signature) : void 0,
+      userHandle: cred.response.userHandle ? uint8ArrayToBase64UrlString(cred.response.userHandle) : void 0
+    },
+    type: cred.type
+  });
+}
 var N = BigInt(
   "0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF"
 );
@@ -720,6 +759,24 @@ async function hmac(algorithm, key, data) {
   const signature = await crypto.subtle.sign("HMAC", cryptoKey, data);
   return new Uint8Array(signature);
 }
+function removeUndefined(obj) {
+  if (Array.isArray(obj)) {
+    return obj.map((item) => removeUndefined(item)).filter((item) => item !== void 0);
+  }
+  if (obj !== null && typeof obj === "object") {
+    return Object.entries(obj).reduce(
+      (acc, [key, value]) => {
+        const cleaned = removeUndefined(value);
+        if (cleaned !== void 0) {
+          acc[key] = cleaned;
+        }
+        return acc;
+      },
+      {}
+    );
+  }
+  return obj !== void 0 ? obj : void 0;
+}
 
 // src/cognito-client.ts
 var ServiceTarget = /* @__PURE__ */ ((ServiceTarget2) => {
@@ -740,6 +797,10 @@ var ServiceTarget = /* @__PURE__ */ ((ServiceTarget2) => {
   ServiceTarget2["VerifySoftwareToken"] = "VerifySoftwareToken";
   ServiceTarget2["ListDevices"] = "ListDevices";
   ServiceTarget2["SetUserMFAPreference"] = "SetUserMFAPreference";
+  ServiceTarget2["StartWebAuthnRegistration"] = "StartWebAuthnRegistration";
+  ServiceTarget2["CompleteWebAuthnRegistration"] = "CompleteWebAuthnRegistration";
+  ServiceTarget2["DeleteWebAuthnCredential"] = "DeleteWebAuthnCredential";
+  ServiceTarget2["ListWebAuthnCredentials"] = "ListWebAuthnCredentials";
   return ServiceTarget2;
 })(ServiceTarget || {});
 var IdentityProvider = /* @__PURE__ */ ((IdentityProvider2) => {
@@ -821,6 +882,11 @@ async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
   }
 }
 var CognitoClient = class {
+  cognitoEndpoint;
+  cognitoPoolName;
+  userPoolClientId;
+  oAuth;
+  clientSecret;
   constructor({ userPoolId, userPoolClientId, endpoint, oAuth2: oAuth, clientSecret }) {
     const [cognitoPoolRegion, cognitoPoolName] = userPoolId.split("_");
     this.cognitoEndpoint = (endpoint || `https://cognito-idp.${cognitoPoolRegion}.amazonaws.com`).replace(/\/$/, "");
@@ -837,6 +903,20 @@ var CognitoClient = class {
       accessToken
     };
   }
+  async initiateAuth(request) {
+    const cognitoResponse = await cognitoRequest(
+      {
+        ...request,
+        ClientId: this.userPoolClientId
+      },
+      "InitiateAuth" /* InitiateAuth */,
+      this.cognitoEndpoint
+    );
+    if (cognitoResponse.AuthenticationResult) {
+      cognitoResponse.AuthenticationResult = adaptExpiresIn(cognitoResponse.AuthenticationResult);
+    }
+    return cognitoResponse;
+  }
   /**
    *
    * Performs user authentication with username and password through ALLOW_USER_SRP_AUTH .
@@ -850,20 +930,15 @@ var CognitoClient = class {
   async authenticateUserSrp(username, password) {
     const smallA = await generateSmallA();
     const A = generateA(smallA);
-    const initUserSrpAuthResponse = await cognitoRequest(
-      {
-        AuthFlow: "USER_SRP_AUTH",
-        ClientId: this.userPoolClientId,
-        AuthParameters: {
-          USERNAME: username,
-          SRP_A: A.toString(16),
-          SECRET_HASH: this.clientSecret && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
-        },
-        ClientMetadata: {}
+    const initUserSrpAuthResponse = await this.initiateAuth({
+      AuthFlow: "USER_SRP_AUTH",
+      AuthParameters: {
+        USERNAME: username,
+        SRP_A: A.toString(16),
+        SECRET_HASH: this.clientSecret && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
       },
-      "InitiateAuth" /* InitiateAuth */,
-      this.cognitoEndpoint
-    );
+      ClientMetadata: {}
+    });
     if (initUserSrpAuthResponse.ChallengeName !== "PASSWORD_VERIFIER") {
       return initUserSrpAuthResponse;
     }
@@ -919,7 +994,6 @@ var CognitoClient = class {
   async authenticateUser(username, password) {
     const initiateAuthPayload = {
       AuthFlow: "USER_PASSWORD_AUTH",
-      ClientId: this.userPoolClientId,
       AuthParameters: {
         USERNAME: username,
         PASSWORD: password,
@@ -927,19 +1001,78 @@ var CognitoClient = class {
       },
       ClientMetadata: {}
     };
-    const initUserPasswordAuthResponse = await cognitoRequest(
-      initiateAuthPayload,
-      "InitiateAuth" /* InitiateAuth */,
-      this.cognitoEndpoint
-    );
+    const initUserPasswordAuthResponse = await this.initiateAuth(initiateAuthPayload);
     if (!initUserPasswordAuthResponse.AuthenticationResult) {
       return initUserPasswordAuthResponse;
     }
-    initUserPasswordAuthResponse.AuthenticationResult = adaptExpiresIn(
-      initUserPasswordAuthResponse.AuthenticationResult
-    );
     return initUserPasswordAuthResponse;
   }
+  /**
+   * Initiates the authentication process for a user using a preferred challenge, such as WEB_AUTHN.
+   */
+  async authenticateWebAuthn(username) {
+    const webAuthnPayload = {
+      AuthFlow: "USER_AUTH",
+      AuthParameters: {
+        USERNAME: username,
+        PREFERRED_CHALLENGE: "WEB_AUTHN"
+      }
+    };
+    const authResponse = await this.initiateAuth(webAuthnPayload);
+    if (authResponse.ChallengeName !== "WEB_AUTHN") {
+      throw new InitAuthError(
+        "Authentication failed, expected WEB_AUTHN challenge but received: " + authResponse.ChallengeName,
+        "InternalErrorException" /* InternalErrorException */
+      );
+    }
+    const credentialRequestOptions = JSON.parse(authResponse.ChallengeParameters.CREDENTIAL_REQUEST_OPTIONS);
+    credentialRequestOptions.challenge = base64UrlToUint8Array(credentialRequestOptions.challenge);
+    credentialRequestOptions.allowCredentials = (credentialRequestOptions.allowCredentials || []).map(
+      (allowCred) => ({
+        ...allowCred,
+        id: base64UrlToUint8Array(allowCred.id)
+      })
+    );
+    const credentials = await navigator.credentials.get({
+      publicKey: credentialRequestOptions
+    });
+    const challengeResponse = await this.respondToAuthChallenge({
+      ChallengeName: "WEB_AUTHN",
+      ChallengeResponses: {
+        USERNAME: username,
+        CREDENTIAL: JSON.stringify(publicKeyCredentialToJSON(credentials)),
+        SECRET_HASH: this.clientSecret && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+      },
+      Session: authResponse.Session
+    });
+    if (challengeResponse.AuthenticationResult) {
+      challengeResponse.AuthenticationResult = adaptExpiresIn(challengeResponse.AuthenticationResult);
+    }
+    return challengeResponse;
+  }
+  /**
+   * Registers a new WebAuthn device for the current user.
+   * This method initiates the WebAuthn registration process by requesting the necessary options from Cognito,
+   * then creates a new public key credential using the WebAuthn API, and finally
+   * completes the registration by sending the credential back to Cognito.
+   *
