@aws-sdk/client-cognito-identity-provider 3.1144.0 → 3.1146.0

package/dist-types/commands/RespondToAuthChallengeCommand.d.ts

@@ -99,6 +99,9 @@ declare const RespondToAuthChallengeCommand_base: {
  * //       DeviceGroupKey: "STRING_VALUE",
  * //     },
  * //   },
+ * //   AvailableChallenges: [ // AvailableChallengeListType
+ * //     "SMS_MFA" || "EMAIL_OTP" || "SOFTWARE_TOKEN_MFA" || "SELECT_MFA_TYPE" || "MFA_SETUP" || "PASSWORD_VERIFIER" || "CUSTOM_CHALLENGE" || "SELECT_CHALLENGE" || "DEVICE_SRP_AUTH" || "DEVICE_PASSWORD_VERIFIER" || "ADMIN_NO_SRP_AUTH" || "NEW_PASSWORD_REQUIRED" || "SMS_OTP" || "PASSWORD" || "WEB_AUTHN" || "PASSWORD_SRP",
+ * //   ],
  * // };
  *
  * ```

package/dist-types/commands/SetLogDeliveryConfigurationCommand.d.ts

@@ -86,8 +86,20 @@ declare const SetLogDeliveryConfigurationCommand_base: {
  * @see {@link CognitoIdentityProviderClientResolvedConfig | config} for CognitoIdentityProviderClient's `config` shape.
  *
  * @throws {@link FeatureUnavailableInTierException} (client fault)
- *  <p>This exception is thrown when a feature you attempted to configure isn't
- *             available in your current feature plan.</p>
+ *  <p>This exception is thrown when a feature that you attempted to use or configure
+ *             isn't included in your user pool's current feature plan. This can occur
+ *             when:</p>
+ *          <ul>
+ *             <li>
+ *                <p>You configure a feature that your feature plan doesn't support.</p>
+ *             </li>
+ *             <li>
+ *                <p>You make a request that uses a feature that requires a higher feature
+ *                     plan.</p>
+ *             </li>
+ *          </ul>
+ *          <p>To resolve this issue, upgrade your user pool to a feature plan that includes the
+ *             feature.</p>
  *
  * @throws {@link InternalErrorException} (server fault)
  *  <p>This exception is thrown when Amazon Cognito encounters an internal error.</p>

package/dist-types/commands/SetUserPoolMfaConfigCommand.d.ts

@@ -1,6 +1,5 @@
 import type { MetadataBearer as __MetadataBearer } from "@smithy/types";
-import type { SetUserPoolMfaConfigRequest } from "../models/models_0";
-import type { SetUserPoolMfaConfigResponse } from "../models/models_1";
+import type { SetUserPoolMfaConfigRequest, SetUserPoolMfaConfigResponse } from "../models/models_1";
 /**
  * @public
  */
@@ -133,8 +132,20 @@ declare const SetUserPoolMfaConfigCommand_base: {
  *             concurrently.</p>
  *
  * @throws {@link FeatureUnavailableInTierException} (client fault)
- *  <p>This exception is thrown when a feature you attempted to configure isn't
- *             available in your current feature plan.</p>
+ *  <p>This exception is thrown when a feature that you attempted to use or configure
+ *             isn't included in your user pool's current feature plan. This can occur
+ *             when:</p>
+ *          <ul>
+ *             <li>
+ *                <p>You configure a feature that your feature plan doesn't support.</p>
+ *             </li>
+ *             <li>
+ *                <p>You make a request that uses a feature that requires a higher feature
+ *                     plan.</p>
+ *             </li>
+ *          </ul>
+ *          <p>To resolve this issue, upgrade your user pool to a feature plan that includes the
+ *             feature.</p>
  *
  * @throws {@link InternalErrorException} (server fault)
  *  <p>This exception is thrown when Amazon Cognito encounters an internal error.</p>

package/dist-types/commands/UpdateIdentityProviderCommand.d.ts

@@ -68,6 +68,9 @@ declare const UpdateIdentityProviderCommand_base: {
  *   IdpIdentifiers: [ // IdpIdentifiersListType
  *     "STRING_VALUE",
  *   ],
+ *   AcrMapping: { // AcrMappingType
+ *     "<keys>": "STRING_VALUE",
+ *   },
  * };
  * const command = new UpdateIdentityProviderCommand(input);
  * const response = await client.send(command);
@@ -85,6 +88,9 @@ declare const UpdateIdentityProviderCommand_base: {
  * //     IdpIdentifiers: [ // IdpIdentifiersListType
  * //       "STRING_VALUE",
  * //     ],
+ * //     AcrMapping: { // AcrMappingType
+ * //       "<keys>": "STRING_VALUE",
+ * //     },
  * //     LastModifiedDate: new Date("TIMESTAMP"),
  * //     CreationDate: new Date("TIMESTAMP"),
  * //   },

