captify 0.1.15

package/dist/auth/services/cognito/constants/cognito.constants.js

@@ -0,0 +1,107 @@
+export const COGNITO_ADMIN_ERROR_CODES = {
+    // Admin operation errors
+    ACCESS_DENIED: "AccessDeniedException",
+    INVALID_PARAMETER: "InvalidParameterException",
+    USER_NOT_FOUND: "UserNotFoundException",
+    USER_EXISTS: "UsernameExistsException",
+    RESOURCE_NOT_FOUND: "ResourceNotFoundException",
+    NOT_AUTHORIZED: "NotAuthorizedException",
+    // Password errors
+    INVALID_PASSWORD: "InvalidPasswordException",
+    PASSWORD_RESET_REQUIRED: "PasswordResetRequiredException",
+    // User state errors
+    USER_NOT_CONFIRMED: "UserNotConfirmedException",
+    USER_LAMBDA_VALIDATION: "UserLambdaValidationException",
+    // Group errors
+    GROUP_EXISTS: "GroupExistsException",
+    // MFA errors
+    MFA_METHOD_NOT_FOUND: "MFAMethodNotFoundException",
+    SOFTWARE_TOKEN_MFA_NOT_FOUND: "SoftwareTokenMFANotFoundException",
+    // Rate limiting errors
+    TOO_MANY_REQUESTS: "TooManyRequestsException",
+    LIMIT_EXCEEDED: "LimitExceededException",
+    TOO_MANY_FAILED_ATTEMPTS: "TooManyFailedAttemptsException",
+    // Service errors
+    INTERNAL_ERROR: "InternalErrorException",
+    INVALID_LAMBDA_RESPONSE: "InvalidLambdaResponseException",
+    UNEXPECTED_LAMBDA: "UnexpectedLambdaException",
+    // Other errors
+    ALIAS_EXISTS: "AliasExistsException",
+    CODE_MISMATCH: "CodeMismatchException",
+    EXPIRED_CODE: "ExpiredCodeException",
+};
+export const COGNITO_ADMIN_FATAL_ERROR_CODES = [
+    COGNITO_ADMIN_ERROR_CODES.ACCESS_DENIED,
+    COGNITO_ADMIN_ERROR_CODES.INVALID_PARAMETER,
+    COGNITO_ADMIN_ERROR_CODES.USER_NOT_FOUND,
+    COGNITO_ADMIN_ERROR_CODES.USER_EXISTS,
+    COGNITO_ADMIN_ERROR_CODES.RESOURCE_NOT_FOUND,
+    COGNITO_ADMIN_ERROR_CODES.NOT_AUTHORIZED,
+    COGNITO_ADMIN_ERROR_CODES.INVALID_PASSWORD,
+    COGNITO_ADMIN_ERROR_CODES.GROUP_EXISTS,
+    COGNITO_ADMIN_ERROR_CODES.ALIAS_EXISTS,
+    COGNITO_ADMIN_ERROR_CODES.CODE_MISMATCH,
+    COGNITO_ADMIN_ERROR_CODES.EXPIRED_CODE,
+    COGNITO_ADMIN_ERROR_CODES.MFA_METHOD_NOT_FOUND,
+    COGNITO_ADMIN_ERROR_CODES.SOFTWARE_TOKEN_MFA_NOT_FOUND,
+];
+export const COGNITO_ADMIN_RETRYABLE_ERROR_CODES = [
+    COGNITO_ADMIN_ERROR_CODES.TOO_MANY_REQUESTS,
+    COGNITO_ADMIN_ERROR_CODES.LIMIT_EXCEEDED,
+    COGNITO_ADMIN_ERROR_CODES.INTERNAL_ERROR,
+    COGNITO_ADMIN_ERROR_CODES.TOO_MANY_FAILED_ATTEMPTS,
+];
+/**
+ * AWS Cognito limits and constraints
+ * Reference: https://docs.aws.amazon.com/cognito/latest/developerguide/limits.html
+ */
+export const COGNITO_LIMITS = {
+    // Username constraints
+    USERNAME_MIN_LENGTH: 1,
+    USERNAME_MAX_LENGTH: 128,
+    // Password constraints (AWS defaults - can be customized in User Pool policy)
+    PASSWORD_MIN_LENGTH: 6,
+    PASSWORD_MAX_LENGTH: 256,
+    // Email constraints
+    EMAIL_MAX_LENGTH: 320, // RFC 5321
+    // Phone number constraints
+    PHONE_NUMBER_MAX_LENGTH: 20,
+    // User Pool ID format
+    USER_POOL_ID_PATTERN: /^[\w-]+_[a-zA-Z0-9]+$/,
+    // Group name constraints
+    GROUP_NAME_MIN_LENGTH: 1,
+    GROUP_NAME_MAX_LENGTH: 128,
+    // Attribute constraints
+    // Custom attribute names: max 20 characters (not including "custom:" prefix)
+    // Reference: AWS Cognito custom attribute name limit
+    CUSTOM_ATTRIBUTE_NAME_MAX_LENGTH: 20,
+    ATTRIBUTE_VALUE_MAX_LENGTH: 2048,
+    // List operations
+    LIST_USERS_MAX_LIMIT: 60,
+    LIST_GROUPS_MAX_LIMIT: 60,
+    // Description constraints
+    DESCRIPTION_MAX_LENGTH: 2048,
+};
+/**
+ * Cognito username validation pattern
+ * Usernames can contain: alphanumeric characters, plus (+), equals (=),
+ * comma (,), period (.), at (@), hyphen (-), and underscore (_)
+ */
+export const COGNITO_USERNAME_PATTERN = /^[a-zA-Z0-9+._@-]+$/;
+/**
+ * Cognito email validation pattern (simplified)
+ */
+export const COGNITO_EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/**
+ * Cognito phone number pattern (E.164 format)
+ * Must start with + and contain only digits
+ */
+export const COGNITO_PHONE_PATTERN = /^\+[1-9]\d{1,14}$/;
+// ============================================================================
+// Permission Constants
+// ============================================================================
+/**
+ * Cognito group name for users who can manage users and groups
+ */
+export const USER_ADMIN_GROUP = "User_Admin";
+//# sourceMappingURL=cognito.constants.js.map