+   * @param accessToken Access token of the current user.
+   */
+  async registerWebAuthnDevice(accessToken) {
+    const { CredentialCreationOptions } = await this.startWebAuthnRegistration({
+      AccessToken: accessToken
+    });
+    const credentials = await navigator.credentials.create({
+      publicKey: CredentialCreationOptions
+    });
+    if (!(credentials instanceof PublicKeyCredential)) {
+      throw new Error("Invalid credentials returned from WebAuthn API");
+    }
+    await this.completeWebAuthnRegistration({
+      AccessToken: accessToken,
+      Credential: credentials
+    });
+  }
   /**
    * Returns a new session based on the given refresh token.
    *
@@ -951,18 +1084,13 @@ var CognitoClient = class {
   async refreshSession(refreshToken, username) {
     const refreshTokenPayload = {
       AuthFlow: "REFRESH_TOKEN_AUTH",
-      ClientId: this.userPoolClientId,
       AuthParameters: {
         REFRESH_TOKEN: refreshToken,
         SECRET_HASH: this.clientSecret && username && await calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
       },
       ClientMetadata: {}
     };
-    const { AuthenticationResult } = await cognitoRequest(
-      refreshTokenPayload,
-      "InitiateAuth" /* InitiateAuth */,
-      this.cognitoEndpoint
-    );
+    const { AuthenticationResult } = await this.initiateAuth(refreshTokenPayload);
     if (!AuthenticationResult) {
       throw new InitAuthError(
         "Authentication failed, no authentication result returned",
@@ -972,7 +1100,7 @@ var CognitoClient = class {
     if (!AuthenticationResult.RefreshToken) {
       AuthenticationResult.RefreshToken = refreshToken;
     }
-    return adaptExpiresIn(AuthenticationResult);
+    return AuthenticationResult;
   }
   /**
    *
@@ -1027,15 +1155,40 @@ var CognitoClient = class {
     };
     await cognitoRequest(changePasswordPayload, "ChangePassword" /* ChangePassword */, this.cognitoEndpoint);
   }
+  /**
+   * Gets the user information.
+   * @param accessToken Access token of the current user.
+   * @returns User information.
+   */
   async getUser(accessToken) {
     const getUserPayload = {
       AccessToken: accessToken
     };
     return cognitoRequest(getUserPayload, "GetUser" /* GetUser */, this.cognitoEndpoint);
   }
+  /**
+   * Associates a software token with the user.
+   * @param params Request to associate a software token with the user.
+   * @param params.AccessToken Access token of the current user.
+   * @param params.Session Optional session identifier for the authentication process.
+   * @param params.ClientMetadata Optional metadata to pass to the service.
+   * @param params.UserContextData Optional user context data.
+   * @param params.AnalyticsMetadata Optional analytics metadata.
+   * @param params.FriendlyDeviceName Optional friendly name for the device.
+   * @returns
+   */
   async associateSoftwareToken(params) {
     return cognitoRequest(params, "AssociateSoftwareToken" /* AssociateSoftwareToken */, this.cognitoEndpoint);
   }
+  /**
+   * Verifies a software token.
+   * @param params Request to verify a software token.
+   * @param params.AccessToken Access token of the current user.
+   * @param params.FriendlyDeviceName Optional friendly name for the device.
+   * @param params.Session Optional session identifier for the authentication process.
+   * @param params.UserCode The user code to verify.
+   * @returns
+   */
   async verifySoftwareToken(params) {
     return cognitoRequest(params, "VerifySoftwareToken" /* VerifySoftwareToken */, this.cognitoEndpoint);
   }
@@ -1178,6 +1331,59 @@ var CognitoClient = class {
     };
     await cognitoRequest(resendConfirmationCodeRequest, "ResendConfirmationCode" /* ResendConfirmationCode */, this.cognitoEndpoint);
   }
+  async startWebAuthnRegistration(request) {
+    const response = await cognitoRequest(request, "StartWebAuthnRegistration" /* StartWebAuthnRegistration */, this.cognitoEndpoint);
+    response.CredentialCreationOptions.challenge = base64UrlToUint8Array(
+      response.CredentialCreationOptions.challenge
+    );
+    response.CredentialCreationOptions.user.id = base64UrlToUint8Array(
+      response.CredentialCreationOptions.user.id
+    );
+    response.CredentialCreationOptions.excludeCredentials = (response.CredentialCreationOptions.excludeCredentials || []).map((excludeCred) => ({
+      ...excludeCred,
+      id: base64UrlToUint8Array(excludeCred.id)
+    }));
+    return response;
+  }
+  /**
+   * Completes registration of a passkey authenticator for the currently signed-in user.
+   * @param request Request to complete WebAuthn registration.
+   * @param request.AccessToken Access token of the current user.
+   * @param request.Credential The credential object returned by the WebAuthn API.
+   */
+  async completeWebAuthnRegistration(request) {
+    await cognitoRequest(
+      {
+        AccessToken: request.AccessToken,
+        Credential: publicKeyCredentialToJSON(request.Credential)
+      },
+      "CompleteWebAuthnRegistration" /* CompleteWebAuthnRegistration */,
+      this.cognitoEndpoint
+    );
+  }
+  /**
+   * Deletes a registered passkey, or WebAuthn, authenticator for the currently signed-in user.
+   *
+   * @param request Request to delete a WebAuthn credential.
+   * @param request.AccessToken Access token of the current user.
+   * @param request.CredentialId The ID of the credential to delete.
+   */
+  async deleteWebAuthnCredential(request) {
+    await cognitoRequest(request, "DeleteWebAuthnCredential" /* DeleteWebAuthnCredential */, this.cognitoEndpoint);
+  }
+  /**
+   * Lists all registered WebAuthn credentials for the currently signed-in user.
+   *
+   * @param request Request to list WebAuthn credentials.
+   * @param request.AccessToken Access token of the current user.
+   * @param request.MaxResults Maximum number of credentials to return.
+   * @param request.NextToken Pagination token to continue listing credentials.
+   * @returns
+   */
+  async listWebAuthnCredentials(request) {
+    const response = await cognitoRequest(request, "ListWebAuthnCredentials" /* ListWebAuthnCredentials */, this.cognitoEndpoint);
+    return response;
+  }
   /**
    * Returns a link to Cognito`s Hosted UI for OAuth2 authentication.
    * This method works in conjunction with @see handleCodeFlow .
@@ -1319,5 +1525,30 @@ export {
   VerifyUserAttributeError,
   VerifyUserAttributeException,
   adaptExpiresIn,
-  cognitoRequest
+  base64UrlToUint8Array,
+  calculateHKDF,
+  calculateS,
+  calculateSecretHash,
+  calculateSignature,
+  calculateU,
+  cognitoRequest,
+  decodeJwt,
+  digest,
+  formatTimestamp,
+  generateA,
+  generateSmallA,
+  getPasswordAuthenticationKey,
+  hashBuffer,
+  hashHexString,
+  hmac,
+  padHex,
+  publicKeyCredentialToJSON,
+  randomBytes,
+  removeUndefined,
+  uint8ArrayFromBase64String,
+  uint8ArrayFromHexString,
+  uint8ArrayFromString,
+  uint8ArrayToBase64String,
+  uint8ArrayToBase64UrlString,
+  uint8ArrayToHexString
 };