package/dist-types/commands/UpdateUserPoolClientCommand.d.ts

@@ -191,8 +191,20 @@ declare const UpdateUserPoolClientCommand_base: {
  *             concurrently.</p>
  *
  * @throws {@link FeatureUnavailableInTierException} (client fault)
- *  <p>This exception is thrown when a feature you attempted to configure isn't
- *             available in your current feature plan.</p>
+ *  <p>This exception is thrown when a feature that you attempted to use or configure
+ *             isn't included in your user pool's current feature plan. This can occur
+ *             when:</p>
+ *          <ul>
+ *             <li>
+ *                <p>You configure a feature that your feature plan doesn't support.</p>
+ *             </li>
+ *             <li>
+ *                <p>You make a request that uses a feature that requires a higher feature
+ *                     plan.</p>
+ *             </li>
+ *          </ul>
+ *          <p>To resolve this issue, upgrade your user pool to a feature plan that includes the
+ *             feature.</p>
  *
  * @throws {@link InternalErrorException} (server fault)
  *  <p>This exception is thrown when Amazon Cognito encounters an internal error.</p>

package/dist-types/commands/UpdateUserPoolCommand.d.ts

@@ -208,6 +208,11 @@ declare const UpdateUserPoolCommand_base: {
  *   IssuerConfiguration: { // IssuerConfigurationType
  *     Type: "ORIGINAL" || "UPDATED",
  *   },
+ *   AcrConfiguration: { // AcrConfigurationType
+ *     "<keys>": { // AcrLevelConfigType
+ *       AcrValue: "STRING_VALUE", // required
+ *     },
+ *   },
  * };
  * const command = new UpdateUserPoolCommand(input);
  * const response = await client.send(command);
@@ -226,8 +231,20 @@ declare const UpdateUserPoolCommand_base: {
  *             concurrently.</p>
  *
  * @throws {@link FeatureUnavailableInTierException} (client fault)
- *  <p>This exception is thrown when a feature you attempted to configure isn't
- *             available in your current feature plan.</p>
+ *  <p>This exception is thrown when a feature that you attempted to use or configure
+ *             isn't included in your user pool's current feature plan. This can occur
+ *             when:</p>
+ *          <ul>
+ *             <li>
+ *                <p>You configure a feature that your feature plan doesn't support.</p>
+ *             </li>
+ *             <li>
+ *                <p>You make a request that uses a feature that requires a higher feature
+ *                     plan.</p>
+ *             </li>
+ *          </ul>
+ *          <p>To resolve this issue, upgrade your user pool to a feature plan that includes the
+ *             feature.</p>
  *
  * @throws {@link InternalErrorException} (server fault)
  *  <p>This exception is thrown when Amazon Cognito encounters an internal error.</p>

package/dist-types/commands/UpdateUserPoolDomainCommand.d.ts

@@ -110,8 +110,20 @@ declare const UpdateUserPoolDomainCommand_base: {
  *             concurrently.</p>
  *
  * @throws {@link FeatureUnavailableInTierException} (client fault)
- *  <p>This exception is thrown when a feature you attempted to configure isn't
- *             available in your current feature plan.</p>
+ *  <p>This exception is thrown when a feature that you attempted to use or configure
+ *             isn't included in your user pool's current feature plan. This can occur
+ *             when:</p>
+ *          <ul>
+ *             <li>
+ *                <p>You configure a feature that your feature plan doesn't support.</p>
+ *             </li>
+ *             <li>
+ *                <p>You make a request that uses a feature that requires a higher feature
+ *                     plan.</p>
+ *             </li>
+ *          </ul>
+ *          <p>To resolve this issue, upgrade your user pool to a feature plan that includes the
+ *             feature.</p>
  *
  * @throws {@link InternalErrorException} (server fault)
  *  <p>This exception is thrown when Amazon Cognito encounters an internal error.</p>

package/dist-types/models/errors.d.ts

@@ -323,6 +323,31 @@ export declare class InvalidUserPoolConfigurationException extends __BaseExcepti
      */
     constructor(opts: __ExceptionOptionType<InvalidUserPoolConfigurationException, __BaseException>);
 }
+/**
+ * <p>This exception is thrown when a feature that you attempted to use or configure
