@aws-amplify/auth 6.16.1-unstable.aae2834.0 → 6.17.0

package/dist/esm/providers/cognito/tokenProvider/types.d.ts

@@ -1,9 +1,10 @@
-import { AuthConfig, AuthTokens, FetchAuthSessionOptions, KeyValueStorageInterface, TokenProvider } from '@aws-amplify/core';
-import { CognitoAuthSignInDetails } from '../types';
-export type TokenRefresher = ({ tokens, authConfig, username, }: {
+import { AuthConfig, AuthTokens, ClientMetadataProvider, FetchAuthSessionOptions, KeyValueStorageInterface, TokenProvider } from '@aws-amplify/core';
+import { ClientMetadata, CognitoAuthSignInDetails } from '../types';
+export type TokenRefresher = ({ tokens, authConfig, username, clientMetadata, }: {
     tokens: CognitoAuthTokens;
     authConfig?: AuthConfig;
     username: string;
+    clientMetadata?: ClientMetadata;
 }) => Promise<CognitoAuthTokens>;
 export type AuthKeys<AuthKey extends string> = Record<AuthKey, string>;
 export declare const AuthTokenStorageKeys: {
@@ -47,6 +48,7 @@ export interface AuthTokenOrchestrator {
 export interface CognitoUserPoolTokenProviderType extends TokenProvider {
     setKeyValueStorage(keyValueStorage: KeyValueStorageInterface): void;
     setAuthConfig(authConfig: AuthConfig): void;
+    setClientMetadataProvider(clientMetadataProvider: ClientMetadataProvider): void;
 }
 export type CognitoAuthTokens = AuthTokens & {
     refreshToken?: string;

package/dist/esm/providers/cognito/types/models.d.ts

@@ -12,7 +12,7 @@ export declare const cognitoHostedUIIdentityProviderMap: Record<AuthProvider, st
 /**
  * Arbitrary key/value pairs that may be passed as part of certain Cognito requests
  */
-export type ClientMetadata = Record<string, string>;
+export type { ClientMetadata } from '@aws-amplify/core';
 /**
  * Allowed values for preferredChallenge
  */
@@ -70,4 +70,3 @@ export interface AuthUser extends AWSAuthUser {
  * Holds data describing the dispatch of a confirmation code.
  */
 export type CodeDeliveryDetails<CognitoUserAttributeKey extends UserAttributeKey = UserAttributeKey> = AuthCodeDeliveryDetails<CognitoUserAttributeKey>;
-export {};

package/dist/esm/providers/cognito/utils/refreshAuthTokens.d.ts

@@ -1,8 +1,10 @@
 import { AuthConfig } from '@aws-amplify/core';
 import { CognitoAuthTokens, TokenRefresher } from '../tokenProvider/types';
+import { ClientMetadata } from '../types';
 export declare const refreshAuthTokens: (args_0: {
     tokens: CognitoAuthTokens;
     authConfig?: AuthConfig;
     username: string;
+    clientMetadata?: ClientMetadata;
 }) => Promise<CognitoAuthTokens>;
 export declare const refreshAuthTokensWithoutDedupe: TokenRefresher;

package/dist/esm/providers/cognito/utils/refreshAuthTokens.mjs

@@ -15,7 +15,7 @@ import '../types/errors.mjs';
 
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
-const refreshAuthTokensFunction = async ({ tokens, authConfig, username, }) => {
+const refreshAuthTokensFunction = async ({ tokens, authConfig, username, clientMetadata, }) => {
     assertTokenProviderConfig(authConfig?.Cognito);
     const { userPoolId, userPoolClientId, userPoolEndpoint } = authConfig.Cognito;
     const region = getRegionFromUserPoolId(userPoolId);
@@ -29,6 +29,7 @@ const refreshAuthTokensFunction = async ({ tokens, authConfig, username, }) => {
         ClientId: userPoolClientId,
         RefreshToken: tokens.refreshToken,
         DeviceKey: tokens.deviceMetadata?.deviceKey,
+        ClientMetadata: clientMetadata,
     });
     const accessToken = decodeJWT(AuthenticationResult?.AccessToken ?? '');
     const idToken = AuthenticationResult?.IdToken