package/lib/cognito-client.d.ts

@@ -9,7 +9,7 @@ export interface CognitoBaseRequest {
         IpAddress?: string;
     };
 }
-export interface InitiateAuthUserSrpAuthRequest extends CognitoBaseRequest {
+export interface _InitiateAuthUserSrpAuthRequest extends CognitoBaseRequest {
     AuthFlow: 'USER_SRP_AUTH';
     AuthParameters: {
         USERNAME: string;
@@ -17,7 +17,7 @@ export interface InitiateAuthUserSrpAuthRequest extends CognitoBaseRequest {
         SECRET_HASH?: string;
     };
 }
-export interface InitiateAuthUserPasswordAuthRequest extends CognitoBaseRequest {
+export interface _InitiateAuthUserPasswordAuthRequest extends CognitoBaseRequest {
     AuthFlow: 'USER_PASSWORD_AUTH';
     AuthParameters: {
         USERNAME: string;
@@ -25,21 +25,31 @@ export interface InitiateAuthUserPasswordAuthRequest extends CognitoBaseRequest
         SECRET_HASH?: string;
     };
 }
-export interface InitiateAuthRefreshTokenAuthRequest extends CognitoBaseRequest {
+export interface _InitiateAuthRefreshTokenAuthRequest extends CognitoBaseRequest {
     AuthFlow: 'REFRESH_TOKEN_AUTH';
     AuthParameters: {
         REFRESH_TOKEN: string;
         SECRET_HASH?: string;
+        USERNAME?: never;
     };
 }
-export interface InitiateAuthCustomAuthRequest extends CognitoBaseRequest {
+export interface _InitiateAuthCustomAuthRequest extends CognitoBaseRequest {
     AuthFlow: 'CUSTOM_AUTH';
     AuthParameters: {
         USERNAME: string;
         SECRET_HASH?: string;
     };
 }
-export type InitiateAuthRequest = InitiateAuthUserSrpAuthRequest | InitiateAuthRefreshTokenAuthRequest | InitiateAuthCustomAuthRequest | InitiateAuthUserPasswordAuthRequest;
+export interface _InitiateAuthUserAuthRequest extends CognitoBaseRequest {
+    AuthFlow: 'USER_AUTH';
+    AuthParameters: {
+        USERNAME: string;
+        PREFERRED_CHALLENGE?: AuthChallenge;
+        SECRET_HASH?: string;
+    };
+}
+type _InitiateAuthRequest = _InitiateAuthUserSrpAuthRequest | _InitiateAuthUserPasswordAuthRequest | _InitiateAuthRefreshTokenAuthRequest | _InitiateAuthCustomAuthRequest | _InitiateAuthUserAuthRequest;
+export type InitiateAuthRequest = Omit<_InitiateAuthUserSrpAuthRequest, 'ClientId'> | Omit<_InitiateAuthUserPasswordAuthRequest, 'ClientId'> | Omit<_InitiateAuthRefreshTokenAuthRequest, 'ClientId'> | Omit<_InitiateAuthCustomAuthRequest, 'ClientId'> | Omit<_InitiateAuthUserAuthRequest, 'ClientId'>;
 export interface RespondToAuthChallengeBaseRequest extends CognitoBaseRequest {
     Session?: string;
 }
@@ -112,6 +122,7 @@ export interface _RespondToAuthChallengeMfaSetupRequest extends RespondToAuthCha
         SOFTWARE_TOKEN_MFA_CODE?: string;
         SECRET_HASH?: string;
     };
+    Session?: never;
 }
 export interface _RespondToAuthChallengeSelectMfaTypeRequest extends RespondToAuthChallengeBaseRequest {
     ChallengeName: 'SELECT_MFA_TYPE';
@@ -121,8 +132,16 @@ export interface _RespondToAuthChallengeSelectMfaTypeRequest extends RespondToAu
         SECRET_HASH?: string;
     };
 }
-type _RespondToAuthChallengeRequest = _RespondToAuthChallengePasswordVerifierRequest | _RespondToAuthChallengeSmsMfaRequest | _RespondToAuthChallengeCustomChallengeNameRequest | _RespondToAuthChallengeNewPasswordRequiredRequest | _RespondToAuthChallengeSoftwareTokenMfaRequest | _RespondToAuthChallengeDeviceSrpAuthRequest | _RespondToAuthChallengeDevicePasswordVerifierRequest | _RespondToAuthChallengeMfaSetupRequest | _RespondToAuthChallengeSelectMfaTypeRequest;
-export type RespondToAuthChallengeRequest = Omit<_RespondToAuthChallengePasswordVerifierRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSmsMfaRequest, 'ClientId'> | Omit<_RespondToAuthChallengeCustomChallengeNameRequest, 'ClientId'> | Omit<_RespondToAuthChallengeNewPasswordRequiredRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSoftwareTokenMfaRequest, 'ClientId'> | Omit<_RespondToAuthChallengeDeviceSrpAuthRequest, 'ClientId'> | Omit<_RespondToAuthChallengeDevicePasswordVerifierRequest, 'ClientId'> | Omit<_RespondToAuthChallengeMfaSetupRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSelectMfaTypeRequest, 'ClientId'>;
+export interface _RespondToAuthChallengeWebAuthnRequest extends RespondToAuthChallengeBaseRequest {
+    ChallengeName: 'WEB_AUTHN';
+    ChallengeResponses: {
+        USERNAME: string;
+        CREDENTIAL: any;
+        SECRET_HASH?: string;
+    };
+}
+type _RespondToAuthChallengeRequest = _RespondToAuthChallengePasswordVerifierRequest | _RespondToAuthChallengeSmsMfaRequest | _RespondToAuthChallengeCustomChallengeNameRequest | _RespondToAuthChallengeNewPasswordRequiredRequest | _RespondToAuthChallengeSoftwareTokenMfaRequest | _RespondToAuthChallengeDeviceSrpAuthRequest | _RespondToAuthChallengeDevicePasswordVerifierRequest | _RespondToAuthChallengeMfaSetupRequest | _RespondToAuthChallengeSelectMfaTypeRequest | _RespondToAuthChallengeWebAuthnRequest;
+export type RespondToAuthChallengeRequest = Omit<_RespondToAuthChallengePasswordVerifierRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSmsMfaRequest, 'ClientId'> | Omit<_RespondToAuthChallengeCustomChallengeNameRequest, 'ClientId'> | Omit<_RespondToAuthChallengeNewPasswordRequiredRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSoftwareTokenMfaRequest, 'ClientId'> | Omit<_RespondToAuthChallengeDeviceSrpAuthRequest, 'ClientId'> | Omit<_RespondToAuthChallengeDevicePasswordVerifierRequest, 'ClientId'> | Omit<_RespondToAuthChallengeMfaSetupRequest, 'ClientId'> | Omit<_RespondToAuthChallengeSelectMfaTypeRequest, 'ClientId'> | Omit<_RespondToAuthChallengeWebAuthnRequest, 'ClientId'>;
 export interface UserAttribute {
     Name: string;
     Value: string;
@@ -258,7 +277,11 @@ export declare enum ServiceTarget {
     AssociateSoftwareToken = "AssociateSoftwareToken",
     VerifySoftwareToken = "VerifySoftwareToken",
     ListDevices = "ListDevices",
-    SetUserMFAPreference = "SetUserMFAPreference"
+    SetUserMFAPreference = "SetUserMFAPreference",
+    StartWebAuthnRegistration = "StartWebAuthnRegistration",
+    CompleteWebAuthnRegistration = "CompleteWebAuthnRegistration",
+    DeleteWebAuthnCredential = "DeleteWebAuthnCredential",
+    ListWebAuthnCredentials = "ListWebAuthnCredentials"
 }
 export interface AssociateSoftwareTokenRequest {
     AccessToken?: string;
@@ -321,12 +344,16 @@ export interface NewDeviceMetadata {
     DeviceKey?: string;
     DeviceGroupKey?: string;
 }
-export interface InitiateAuthAuthenticationResponse {
+export type AuthChallenge = InitiateAuthChallengeResponse['ChallengeName'];
+export interface InitiateAuthBaseResponse {
+    AvailableChallenges: [];
+    Session: string;
+}
+export interface InitiateAuthAuthenticationResponse extends InitiateAuthBaseResponse {
     AuthenticationResult: AuthenticationResult;
     ChallengeName?: never;
-    session?: never;
 }
-export interface InitiateAuthPasswordVerifierChallengeResponse {
+export interface InitiateAuthPasswordVerifierChallengeResponse extends InitiateAuthBaseResponse {
     AuthenticationResult?: never;
     ChallengeName: 'PASSWORD_VERIFIER';
     ChallengeParameters: {
@@ -336,20 +363,48 @@ export interface InitiateAuthPasswordVerifierChallengeResponse {
         USERNAME: string;
         USER_ID_FOR_SRP: string;
     };
-    session?: never;
 }
-export interface InitiateAuthSoftwareTokenMfaChallengeResponse {
+export interface InitiateAuthSoftwareTokenMfaChallengeResponse extends InitiateAuthBaseResponse {
     AuthenticationResult?: never;
     ChallengeName: 'SOFTWARE_TOKEN_MFA';
+}
+export interface InitiateAuthWebAuthResponse extends InitiateAuthBaseResponse {
+    AuthenticationResult?: never;
+    ChallengeName: 'WEB_AUTHN';
     Session: string;
+    ChallengeParameters: {
+        CREDENTIAL_REQUEST_OPTIONS: string;
+    };
 }
-export interface InitiateEmailOtpChallengeResponse {
+export interface InitiateEmailOtpChallengeResponse extends InitiateAuthBaseResponse {
+    AuthenticationResult?: never;
     ChallengeName: 'EMAIL_OTP';
     ChallengeParameters: {
         CODE_DELIVERY_DELIVERY_MEDIUM: string;
         CODE_DELIVERY_DESTINATION: string;
     };
-    session: string;
+    Session: string;
+}
+export interface InitAuthSelectChallengeResponse extends InitiateAuthBaseResponse {
+    AuthenticationResult?: never;
+    ChallengeName: 'SELECT_CHALLENGE';
+    ChallengeParameters: never;
+}
+export interface InitAuthPasswordChallengeResponse extends InitiateAuthBaseResponse {
+    AuthenticationResult?: never;
+    ChallengeName: 'PASSWORD';
+    ChallengeParameters: never;
+}