+ *             isn't included in your user pool's current feature plan. This can occur
+ *             when:</p>
+ *          <ul>
+ *             <li>
+ *                <p>You configure a feature that your feature plan doesn't support.</p>
+ *             </li>
+ *             <li>
+ *                <p>You make a request that uses a feature that requires a higher feature
+ *                     plan.</p>
+ *             </li>
+ *          </ul>
+ *          <p>To resolve this issue, upgrade your user pool to a feature plan that includes the
+ *             feature.</p>
+ * @public
+ */
+export declare class FeatureUnavailableInTierException extends __BaseException {
+    readonly name: "FeatureUnavailableInTierException";
+    readonly $fault: "client";
+    /**
+     * @internal
+     */
+    constructor(opts: __ExceptionOptionType<FeatureUnavailableInTierException, __BaseException>);
+}
 /**
  * <p>This exception is thrown when Amazon Cognito isn't allowed to use your email identity. HTTP
  *             status code: 400.</p>
@@ -606,19 +631,6 @@ export declare class TermsExistsException extends __BaseException {
      */
     constructor(opts: __ExceptionOptionType<TermsExistsException, __BaseException>);
 }
-/**
- * <p>This exception is thrown when a feature you attempted to configure isn't
- *             available in your current feature plan.</p>
- * @public
- */
-export declare class FeatureUnavailableInTierException extends __BaseException {
-    readonly name: "FeatureUnavailableInTierException";
-    readonly $fault: "client";
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<FeatureUnavailableInTierException, __BaseException>);
-}
 /**
  * <p>This exception is thrown when you've attempted to change your feature plan but
  *             the operation isn't permitted.</p>

package/dist-types/models/models_0.d.ts

@@ -201,6 +201,20 @@ export interface AccountTakeoverRiskConfigurationType {
      */
     Actions: AccountTakeoverActionsType | undefined;
 }
+/**
+ * <p>The configuration for a single authentication context class reference (ACR) level in a user pool. Each entry in an <code>AcrConfiguration</code> map associates a level (<code>Level1</code> through <code>Level4</code>) with this configuration, which provides the custom name that Amazon Cognito reports for that level in the <code>acr</code> token claim.</p>
+ * @public
+ */
+export interface AcrLevelConfigType {
+    /**
+     * <p>The custom name for this authentication context class reference (ACR) level. This
+     *             value is the URI that Amazon Cognito reports in the <code>acr</code> token claim when a
+     *             user meets this level. The name must be unique across all levels in the user pool,
+     *             including default names.</p>
+     * @public
+     */
+    AcrValue: string | undefined;
+}
 /**
  * <p>The minimum and maximum values of an attribute that is of the number type, for example
  *                 <code>custom:age</code>.</p>
@@ -1445,6 +1459,38 @@ export interface AdminInitiateAuthRequest {
      *                                     <code>AvailableChallenges</code> parameter that specifies the
      *                                 available sign-in methods.</p>
      *                   </li>
+     *                   <li>
+     *                      <p>
+     *                         <code>TARGET_ACR_VALUES</code>. An optional, space-separated list
+     *                                 of the authentication context class reference (ACR) level URIs that
+     *                                 you want the user to reach. List the levels in priority order, from
+     *                                 highest to lowest. Amazon Cognito attempts the highest-priority level that the
+     *                                 user can satisfy, and falls back through the list. Amazon Cognito ignores any
+     *                                 value that it doesn't recognize. If none of the requested values are
+     *                                 valid, Amazon Cognito returns an error.</p>
+     *                      <p>Requesting step-up authentication with this parameter requires the
+     *                                 Essentials or Plus feature plan. On a lower feature plan,
+     *                                 AdminInitiateAuth returns a FeatureUnavailableInTierException.
