AWS account management

AWSIKCognito is the first adapter for the portable IUCIKAccountProvider role. Blueprint actions expose the variable inputs for registration, confirmation, password reset, profile attributes, MFA, remembered devices, account deletion, and session revocation. The provider keeps access and refresh tokens in memory; callers identify the local user and never pass a token pin.

The role supports:

• register, confirm registration, and resend a confirmation code;
• begin and complete password reset, and change a signed-in password;
• read and update profile attributes;
• enrol, confirm, or disable software-token MFA;
• list and forget remembered devices;
• delete the signed-in account or revoke its refresh session.

Login challenges use the same continuation model as identity login. An MFA enrolment returns a continuation containing the opaque association session and the secret required by the authenticator setup UI. Feed that continuation to confirmation once; do not persist or log it.

Account operations fail locally with a configuration or authentication error when a required pool/client setting or signed-in session is absent. AWS exception name, request id, HTTP status, throttling/retry flags, and numeric native error code are retained in FBetideError.

The additive AWS role header is intentionally provider-neutral. Once the unified-roles branch lands, move the declaration to its canonical role registry without changing the Cognito adapter contract.