+export interface InitAuthPasswordSRPChallengeResponse extends InitiateAuthBaseResponse {
+    AuthenticationResult?: never;
+    ChallengeName: 'PASSWORD_SRP';
+    ChallengeParameters: never;
+}
+export interface InitAuthMfaSetupChallengeResponse extends InitiateAuthBaseResponse {
+    AuthenticationResult?: never;
+    ChallengeName: 'MFA_SETUP';
+    ChallengeParameters: never;
+    MFAS_CAN_SETUP: ('SMS_MFA' | 'SOFTWARE_TOKEN_MFA')[];
 }
 export interface MfaOption {
     DeliveryMedium: 'SMS' | 'EMAIL';
@@ -377,7 +432,38 @@ export interface SetUserMFAPreferenceRequest {
         PreferredMfa?: boolean;
     };
 }
-export type InitiateAuthChallengeResponse = InitiateAuthPasswordVerifierChallengeResponse | InitiateAuthSoftwareTokenMfaChallengeResponse;
+export interface StartWebAuthnRegistrationRequest {
+    AccessToken: string;
+}
+export interface StartWebAuthnRegistrationResponse {
+    CredentialCreationOptions: any;
+}
+export interface CompleteWebAuthnRegistrationRequest {
+    AccessToken: string;
+    Credential: PublicKeyCredential;
+}
+export interface DeleteWebAuthnCredentialRequest {
+    AccessToken: string;
+    CredentialId: string;
+}
+export interface ListWebAuthnCredentialsRequest {
+    AccessToken: string;
+    MaxResults?: number;
+    NextToken?: string;
+}
+export interface WebAuthnCredential {
+    AuthenticatorTransports: string[];
+    CreatedAt: string;
+    CredentialId: string;
+    FriendlyCredentialName: string;
+    RelyingPartyId: string;
+    AuthenticatorAttachment?: string;
+}
+export interface ListWebAuthnCredentialsResponse {
+    Credentials: WebAuthnCredential[];
+    NextToken?: string;
+}
+export type InitiateAuthChallengeResponse = InitiateAuthPasswordVerifierChallengeResponse | InitiateAuthSoftwareTokenMfaChallengeResponse | InitiateAuthWebAuthResponse | InitiateEmailOtpChallengeResponse | InitAuthSelectChallengeResponse | InitAuthPasswordChallengeResponse | InitAuthPasswordSRPChallengeResponse | InitAuthMfaSetupChallengeResponse;
 export type InitiateAuthResponse = InitiateAuthAuthenticationResponse | InitiateAuthPasswordVerifierChallengeResponse | InitiateAuthChallengeResponse;
 type CognitoResponseMap = {
     [ServiceTarget.InitiateAuth]: InitiateAuthResponse;
@@ -400,9 +486,13 @@ type CognitoResponseMap = {
     [ServiceTarget.VerifySoftwareToken]: VerifySoftwareTokenResponse;
     [ServiceTarget.ListDevices]: ListDevicesResponse;
     [ServiceTarget.SetUserMFAPreference]: void;
+    [ServiceTarget.StartWebAuthnRegistration]: StartWebAuthnRegistrationResponse;
+    [ServiceTarget.CompleteWebAuthnRegistration]: void;
+    [ServiceTarget.DeleteWebAuthnCredential]: void;
+    [ServiceTarget.ListWebAuthnCredentials]: ListWebAuthnCredentialsResponse;
 };
 type CognitoRequestMap = {
-    [ServiceTarget.InitiateAuth]: InitiateAuthRequest;
+    [ServiceTarget.InitiateAuth]: _InitiateAuthRequest;
     [ServiceTarget.RespondToAuthChallenge]: _RespondToAuthChallengeRequest;
     [ServiceTarget.SignUp]: SignUpRequest;
     [ServiceTarget.ConfirmSignUp]: ConfirmSignUpRequest;
@@ -438,6 +528,10 @@ type CognitoRequestMap = {
     [ServiceTarget.VerifySoftwareToken]: VerifySoftwareTokenRequest;
     [ServiceTarget.ListDevices]: ListDevicesRequest;
     [ServiceTarget.SetUserMFAPreference]: SetUserMFAPreferenceRequest;
+    [ServiceTarget.StartWebAuthnRegistration]: StartWebAuthnRegistrationRequest;
+    [ServiceTarget.CompleteWebAuthnRegistration]: any;
+    [ServiceTarget.DeleteWebAuthnCredential]: DeleteWebAuthnCredentialRequest;
+    [ServiceTarget.ListWebAuthnCredentials]: ListWebAuthnCredentialsRequest;
 };
 export declare function adaptExpiresIn(auth: AuthenticationResult): {
     ExpiresIn: number;
@@ -458,6 +552,7 @@ export declare class CognitoClient {
     private readonly clientSecret?;
     constructor({ userPoolId, userPoolClientId, endpoint, oAuth2: oAuth, clientSecret }: CognitoClientProps);
     static getDecodedTokenFromSession(auth: AuthenticationResult): DecodedTokens;
+    initiateAuth(request: InitiateAuthRequest): Promise<InitiateAuthResponse>;
     /**
      *
      * Performs user authentication with username and password through ALLOW_USER_SRP_AUTH .
@@ -479,6 +574,19 @@ export declare class CognitoClient {
      * @throws {InitAuthError}
      */
     authenticateUser(username: string, password: string): Promise<InitiateAuthResponse>;
+    /**
+     * Initiates the authentication process for a user using a preferred challenge, such as WEB_AUTHN.
+     */
+    authenticateWebAuthn(username: string): Promise<InitiateAuthResponse>;
+    /**
+     * Registers a new WebAuthn device for the current user.
+     * This method initiates the WebAuthn registration process by requesting the necessary options from Cognito,
+     * then creates a new public key credential using the WebAuthn API, and finally
+     * completes the registration by sending the credential back to Cognito.
+     *
+     * @param accessToken Access token of the current user.
+     */
+    registerWebAuthnDevice(accessToken: string): Promise<void>;
     /**
      * Returns a new session based on the given refresh token.
      *
@@ -516,8 +624,33 @@ export declare class CognitoClient {
      * @throws {ChangePasswordError}
      */
     changePassword(currentPassword: string, newPassword: string, accessToken: string): Promise<void>;
+    /**
+     * Gets the user information.
+     * @param accessToken Access token of the current user.
+     * @returns User information.
+     */
     getUser(accessToken: string): Promise<GetUserResponse>;
+    /**
+     * Associates a software token with the user.
+     * @param params Request to associate a software token with the user.
+     * @param params.AccessToken Access token of the current user.
+     * @param params.Session Optional session identifier for the authentication process.
+     * @param params.ClientMetadata Optional metadata to pass to the service.
+     * @param params.UserContextData Optional user context data.
+     * @param params.AnalyticsMetadata Optional analytics metadata.
+     * @param params.FriendlyDeviceName Optional friendly name for the device.
+     * @returns
+     */
     associateSoftwareToken(params: AssociateSoftwareTokenRequest): Promise<AssociateSoftwareResponse>;
+    /**
+     * Verifies a software token.
+     * @param params Request to verify a software token.
+     * @param params.AccessToken Access token of the current user.
+     * @param params.FriendlyDeviceName Optional friendly name for the device.
+     * @param params.Session Optional session identifier for the authentication process.
+     * @param params.UserCode The user code to verify.
+     * @returns
+     */
     verifySoftwareToken(params: VerifySoftwareTokenRequest): Promise<VerifySoftwareTokenResponse>;
     /**
      * Responds to an authentication challenge.
@@ -602,6 +735,32 @@ export declare class CognitoClient {
      * @throws {ResendConfirmationCodeError}
      */
     resendConfirmationCode(username: string): Promise<void>;
+    startWebAuthnRegistration(request: StartWebAuthnRegistrationRequest): Promise<StartWebAuthnRegistrationResponse>;
+    /**
+     * Completes registration of a passkey authenticator for the currently signed-in user.
+     * @param request Request to complete WebAuthn registration.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.Credential The credential object returned by the WebAuthn API.
+     */
+    completeWebAuthnRegistration(request: CompleteWebAuthnRegistrationRequest): Promise<void>;
+    /**
+     * Deletes a registered passkey, or WebAuthn, authenticator for the currently signed-in user.
+     *
+     * @param request Request to delete a WebAuthn credential.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.CredentialId The ID of the credential to delete.
+     */
+    deleteWebAuthnCredential(request: DeleteWebAuthnCredentialRequest): Promise<void>;
+    /**
+     * Lists all registered WebAuthn credentials for the currently signed-in user.
+     *
+     * @param request Request to list WebAuthn credentials.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.MaxResults Maximum number of credentials to return.
+     * @param request.NextToken Pagination token to continue listing credentials.
+     * @returns
+     */
+    listWebAuthnCredentials(request: ListWebAuthnCredentialsRequest): Promise<ListWebAuthnCredentialsResponse>;
     /**
      * Returns a link to Cognito`s Hosted UI for OAuth2 authentication.
      * This method works in conjunction with @see handleCodeFlow .