package/dist/esm/providers/cognito/utils/refreshAuthTokens.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refreshAuthTokens.mjs","sources":["../../../../../src/providers/cognito/utils/refreshAuthTokens.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { assertTokenProviderConfig, deDupeAsyncFunction, decodeJWT, } from '@aws-amplify/core/internals/utils';\nimport { getRegionFromUserPoolId } from '../../../foundation/parsers';\nimport { assertAuthTokensWithRefreshToken } from '../utils/types';\nimport { AuthError } from '../../../errors/AuthError';\nimport { createCognitoUserPoolEndpointResolver } from '../factories';\nimport { createGetTokensFromRefreshTokenClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';\nconst refreshAuthTokensFunction = async ({ tokens, authConfig, username, }) => {\n    assertTokenProviderConfig(authConfig?.Cognito);\n    const { userPoolId, userPoolClientId, userPoolEndpoint } = authConfig.Cognito;\n    const region = getRegionFromUserPoolId(userPoolId);\n    assertAuthTokensWithRefreshToken(tokens);\n    const getTokensFromRefreshToken = createGetTokensFromRefreshTokenClient({\n        endpointResolver: createCognitoUserPoolEndpointResolver({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const { AuthenticationResult } = await getTokensFromRefreshToken({ region }, {\n        ClientId: userPoolClientId,\n        RefreshToken: tokens.refreshToken,\n        DeviceKey: tokens.deviceMetadata?.deviceKey,\n    });\n    const accessToken = decodeJWT(AuthenticationResult?.AccessToken ?? '');\n    const idToken = AuthenticationResult?.IdToken\n        ? decodeJWT(AuthenticationResult.IdToken)\n        : undefined;\n    const { iat } = accessToken.payload;\n    // This should never happen. If it does, it's a bug from the service.\n    if (!iat) {\n        throw new AuthError({\n            name: 'iatNotFoundException',\n            message: 'iat not found in access token',\n        });\n    }\n    const clockDrift = iat * 1000 - new Date().getTime();\n    return {\n        accessToken,\n        idToken,\n        clockDrift,\n        refreshToken: AuthenticationResult?.RefreshToken ?? tokens.refreshToken,\n        username,\n    };\n};\nexport const refreshAuthTokens = deDupeAsyncFunction(refreshAuthTokensFunction);\nexport const refreshAuthTokensWithoutDedupe = refreshAuthTokensFunction;\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;AACA;AAOA,MAAM,yBAAyB,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,GAAG,KAAK;AAC/E,IAAI,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC;AAClD,IAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC,OAAO;AACjF,IAAI,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,CAAC;AACtD,IAAI,gCAAgC,CAAC,MAAM,CAAC;AAC5C,IAAI,MAAM,yBAAyB,GAAG,qCAAqC,CAAC;AAC5E,QAAQ,gBAAgB,EAAE,qCAAqC,CAAC;AAChE,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC;AACN,IAAI,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACjF,QAAQ,QAAQ,EAAE,gBAAgB;AAClC,QAAQ,YAAY,EAAE,MAAM,CAAC,YAAY;AACzC,QAAQ,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,SAAS;AACnD,KAAK,CAAC;AACN,IAAI,MAAM,WAAW,GAAG,SAAS,CAAC,oBAAoB,EAAE,WAAW,IAAI,EAAE,CAAC;AAC1E,IAAI,MAAM,OAAO,GAAG,oBAAoB,EAAE;AAC1C,UAAU,SAAS,CAAC,oBAAoB,CAAC,OAAO;AAChD,UAAU,SAAS;AACnB,IAAI,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO;AACvC;AACA,IAAI,IAAI,CAAC,GAAG,EAAE;AACd,QAAQ,MAAM,IAAI,SAAS,CAAC;AAC5B,YAAY,IAAI,EAAE,sBAAsB;AACxC,YAAY,OAAO,EAAE,+BAA+B;AACpD,SAAS,CAAC;AACV,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE;AACxD,IAAI,OAAO;AACX,QAAQ,WAAW;AACnB,QAAQ,OAAO;AACf,QAAQ,UAAU;AAClB,QAAQ,YAAY,EAAE,oBAAoB,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY;AAC/E,QAAQ,QAAQ;AAChB,KAAK;AACL,CAAC;AACW,MAAC,iBAAiB,GAAG,mBAAmB,CAAC,yBAAyB;AAClE,MAAC,8BAA8B,GAAG;;;;"}
