captify 0.1.15

package/dist/services/cognito/services/cognito-identity.service.js

@@ -0,0 +1,478 @@
+import { BaseAwsService } from "../../shared";
+import { CognitoIdentityClient, GetCredentialsForIdentityCommand, GetIdCommand, } from "@aws-sdk/client-cognito-identity";
+import { COGNITO_ERROR_MESSAGES } from "../constants";
+import { classifyCognitoError } from "../errors";
+/**
+ * Maximum number of cached credential entries (LRU eviction when exceeded)
+ * Can be overridden via CREDENTIALS_CACHE_MAX_SIZE environment variable
+ */
+const DEFAULT_MAX_CACHE_SIZE = 1000;
+/**
+ * Interval for cleaning up expired credentials (milliseconds)
+ * Can be overridden via CREDENTIALS_CACHE_CLEANUP_INTERVAL_MS environment variable
+ */
+const DEFAULT_CLEANUP_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * Service for exchanging Cognito User Pool JWT tokens for temporary AWS credentials
+ * via Cognito Identity Pool.
+ *
+ * This enables user-level AWS access control - each user gets temporary credentials
+ * with IAM permissions based on their Cognito group membership.
+ *
+ * Features:
+ * - Bounded LRU cache with automatic eviction
+ * - Request deduplication for concurrent calls
+ * - Periodic cleanup of expired credentials
+ * - Proper base64url JWT decoding
+ *
+ * @example
+ * ```typescript
+ * // Initialize service
+ * const identityService = CognitoIdentityService.create({
+ *   region: 'us-east-1',
+ *   userPoolId: 'us-east-1_ABC123',
+ *   identityPoolId: 'us-east-1:abc-123-def',
+ *   clientId: 'your-client-id'
+ * });
+ *
+ * // Exchange user's JWT for AWS credentials
+ * const userCredentials = await identityService.getUserCredentials({
+ *   idToken: userJwtToken
+ * });
+ *
+ * // Use credentials with AWS services
+ * const s3 = new S3Client({
+ *   credentials: {
+ *     accessKeyId: userCredentials.accessKeyId,
+ *     secretAccessKey: userCredentials.secretAccessKey,
+ *     sessionToken: userCredentials.sessionToken
+ *   }
+ * });
+ * ```
+ */
+export class CognitoIdentityService extends BaseAwsService {
+    constructor(config, logger) {
+        var _a, _b;
+        super({ logger, serviceName: "CognitoIdentityService" });
+        /**
+         * In-memory LRU cache for user credentials keyed by user ID (JWT sub claim)
+         */
+        this.credentialsCache = new Map();
+        /**
+         * Pending credential fetch promises for request deduplication
+         * Prevents concurrent calls for the same user from triggering parallel AWS fetches
+         */
+        this.pendingRequests = new Map();
+        this.config = config;
+        if (!config.identityPoolId) {
+            throw new Error(COGNITO_ERROR_MESSAGES.IDENTITY_POOL_ID_REQUIRED);
+        }
+        if (!config.userPoolId) {
+            throw new Error(COGNITO_ERROR_MESSAGES.USER_POOL_ID_REQUIRED);
+        }
+        this.identityPoolId = config.identityPoolId;
+        // Configure cache size (from env or default)
+        const rawMaxSize = (_a = process.env.CREDENTIALS_CACHE_MAX_SIZE) !== null && _a !== void 0 ? _a : "";
+        const parsedMaxSize = parseInt(rawMaxSize, 10);
+        this.maxCacheSize =
+            Number.isFinite(parsedMaxSize) && parsedMaxSize > 0 ? parsedMaxSize : DEFAULT_MAX_CACHE_SIZE;
+        // Create Identity client for credential exchange
+        this.identityClient = new CognitoIdentityClient({
+            region: config.region,
+        });
+        // Start periodic cleanup of expired credentials
+        const rawCleanup = (_b = process.env.CREDENTIALS_CACHE_CLEANUP_INTERVAL_MS) !== null && _b !== void 0 ? _b : "";
+        const parsedCleanup = parseInt(rawCleanup, 10);
+        const cleanupIntervalMs = Number.isFinite(parsedCleanup) && parsedCleanup > 0
+            ? parsedCleanup
+            : DEFAULT_CLEANUP_INTERVAL_MS;
+        this.cleanupIntervalHandle = setInterval(() => {
+            this.cleanupExpiredEntries();
+        }, cleanupIntervalMs);
+        // Ensure cleanup interval doesn't prevent process exit
+        if (this.cleanupIntervalHandle.unref) {
+            this.cleanupIntervalHandle.unref();
+        }
+        this.logger.info("CognitoIdentityService initialized", {
+            region: config.region,
+            identityPoolId: this.maskIdentityPoolId(config.identityPoolId),
+            maxCacheSize: this.maxCacheSize,
+            cleanupIntervalMs,
+        });
+    }
+    /**
+     * Create a new CognitoIdentityService instance
+     */
+    static create(config, logger) {
+        return new CognitoIdentityService(config, logger);
+    }
+    /**
+     * Get temporary AWS credentials for a user by exchanging their JWT token
+     * via Cognito Identity Pool.