+     *                                 <code>USERNAME</code> is required. When you provide an
+     *                                 <code>ACCESS_TOKEN</code>, you must also provide
+     *                                 <code>TARGET_ACR_VALUES</code>. Amazon Cognito returns an error if you provide
+     *                                 an <code>ACCESS_TOKEN</code> without <code>TARGET_ACR_VALUES</code>.
+     *                                 The <code>USERNAME</code> that you provide must match the user that the
+     *                                 <code>ACCESS_TOKEN</code> was issued for.</p>
+     *                      <p>For more information about step-up authentication and how Amazon Cognito
+     *                                 handles multi-factor authentication requirements, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-step-up-authentication.html">Step-up
+     *                                 authentication with ACR and AMR</a> in the <i>Amazon Cognito
+     *                                 Developer Guide</i>.</p>
+     *                   </li>
+     *                   <li>
+     *                      <p>
+     *                         <code>MAX_AGE</code>. An optional integer that sets the maximum
+     *                                 number of seconds allowed since the user last authenticated. If the
+     *                                 user's most recent authentication is older than this value, Amazon Cognito
+     *                                 discards the authentication-methods credit from any access token that
+     *                                 you provide and processes the request as a fresh authentication toward
+     *                                 the target level. The access token itself remains valid.</p>
+     *                   </li>
      *                </ul>
      *             </dd>
      *             <dt>USER_SRP_AUTH</dt>
@@ -3097,6 +3143,14 @@ export interface AdminRespondToAuthChallengeResponse {
      * @public
      */
     AuthenticationResult?: AuthenticationResultType | undefined;
+    /**
+     * <p>This response parameter lists the available authentication challenges that users can
+     *             select from in <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/authentication-flows-selection-sdk.html#authentication-flows-selection-choice">choice-based authentication</a>. For example, they might be
+     *             able to choose between passkey authentication, a one-time password from an SMS message,
+     *             and a traditional password.</p>
+     * @public
+     */
+    AvailableChallenges?: ChallengeNameType[] | undefined;
 }
 /**
  * <p>User preferences for multi-factor authentication with email messages. Activates or
@@ -4186,6 +4240,20 @@ export interface CreateIdentityProviderRequest {
      * @public
      */
     IdpIdentifiers?: string[] | undefined;
+    /**
+     * <p>A mapping between the authentication context class reference (ACR) levels of your user
+     *             pool and the ACR values of the external OpenID Connect (OIDC) identity provider (IdP).
+     *             The map is keyed by level, from <code>Level1</code> through <code>Level4</code>, and each
+     *             value is the ACR value that the IdP uses for the corresponding level. Amazon Cognito uses
+     *             this mapping to translate a requested user pool ACR level to the value that the IdP
+     *             expects, and to map an ACR value that the IdP returns back to a user pool level. When the
+     *             IdP returns an ACR value that isn't mapped, Amazon Cognito resolves it to the lowest
+     *             level. Only OIDC IdPs support ACR mapping.</p>
+     *          <p>Setting <code>AcrMapping</code> is available in all feature plans. It isn't restricted
+     *             to the Essentials or Plus feature plan.</p>
+     * @public
+     */
+    AcrMapping?: Record<string, string> | undefined;
 }
 /**
  * <p>A user pool identity provider (IdP). Contains information about a third-party IdP to a
@@ -4346,6 +4414,15 @@ export interface IdentityProviderType {
      * @public
      */
     IdpIdentifiers?: string[] | undefined;
+    /**
+     * <p>A mapping between the authentication context class reference (ACR) levels of your user
+     *             pool and the ACR values of the external OpenID Connect (OIDC) identity provider (IdP), so
+     *             that your application gets a consistent step-up experience regardless of which IdP
+     *             authenticated the user. The map is keyed by level, from <code>Level1</code> through
+     *             <code>Level4</code>.</p>
+     * @public
+     */
+    AcrMapping?: Record<string, string> | undefined;
     /**
      * <p>The date and time when the item was modified. Amazon Cognito returns this timestamp in UNIX epoch time format. Your SDK might render the output in a
      * human-readable format like ISO 8601 or a Java <code>Date</code> object.</p>
@@ -5858,6 +5935,25 @@ export interface CreateUserPoolRequest {
      * @public
      */
     IssuerConfiguration?: IssuerConfigurationType | undefined;
+    /**
+     * <p>The custom names for the authentication context class reference
+     *             (ACR) levels in your user pool. Amazon Cognito defines four fixed ACR levels that
+     *             represent increasing authentication assurance. The combination of authentication factors
+     *             that satisfies each level is fixed and you can't change it. With this configuration, you
+     *             customize only the URI name that Amazon Cognito reports for each level in the
+     *             <code>acr</code> token claim.</p>
+     *          <p>You can override a subset of the levels. By default, the levels are named
+     *             <code>urn:cognito:loa:1</code> through <code>urn:cognito:loa:4</code>, and Amazon Cognito
+     *             applies the default name to any level that you don't specify. Each name must be
+     *             unique across all four levels, including any default names that apply to levels you
+     *             don't override. A name can contain any character
+     *             that is valid in a URL or a URN.</p>
+     *          <p>Configuring custom ACR level names requires the Essentials or Plus feature plan.