+{"version":3,"file":"refreshAuthTokens.mjs","sources":["../../../../../src/providers/cognito/utils/refreshAuthTokens.ts"],"sourcesContent":["// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n// SPDX-License-Identifier: Apache-2.0\nimport { assertTokenProviderConfig, deDupeAsyncFunction, decodeJWT, } from '@aws-amplify/core/internals/utils';\nimport { getRegionFromUserPoolId } from '../../../foundation/parsers';\nimport { assertAuthTokensWithRefreshToken } from '../utils/types';\nimport { AuthError } from '../../../errors/AuthError';\nimport { createCognitoUserPoolEndpointResolver } from '../factories';\nimport { createGetTokensFromRefreshTokenClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';\nconst refreshAuthTokensFunction = async ({ tokens, authConfig, username, clientMetadata, }) => {\n    assertTokenProviderConfig(authConfig?.Cognito);\n    const { userPoolId, userPoolClientId, userPoolEndpoint } = authConfig.Cognito;\n    const region = getRegionFromUserPoolId(userPoolId);\n    assertAuthTokensWithRefreshToken(tokens);\n    const getTokensFromRefreshToken = createGetTokensFromRefreshTokenClient({\n        endpointResolver: createCognitoUserPoolEndpointResolver({\n            endpointOverride: userPoolEndpoint,\n        }),\n    });\n    const { AuthenticationResult } = await getTokensFromRefreshToken({ region }, {\n        ClientId: userPoolClientId,\n        RefreshToken: tokens.refreshToken,\n        DeviceKey: tokens.deviceMetadata?.deviceKey,\n        ClientMetadata: clientMetadata,\n    });\n    const accessToken = decodeJWT(AuthenticationResult?.AccessToken ?? '');\n    const idToken = AuthenticationResult?.IdToken\n        ? decodeJWT(AuthenticationResult.IdToken)\n        : undefined;\n    const { iat } = accessToken.payload;\n    // This should never happen. If it does, it's a bug from the service.\n    if (!iat) {\n        throw new AuthError({\n            name: 'iatNotFoundException',\n            message: 'iat not found in access token',\n        });\n    }\n    const clockDrift = iat * 1000 - new Date().getTime();\n    return {\n        accessToken,\n        idToken,\n        clockDrift,\n        refreshToken: AuthenticationResult?.RefreshToken ?? tokens.refreshToken,\n        username,\n    };\n};\nexport const refreshAuthTokens = deDupeAsyncFunction(refreshAuthTokensFunction);\nexport const refreshAuthTokensWithoutDedupe = refreshAuthTokensFunction;\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;AACA;AAOA,MAAM,yBAAyB,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,GAAG,KAAK;AAC/F,IAAI,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC;AAClD,IAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC,OAAO;AACjF,IAAI,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,CAAC;AACtD,IAAI,gCAAgC,CAAC,MAAM,CAAC;AAC5C,IAAI,MAAM,yBAAyB,GAAG,qCAAqC,CAAC;AAC5E,QAAQ,gBAAgB,EAAE,qCAAqC,CAAC;AAChE,YAAY,gBAAgB,EAAE,gBAAgB;AAC9C,SAAS,CAAC;AACV,KAAK,CAAC;AACN,IAAI,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,EAAE;AACjF,QAAQ,QAAQ,EAAE,gBAAgB;AAClC,QAAQ,YAAY,EAAE,MAAM,CAAC,YAAY;AACzC,QAAQ,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,SAAS;AACnD,QAAQ,cAAc,EAAE,cAAc;AACtC,KAAK,CAAC;AACN,IAAI,MAAM,WAAW,GAAG,SAAS,CAAC,oBAAoB,EAAE,WAAW,IAAI,EAAE,CAAC;AAC1E,IAAI,MAAM,OAAO,GAAG,oBAAoB,EAAE;AAC1C,UAAU,SAAS,CAAC,oBAAoB,CAAC,OAAO;AAChD,UAAU,SAAS;AACnB,IAAI,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO;AACvC;AACA,IAAI,IAAI,CAAC,GAAG,EAAE;AACd,QAAQ,MAAM,IAAI,SAAS,CAAC;AAC5B,YAAY,IAAI,EAAE,sBAAsB;AACxC,YAAY,OAAO,EAAE,+BAA+B;AACpD,SAAS,CAAC;AACV,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE;AACxD,IAAI,OAAO;AACX,QAAQ,WAAW;AACnB,QAAQ,OAAO;AACf,QAAQ,UAAU;AAClB,QAAQ,YAAY,EAAE,oBAAoB,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY;AAC/E,QAAQ,QAAQ;AAChB,KAAK;AACL,CAAC;AACW,MAAC,iBAAiB,GAAG,mBAAmB,CAAC,yBAAyB;AAClE,MAAC,8BAA8B,GAAG;;;;"}