package/dist/auth/services/cognito/constants/cognito.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito.constants.js","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/constants/cognito.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,yBAAyB;IACzB,aAAa,EAAE,uBAAuB;IACtC,iBAAiB,EAAE,2BAA2B;IAC9C,cAAc,EAAE,uBAAuB;IACvC,WAAW,EAAE,yBAAyB;IACtC,kBAAkB,EAAE,2BAA2B;IAC/C,cAAc,EAAE,wBAAwB;IAExC,kBAAkB;IAClB,gBAAgB,EAAE,0BAA0B;IAC5C,uBAAuB,EAAE,gCAAgC;IAEzD,oBAAoB;IACpB,kBAAkB,EAAE,2BAA2B;IAC/C,sBAAsB,EAAE,+BAA+B;IAEvD,eAAe;IACf,YAAY,EAAE,sBAAsB;IAEpC,aAAa;IACb,oBAAoB,EAAE,4BAA4B;IAClD,4BAA4B,EAAE,mCAAmC;IAEjE,uBAAuB;IACvB,iBAAiB,EAAE,0BAA0B;IAC7C,cAAc,EAAE,wBAAwB;IACxC,wBAAwB,EAAE,gCAAgC;IAE1D,iBAAiB;IACjB,cAAc,EAAE,wBAAwB;IACxC,uBAAuB,EAAE,gCAAgC;IACzD,iBAAiB,EAAE,2BAA2B;IAE9C,eAAe;IACf,YAAY,EAAE,sBAAsB;IACpC,aAAa,EAAE,uBAAuB;IACtC,YAAY,EAAE,sBAAsB;CAC5B,CAAC;AAEX,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,yBAAyB,CAAC,aAAa;IACvC,yBAAyB,CAAC,iBAAiB;IAC3C,yBAAyB,CAAC,cAAc;IACxC,yBAAyB,CAAC,WAAW;IACrC,yBAAyB,CAAC,kBAAkB;IAC5C,yBAAyB,CAAC,cAAc;IACxC,yBAAyB,CAAC,gBAAgB;IAC1C,yBAAyB,CAAC,YAAY;IACtC,yBAAyB,CAAC,YAAY;IACtC,yBAAyB,CAAC,aAAa;IACvC,yBAAyB,CAAC,YAAY;IACtC,yBAAyB,CAAC,oBAAoB;IAC9C,yBAAyB,CAAC,4BAA4B;CAC9C,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,yBAAyB,CAAC,iBAAiB;IAC3C,yBAAyB,CAAC,cAAc;IACxC,yBAAyB,CAAC,cAAc;IACxC,yBAAyB,CAAC,wBAAwB;CAC1C,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,uBAAuB;IACvB,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,GAAG;IAExB,8EAA8E;IAC9E,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,GAAG;IAExB,oBAAoB;IACpB,gBAAgB,EAAE,GAAG,EAAE,WAAW;IAElC,2BAA2B;IAC3B,uBAAuB,EAAE,EAAE;IAE3B,sBAAsB;IACtB,oBAAoB,EAAE,uBAAuB;IAE7C,yBAAyB;IACzB,qBAAqB,EAAE,CAAC;IACxB,qBAAqB,EAAE,GAAG;IAE1B,wBAAwB;IACxB,6EAA6E;IAC7E,qDAAqD;IACrD,gCAAgC,EAAE,EAAE;IACpC,0BAA0B,EAAE,IAAI;IAEhC,kBAAkB;IAClB,oBAAoB,EAAE,EAAE;IACxB,qBAAqB,EAAE,EAAE;IAEzB,0BAA0B;IAC1B,sBAAsB,EAAE,IAAI;CACpB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC"}