+     *
+     * The returned credentials have IAM permissions based on the user's Cognito group.
+     *
+     * Credentials are cached by user ID and automatically reused if still valid,
+     * significantly improving performance by avoiding redundant credential exchanges.
+     *
+     * @param params - Parameters including the user's JWT ID token
+     * @returns Temporary AWS credentials with user-specific IAM permissions
+     *
+     * @example
+     * ```typescript
+     * const credentials = await service.getUserCredentials({
+     *   idToken: 'eyJhbGc...'
+     * });
+     *
+     * console.log(credentials.accessKeyId);    // ASIA...
+     * console.log(credentials.expiration);     // 1 hour from now
+     * console.log(credentials.identityId);     // us-east-1:abc-123...
+     * ```
+     */
+    async getUserCredentials(params) {
+        // Extract user ID from JWT for cache key
+        const userId = this.extractUserIdFromToken(params.idToken);
+        // Check cache first
+        const cachedCredentials = this.getCachedCredentials(userId);
+        if (cachedCredentials) {
+            this.logger.debug("Using cached credentials", {
+                userId: this.maskUserId(userId),
+                expiresIn: Math.floor((cachedCredentials.expiration.getTime() - Date.now()) / 1000) + "s",
+            });
+            return cachedCredentials;
+        }
+        // Check if there's already a pending request for this user (request deduplication)
+        const pendingRequest = this.pendingRequests.get(userId);
+        if (pendingRequest) {
+            this.logger.debug("Awaiting pending credential request", {
+                userId: this.maskUserId(userId),
+            });
+            return pendingRequest;
+        }
+        // Cache miss or expired - fetch new credentials
+        const fetchPromise = this.executeWithRetry(async () => {
+            const userPoolId = params.userPoolId || this.config.userPoolId;
+            this.logger.info("Fetching new user credentials from Identity Pool", {
+                identityPoolId: this.maskIdentityPoolId(this.identityPoolId),
+                userId: this.maskUserId(userId),
+            });
+            // Step 1: Exchange JWT token for Identity ID
+            const getIdCommand = new GetIdCommand({
+                IdentityPoolId: this.identityPoolId,
+                Logins: {
+                    [`cognito-idp.${this.config.region}.amazonaws.com/${userPoolId}`]: params.idToken,
+                },
+            });
+            const identityResponse = await this.identityClient.send(getIdCommand);
+            if (!identityResponse.IdentityId) {
+                throw new Error("Failed to get Identity ID from Identity Pool");
+            }
+            this.logger.debug("Obtained Identity ID", {
+                identityId: this.maskIdentityId(identityResponse.IdentityId),
+            });
+            // Step 2: Exchange Identity ID for temporary AWS credentials
+            const getCredsCommand = new GetCredentialsForIdentityCommand({
+                IdentityId: identityResponse.IdentityId,
+                Logins: {
+                    [`cognito-idp.${this.config.region}.amazonaws.com/${userPoolId}`]: params.idToken,
+                },
+            });
+            const credentialsResponse = await this.identityClient.send(getCredsCommand);
+            if (!credentialsResponse.Credentials) {
+                throw new Error("Failed to get credentials from Identity Pool");
+            }
+            const creds = credentialsResponse.Credentials;
+            if (!creds.AccessKeyId || !creds.SecretKey || !creds.SessionToken || !creds.Expiration) {
+                throw new Error("Incomplete credentials received from Identity Pool");
+            }