package/dist/esm/types/inputs.d.ts

@@ -47,6 +47,10 @@ export type AuthPrompt = 'NONE' | 'LOGIN' | 'CONSENT' | 'SELECT_ACCOUNT';
 export interface AuthSignInWithRedirectInput {
     provider?: AuthProvider | {
         custom: string;
+        idpIdentifier?: never;
+    } | {
+        idpIdentifier: string;
+        custom?: never;
     };
     customState?: string;
     options?: {

package/package.json

@@ -1,113 +1,113 @@
 {
-  "name": "@aws-amplify/auth",
-  "version": "6.16.1-unstable.aae2834.0+aae2834",
-  "description": "Auth category of aws-amplify",
-  "main": "./dist/cjs/index.js",
-  "module": "./dist/esm/index.mjs",
-  "typings": "./dist/esm/index.d.ts",
-  "react-native": "./dist/cjs/index.js",
-  "sideEffects": [
-    "./dist/cjs/providers/cognito/apis/signInWithRedirect.js",
-    "./dist/esm/providers/cognito/apis/signInWithRedirect.mjs",
-    "./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js",
-    "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "test": "yarn lint --fix && jest -w 1 --coverage --logHeapUsage",
-    "build-with-test": "npm test && npm run build",
-    "build:umd": "webpack && webpack --config ./webpack.config.dev.js",
-    "build:esm-cjs": "rollup --forceExit -c rollup.config.mjs",
-    "build:watch": "npm run build:esm-cjs -- --watch",
-    "build": "npm run clean && npm run build:esm-cjs && npm run build:umd",
-    "clean": "npm run clean:size && rimraf lib-esm lib dist",
-    "clean:size": "rimraf dual-publish-tmp tmp*",
-    "format": "echo \"Not implemented\"",
-    "lint": "eslint '**/*.{ts,tsx}' && npm run ts-coverage",
-    "lint:fix": "eslint '**/*.{ts,tsx}' --fix",
-    "ts-coverage": "typescript-coverage-report -p ./tsconfig.build.json -t 91.18"
-  },
-  "typesVersions": {
-    ">=4.2": {
-      "cognito": [
-        "./dist/esm/providers/cognito/index.d.ts"
-      ],
-      "cognito/server": [
-        "./dist/esm/providers/cognito/apis/server/index.d.ts"
-      ],
-      "server": [
-        "./dist/esm/server.d.ts"
-      ]
-    }
-  },
-  "exports": {
-    ".": {
-      "react-native": "./dist/cjs/index.js",
-      "types": "./dist/esm/index.d.ts",
-      "import": "./dist/esm/index.mjs",
-      "require": "./dist/cjs/index.js"
-    },
-    "./cognito": {
-      "react-native": "./dist/cjs/providers/cognito/index.js",
-      "types": "./dist/esm/providers/cognito/index.d.ts",
-      "import": "./dist/esm/providers/cognito/index.mjs",
-      "require": "./dist/cjs/providers/cognito/index.js"
-    },
-    "./cognito/server": {
-      "types": "./dist/esm/providers/cognito/apis/server/index.d.ts",
-      "import": "./dist/esm/providers/cognito/apis/server/index.mjs",
-      "require": "./dist/cjs/providers/cognito/apis/server/index.js"
-    },
-    "./server": {
-      "types": "./dist/esm/server.d.ts",
-      "import": "./dist/esm/server.mjs",
-      "require": "./dist/cjs/server.js"
-    },
-    "./enable-oauth-listener": {
-      "types": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.d.ts",
-      "import": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs",
-      "require": "./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/aws-amplify/amplify-js.git"
-  },
-  "author": "Amazon Web Services",
-  "license": "Apache-2.0",
-  "bugs": {
-    "url": "https://github.com/aws/aws-amplify/issues"
-  },
-  "homepage": "https://aws-amplify.github.io/",
-  "files": [
-    "dist/cjs",
-    "dist/esm",
-    "src",
-    "cognito",
-    "server",
-    "enable-oauth-listener"
-  ],
-  "dependencies": {
-    "@aws-crypto/sha256-js": "5.2.0",
-    "@smithy/types": "^3.3.0",
-    "tslib": "^2.5.0"
-  },
-  "peerDependencies": {
-    "@aws-amplify/core": "6.13.4-unstable.aae2834.0+aae2834",
-    "@aws-amplify/react-native": "^1.1.10"
-  },
-  "peerDependenciesMeta": {
-    "@aws-amplify/react-native": {
-      "optional": true
-    }
