@ttoss/cloud-auth 0.13.9 → 0.13.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/cloud-auth",
-  "version": "0.13.9",
+  "version": "0.13.11",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -19,13 +19,13 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@ttoss/cloudformation": "^0.11.7"
+    "@ttoss/cloudformation": "^0.11.9"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
     "jest": "^30.2.0",
     "tsup": "^8.5.1",
-    "typescript": "~5.7.2",
+    "typescript": "~5.9.3",
     "@ttoss/config": "^1.35.12"
   },
   "publishConfig": {

package/dist/esm/index.js

@@ -1,382 +0,0 @@
-/** Powered by @ttoss/config. https://ttoss.dev/docs/modules/packages/config/ */
-var __defProp = Object.defineProperty;
-var __name = (target, value) => __defProp(target, "name", {
-  value,
-  configurable: true
-});
-
-// src/config.ts
-var PASSWORD_MINIMUM_LENGTH = 8;
-
-// src/template.ts
-var CognitoUserPoolLogicalId = "CognitoUserPool";
-var CognitoUserPoolClientLogicalId = "CognitoUserPoolClient";
-var CognitoIdentityPoolLogicalId = "CognitoIdentityPool";
-var IdentityPoolAuthenticatedIAMRoleLogicalId = "IdentityPoolAuthenticatedIAMRole";
-var IdentityPoolUnauthenticatedIAMRoleLogicalId = "IdentityPoolUnauthenticatedIAMRole";
-var DenyStatement = {
-  Effect: "Deny",
-  Action: ["*"],
-  Resource: ["*"]
-};
-var defaultPrincipalTags = {
-  appClientId: "aud",
-  userId: "sub"
-};
-var createAuthTemplate = /* @__PURE__ */__name(({
-  autoVerifiedAttributes = ["email"],
-  identityPool,
-  schema,
-  usernameAttributes = ["email"],
-  lambdaTriggers,
-  deletionProtection
-} = {}) => {
-  const AutoVerifiedAttributes = Array.isArray(autoVerifiedAttributes) && autoVerifiedAttributes.length > 0 ? autoVerifiedAttributes : [];
-  const template = {
-    AWSTemplateFormatVersion: "2010-09-09",
-    Resources: {
-      [CognitoUserPoolLogicalId]: {
-        /**
-        * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html
-        */
-        Type: "AWS::Cognito::UserPool",
-        Properties: {
-          AutoVerifiedAttributes,
-          Policies: {
-            PasswordPolicy: {
-              MinimumLength: PASSWORD_MINIMUM_LENGTH,
-              RequireLowercase: false,
-              RequireNumbers: false,
-              RequireSymbols: false,
-              RequireUppercase: false,
-              TemporaryPasswordValidityDays: 30
-            }
-          },
-          UsernameAttributes: usernameAttributes,
-          UsernameConfiguration: {
-            CaseSensitive: false
-          },
-          UserPoolName: {
-            Ref: "AWS::StackName"
-          },
-          ...(deletionProtection && {
-            DeletionProtection: deletionProtection
-          })
-        }
-      },
-      [CognitoUserPoolClientLogicalId]: {
-        /**
-        * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.html
-        */
-        Type: "AWS::Cognito::UserPoolClient",
-        Properties: {
-          SupportedIdentityProviders: ["COGNITO"],
-          UserPoolId: {
-            Ref: "CognitoUserPool"
-          }
-        }
-      }
-    },
-    Outputs: {
-      Region: {
-        Description: "You use this value on Amplify Auth `region`.",
-        Value: {
-          Ref: "AWS::Region"
-        },
-        Export: {
-          Name: {
-            "Fn::Join": [":", [{
-              Ref: "AWS::StackName"
-            }, "Region"]]
-          }
-        }
-      },
-      UserPoolId: {
-        Description: "You use this value on Amplify Auth `userPoolId`.",
-        Value: {
-          Ref: CognitoUserPoolLogicalId
-        },
-        Export: {
-          Name: {
-            "Fn::Join": [":", [{
-              Ref: "AWS::StackName"
-            }, "UserPoolId"]]
-          }
-        }
-      },
-      AppClientId: {