+            this.logger.info("Successfully obtained user credentials", {
+                identityId: this.maskIdentityId(identityResponse.IdentityId),
+                expiresIn: Math.floor((creds.Expiration.getTime() - Date.now()) / 1000) + "s",
+            });
+            const credentials = {
+                accessKeyId: creds.AccessKeyId,
+                secretAccessKey: creds.SecretKey,
+                sessionToken: creds.SessionToken,
+                expiration: creds.Expiration,
+                identityId: identityResponse.IdentityId,
+            };
+            // Cache the credentials for future use
+            this.cacheCredentials(userId, credentials);
+            return credentials;
+        });
+        // Store pending request for deduplication
+        this.pendingRequests.set(userId, fetchPromise);
+        try {
+            const credentials = await fetchPromise;
+            return credentials;
+        }
+        finally {
+            // Always remove from pending requests (success or failure)
+            this.pendingRequests.delete(userId);
+        }
+    }
+    /**
+     * Check if credentials are expired or about to expire
+     *
+     * @param credentials - User credentials to check
+     * @param bufferSeconds - Consider expired if expiring within this many seconds (default: 300 = 5 minutes)
+     * @returns true if credentials are expired or about to expire
+     */
+    areCredentialsExpired(credentials, bufferSeconds = 300) {
+        const expirationTime = credentials.expiration.getTime();
+        const now = Date.now();
+        const bufferMs = bufferSeconds * 1000;
+        return now >= expirationTime - bufferMs;
+    }
+    /**
+     * Clear cached credentials for a specific user or all users
+     *
+     * @param userId - Optional user ID to clear cache for. If not provided, clears all cached credentials.
+     *
+     * @example
+     * ```typescript
+     * // Clear cache for specific user
+     * service.clearCredentialsCache('user-123');
+     *
+     * // Clear all cached credentials
+     * service.clearCredentialsCache();
+     * ```
+     */
+    clearCredentialsCache(userId) {
+        if (userId) {
+            this.credentialsCache.delete(userId);
+            this.logger.debug("Cleared cached credentials for user", {
+                userId: this.maskUserId(userId),
+            });
+        }
+        else {
+            this.credentialsCache.clear();
+            this.logger.debug("Cleared all cached credentials");
+        }
+    }
+    /**
+     * Get cache statistics for monitoring
+     *
+     * WARNING: This method exposes sensitive cache information and must NEVER be
+     * exposed to client-facing endpoints or telemetry pipelines without proper
+     * redaction/aggregation. Only use in admin-only, authorized contexts.
+     *
+     * @returns Object containing cache size and entry details
+     * @private This should only be called by authorized admin/monitoring systems
+     */
+    getCacheStats() {
+        const entries = Array.from(this.credentialsCache.entries()).map(([userId, entry]) => ({
+            userId: this.maskUserId(userId),
+            expiresIn: Math.floor((entry.credentials.expiration.getTime() - Date.now()) / 1000),
+            cachedAt: entry.cachedAt,
+            lastAccessedAt: entry.lastAccessedAt,
+        }));
+        return {
+            size: this.credentialsCache.size,
+            entries,
+        };
+    }
+    /**
+     * Extract user ID (sub claim) from JWT token
+     *
+     * Uses proper base64url decoding (JWT standard) to reliably parse the payload.
+     * Note: This method does NOT verify the JWT signature. Signature verification
+     * should be performed by NextAuth.js or the authentication layer before the
+     * token reaches this service.