package/dist/auth/services/cognito/constants/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./cognito-messages.constants";
+export * from "./cognito.constants";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/services/cognito/constants/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC"}

package/dist/auth/services/cognito/constants/index.js

@@ -0,0 +1,3 @@
+export * from "./cognito-messages.constants";
+export * from "./cognito.constants";
+//# sourceMappingURL=index.js.map

package/dist/auth/services/cognito/constants/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,qBAAqB,CAAC"}

package/dist/auth/services/cognito/errors/cognito-errors.d.ts

@@ -0,0 +1,12 @@
+import { AWS_ERROR_KIND } from "../../../../services/shared/constants";
+import { BaseAwsError } from "../../../../services/shared/errors";
+export declare class CognitoError extends BaseAwsError {
+    constructor(message: string, kind: (typeof AWS_ERROR_KIND)[keyof typeof AWS_ERROR_KIND], opts?: {
+        cause?: unknown;
+        code?: string;
+        timestamp?: Date;
+    });
+}
+export declare function classifyCognitoError(err: unknown): CognitoError;
+export declare function isCognitoError(err: unknown): err is CognitoError;
+//# sourceMappingURL=cognito-errors.d.ts.map

package/dist/auth/services/cognito/errors/cognito-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-errors.d.ts","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/errors/cognito-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG5D,qBAAa,YAAa,SAAQ,YAAY;gBAE1C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,EAC1D,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,IAAI,CAAC;KAClB;CAMJ;AA2BD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAuB/D;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,CAEhE"}