-        Description: "You use this value on Amplify Auth `userPoolWebClientId`.",
-        Value: {
-          Ref: CognitoUserPoolClientLogicalId
-        },
-        Export: {
-          Name: {
-            "Fn::Join": [":", [{
-              Ref: "AWS::StackName"
-            }, "AppClientId"]]
-          }
-        }
-      }
-    }
-  };
-  if (schema) {
-    const Schema = schema.map(attribute => {
-      let NumberAttributeConstraints = void 0;
-      if (attribute.numberAttributeConstraints) {
-        NumberAttributeConstraints = {
-          MaxValue: attribute.numberAttributeConstraints?.maxValue,
-          MinValue: attribute.numberAttributeConstraints?.minValue
-        };
-      }
-      let StringAttributeConstraints = void 0;
-      if (attribute.stringAttributeConstraints) {
-        StringAttributeConstraints = {
-          MaxLength: attribute.stringAttributeConstraints?.maxLength,
-          MinLength: attribute.stringAttributeConstraints?.minLength
-        };
-      }
-      return {
-        AttributeDataType: attribute.attributeDataType,
-        DeveloperOnlyAttribute: attribute.developerOnlyAttribute,
-        Mutable: attribute.mutable,
-        Name: attribute.name,
-        NumberAttributeConstraints,
-        Required: attribute.required,
-        StringAttributeConstraints
-      };
-    });
-    template.Resources[CognitoUserPoolLogicalId].Properties = {
-      ...template.Resources[CognitoUserPoolLogicalId].Properties,
-      Schema
-    };
-  }
-  if (identityPool?.enabled) {
-    template.Resources[CognitoIdentityPoolLogicalId] = {
-      /**
-      * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypool.html
-      */
-      Type: "AWS::Cognito::IdentityPool",
-      Properties: {
-        AllowUnauthenticatedIdentities: identityPool.allowUnauthenticatedIdentities || false,
-        CognitoIdentityProviders: [{
-          ClientId: {
-            Ref: CognitoUserPoolClientLogicalId
-          },
-          ProviderName: {
-            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
-          }
-        }]
-      }
-    };
-    if (identityPool.name) {
-      template.Resources[CognitoIdentityPoolLogicalId].Properties = {
-        ...template.Resources[CognitoIdentityPoolLogicalId].Properties,
-        IdentityPoolName: identityPool.name
-      };
-    }
-    template.Resources.CognitoIdentityPoolRoleAttachment = {
-      /**
-      * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypoolroleattachment.html
-      */
-      Type: "AWS::Cognito::IdentityPoolRoleAttachment",
-      Properties: {
-        IdentityPoolId: {
-          Ref: CognitoIdentityPoolLogicalId
-        },
-        Roles: {}
-      }
-    };
-    if (!identityPool.authenticatedRoleArn) {
-      template.Resources[IdentityPoolAuthenticatedIAMRoleLogicalId] = {
-        Type: "AWS::IAM::Role",
-        Properties: {
-          AssumeRolePolicyDocument: {
-            Version: "2012-10-17",
-            Statement: [{
-              Effect: "Allow",
-              Principal: {
-                Federated: "cognito-identity.amazonaws.com"
-              },
-              Action: ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"],
-              Condition: {
-                StringEquals: {
-                  "cognito-identity.amazonaws.com:aud": {
-                    Ref: CognitoIdentityPoolLogicalId
-                  }
-                },
-                "ForAnyValue:StringLike": {
-                  "cognito-identity.amazonaws.com:amr": "authenticated"
-                }
-              }
-            }]
-          },
-          Policies: identityPool.authenticatedPolicies || [{
-            PolicyName: "IdentityPoolAuthenticatedIAMRolePolicyName",
-            PolicyDocument: {
-              Version: "2012-10-17",