-  },
-  "devDependencies": {
-    "@aws-amplify/core": "6.13.4-unstable.aae2834.0+aae2834",
-    "@aws-amplify/react-native": "1.2.1-unstable.aae2834.0+aae2834",
-    "@jest/test-sequencer": "^29.7.0"
-  },
-  "gitHead": "aae28343658394c3ee339e8947524feac977c8de"
+	"name": "@aws-amplify/auth",
+	"version": "6.17.0",
+	"description": "Auth category of aws-amplify",
+	"main": "./dist/cjs/index.js",
+	"module": "./dist/esm/index.mjs",
+	"typings": "./dist/esm/index.d.ts",
+	"react-native": "./dist/cjs/index.js",
+	"sideEffects": [
+		"./dist/cjs/providers/cognito/apis/signInWithRedirect.js",
+		"./dist/esm/providers/cognito/apis/signInWithRedirect.mjs",
+		"./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js",
+		"./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs"
+	],
+	"publishConfig": {
+		"access": "public"
+	},
+	"scripts": {
+		"test": "yarn lint --fix && jest -w 1 --coverage --logHeapUsage",
+		"build-with-test": "npm test && npm run build",
+		"build:umd": "webpack && webpack --config ./webpack.config.dev.js",
+		"build:esm-cjs": "rollup --forceExit -c rollup.config.mjs",
+		"build:watch": "npm run build:esm-cjs -- --watch",
+		"build": "npm run clean && npm run build:esm-cjs && npm run build:umd",
+		"clean": "npm run clean:size && rimraf lib-esm lib dist",
+		"clean:size": "rimraf dual-publish-tmp tmp*",
+		"format": "echo \"Not implemented\"",
+		"lint": "eslint '**/*.{ts,tsx}' && npm run ts-coverage",
+		"lint:fix": "eslint '**/*.{ts,tsx}' --fix",
+		"ts-coverage": "typescript-coverage-report -p ./tsconfig.build.json -t 91.18"
+	},
+	"typesVersions": {
+		">=4.2": {
+			"cognito": [
+				"./dist/esm/providers/cognito/index.d.ts"
+			],
+			"cognito/server": [
+				"./dist/esm/providers/cognito/apis/server/index.d.ts"
+			],
+			"server": [
+				"./dist/esm/server.d.ts"
+			]
+		}
+	},
+	"exports": {
+		".": {
+			"react-native": "./dist/cjs/index.js",
+			"types": "./dist/esm/index.d.ts",
+			"import": "./dist/esm/index.mjs",
+			"require": "./dist/cjs/index.js"
+		},
+		"./cognito": {
+			"react-native": "./dist/cjs/providers/cognito/index.js",
+			"types": "./dist/esm/providers/cognito/index.d.ts",
+			"import": "./dist/esm/providers/cognito/index.mjs",
+			"require": "./dist/cjs/providers/cognito/index.js"
+		},
+		"./cognito/server": {
+			"types": "./dist/esm/providers/cognito/apis/server/index.d.ts",
+			"import": "./dist/esm/providers/cognito/apis/server/index.mjs",
+			"require": "./dist/cjs/providers/cognito/apis/server/index.js"
+		},
+		"./server": {
+			"types": "./dist/esm/server.d.ts",
+			"import": "./dist/esm/server.mjs",
+			"require": "./dist/cjs/server.js"
+		},
+		"./enable-oauth-listener": {
+			"types": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.d.ts",
+			"import": "./dist/esm/providers/cognito/utils/oauth/enableOAuthListener.mjs",
+			"require": "./dist/cjs/providers/cognito/utils/oauth/enableOAuthListener.js"
+		},
+		"./package.json": "./package.json"
+	},
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/aws-amplify/amplify-js.git"
+	},
+	"author": "Amazon Web Services",
+	"license": "Apache-2.0",
+	"bugs": {
+		"url": "https://github.com/aws/aws-amplify/issues"
+	},
+	"homepage": "https://aws-amplify.github.io/",
+	"files": [
+		"dist/cjs",
+		"dist/esm",
+		"src",
+		"cognito",
+		"server",
+		"enable-oauth-listener"
+	],
+	"dependencies": {
+		"@aws-crypto/sha256-js": "5.2.0",
+		"@smithy/types": "^3.3.0",
+		"tslib": "^2.5.0"
+	},
+	"peerDependencies": {
+		"@aws-amplify/core": "^6.1.0",
+		"@aws-amplify/react-native": "^1.1.10"
+	},
+	"peerDependenciesMeta": {
+		"@aws-amplify/react-native": {
+			"optional": true
+		}
+	},
+	"devDependencies": {
+		"@aws-amplify/core": "6.14.0",
+		"@aws-amplify/react-native": "1.3.0",
+		"@jest/test-sequencer": "^29.7.0"
+	},
+	"gitHead": "bcb7c416052db16e7e329b2ac44fadc564274e2b"
 }