package/lib/cognito-client.js

@@ -1,5 +1,5 @@
 import { ChangePasswordError, ConfirmForgotPasswordError, ConfirmSignUpError, ForgotPasswordError, GlobalSignOutError, InitAuthError, ResendConfirmationCodeError, RespondToAuthChallengeError, RevokeTokenError, SignUpError, UpdateUserAttributesError, VerifyUserAttributeError, InitiateAuthException, COMMON_EXCEPTIONS, CommonError, VerifySoftwareTokenError, AssociateSoftwareTokenError, SetUserMFAPreferenceError, ListDevicesError, GetUserError } from './error.js';
-import { calculateSecretHash, calculateSignature, calculateU, decodeJwt, digest, generateA, generateSmallA, getPasswordAuthenticationKey, randomBytes, uint8ArrayFromString, uint8ArrayToBase64String } from './utils.js';
+import { base64UrlToUint8Array, calculateSecretHash, calculateSignature, calculateU, decodeJwt, digest, generateA, generateSmallA, getPasswordAuthenticationKey, publicKeyCredentialToJSON, randomBytes, uint8ArrayFromString, uint8ArrayToBase64String } from './utils.js';
 /**
  * List of used and supported Cognito API calls.
  * @see https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_Operations.html for more details
@@ -23,6 +23,10 @@ export var ServiceTarget;
     ServiceTarget["VerifySoftwareToken"] = "VerifySoftwareToken";
     ServiceTarget["ListDevices"] = "ListDevices";
     ServiceTarget["SetUserMFAPreference"] = "SetUserMFAPreference";
+    ServiceTarget["StartWebAuthnRegistration"] = "StartWebAuthnRegistration";
+    ServiceTarget["CompleteWebAuthnRegistration"] = "CompleteWebAuthnRegistration";
+    ServiceTarget["DeleteWebAuthnCredential"] = "DeleteWebAuthnCredential";
+    ServiceTarget["ListWebAuthnCredentials"] = "ListWebAuthnCredentials";
 })(ServiceTarget || (ServiceTarget = {}));
 /**
  * Cognito supported federated identities public providers.
@@ -119,6 +123,11 @@ export async function cognitoRequest(body, serviceTarget, cognitoEndpoint) {
  * Lightweight AWS Cogito client without any AWS SDK dependencies.
  */
 export class CognitoClient {
+    cognitoEndpoint;
+    cognitoPoolName;
+    userPoolClientId;
+    oAuth;
+    clientSecret;
     constructor({ userPoolId, userPoolClientId, endpoint, oAuth2: oAuth, clientSecret }) {
         const [cognitoPoolRegion, cognitoPoolName] = userPoolId.split('_');
         this.cognitoEndpoint = (endpoint || `https://cognito-idp.${cognitoPoolRegion}.amazonaws.com`).replace(/\/$/, '');
@@ -135,6 +144,16 @@ export class CognitoClient {
             accessToken
         };
     }
+    async initiateAuth(request) {
+        const cognitoResponse = await cognitoRequest({
+            ...request,
+            ClientId: this.userPoolClientId
+        }, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
+        if (cognitoResponse.AuthenticationResult) {
+            cognitoResponse.AuthenticationResult = adaptExpiresIn(cognitoResponse.AuthenticationResult);
+        }
+        return cognitoResponse;
+    }
     /**
      *
      * Performs user authentication with username and password through ALLOW_USER_SRP_AUTH .
@@ -148,16 +167,15 @@ export class CognitoClient {
     async authenticateUserSrp(username, password) {
         const smallA = await generateSmallA();
         const A = generateA(smallA);
-        const initUserSrpAuthResponse = await cognitoRequest({
+        const initUserSrpAuthResponse = await this.initiateAuth({
             AuthFlow: 'USER_SRP_AUTH',
-            ClientId: this.userPoolClientId,
             AuthParameters: {
                 USERNAME: username,
                 SRP_A: A.toString(16),
                 SECRET_HASH: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
             },
             ClientMetadata: {}
-        }, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
+        });
         if (initUserSrpAuthResponse.ChallengeName !== 'PASSWORD_VERIFIER') {
             return initUserSrpAuthResponse;
         }
@@ -195,7 +213,6 @@ export class CognitoClient {
     async authenticateUser(username, password) {
         const initiateAuthPayload = {
             AuthFlow: 'USER_PASSWORD_AUTH',
-            ClientId: this.userPoolClientId,
             AuthParameters: {
                 USERNAME: username,
                 PASSWORD: password,
@@ -203,13 +220,73 @@ export class CognitoClient {
             },
             ClientMetadata: {}
         };
-        const initUserPasswordAuthResponse = await cognitoRequest(initiateAuthPayload, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
+        const initUserPasswordAuthResponse = await this.initiateAuth(initiateAuthPayload);
         if (!initUserPasswordAuthResponse.AuthenticationResult) {
             return initUserPasswordAuthResponse;
         }
-        initUserPasswordAuthResponse.AuthenticationResult = adaptExpiresIn(initUserPasswordAuthResponse.AuthenticationResult);
         return initUserPasswordAuthResponse;
     }
+    /**
+     * Initiates the authentication process for a user using a preferred challenge, such as WEB_AUTHN.
+     */
+    async authenticateWebAuthn(username) {
+        const webAuthnPayload = {
+            AuthFlow: 'USER_AUTH',
+            AuthParameters: {
+                USERNAME: username,
+                PREFERRED_CHALLENGE: 'WEB_AUTHN'
+            }
+        };
+        const authResponse = await this.initiateAuth(webAuthnPayload);
+        if (authResponse.ChallengeName !== 'WEB_AUTHN') {
+            throw new InitAuthError('Authentication failed, expected WEB_AUTHN challenge but received: ' + authResponse.ChallengeName, InitiateAuthException.InternalErrorException);
+        }
+        const credentialRequestOptions = JSON.parse(authResponse.ChallengeParameters.CREDENTIAL_REQUEST_OPTIONS);
+        credentialRequestOptions.challenge = base64UrlToUint8Array(credentialRequestOptions.challenge);
+        credentialRequestOptions.allowCredentials = (credentialRequestOptions.allowCredentials || []).map((allowCred) => ({
+            ...allowCred,
+            id: base64UrlToUint8Array(allowCred.id)
+        }));
+        const credentials = await navigator.credentials.get({
+            publicKey: credentialRequestOptions
+        });
+        const challengeResponse = await this.respondToAuthChallenge({
+            ChallengeName: 'WEB_AUTHN',
+            ChallengeResponses: {
+                USERNAME: username,
+                CREDENTIAL: JSON.stringify(publicKeyCredentialToJSON(credentials)),
+                SECRET_HASH: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
+            },
+            Session: authResponse.Session
+        });
+        if (challengeResponse.AuthenticationResult) {
+            challengeResponse.AuthenticationResult = adaptExpiresIn(challengeResponse.AuthenticationResult);
+        }
+        return challengeResponse;