+     *
+     * @param idToken - JWT ID token
+     * @returns User ID from token's sub claim
+     */
+    extractUserIdFromToken(idToken) {
+        try {
+            // JWT tokens are in format: header.payload.signature
+            const parts = idToken.split(".");
+            if (parts.length !== 3) {
+                throw new Error("Invalid JWT token format");
+            }
+            // Decode the payload (base64url encoded)
+            const payload = parts[1];
+            // Convert base64url to base64:
+            // - Replace '-' with '+'
+            // - Replace '_' with '/'
+            // - Add padding if needed
+            let base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+            // Add padding if necessary (base64url omits padding)
+            const padLength = (4 - (base64.length % 4)) % 4;
+            base64 += "=".repeat(padLength);
+            // Decode and parse
+            const decodedPayload = Buffer.from(base64, "base64").toString("utf-8");
+            const claims = JSON.parse(decodedPayload);
+            if (!claims.sub) {
+                throw new Error("JWT token missing 'sub' claim");
+            }
+            return claims.sub;
+        }
+        catch (error) {
+            this.logger.error("Failed to extract user ID from token", { error });
+            throw new Error("Invalid JWT token: unable to extract user ID");
+        }
+    }
+    /**
+     * Get cached credentials if valid (not expired)
+     * Updates last access time for LRU tracking
+     *
+     * @param userId - User ID to look up
+     * @returns Cached credentials if valid, undefined otherwise
+     */
+    getCachedCredentials(userId) {
+        const cached = this.credentialsCache.get(userId);
+        if (!cached) {
+            return undefined;
+        }
+        // Check if credentials are expired (with 5 minute buffer)
+        if (this.areCredentialsExpired(cached.credentials)) {
+            this.logger.debug("Cached credentials expired, removing from cache", {
+                userId: this.maskUserId(userId),
+            });
+            this.credentialsCache.delete(userId);
+            return undefined;
+        }
+        // Update last access time for LRU tracking
+        cached.lastAccessedAt = new Date();
+        this.credentialsCache.set(userId, cached);
+        return cached.credentials;
+    }
+    /**
+     * Cache credentials for a user with LRU eviction
+     *
+     * @param userId - User ID
+     * @param credentials - Credentials to cache
+     */
+    cacheCredentials(userId, credentials) {
+        const now = new Date();
+        // If cache is at max size, evict least recently used entry
+        if (this.credentialsCache.size >= this.maxCacheSize && !this.credentialsCache.has(userId)) {
+            this.evictLRUEntry();
+        }
+        this.credentialsCache.set(userId, {
+            credentials,
+            cachedAt: now,
+            lastAccessedAt: now,
+        });
+        this.logger.debug("Cached credentials for user", {
+            userId: this.maskUserId(userId),
+            cacheSize: this.credentialsCache.size,
+            expiresIn: Math.floor((credentials.expiration.getTime() - Date.now()) / 1000) + "s",
+        });
+    }
+    /**
+     * Evict the least recently used entry from the cache
+     */
+    evictLRUEntry() {
+        let lruUserId = null;
+        let lruTime = Date.now();
+        // Find the entry with the oldest lastAccessedAt time
+        for (const [userId, entry] of this.credentialsCache.entries()) {
+            const accessTime = entry.lastAccessedAt.getTime();
+            if (accessTime < lruTime) {
+                lruTime = accessTime;
+                lruUserId = userId;
+            }
+        }
+        if (lruUserId) {
+            this.credentialsCache.delete(lruUserId);
+            this.logger.debug("Evicted LRU cache entry", {
+                userId: this.maskUserId(lruUserId),
+                cacheSize: this.credentialsCache.size,
+            });
+        }
+    }
+    /**
+     * Clean up expired credential entries from the cache
+     * Called periodically by the cleanup interval
+     */
+    cleanupExpiredEntries() {
+        let removedCount = 0;
+        for (const [userId, entry] of this.credentialsCache.entries()) {
+            if (this.areCredentialsExpired(entry.credentials)) {
+                this.credentialsCache.delete(userId);
+                removedCount++;
+            }
+        }
+        if (removedCount > 0) {
+            this.logger.debug("Cleaned up expired cache entries", {
+                removedCount,
+                remainingSize: this.credentialsCache.size,
+            });
+        }
+    }
+    /**
+     * Destroy the service and clean up resources
+     * Call this when shutting down to clear the cleanup interval
+     */
+    destroy() {
+        if (this.cleanupIntervalHandle) {
+            clearInterval(this.cleanupIntervalHandle);
+            this.cleanupIntervalHandle = undefined;
+            this.logger.debug("Cleared credential cache cleanup interval");
+        }
+        this.credentialsCache.clear();
+        this.pendingRequests.clear();
+        this.logger.info("CognitoIdentityService destroyed");
+    }
+    classifyError(err) {
+        return classifyCognitoError(err);
+    }
+    onMetric(name, dims) {