+     *             To activate this setting, your user pool must be in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html">
+     *                      Essentials tier</a> or higher.</p>
+     * @public
+     */
+    AcrConfiguration?: Record<string, AcrLevelConfigType> | undefined;
 }
 /**
  * <p>The configuration of a user pool.</p>
@@ -6141,6 +6237,16 @@ export interface UserPoolType {
      * @public
      */
     IssuerConfiguration?: IssuerConfigurationType | undefined;
+    /**
+     * <p>The names of the authentication context class reference (ACR) levels for the user
+     *             pool. Amazon Cognito always returns the effective configuration, with default names
+     *             merged in for any level that you haven't customized.</p>
+     *          <p>Configuring custom ACR level names requires the Essentials or Plus feature plan.
+     *             To activate this setting, your user pool must be in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html">
+     *                      Essentials tier</a> or higher.</p>
+     * @public
+     */
+    AcrConfiguration?: Record<string, AcrLevelConfigType> | undefined;
 }
 /**
  * <p>Represents the response from the server for the request to create a user pool.</p>
@@ -7748,7 +7854,7 @@ export interface DescribeTermsByClientRequest {
  */
 export interface DescribeTermsByClientResponse {
     /**
-     * <p>A summary of the requested terms documents. Includes a unique identifier for later
+     * <p>A summary of the requested terms documents, including a unique identifier for later
      *             changes to the terms documents.</p>
      * @public
      */
@@ -9050,6 +9156,38 @@ export interface InitiateAuthRequest {
      *                                     <code>AvailableChallenges</code> parameter that specifies the
      *                                 available sign-in methods.</p>
      *                   </li>
+     *                   <li>
+     *                      <p>
+     *                         <code>TARGET_ACR_VALUES</code>. An optional, space-separated list
+     *                                 of the authentication context class reference (ACR) level URIs that
+     *                                 you want the user to reach. List the levels in priority order, from
+     *                                 highest to lowest. Amazon Cognito attempts the highest-priority level that the
+     *                                 user can satisfy, and falls back through the list. Amazon Cognito ignores any
+     *                                 value that it doesn't recognize. If none of the requested values are
+     *                                 valid, Amazon Cognito returns an error.</p>
+     *                      <p>Requesting step-up authentication with this parameter requires the
+     *                                 Essentials or Plus feature plan. On a lower feature plan, InitiateAuth
+     *                                 returns a FeatureUnavailableInTierException. <code>USERNAME</code> is
+     *                                 required. When you provide an <code>ACCESS_TOKEN</code>, you must also
+     *                                 provide <code>TARGET_ACR_VALUES</code>. Amazon Cognito returns an error if you
+     *                                 provide an <code>ACCESS_TOKEN</code> without
+     *                                 <code>TARGET_ACR_VALUES</code>. The <code>USERNAME</code> that you
+     *                                 provide must match the user that the <code>ACCESS_TOKEN</code> was
+     *                                 issued for.</p>
+     *                      <p>For more information about step-up authentication and how Amazon Cognito
+     *                                 handles multi-factor authentication requirements, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-step-up-authentication.html">Step-up
+     *                                 authentication with ACR and AMR</a> in the <i>Amazon Cognito
+     *                                 Developer Guide</i>.</p>
+     *                   </li>
+     *                   <li>
+     *                      <p>
+     *                         <code>MAX_AGE</code>. An optional integer that sets the maximum
+     *                                 number of seconds allowed since the user last authenticated. If the