package/src/providers/cognito/apis/signInWithRedirect.ts

@@ -51,17 +51,21 @@ export async function signInWithRedirect(
 	}
 
 	let provider = 'COGNITO'; // Default
+	let idpIdentifier: string | undefined;
 
 	if (typeof input?.provider === 'string') {
 		provider = cognitoHostedUIIdentityProviderMap[input.provider];
 	} else if (input?.provider?.custom) {
 		provider = input.provider.custom;
+	} else if (input?.provider?.idpIdentifier) {
+		({ idpIdentifier } = input.provider);
 	}
 
 	return oauthSignIn({
 		oauthConfig: authConfig.loginWith.oauth,
 		clientId: authConfig.userPoolClientId,
 		provider,
+		idpIdentifier,
 		customState: input?.customState,
 		preferPrivateSession: input?.options?.preferPrivateSession,
 		options: {
@@ -77,6 +81,7 @@ export async function signInWithRedirect(
 const oauthSignIn = async ({
 	oauthConfig,
 	provider,
+	idpIdentifier,
 	clientId,
 	customState,
 	preferPrivateSession,
@@ -85,6 +90,7 @@ const oauthSignIn = async ({
 }: {
 	oauthConfig: OAuthConfig;
 	provider: string;
+	idpIdentifier?: string;
 	clientId: string;
 	customState?: string;
 	preferPrivateSession?: boolean;
@@ -117,10 +123,17 @@ const oauthSignIn = async ({
 		['redirect_uri', redirectUri],
 		['response_type', responseType],
 		['client_id', clientId],
-		['identity_provider', provider],
-		['scope', scopes.join(' ')],
 	]);
 
+	// Add either identity_provider or idp_identifier, but not both
+	if (idpIdentifier) {
+		params.append('idp_identifier', idpIdentifier);
+	} else {
+		params.append('identity_provider', provider);
+	}
+
+	params.append('scope', scopes.join(' '));
+
 	loginHint && params.append('login_hint', loginHint);
 	lang && params.append('lang', lang);
 	nonce && params.append('nonce', nonce);

package/src/providers/cognito/tokenProvider/CognitoUserPoolsTokenProvider.ts

@@ -4,6 +4,7 @@
 import {
 	AuthConfig,
 	AuthTokens,
+	ClientMetadataProvider,
 	FetchAuthSessionOptions,
 	KeyValueStorageInterface,
 	defaultStorage,
@@ -28,16 +29,20 @@ export class CognitoUserPoolsTokenProvider
 		this.tokenOrchestrator.setTokenRefresher(refreshAuthTokens);
 	}
 
-	getTokens(
-		{ forceRefresh }: FetchAuthSessionOptions = { forceRefresh: false },
-	): Promise<AuthTokens | null> {
-		return this.tokenOrchestrator.getTokens({ forceRefresh });
+	getTokens(options: FetchAuthSessionOptions = {}): Promise<AuthTokens | null> {
+		return this.tokenOrchestrator.getTokens(options);
 	}
 
 	setKeyValueStorage(keyValueStorage: KeyValueStorageInterface): void {
 		this.authTokenStore.setKeyValueStorage(keyValueStorage);
 	}
 