-              Statement: [DenyStatement]
-            }
-          }]
-        }
-      };
-      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
-        authenticated: {
-          "Fn::GetAtt": [IdentityPoolAuthenticatedIAMRoleLogicalId, "Arn"]
-        }
-      });
-    } else {
-      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
-        authenticated: identityPool.authenticatedRoleArn
-      });
-    }
-    if (!identityPool.unauthenticatedRoleArn) {
-      template.Resources[IdentityPoolUnauthenticatedIAMRoleLogicalId] = {
-        Type: "AWS::IAM::Role",
-        Properties: {
-          AssumeRolePolicyDocument: {
-            Version: "2012-10-17",
-            Statement: [{
-              Effect: "Allow",
-              Principal: {
-                Federated: "cognito-identity.amazonaws.com"
-              },
-              Action: "sts:AssumeRoleWithWebIdentity",
-              Condition: {
-                StringEquals: {
-                  "cognito-identity.amazonaws.com:aud": {
-                    Ref: CognitoIdentityPoolLogicalId
-                  }
-                },
-                "ForAnyValue:StringLike": {
-                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
-                }
-              }
-            }]
-          },
-          Policies: identityPool.unauthenticatedPolicies || [{
-            PolicyName: "IdentityPoolUnauthenticatedIAMRolePolicyName",
-            PolicyDocument: {
-              Version: "2012-10-17",
-              Statement: [DenyStatement]
-            }
-          }]
-        }
-      };
-      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
-        unauthenticated: {
-          "Fn::GetAtt": [IdentityPoolUnauthenticatedIAMRoleLogicalId, "Arn"]
-        }
-      });
-    } else {
-      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
-        unauthenticated: identityPool.unauthenticatedRoleArn
-      });
-    }
-    if (identityPool.principalTags || identityPool.principalTags === void 0) {
-      const PrincipalTags = (() => {
-        if (typeof identityPool.principalTags === "boolean") {
-          return defaultPrincipalTags;
-        }
-        if (identityPool.principalTags === void 0) {
-          return defaultPrincipalTags;
-        }
-        return identityPool.principalTags;
-      })();
-      template.Resources.CognitoIdentityPoolPrincipalTag = {
-        Type: "AWS::Cognito::IdentityPoolPrincipalTag",
-        Properties: {
-          IdentityPoolId: {
-            Ref: CognitoIdentityPoolLogicalId
-          },
-          IdentityProviderName: {
-            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
-          },
-          PrincipalTags,
-          UseDefaults: false
-        }
-      };
-    }
-    template.Outputs = {
-      ...template.Outputs,
-      IdentityPoolId: {
-        Description: "You use this value on Amplify Auth `identityPoolId`.",
-        Value: {
-          Ref: CognitoIdentityPoolLogicalId
-        },
-        Export: {
-          Name: {
-            "Fn::Join": [":", [{
-              Ref: "AWS::StackName"
-            }, "CognitoIdentityPoolId"]]
-          }
-        }
-      }
-    };
-  }
-  if (lambdaTriggers) {
-    const LambdaConfig = {};
-    if (lambdaTriggers.preSignUp) {
-      LambdaConfig.PreSignUp = lambdaTriggers.preSignUp;
-    }
-    if (lambdaTriggers.postConfirmation) {
-      LambdaConfig.PostConfirmation = lambdaTriggers.postConfirmation;
-    }
-    if (lambdaTriggers.preAuthentication) {
-      LambdaConfig.PreAuthentication = lambdaTriggers.preAuthentication;
-    }
-    if (lambdaTriggers.postAuthentication) {
-      LambdaConfig.PostAuthentication = lambdaTriggers.postAuthentication;
-    }
-    if (lambdaTriggers.defineAuthChallenge) {