+     *                                 user's most recent authentication is older than this value, Amazon Cognito
+     *                                 discards the authentication-methods credit from any access token that
+     *                                 you provide and processes the request as a fresh authentication toward
+     *                                 the target level. The access token itself remains valid.</p>
+     *                   </li>
      *                </ul>
      *             </dd>
      *             <dt>USER_SRP_AUTH</dt>
@@ -10860,6 +10998,14 @@ export interface RespondToAuthChallengeResponse {
      * @public
      */
     AuthenticationResult?: AuthenticationResultType | undefined;
+    /**
+     * <p>This response parameter lists the available authentication challenges that users can
+     *             select from in <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/authentication-flows-selection-sdk.html#authentication-flows-selection-choice">choice-based authentication</a>. For example, they might be
+     *             able to choose between passkey authentication, a one-time password from an SMS message,
+     *             and a traditional password.</p>
+     * @public
+     */
+    AvailableChallenges?: ChallengeNameType[] | undefined;
 }
 /**
  * @public
@@ -11058,53 +11204,3 @@ export interface SetUserMFAPreferenceRequest {
  */
 export interface SetUserMFAPreferenceResponse {
 }
-/**
- * @public
- */
-export interface SetUserPoolMfaConfigRequest {
-    /**
-     * <p>The user pool ID.</p>
-     * @public
-     */
-    UserPoolId: string | undefined;
-    /**
-     * <p>Configures user pool SMS messages for MFA. Sets the message template and the SMS
-     *             message sending configuration for Amazon SNS.</p>
-     * @public
-     */
-    SmsMfaConfiguration?: SmsMfaConfigType | undefined;
-    /**
-     * <p>Configures a user pool for time-based one-time password (TOTP) MFA. Enables or
-     *             disables TOTP.</p>
-     * @public
-     */
-    SoftwareTokenMfaConfiguration?: SoftwareTokenMfaConfigType | undefined;
-    /**
-     * <p>Sets configuration for user pool email message MFA and sign-in with one-time passwords
-     *             (OTPs). Includes the subject and body of the email message template for sign-in and MFA
-     *             messages. To activate this setting, your user pool must be in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html">
-     *                      Essentials tier</a> or higher.</p>
-     * @public
-     */
-    EmailMfaConfiguration?: EmailMfaConfigType | undefined;
-    /**
-     * <p>Sets multi-factor authentication (MFA) to be on, off, or optional. When
-     *                 <code>ON</code>, all users must set up MFA before they can sign in. When
-     *                 <code>OPTIONAL</code>, your application must make a client-side determination of
-     *             whether a user wants to register an MFA device. For user pools with adaptive
-     *             authentication with threat protection, choose <code>OPTIONAL</code>.</p>
-     *          <p>When <code>MfaConfiguration</code> is <code>OPTIONAL</code>, managed login
-     *             doesn't automatically prompt users to set up MFA. Amazon Cognito generates MFA prompts in
-     *             API responses and in managed login for users who have chosen and configured a preferred
-     *             MFA factor.</p>
-     * @public
-     */
-    MfaConfiguration?: UserPoolMfaType | undefined;
-    /**
-     * <p>The configuration of your user pool for passkey, or WebAuthn, authentication and
-     *             registration. Includes relying-party configuration, user-verification requirements,
-     *             and whether passkeys can satisfy MFA requirements.</p>
-     * @public
-     */
-    WebAuthnConfiguration?: WebAuthnConfigurationType | undefined;
-}

package/dist-types/models/models_1.d.ts

@@ -1,6 +1,56 @@
 import type { DocumentType as __DocumentType } from "@smithy/types";
 import type { DeletionProtectionType, DeviceRememberedStatusType, ExplicitAuthFlowsType, FeedbackValueType, OAuthFlowType, PreventUserExistenceErrorTypes, TermsEnforcementType, TermsSourceType, UpdateReplicaStatusType, UserPoolMfaType, UserPoolTierType, VerifiedAttributeType, VerifySoftwareTokenResponseType } from "./enums";