+        this.logger.debug(`Cognito Identity Metric: ${name}`, dims);
+    }
+    /**
+     * Mask Identity Pool ID for logging (security)
+     */
+    maskIdentityPoolId(identityPoolId) {
+        if (!identityPoolId || identityPoolId.length < 10) {
+            return "***";
+        }
+        // Show region and first few chars: us-east-1:abc***
+        const parts = identityPoolId.split(":");
+        if (parts.length === 2) {
+            return `${parts[0]}:${parts[1].substring(0, 3)}***`;
+        }
+        return identityPoolId.substring(0, 6) + "***";
+    }
+    /**
+     * Mask Identity ID for logging (security)
+     */
+    maskIdentityId(identityId) {
+        if (!identityId || identityId.length < 10) {
+            return "***";
+        }
+        // Show region and first few chars: us-east-1:abc***
+        const parts = identityId.split(":");
+        if (parts.length === 2) {
+            return `${parts[0]}:${parts[1].substring(0, 6)}***`;
+        }
+        return identityId.substring(0, 6) + "***";
+    }
+    /**
+     * Mask user ID for logging (security)
+     */
+    maskUserId(userId) {
+        if (!userId || userId.length < 8) {
+            return "***";
+        }
+        // Show first 4 and last 4 chars: abcd***xyz
+        return userId.substring(0, 4) + "***" + userId.substring(userId.length - 4);
+    }
+}
+// Singleton identity service instance
+let identityServiceInstance = null;
+export function getIdentityService() {
+    if (!identityServiceInstance) {
+        const config = {
+            region: process.env.AWS_REGION || "us-east-1",
+            userPoolId: process.env.COGNITO_USER_POOL_ID || "",
+            clientId: process.env.COGNITO_CLIENT_ID || "",
+            identityPoolId: process.env.COGNITO_IDENTITY_POOL_ID || "",
+        };
+        identityServiceInstance = CognitoIdentityService.create(config);
+    }
+    return identityServiceInstance;
+}
+//# sourceMappingURL=cognito-identity.service.js.map

package/dist/services/cognito/services/cognito-identity.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-identity.service.js","sourceRoot":"","sources":["../../../../lib/services/cognito/services/cognito-identity.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,qBAAqB,EACrB,gCAAgC,EAChC,YAAY,GACb,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAQjD;;;GAGG;AACH,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC;;;GAGG;AACH,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,OAAO,sBAAuB,SAAQ,cAAc;IA0BxD,YAAoB,MAAqB,EAAE,MAAe;;QACxD,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAtB3D;;WAEG;QACc,qBAAgB,GAAuC,IAAI,GAAG,EAAE,CAAC;QAElF;;;WAGG;QACc,oBAAe,GAA6C,IAAI,GAAG,EAAE,CAAC;QAcrF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAE5C,6CAA6C;QAC7C,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,0BAA0B,mCAAI,EAAE,CAAC;QAChE,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,YAAY;YACf,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAE/F,iDAAiD;QACjD,IAAI,CAAC,cAAc,GAAG,IAAI,qBAAqB,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,gDAAgD;QAChD,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,qCAAqC,mCAAI,EAAE,CAAC;QAC3E,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,iBAAiB,GACrB,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC;YACjD,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,2BAA2B,CAAC;QAElC,IAAI,CAAC,qBAAqB,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5C,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/B,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAEtB,uDAAuD;QACvD,IAAI,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;YACrD,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC;YAC9D,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,MAAM,CAAC,MAAqB,EAAE,MAAe;QAClD,OAAO,IAAI,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAgC;QACvD,yCAAyC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE3D,oBAAoB;QACpB,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBAC5C,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC/B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG;aAC1F,CAAC,CAAC;YACH,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAED,mFAAmF;QACnF,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;gBACvD,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,gDAAgD;QAChD,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,IAAI,EAAE;YACpD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;YAE/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;gBACnE,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC;gBAC5D,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;aAChC,CAAC,CAAC;YAEH,6CAA6C;YAC7C,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC;gBACpC,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE;oBACN,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,MAAM,kBAAkB,UAAU,EAAE,CAAC,EAAE,MAAM,CAAC,OAAO;iBAClF;aACF,CAAC,CAAC;YAEH,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAEtE,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;gBACxC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,UAAU,CAAC;aAC7D,CAAC,CAAC;YAEH,6DAA6D;YAC7D,MAAM,eAAe,GAAG,IAAI,gCAAgC,CAAC;gBAC3D,UAAU,EAAE,gBAAgB,CAAC,UAAU;gBACvC,MAAM,EAAE;oBACN,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,MAAM,kBAAkB,UAAU,EAAE,CAAC,EAAE,MAAM,CAAC,OAAO;iBAClF;aACF,CAAC,CAAC;YAEH,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAE5E,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