package/dist/auth/services/cognito/errors/cognito-errors.js

@@ -0,0 +1,48 @@
+import { AWS_ERROR_KIND } from "../../../../services/shared/constants";
+import { BaseAwsError } from "../../../../services/shared/errors";
+import { COGNITO_ADMIN_RETRYABLE_ERROR_CODES, COGNITO_ERROR_MESSAGES } from "../constants";
+export class CognitoError extends BaseAwsError {
+    constructor(message, kind, opts) {
+        super(message, kind, opts);
+        this.name = "CognitoError";
+        Object.setPrototypeOf(this, CognitoError.prototype);
+    }
+}
+const COGNITO_ERROR_CODE_MAP = {
+    UserNotFoundException: COGNITO_ERROR_MESSAGES.USER_NOT_FOUND,
+    UsernameExistsException: COGNITO_ERROR_MESSAGES.USER_EXISTS,
+    InvalidPasswordException: COGNITO_ERROR_MESSAGES.INVALID_PASSWORD,
+    InvalidParameterException: COGNITO_ERROR_MESSAGES.INVALID_PARAMETER,
+    AccessDeniedException: COGNITO_ERROR_MESSAGES.ACCESS_DENIED,
+    NotAuthorizedException: COGNITO_ERROR_MESSAGES.NOT_AUTHORIZED,
+    GroupExistsException: COGNITO_ERROR_MESSAGES.GROUP_EXISTS,
+    ResourceNotFoundException: COGNITO_ERROR_MESSAGES.RESOURCE_NOT_FOUND,
+    InvalidAttributeValueException: COGNITO_ERROR_MESSAGES.INVALID_ATTRIBUTE_VALUE,
+    UserLambdaValidationException: COGNITO_ERROR_MESSAGES.USER_LAMBDA_VALIDATION,
+    TooManyRequestsException: COGNITO_ERROR_MESSAGES.TOO_MANY_REQUESTS,
+    LimitExceededException: COGNITO_ERROR_MESSAGES.LIMIT_EXCEEDED,
+    TooManyFailedAttemptsException: COGNITO_ERROR_MESSAGES.TOO_MANY_FAILED_ATTEMPTS,
+    InternalErrorException: COGNITO_ERROR_MESSAGES.INTERNAL_ERROR,
+};
+export function classifyCognitoError(err) {
+    var _a;
+    const cognitoErr = err;
+    const code = (cognitoErr === null || cognitoErr === void 0 ? void 0 : cognitoErr.code) || (cognitoErr === null || cognitoErr === void 0 ? void 0 : cognitoErr.name);
+    // Map error codes to user-friendly messages (never use raw error.message)
+    const message = code
+        ? ((_a = COGNITO_ERROR_CODE_MAP[code]) !== null && _a !== void 0 ? _a : COGNITO_ERROR_MESSAGES.UNKNOWN_ERROR)
+        : COGNITO_ERROR_MESSAGES.UNKNOWN_ERROR;
+    // Check if it's a retryable error
+    const isRetryable = code &&
+        COGNITO_ADMIN_RETRYABLE_ERROR_CODES.includes(code);
+    const kind = isRetryable ? AWS_ERROR_KIND.TRANSIENT : AWS_ERROR_KIND.FATAL;
+    return new CognitoError(message, kind, {
+        cause: err,
+        code,
+        timestamp: new Date(),
+    });
+}
+export function isCognitoError(err) {
+    return err instanceof CognitoError;
+}
+//# sourceMappingURL=cognito-errors.js.map