-import type { AccountRecoverySettingType, AdminCreateUserConfigType, AnalyticsConfigurationType, AnalyticsMetadataType, AssetType, AttributeType, CodeDeliveryDetailsType, CustomDomainConfigType, DeviceConfigurationType, EmailConfigurationType, EmailMfaConfigType, GroupType, IdentityProviderType, IssuerConfigurationType, KeyConfigurationType, LambdaConfigType, LimitDefinitionType, LimitType, ManagedLoginBrandingType, MFAOptionType, RefreshTokenRotationType, ResourceServerScopeType, ResourceServerType, RoutingType, SmsConfigurationType, SmsMfaConfigType, SoftwareTokenMfaConfigType, TermsType, TokenValidityUnitsType, UserAttributeUpdateSettingsType, UserContextDataType, UserImportJobType, UserPoolAddOnsType, UserPoolClientType, UserPoolPolicyType, UserPoolReplicaType, VerificationMessageTemplateType, WebAuthnConfigurationType } from "./models_0";
+import type { AccountRecoverySettingType, AcrLevelConfigType, AdminCreateUserConfigType, AnalyticsConfigurationType, AnalyticsMetadataType, AssetType, AttributeType, CodeDeliveryDetailsType, CustomDomainConfigType, DeviceConfigurationType, EmailConfigurationType, EmailMfaConfigType, GroupType, IdentityProviderType, IssuerConfigurationType, KeyConfigurationType, LambdaConfigType, LimitDefinitionType, LimitType, ManagedLoginBrandingType, MFAOptionType, RefreshTokenRotationType, ResourceServerScopeType, ResourceServerType, RoutingType, SmsConfigurationType, SmsMfaConfigType, SoftwareTokenMfaConfigType, TermsType, TokenValidityUnitsType, UserAttributeUpdateSettingsType, UserContextDataType, UserImportJobType, UserPoolAddOnsType, UserPoolClientType, UserPoolPolicyType, UserPoolReplicaType, VerificationMessageTemplateType, WebAuthnConfigurationType } from "./models_0";
+/**
+ * @public
+ */
+export interface SetUserPoolMfaConfigRequest {
+    /**
+     * <p>The user pool ID.</p>
+     * @public
+     */
+    UserPoolId: string | undefined;
+    /**
+     * <p>Configures user pool SMS messages for MFA. Sets the message template and the SMS
+     *             message sending configuration for Amazon SNS.</p>
+     * @public
+     */
+    SmsMfaConfiguration?: SmsMfaConfigType | undefined;
+    /**
+     * <p>Configures a user pool for time-based one-time password (TOTP) MFA. Enables or
+     *             disables TOTP.</p>
+     * @public
+     */
+    SoftwareTokenMfaConfiguration?: SoftwareTokenMfaConfigType | undefined;
+    /**
+     * <p>Sets configuration for user pool email message MFA and sign-in with one-time passwords
+     *             (OTPs). Includes the subject and body of the email message template for sign-in and MFA
+     *             messages. To activate this setting, your user pool must be in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html">
+     *                      Essentials tier</a> or higher.</p>
+     * @public
+     */
+    EmailMfaConfiguration?: EmailMfaConfigType | undefined;
+    /**
+     * <p>Sets multi-factor authentication (MFA) to be on, off, or optional. When
+     *                 <code>ON</code>, all users must set up MFA before they can sign in. When
+     *                 <code>OPTIONAL</code>, your application must make a client-side determination of
+     *             whether a user wants to register an MFA device. For user pools with adaptive
+     *             authentication with threat protection, choose <code>OPTIONAL</code>.</p>
+     *          <p>When <code>MfaConfiguration</code> is <code>OPTIONAL</code>, managed login
+     *             doesn't automatically prompt users to set up MFA. Amazon Cognito generates MFA prompts in
+     *             API responses and in managed login for users who have chosen and configured a preferred
+     *             MFA factor.</p>
+     * @public
+     */
+    MfaConfiguration?: UserPoolMfaType | undefined;
+    /**
+     * <p>The configuration of your user pool for passkey, or WebAuthn, authentication and
+     *             registration. Includes relying-party configuration, user-verification requirements,
+     *             and whether passkeys can satisfy MFA requirements.</p>
+     * @public
+     */
+    WebAuthnConfiguration?: WebAuthnConfigurationType | undefined;
+}
 /**
  * @public
  */
@@ -609,6 +659,16 @@ export interface UpdateIdentityProviderRequest {
      * @public
      */
     IdpIdentifiers?: string[] | undefined;
+    /**
+     * <p>A mapping between the authentication context class reference (ACR) levels of your user
+     *             pool and the ACR values of the external OpenID Connect (OIDC) identity provider (IdP).