+	setClientMetadataProvider(
+		clientMetadataProvider: ClientMetadataProvider,
+	): void {
+		this.tokenOrchestrator.setClientMetadataProvider(clientMetadataProvider);
+	}
+
 	setAuthConfig(authConfig: AuthConfig) {
 		this.authTokenStore.setAuthConfig(authConfig);
 		this.tokenOrchestrator.setAuthConfig(authConfig);

package/src/providers/cognito/tokenProvider/TokenOrchestrator.ts

@@ -3,13 +3,13 @@
 import {
 	AuthConfig,
 	AuthTokens,
+	ClientMetadataProvider,
 	CognitoUserPoolConfig,
 	FetchAuthSessionOptions,
 	Hub,
 } from '@aws-amplify/core';
 import {
 	AMPLIFY_SYMBOL,
-	AmplifyErrorCode,
 	assertTokenProviderConfig,
 	isBrowser,
 	isTokenExpired,
@@ -19,7 +19,7 @@ import { assertServiceError } from '../../../errors/utils/assertServiceError';
 import { AuthError } from '../../../errors/AuthError';
 import { oAuthStore } from '../utils/oauth/oAuthStore';
 import { addInflightPromise } from '../utils/oauth/inflightPromise';
-import { CognitoAuthSignInDetails } from '../types';
+import { ClientMetadata, CognitoAuthSignInDetails } from '../types';
 
 import {
 	AuthTokenOrchestrator,
@@ -32,6 +32,7 @@ import {
 
 export class TokenOrchestrator implements AuthTokenOrchestrator {
 	private authConfig?: AuthConfig;
+	clientMetadataProvider?: ClientMetadataProvider;
 	tokenStore?: AuthTokenStore;
 	tokenRefresher?: TokenRefresher;
 	inflightPromise: Promise<void> | undefined;
@@ -94,6 +95,12 @@ export class TokenOrchestrator implements AuthTokenOrchestrator {
 		return this.tokenRefresher;
 	}
 
+	setClientMetadataProvider(
+		clientMetadataProvider: ClientMetadataProvider,
+	): void {
+		this.clientMetadataProvider = clientMetadataProvider;
+	}
+
 	async getTokens(
 		options?: FetchAuthSessionOptions,
 	): Promise<
@@ -130,6 +137,8 @@ export class TokenOrchestrator implements AuthTokenOrchestrator {
 			tokens = await this.refreshTokens({
 				tokens,
 				username,
+				clientMetadata:
+					options?.clientMetadata ?? (await this.clientMetadataProvider?.()),
 			});
 
 			if (tokens === null) {
@@ -147,9 +156,11 @@ export class TokenOrchestrator implements AuthTokenOrchestrator {
 	private async refreshTokens({
 		tokens,
 		username,
+		clientMetadata,
 	}: {
 		tokens: CognitoAuthTokens;
 		username: string;
+		clientMetadata?: ClientMetadata;
 	}): Promise<CognitoAuthTokens | null> {
 		try {
 			const { signInDetails } = tokens;
@@ -157,6 +168,7 @@ export class TokenOrchestrator implements AuthTokenOrchestrator {
 				tokens,
 				authConfig: this.authConfig,
 				username,
+				clientMetadata,
 			});
 			newTokens.signInDetails = signInDetails;
 			await this.setTokens({ tokens: newTokens });
@@ -170,10 +182,15 @@ export class TokenOrchestrator implements AuthTokenOrchestrator {
 
 	private handleErrors(err: unknown) {
 		assertServiceError(err);
-		if (err.name !== AmplifyErrorCode.NetworkError) {
-			// TODO(v6): Check errors on client
+
+		// Only clear tokens for definitive authentication failures
+		// Do NOT clear tokens for transient errors like service issues, rate limits, etc.
+		const shouldClearTokens = this.isAuthenticationError(err);
+
+		if (shouldClearTokens) {
 			this.clearTokens();
 		}
+
 		Hub.dispatch(
 			'auth',
 			{
@@ -190,6 +207,23 @@ export class TokenOrchestrator implements AuthTokenOrchestrator {
 		throw err;
 	}
 