package/dist/auth/services/cognito/errors/cognito-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-errors.js","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/errors/cognito-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE3F,MAAM,OAAO,YAAa,SAAQ,YAAY;IAC5C,YACE,OAAe,EACf,IAA0D,EAC1D,IAIC;QAED,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;CACF;AAUD,MAAM,sBAAsB,GAA2B;IACrD,qBAAqB,EAAE,sBAAsB,CAAC,cAAc;IAC5D,uBAAuB,EAAE,sBAAsB,CAAC,WAAW;IAC3D,wBAAwB,EAAE,sBAAsB,CAAC,gBAAgB;IACjE,yBAAyB,EAAE,sBAAsB,CAAC,iBAAiB;IACnE,qBAAqB,EAAE,sBAAsB,CAAC,aAAa;IAC3D,sBAAsB,EAAE,sBAAsB,CAAC,cAAc;IAC7D,oBAAoB,EAAE,sBAAsB,CAAC,YAAY;IACzD,yBAAyB,EAAE,sBAAsB,CAAC,kBAAkB;IACpE,8BAA8B,EAAE,sBAAsB,CAAC,uBAAuB;IAC9E,6BAA6B,EAAE,sBAAsB,CAAC,sBAAsB;IAC5E,wBAAwB,EAAE,sBAAsB,CAAC,iBAAiB;IAClE,sBAAsB,EAAE,sBAAsB,CAAC,cAAc;IAC7D,8BAA8B,EAAE,sBAAsB,CAAC,wBAAwB;IAC/E,sBAAsB,EAAE,sBAAsB,CAAC,cAAc;CAC9D,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,GAAY;;IAC/C,MAAM,UAAU,GAAG,GAAwB,CAAC;IAE5C,MAAM,IAAI,GAAG,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,IAAI,MAAI,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,IAAI,CAAA,CAAC;IAElD,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAI;QAClB,CAAC,CAAC,CAAC,MAAA,sBAAsB,CAAC,IAAI,CAAC,mCAAI,sBAAsB,CAAC,aAAa,CAAC;QACxE,CAAC,CAAC,sBAAsB,CAAC,aAAa,CAAC;IAEzC,kCAAkC;IAClC,MAAM,WAAW,GACf,IAAI;QACJ,mCAAmC,CAAC,QAAQ,CAC1C,IAA4D,CAC7D,CAAC;IACJ,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC;IAE3E,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE;QACrC,KAAK,EAAE,GAAG;QACV,IAAI;QACJ,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,OAAO,GAAG,YAAY,YAAY,CAAC;AACrC,CAAC"}

package/dist/auth/services/cognito/errors/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./cognito-errors";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/services/cognito/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/errors/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC"}

package/dist/auth/services/cognito/errors/index.js

@@ -0,0 +1,2 @@
+export * from "./cognito-errors";
+//# sourceMappingURL=index.js.map

package/dist/auth/services/cognito/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/errors/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC"}

package/dist/auth/services/cognito/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./constants";
+export * from "./errors";
+export * from "./interfaces";
+export * from "./schemas";
+export * from "./services";
+export * from "./utilities";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/services/cognito/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../lib/auth/services/cognito/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/auth/services/cognito/index.js

@@ -0,0 +1,7 @@
+export * from "./constants";
+export * from "./errors";
+export * from "./interfaces";
+export * from "./schemas";
+export * from "./services";
+export * from "./utilities";
+//# sourceMappingURL=index.js.map

package/dist/auth/services/cognito/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../lib/auth/services/cognito/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/auth/services/cognito/interfaces/cognito-admin.interface.d.ts