+    }
+    /**
+     * Registers a new WebAuthn device for the current user.
+     * This method initiates the WebAuthn registration process by requesting the necessary options from Cognito,
+     * then creates a new public key credential using the WebAuthn API, and finally
+     * completes the registration by sending the credential back to Cognito.
+     *
+     * @param accessToken Access token of the current user.
+     */
+    async registerWebAuthnDevice(accessToken) {
+        const { CredentialCreationOptions } = await this.startWebAuthnRegistration({
+            AccessToken: accessToken
+        });
+        const credentials = await navigator.credentials.create({
+            publicKey: CredentialCreationOptions
+        });
+        if (!(credentials instanceof PublicKeyCredential)) {
+            throw new Error('Invalid credentials returned from WebAuthn API');
+        }
+        await this.completeWebAuthnRegistration({
+            AccessToken: accessToken,
+            Credential: credentials
+        });
+    }
     /**
      * Returns a new session based on the given refresh token.
      *
@@ -221,7 +298,6 @@ export class CognitoClient {
     async refreshSession(refreshToken, username) {
         const refreshTokenPayload = {
             AuthFlow: 'REFRESH_TOKEN_AUTH',
-            ClientId: this.userPoolClientId,
             AuthParameters: {
                 REFRESH_TOKEN: refreshToken,
                 SECRET_HASH: this.clientSecret &&
@@ -230,14 +306,14 @@ export class CognitoClient {
             },
             ClientMetadata: {}
         };
-        const { AuthenticationResult } = await cognitoRequest(refreshTokenPayload, ServiceTarget.InitiateAuth, this.cognitoEndpoint);
+        const { AuthenticationResult } = await this.initiateAuth(refreshTokenPayload);
         if (!AuthenticationResult) {
             throw new InitAuthError('Authentication failed, no authentication result returned', InitiateAuthException.InternalErrorException);
         }
         if (!AuthenticationResult.RefreshToken) {
             AuthenticationResult.RefreshToken = refreshToken;
         }
-        return adaptExpiresIn(AuthenticationResult);
+        return AuthenticationResult;
     }
     /**
      *
@@ -292,15 +368,40 @@ export class CognitoClient {
         };
         await cognitoRequest(changePasswordPayload, ServiceTarget.ChangePassword, this.cognitoEndpoint);
     }
+    /**
+     * Gets the user information.
+     * @param accessToken Access token of the current user.
+     * @returns User information.
+     */
     async getUser(accessToken) {
         const getUserPayload = {
             AccessToken: accessToken
         };
         return cognitoRequest(getUserPayload, ServiceTarget.GetUser, this.cognitoEndpoint);
     }
+    /**
+     * Associates a software token with the user.
+     * @param params Request to associate a software token with the user.
+     * @param params.AccessToken Access token of the current user.
+     * @param params.Session Optional session identifier for the authentication process.
+     * @param params.ClientMetadata Optional metadata to pass to the service.
+     * @param params.UserContextData Optional user context data.
+     * @param params.AnalyticsMetadata Optional analytics metadata.
+     * @param params.FriendlyDeviceName Optional friendly name for the device.
+     * @returns
+     */
     async associateSoftwareToken(params) {
         return cognitoRequest(params, ServiceTarget.AssociateSoftwareToken, this.cognitoEndpoint);
     }
+    /**
+     * Verifies a software token.
+     * @param params Request to verify a software token.
+     * @param params.AccessToken Access token of the current user.
+     * @param params.FriendlyDeviceName Optional friendly name for the device.
+     * @param params.Session Optional session identifier for the authentication process.
+     * @param params.UserCode The user code to verify.
+     * @returns
+     */
     async verifySoftwareToken(params) {
         return cognitoRequest(params, ServiceTarget.VerifySoftwareToken, this.cognitoEndpoint);
     }
@@ -439,6 +540,51 @@ export class CognitoClient {
         };
         await cognitoRequest(resendConfirmationCodeRequest, ServiceTarget.ResendConfirmationCode, this.cognitoEndpoint);
     }
+    async startWebAuthnRegistration(request) {
+        const response = await cognitoRequest(request, ServiceTarget.StartWebAuthnRegistration, this.cognitoEndpoint);
+        response.CredentialCreationOptions.challenge = base64UrlToUint8Array(response.CredentialCreationOptions.challenge);
+        response.CredentialCreationOptions.user.id = base64UrlToUint8Array(response.CredentialCreationOptions.user.id);
+        response.CredentialCreationOptions.excludeCredentials = (response.CredentialCreationOptions.excludeCredentials || []).map((excludeCred) => ({
+            ...excludeCred,
+            id: base64UrlToUint8Array(excludeCred.id)
+        }));
+        return response;
+    }
+    /**
+     * Completes registration of a passkey authenticator for the currently signed-in user.
+     * @param request Request to complete WebAuthn registration.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.Credential The credential object returned by the WebAuthn API.
+     */
+    async completeWebAuthnRegistration(request) {
+        await cognitoRequest({
+            AccessToken: request.AccessToken,
+            Credential: publicKeyCredentialToJSON(request.Credential)
+        }, ServiceTarget.CompleteWebAuthnRegistration, this.cognitoEndpoint);
+    }
+    /**
+     * Deletes a registered passkey, or WebAuthn, authenticator for the currently signed-in user.
+     *
+     * @param request Request to delete a WebAuthn credential.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.CredentialId The ID of the credential to delete.
+     */
+    async deleteWebAuthnCredential(request) {
+        await cognitoRequest(request, ServiceTarget.DeleteWebAuthnCredential, this.cognitoEndpoint);
+    }
+    /**
+     * Lists all registered WebAuthn credentials for the currently signed-in user.
+     *
+     * @param request Request to list WebAuthn credentials.
+     * @param request.AccessToken Access token of the current user.
+     * @param request.MaxResults Maximum number of credentials to return.
+     * @param request.NextToken Pagination token to continue listing credentials.
+     * @returns
+     */
+    async listWebAuthnCredentials(request) {
+        const response = await cognitoRequest(request, ServiceTarget.ListWebAuthnCredentials, this.cognitoEndpoint);
+        return response;
+    }
     /**
      * Returns a link to Cognito`s Hosted UI for OAuth2 authentication.
      * This method works in conjunction with @see handleCodeFlow .