+	private isAuthenticationError(err: any): boolean {
+		// Only clear tokens for errors that definitively indicate the tokens are invalid
+		// and re-authentication is required. All other errors (service errors, rate limits, etc.)
+		// should preserve the tokens to allow for retry.
+		// See: https://github.com/aws-amplify/amplify-js/issues/14534
+		const authErrorNames = [
+			'NotAuthorizedException', // Refresh token is expired or invalid
+			'TokenRevokedException', // Token was revoked by admin
+			'UserNotFoundException', // User no longer exists
+			'PasswordResetRequiredException', // User must reset password
+			'UserNotConfirmedException', // User account is not confirmed
+			'RefreshTokenReuseException', // Refresh token invalidated by rotation
+		];
+
+		return authErrorNames.some(errorName => err?.name?.startsWith?.(errorName));
+	}
+
 	async setTokens({ tokens }: { tokens: CognitoAuthTokens }) {
 		return this.getTokenStore().storeTokens(tokens);
 	}

package/src/providers/cognito/tokenProvider/types.ts

@@ -3,21 +3,24 @@
 import {
 	AuthConfig,
 	AuthTokens,
+	ClientMetadataProvider,
 	FetchAuthSessionOptions,
 	KeyValueStorageInterface,
 	TokenProvider,
 } from '@aws-amplify/core';
 
-import { CognitoAuthSignInDetails } from '../types';
+import { ClientMetadata, CognitoAuthSignInDetails } from '../types';
 
 export type TokenRefresher = ({
 	tokens,
 	authConfig,
 	username,
+	clientMetadata,
 }: {
 	tokens: CognitoAuthTokens;
 	authConfig?: AuthConfig;
 	username: string;
+	clientMetadata?: ClientMetadata;
 }) => Promise<CognitoAuthTokens>;
 
 export type AuthKeys<AuthKey extends string> = Record<AuthKey, string>;
@@ -66,6 +69,9 @@ export interface AuthTokenOrchestrator {
 export interface CognitoUserPoolTokenProviderType extends TokenProvider {
 	setKeyValueStorage(keyValueStorage: KeyValueStorageInterface): void;
 	setAuthConfig(authConfig: AuthConfig): void;
+	setClientMetadataProvider(
+		clientMetadataProvider: ClientMetadataProvider,
+	): void;
 }
 
 export type CognitoAuthTokens = AuthTokens & {

package/src/providers/cognito/types/models.ts

@@ -38,7 +38,7 @@ export const cognitoHostedUIIdentityProviderMap: Record<AuthProvider, string> =
 /**
  * Arbitrary key/value pairs that may be passed as part of certain Cognito requests
  */
-export type ClientMetadata = Record<string, string>;
+export type { ClientMetadata } from '@aws-amplify/core';
 
 /**
  * Allowed values for preferredChallenge

package/src/providers/cognito/utils/refreshAuthTokens.ts

@@ -14,15 +14,18 @@ import { assertAuthTokensWithRefreshToken } from '../utils/types';
 import { AuthError } from '../../../errors/AuthError';
 import { createCognitoUserPoolEndpointResolver } from '../factories';
 import { createGetTokensFromRefreshTokenClient } from '../../../foundation/factories/serviceClients/cognitoIdentityProvider';
+import { ClientMetadata } from '../types';
 
 const refreshAuthTokensFunction: TokenRefresher = async ({
 	tokens,
 	authConfig,
 	username,
+	clientMetadata,
 }: {
 	tokens: CognitoAuthTokens;
 	authConfig?: AuthConfig;
 	username: string;
+	clientMetadata?: ClientMetadata;
 }): Promise<CognitoAuthTokens> => {
 	assertTokenProviderConfig(authConfig?.Cognito);
 	const { userPoolId, userPoolClientId, userPoolEndpoint } = authConfig.Cognito;
@@ -41,6 +44,7 @@ const refreshAuthTokensFunction: TokenRefresher = async ({
 			ClientId: userPoolClientId,
 			RefreshToken: tokens.refreshToken,
 			DeviceKey: tokens.deviceMetadata?.deviceKey,
+			ClientMetadata: clientMetadata,
 		},
 	);
 

package/src/types/inputs.ts

@@ -69,7 +69,10 @@ export type AuthProvider = 'Amazon' | 'Apple' | 'Facebook' | 'Google';
 export type AuthPrompt = 'NONE' | 'LOGIN' | 'CONSENT' | 'SELECT_ACCOUNT';
 
 export interface AuthSignInWithRedirectInput {
-	provider?: AuthProvider | { custom: string };
+	provider?:
+		| AuthProvider
+		| { custom: string; idpIdentifier?: never }
+		| { idpIdentifier: string; custom?: never };
 	customState?: string;
 	options?: {
 		/**