@@ -0,0 +1,102 @@
+import { Logger } from "../../../../services/logger";
+import { CognitoIdentityProviderClient, type UserStatusType } from "@aws-sdk/client-cognito-identity-provider";
+import { CognitoConfig } from "./cognito.interface";
+export { AccountStatus } from "../../..";
+export interface CognitoAdminServiceDeps {
+    logger?: Logger;
+    config: CognitoConfig;
+    client?: CognitoIdentityProviderClient;
+}
+export interface CognitoAdminCreateUserParams {
+    username: string;
+    password?: string;
+    email?: string;
+    phoneNumber?: string;
+    attributes?: Record<string, string>;
+    temporaryPassword?: boolean;
+    messageAction?: "RESEND" | "SUPPRESS";
+}
+export interface CognitoAdminUpdateUserParams {
+    username: string;
+    attributes?: Record<string, string>;
+    enabled?: boolean;
+}
+export interface CognitoAdminDeleteUserParams {
+    username: string;
+}
+export interface CognitoAdminListUsersParams {
+    limit?: number;
+    paginationToken?: string;
+    filter?: string;
+}
+export interface CognitoAdminCreateGroupParams {
+    groupName: string;
+    description?: string;
+    precedence?: number;
+    roleArn?: string;
+}
+export interface CognitoAdminAddUserToGroupParams {
+    username: string;
+    groupName: string;
+}
+export interface CognitoAdminRemoveUserFromGroupParams {
+    username: string;
+    groupName: string;
+}
+export interface CognitoAdminListGroupsForUserParams {
+    username: string;
+    limit?: number;
+    nextToken?: string;
+}
+export interface CognitoAdminListGroupsParams {
+    limit?: number;
+    nextToken?: string;
+}
+export interface CognitoAdminGetGroupParams {
+    groupName: string;
+}
+export interface CognitoAdminUpdateGroupParams {
+    groupName: string;
+    description?: string;
+    precedence?: number;
+    roleArn?: string;
+}
+export interface CognitoAdminDeleteGroupParams {
+    groupName: string;
+}
+export interface CognitoAdminListUsersInGroupParams {
+    groupName: string;
+    limit?: number;
+    nextToken?: string;
+}
+export interface CognitoAdminListPendingUsersParams {
+    limit?: number;
+    paginationToken?: string;
+}
+export interface CognitoAdminApproveUserParams {
+    username: string;
+}
+export interface CognitoAdminRejectUserParams {
+    username: string;
+}
+export interface CognitoAdminUser {
+    username: string;
+    email?: string;
+    phoneNumber?: string;
+    enabled: boolean;
+    userStatus: UserStatusType;
+    attributes?: Record<string, string>;
+    createdAt?: Date;
+    updatedAt?: Date;
+    lastModifiedDate?: Date;
+    lastLoginDate?: Date;
+}
+export interface CognitoAdminGroup {
+    groupName: string;
+    description?: string;
+    precedence?: number;
+    roleArn?: string;
+    creationDate?: Date;
+    lastModifiedDate?: Date;
+}
+//# sourceMappingURL=cognito-admin.interface.d.ts.map

package/dist/auth/services/cognito/interfaces/cognito-admin.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-admin.interface.d.ts","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/interfaces/cognito-admin.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EACL,6BAA6B,EAC7B,KAAK,cAAc,EACpB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,6BAA6B,CAAC;CACxC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;CACvC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kCAAkC;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kCAAkC;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,gBAAgB,CAAC,EAAE,IAAI,CAAC;IACxB,aAAa,CAAC,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,gBAAgB,CAAC,EAAE,IAAI,CAAC;CACzB"}

package/dist/auth/services/cognito/interfaces/cognito-admin.interface.js

@@ -0,0 +1,3 @@
+// Re-export AccountStatus enum from auth for convenience (single source of truth)
+export { AccountStatus } from "../../..";
+//# sourceMappingURL=cognito-admin.interface.js.map

package/dist/auth/services/cognito/interfaces/cognito-admin.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-admin.interface.js","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/interfaces/cognito-admin.interface.ts"],"names":[],"mappings":"AAOA,kFAAkF;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/auth/services/cognito/interfaces/cognito-user.interface.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Cognito user details returned by user-level APIs
+ * Simplified version without admin-specific fields
+ */
+export interface CognitoUser {
+    /** User's Cognito username (sub) */
+    username: string;
+    /** User's email address */
+    email?: string;
+    /** User's phone number */
+    phoneNumber?: string;
+    /** All user attributes (standard + custom) */
+    attributes?: Record<string, string>;
+}
+//# sourceMappingURL=cognito-user.interface.d.ts.map