package/lib/error.js

@@ -401,6 +401,8 @@ export var RevokeTokenException;
     RevokeTokenException["UnsupportedTokenTypeException"] = "UnsupportedTokenTypeException";
 })(RevokeTokenException || (RevokeTokenException = {}));
 export class CognitoError extends Error {
+    errorType;
+    cognitoException;
     constructor(message, errorType, cognitoException) {
         super(message);
         this.errorType = errorType;
@@ -408,108 +410,126 @@ export class CognitoError extends Error {
     }
 }
 export class CommonError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'CommonError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class InitAuthError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'InitAuthError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class RespondToAuthChallengeError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'RespondToAuthChallengeError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class SignUpError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'SignUpError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class ConfirmSignUpError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'ConfirmSignUpError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class ChangePasswordError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'ChangePasswordError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class RevokeTokenError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'RevokeTokenError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class ForgotPasswordError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'ForgotPasswordError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class ConfirmForgotPasswordError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'ConfirmForgotPasswordError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class ResendConfirmationCodeError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'ResendConfirmationCodeError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class UpdateUserAttributesError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'UpdateUserAttributesError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class VerifyUserAttributeError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'VerifyUserAttributeError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class GlobalSignOutError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'GlobalSignOutError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class VerifySoftwareTokenError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'VerifySoftwareTokenError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class AssociateSoftwareTokenError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'AssociateSoftwareTokenError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class SetUserMFAPreferenceError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'SetUserMFAPreferenceError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class ListDevicesError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'ListDevicesError', cognitoException);
         this.cognitoException = cognitoException;
     }
 }
 export class GetUserError extends CognitoError {
+    cognitoException;
     constructor(message, cognitoException) {
         super(message, 'GetUserError', cognitoException);
         this.cognitoException = cognitoException;