,WAAW,CAAC;YAE9C,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;gBACvF,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;gBACzD,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,UAAU,CAAC;gBAC5D,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG;aAC9E,CAAC,CAAC;YAEH,MAAM,WAAW,GAAuB;gBACtC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,eAAe,EAAE,KAAK,CAAC,SAAS;gBAChC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,gBAAgB,CAAC,UAAU;aACxC,CAAC;YAEF,uCAAuC;YACvC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAE3C,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,0CAA0C;QAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC;YACvC,OAAO,WAAW,CAAC;QACrB,CAAC;gBAAS,CAAC;YACT,2DAA2D;YAC3D,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,qBAAqB,CAAC,WAA+B,EAAE,gBAAwB,GAAG;QAChF,MAAM,cAAc,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;QAEtC,OAAO,GAAG,IAAI,cAAc,GAAG,QAAQ,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CAAC,MAAe;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;gBACvD,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,aAAa;QAInB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACpF,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;YACnF,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC,CAAC;QAEJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI;YAChC,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,sBAAsB,CAAC,OAAe;QAC5C,IAAI,CAAC;YACH,qDAAqD;YACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YAED,yCAAyC;YACzC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAEzB,+BAA+B;YAC/B,yBAAyB;YACzB,yBAAyB;YACzB,0BAA0B;YAC1B,IAAI,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAE3D,qDAAqD;YACrD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAEhC,mBAAmB;YACnB,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAE1C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YAED,OAAO,MAAM,CAAC,GAAG,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAAC,MAAc;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,0DAA0D;QAC1D,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE;gBACnE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,2CAA2C;QAC3C,MAAM,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE1C,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,gBAAgB,CAAC,MAAc,EAAE,WAA+B;QACtE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,2DAA2D;QAC3D,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1F,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE;YAChC,WAAW;YACX,QAAQ,EAAE,GAAG;YACb,cAAc,EAAE,GAAG;SACpB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;YAC/C,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI;YACrC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG;SACpF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,aAAa;QACnB,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,OAAO,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAEjC,qDAAqD;QACrD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAClD,IAAI,UAAU,GAAG,OAAO,EAAE,CAAC;gBACzB,OAAO,GAAG,UAAU,CAAC;gBACrB,SAAS,GAAG,MAAM,CAAC;YACrB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE;gBAC3C,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBAClC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,qBAAqB;QAC3B,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,IAAI,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACrC,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;QAED,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;gBACpD,YAAY;gBACZ,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAC1C,IAAI,CAAC,qBAAqB,GAAG,SAAS,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACvD,CAAC;IAES,aAAa,CAAC,GAAY;QAClC,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAES,QAAQ,CAAC,IAAY,EAAE,IAA6B;QAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,cAAsB;QAC/C,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,oDAAoD;QACpD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC;QACtD,CAAC;QACD,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IAChD,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,UAAkB;QACvC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,oDAAoD;QACpD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC;QACtD,CAAC;QACD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IAC5C,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,MAAc;QAC/B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,4CAA4C;QAC5C,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;CACF;AAED,sCAAsC;AACtC,IAAI,uBAAuB,GAAkC,IAAI,CAAC;AAElE,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG;YACb,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;YAC7C,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE;YAClD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE;YAC7C,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE;SAC3D,CAAC;QACF,uBAAuB,GAAG,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC"}

package/dist/services/cognito/services/cognito-user.service.d.ts

@@ -0,0 +1,113 @@
+import type { Logger } from "../..";
+import type { CognitoUser, CognitoUserConfig } from "../interfaces";
+import { BaseAwsService } from "../../shared/services";
+/**
+ * Cognito User Service
+ *
+ * Handles user-level Cognito operations that authenticated users can perform on themselves.
+ * Uses access tokens (not admin credentials) and does not require IAM admin permissions.