package/dist/auth/services/cognito/interfaces/cognito-user.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-user.interface.d.ts","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/interfaces/cognito-user.interface.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC"}

package/dist/auth/services/cognito/interfaces/cognito-user.interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cognito-user.interface.js.map

package/dist/auth/services/cognito/interfaces/cognito-user.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-user.interface.js","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/interfaces/cognito-user.interface.ts"],"names":[],"mappings":""}

package/dist/auth/services/cognito/interfaces/cognito.interface.d.ts

@@ -0,0 +1,69 @@
+import type { UserAwsCredentials } from "../../../../services/shared";
+/**
+ * Configuration for user-level Cognito operations
+ * Only requires region since user-level APIs use access tokens
+ */
+export interface CognitoUserConfig {
+    region: string;
+}
+export interface CognitoConfig {
+    region: string;
+    clientId: string;
+    clientSecret?: string;
+    userPoolId: string;
+    /**
+     * Identity Pool ID for user-level AWS access control
+     * Required for governance compliance - enables IAM-based permissions per user
+     */
+    identityPoolId?: string;
+    /**
+     * Admin credentials for backend service operations
+     * Use when performing admin operations that don't require user-level access control
+     */
+    credentials?: {
+        accessKeyId: string;
+        secretAccessKey: string;
+        /** Session token for temporary credentials (from AWS STS/SSO) */
+        sessionToken?: string;
+    };
+}
+/**
+ * User context for audit logging
+ * Pass this to track which user initiated the operation
+ */
+export interface UserContext {
+    /** User ID from JWT token (sub claim) */
+    userId: string;
+    /** Username from JWT token (cognito:username claim) */
+    username?: string;
+    /** User's email (optional) */
+    email?: string;
+    /** User's IP address (optional) */
+    ipAddress?: string;
+    /** User agent / device info (optional) */
+    userAgent?: string;
+    /** Request ID for tracing (optional) */
+    requestId?: string;
+    /** Any additional metadata */
+    metadata?: Record<string, string>;
+}
+/**
+ * Parameters for getting user AWS credentials from Identity Pool
+ */
+export interface GetUserCredentialsParams {
+    /** JWT ID token from Cognito User Pool authentication */
+    idToken: string;
+    /** User Pool ID (optional, uses config default if not provided) */
+    userPoolId?: string;
+}
+export type { UserAwsCredentials };
+/**
+ * Cache entry for user credentials with LRU metadata
+ */
+export interface CredentialsCacheEntry {
+    credentials: UserAwsCredentials;
+    cachedAt: Date;
+    /** Last access timestamp for LRU eviction */
+    lastAccessedAt: Date;
+}
+//# sourceMappingURL=cognito.interface.d.ts.map

package/dist/auth/services/cognito/interfaces/cognito.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito.interface.d.ts","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/interfaces/cognito.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,iEAAiE;QACjE,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAGD,YAAY,EAAE,kBAAkB,EAAE,CAAC;AAEnC;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,IAAI,CAAC;IACf,6CAA6C;IAC7C,cAAc,EAAE,IAAI,CAAC;CACtB"}

package/dist/auth/services/cognito/interfaces/cognito.interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cognito.interface.js.map

package/dist/auth/services/cognito/interfaces/cognito.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito.interface.js","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/interfaces/cognito.interface.ts"],"names":[],"mappings":""}

package/dist/auth/services/cognito/interfaces/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./cognito.interface";
+export * from "./cognito-admin.interface";
+export * from "./cognito-user.interface";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/services/cognito/interfaces/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/interfaces/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC"}

package/dist/auth/services/cognito/interfaces/index.js

@@ -0,0 +1,4 @@
+export * from "./cognito.interface";
+export * from "./cognito-admin.interface";
+export * from "./cognito-user.interface";
+//# sourceMappingURL=index.js.map

package/dist/auth/services/cognito/interfaces/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../lib/auth/services/cognito/interfaces/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC"}