package/lib/index.d.ts

@@ -1,2 +1,3 @@
 export * from './cognito-client.js';
 export * from './error.js';
+export * from './utils.js';

package/lib/index.js

@@ -1,2 +1,3 @@
 export * from './cognito-client.js';
 export * from './error.js';
+export * from './utils.js';

package/lib/utils.d.ts

@@ -1,9 +1,13 @@
 /// <reference types="node" resolution-mode="require"/>
+/// <reference types="node" resolution-mode="require"/>
 export declare function uint8ArrayFromHexString(hexString: string): Uint8Array;
 export declare function uint8ArrayFromString(str: string): Uint8Array;
 export declare function uint8ArrayFromBase64String(str: string): Uint8Array;
 export declare function uint8ArrayToHexString(bytes: Uint8Array): string;
-export declare function uint8ArrayToBase64String(bytes: Uint8Array): string;
+export declare function uint8ArrayToBase64String(bytes: Uint8Array | ArrayBuffer): string;
+export declare function uint8ArrayToBase64UrlString(bytes: Uint8Array | ArrayBuffer | undefined): string | undefined;
+export declare function base64UrlToUint8Array(base64: string): Uint8Array;
+export declare function publicKeyCredentialToJSON(cred: any): any;
 export declare function padHex(bigInt: bigint): string;
 export declare function hashHexString(str: string): Promise<string>;
 export declare function hashBuffer(buffer: Uint8Array): Promise<string>;
@@ -27,3 +31,4 @@ export declare function formatTimestamp(date: Date): string;
 export declare function calculateSecretHash(clientSecret: string, userPoolClientId: string, username: string): Promise<string>;
 export declare function digest(algorithm: AlgorithmIdentifier, data: Uint8Array): Promise<Uint8Array>;
 export declare function hmac(algorithm: AlgorithmIdentifier, key: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
+export declare function removeUndefined(obj: any): any;

package/lib/utils.js

@@ -20,8 +20,49 @@ export function uint8ArrayToHexString(bytes) {
     return bytes.reduce((str, byte) => str + byte.toString(16).padStart(2, '0'), '');
 }
 export function uint8ArrayToBase64String(bytes) {
+    if (bytes instanceof ArrayBuffer) {
+        const byteArray = new Uint8Array(bytes);
+        return btoa(String.fromCharCode(...byteArray));
+    }
     return btoa(String.fromCharCode(...bytes));
 }
+export function uint8ArrayToBase64UrlString(bytes) {
+    if (bytes === undefined) {
+        return undefined;
+    }
+    const base64String = uint8ArrayToBase64String(bytes);
+    return base64String.replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+}
+export function base64UrlToUint8Array(base64) {
+    const binary = atob(base64.replace(/-/g, '+').replace(/_/g, '/'));
+    const len = binary.length;
+    const bytes = new Uint8Array(len);
+    for (let i = 0; i < len; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+export function publicKeyCredentialToJSON(cred) {
+    return removeUndefined({
+        authenticatorAttachment: cred.authenticatorAttachment,
+        clientExtensionResults: cred.getClientExtensionResults(),
+        id: cred.id,
+        rawId: uint8ArrayToBase64UrlString(cred.rawId),
+        response: {
+            attestationObject: uint8ArrayToBase64UrlString(cred.response.attestationObject),
+            authenticatorData: cred.response.authenticatorData
+                ? uint8ArrayToBase64UrlString(cred.response.authenticatorData)
+                : undefined,
+            clientDataJSON: uint8ArrayToBase64UrlString(cred.response.clientDataJSON),
+            publicKey: cred.response.getPublicKey ? uint8ArrayToBase64UrlString(cred.response.getPublicKey()) : undefined,
+            publicKeyAlgorithm: cred.response.getPublicKeyAlgorithm ? cred.response.getPublicKeyAlgorithm() : undefined,
+            transports: cred.response.getTransports ? cred.response.getTransports() : undefined,
+            signature: cred.response.signature ? uint8ArrayToBase64UrlString(cred.response.signature) : undefined,
+            userHandle: cred.response.userHandle ? uint8ArrayToBase64UrlString(cred.response.userHandle) : undefined
+        },
+        type: cred.type
+    });
+}
 const N = BigInt('0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1' +
     '29024E088A67CC74020BBEA63B139B22514A08798E3404DD' +
     'EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245' +
@@ -151,3 +192,18 @@ export async function hmac(algorithm, key, data) {
     const signature = await crypto.subtle.sign('HMAC', cryptoKey, data);
     return new Uint8Array(signature);
 }
+export function removeUndefined(obj) {
+    if (Array.isArray(obj)) {
+        return obj.map(item => removeUndefined(item)).filter(item => item !== undefined);
+    }
+    if (obj !== null && typeof obj === 'object') {
+        return Object.entries(obj).reduce((acc, [key, value]) => {
+            const cleaned = removeUndefined(value);
+            if (cleaned !== undefined) {
+                acc[key] = cleaned;
+            }
+            return acc;
+        }, {});
+    }
+    return obj !== undefined ? obj : undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vardario/cognito-client",
-  "version": "5.1.0",
+  "version": "5.2.0",
   "description": "",
   "license": "MIT",
   "author": "Sahin Vardar",
@@ -27,7 +27,7 @@
   "devDependencies": {
     "@aws-sdk/client-cognito-identity-provider": "^3.465.0",
     "@types/jsdom": "^21.1.5",
-    "@types/node": "^20",
+    "@types/node": "^24",
     "@typescript-eslint/eslint-plugin": "^6.11.0",
     "@typescript-eslint/parser": "^6.11.0",
     "esbuild": "^0.25.8",
@@ -36,15 +36,15 @@
     "eslint-plugin-unused-imports": "^4.1.4",
     "husky": "^8.0.3",
     "isomorphic-fetch": "^3.0.0",
-    "jsdom": "^22.1.0",
-    "lint-staged": "^15.1.0",
+    "jsdom": "^26.1.0",
+    "lint-staged": "^16.1.4",
     "prettier": "^3.1.0",
     "prettier-package-json": "^2.8.0",
-    "semantic-release": "^22.0.8",
-    "testcontainers": "^10.2.2",
+    "semantic-release": "^24.2.7",
+    "testcontainers": "^11.5.1",
     "tsx": "^4.7.1",
     "typescript": "^5.2.2",
-    "vitest": "^0.34.6",
+    "vitest": "^3.2.4",
     "vitest-fetch-mock": "^0.2.2"
   },
   "lint-staged": {