+     *             This mapping has the same behavior as it does when you create an identity provider. Only
+     *             OIDC IdPs support ACR mapping.</p>
+     *          <p>Setting <code>AcrMapping</code> is available in all feature plans. It isn't restricted
+     *             to the Essentials or Plus feature plan.</p>
+     * @public
+     */
+    AcrMapping?: Record<string, string> | undefined;
 }
 /**
  * @public
@@ -1065,6 +1125,18 @@ export interface UpdateUserPoolRequest {
      * @public
      */
     IssuerConfiguration?: IssuerConfigurationType | undefined;
+    /**
+     * <p>The custom names for the authentication context class reference
+     *             (ACR) levels in your user pool. This configuration has the same behavior as it does when
+     *             you create a user pool: you customize only the URI name that Amazon Cognito reports for
+     *             each of the four fixed ACR levels, and any level that you don't specify keeps its default
+     *             name. Each name must be unique across all four levels, including default names.</p>
+     *          <p>Configuring custom ACR level names requires the Essentials or Plus feature plan.
+     *             To activate this setting, your user pool must be in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html">
+     *                      Essentials tier</a> or higher.</p>
+     * @public
+     */
+    AcrConfiguration?: Record<string, AcrLevelConfigType> | undefined;
 }
 /**
  * <p>Represents the response from the server when you make a request to update the user

package/dist-types/schemas/schemas_0.d.ts

@@ -70,6 +70,7 @@ export declare var AccountRecoverySettingType$: StaticStructureSchema;
 export declare var AccountTakeoverActionsType$: StaticStructureSchema;
 export declare var AccountTakeoverActionType$: StaticStructureSchema;
 export declare var AccountTakeoverRiskConfigurationType$: StaticStructureSchema;
+export declare var AcrLevelConfigType$: StaticStructureSchema;
 export declare var AddCustomAttributesRequest$: StaticStructureSchema;
 export declare var AddCustomAttributesResponse$: StaticStructureSchema;
 export declare var AddUserPoolClientSecretRequest$: StaticStructureSchema;

package/dist-types/ts3.4/commands/SetUserPoolMfaConfigCommand.d.ts

@@ -1,6 +1,5 @@
 import { MetadataBearer as __MetadataBearer } from "@smithy/types";
-import { SetUserPoolMfaConfigRequest } from "../models/models_0";
-import { SetUserPoolMfaConfigResponse } from "../models/models_1";
+import { SetUserPoolMfaConfigRequest, SetUserPoolMfaConfigResponse } from "../models/models_1";
 export { __MetadataBearer };
 export interface SetUserPoolMfaConfigCommandInput extends SetUserPoolMfaConfigRequest {}
 export interface SetUserPoolMfaConfigCommandOutput

package/dist-types/ts3.4/models/errors.d.ts

@@ -128,6 +128,11 @@ export declare class InvalidUserPoolConfigurationException extends __BaseExcepti
   readonly $fault: "client";
   constructor(opts: __ExceptionOptionType<InvalidUserPoolConfigurationException, __BaseException>);
 }
+export declare class FeatureUnavailableInTierException extends __BaseException {
+  readonly name: "FeatureUnavailableInTierException";
+  readonly $fault: "client";
+  constructor(opts: __ExceptionOptionType<FeatureUnavailableInTierException, __BaseException>);
+}
 export declare class InvalidEmailRoleAccessPolicyException extends __BaseException {
   readonly name: "InvalidEmailRoleAccessPolicyException";
   readonly $fault: "client";
@@ -242,11 +247,6 @@ export declare class TermsExistsException extends __BaseException {
   readonly $fault: "client";
   constructor(opts: __ExceptionOptionType<TermsExistsException, __BaseException>);
 }
-export declare class FeatureUnavailableInTierException extends __BaseException {
-  readonly name: "FeatureUnavailableInTierException";
-  readonly $fault: "client";
-  constructor(opts: __ExceptionOptionType<FeatureUnavailableInTierException, __BaseException>);
-}
 export declare class TierChangeNotAllowedException extends __BaseException {
   readonly name: "TierChangeNotAllowedException";
   readonly $fault: "client";