+ *
+ * Key differences from CognitoAdminService:
+ * - Uses user's Cognito access token (not AWS credentials)
+ * - Users can only operate on their own data
+ * - No admin privileges required
+ * - Enforced by Cognito at the token level
+ *
+ * @example
+ * ```typescript
+ * const config = { region: 'us-east-1' };
+ * const userService = new CognitoUserService({ config });
+ *
+ * // Update user's own attributes
+ * await userService.updateUserAttributes({
+ *   accessToken: session.accessToken,
+ *   attributes: { given_name: "John" }
+ * });
+ *
+ * // Get user's own details
+ * const user = await userService.getUserDetails({
+ *   accessToken: session.accessToken
+ * });
+ * ```
+ */
+export declare class CognitoUserService extends BaseAwsService {
+    private readonly config;
+    constructor(deps: {
+        config: CognitoUserConfig;
+        logger?: Logger;
+    });
+    /**
+     * Load configuration from environment variables
+     *
+     * @returns CognitoUserConfig with region from env
+     */
+    static loadEnvConfig(): CognitoUserConfig;
+    /**
+     * Create a singleton instance of CognitoUserService
+     *
+     * @param config - Cognito user configuration
+     * @param logger - Optional logger instance
+     * @returns CognitoUserService instance
+     */
+    static create(config: CognitoUserConfig, logger?: Logger): CognitoUserService;
+    /**
+     * Update user's own attributes using their Cognito access token.
+     * Does not require admin privileges - users can only update their own attributes.
+     *
+     * @param params - Update parameters
+     * @param params.accessToken - User's Cognito access token from OAuth flow
+     * @param params.attributes - Attributes to update (standard and custom)
+     * @returns Promise that resolves when update is complete
+     *
+     * @example
+     * ```typescript
+     * await userService.updateUserAttributes({
+     *   accessToken: session.accessToken,
+     *   attributes: {
+     *     given_name: "John",
+     *     "custom:account_status": "PENDING"
+     *   }
+     * });
+     * ```
+     */
+    updateUserAttributes(params: {
+        accessToken: string;
+        attributes: Record<string, string>;
+    }): Promise<void>;
+    /**
+     * Get user's own details using their Cognito access token.
+     * Does not require admin privileges - users can only get their own details.
+     *
+     * @param params - Get user parameters
+     * @param params.accessToken - User's Cognito access token from OAuth flow
+     * @returns User details with attributes
+     *
+     * @example
+     * ```typescript
+     * const user = await userService.getUserDetails({
+     *   accessToken: session.accessToken
+     * });
+     * console.log(user.attributes?.["custom:account_status"]);
+     * ```
+     */
+    getUserDetails(params: {
+        accessToken: string;
+    }): Promise<CognitoUser>;
+    /**
+     * Classify Cognito errors for retry logic
+     */
+    protected classifyError(error: unknown): import("../..").CognitoError;
+}
+/**
+ * Get singleton instance of CognitoUserService
+ *
+ * @param config - Optional Cognito user configuration (defaults to loading from env)
+ * @param logger - Optional logger instance
+ * @returns CognitoUserService instance
+ */
+export declare function getCognitoUserService(config?: CognitoUserConfig, logger?: Logger): CognitoUserService;
+/**
+ * Clear singleton instance (useful for testing)
+ */
+export declare function clearCognitoUserService(): void;
+//# sourceMappingURL=cognito-user.service.d.ts.map

package/dist/services/cognito/services/cognito-user.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-user.service.d.ts","sourceRoot":"","sources":["../../../../lib/services/cognito/services/cognito-user.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAOhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,kBAAmB,SAAQ,cAAc;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;gBAE/B,IAAI,EAAE;QAAE,MAAM,EAAE,iBAAiB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAKhE;;;;OAIG;IACH,MAAM,CAAC,aAAa,IAAI,iBAAiB;IAMzC;;;;;;OAMG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB;IAI7E;;;;;;;;;;;;;;;;;;;OAmBG;IACG,oBAAoB,CAAC,MAAM,EAAE;QACjC,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,IAAI,CAAC;IAmCjB;;;;;;;;;;;;;;;OAeG;IACG,cAAc,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IA6C3E;;OAEG;IACH,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO;CAGvC;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,CAAC,EAAE,iBAAiB,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,kBAAkB,CAMpB;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C"}