-      LambdaConfig.DefineAuthChallenge = lambdaTriggers.defineAuthChallenge;
-    }
-    if (lambdaTriggers.createAuthChallenge) {
-      LambdaConfig.CreateAuthChallenge = lambdaTriggers.createAuthChallenge;
-    }
-    if (lambdaTriggers.verifyAuthChallengeResponse) {
-      LambdaConfig.VerifyAuthChallengeResponse = lambdaTriggers.verifyAuthChallengeResponse;
-    }
-    if (lambdaTriggers.preTokenGeneration) {
-      LambdaConfig.PreTokenGeneration = lambdaTriggers.preTokenGeneration;
-    }
-    if (lambdaTriggers.userMigration) {
-      LambdaConfig.UserMigration = lambdaTriggers.userMigration;
-    }
-    if (lambdaTriggers.customMessage) {
-      LambdaConfig.CustomMessage = lambdaTriggers.customMessage;
-    }
-    if (lambdaTriggers.customEmailSender) {
-      LambdaConfig.CustomEmailSender = lambdaTriggers.customEmailSender;
-    }
-    if (lambdaTriggers.customSMSSender) {
-      LambdaConfig.CustomSMSSender = lambdaTriggers.customSMSSender;
-    }
-    if (Object.keys(LambdaConfig).length > 0) {
-      template.Resources[CognitoUserPoolLogicalId].Properties = {
-        ...template.Resources[CognitoUserPoolLogicalId].Properties,
-        LambdaConfig
-      };
-    }
-    for (const [key, lambdaTrigger] of Object.entries(LambdaConfig)) {
-      const permissionLogicalId = `${key}PermissionFor${CognitoUserPoolLogicalId}`.slice(0, 255);
-      template.Resources[permissionLogicalId] = {
-        Type: "AWS::Lambda::Permission",
-        Properties: {
-          Action: "lambda:InvokeFunction",
-          FunctionName: lambdaTrigger,
-          Principal: "cognito-idp.amazonaws.com",
-          SourceArn: {
-            "Fn::GetAtt": [CognitoUserPoolLogicalId, "Arn"]
-          }
-        }
-      };
-    }
-  }
-  return template;
-}, "createAuthTemplate");
-createAuthTemplate.CognitoUserPoolLogicalId = CognitoUserPoolLogicalId;
-createAuthTemplate.CognitoUserPoolClientLogicalId = CognitoUserPoolClientLogicalId;
-createAuthTemplate.CognitoIdentityPoolLogicalId = CognitoIdentityPoolLogicalId;
-createAuthTemplate.IdentityPoolAuthenticatedIAMRoleLogicalId = IdentityPoolAuthenticatedIAMRoleLogicalId;
-createAuthTemplate.IdentityPoolUnauthenticatedIAMRoleLogicalId = IdentityPoolUnauthenticatedIAMRoleLogicalId;
-export { PASSWORD_MINIMUM_LENGTH, createAuthTemplate };

package/dist/index.d.mts

@@ -1,62 +0,0 @@
-import { Policy, CloudFormationGetAtt, CloudFormationTemplate } from '@ttoss/cloudformation';
-export { CloudFormationTemplate } from '@ttoss/cloudformation';
-
-declare const PASSWORD_MINIMUM_LENGTH = 8;
-
-type SchemaAttribute = {
-    attributeDataType?: 'Boolean' | 'DateTime' | 'Number' | 'String';
-    developerOnlyAttribute?: boolean;
-    mutable?: boolean;
-    name?: string;
-    numberAttributeConstraints?: {
-        maxValue?: string;
-        minValue?: string;
-    };
-    required?: boolean;
-    stringAttributeConstraints?: {
-        maxLength: string;
-        minLength: string;
-    };
-};
-type IdentityPoolConfig = {
-    enabled?: boolean;
-    name?: string;
-    allowUnauthenticatedIdentities?: boolean;
-    authenticatedRoleArn?: string;
-    authenticatedPolicies?: Policy[];
-    unauthenticatedRoleArn?: string;
-    unauthenticatedPolicies?: Policy[];
-    principalTags?: Record<string, string> | boolean;
-};
-type LambdaTriggers = {
-    preSignUp?: string | CloudFormationGetAtt;
-    postConfirmation?: string | CloudFormationGetAtt;
-    preAuthentication?: string | CloudFormationGetAtt;
-    postAuthentication?: string | CloudFormationGetAtt;
-    defineAuthChallenge?: string | CloudFormationGetAtt;
-    createAuthChallenge?: string | CloudFormationGetAtt;
-    verifyAuthChallengeResponse?: string | CloudFormationGetAtt;
-    preTokenGeneration?: string | CloudFormationGetAtt;
-    userMigration?: string | CloudFormationGetAtt;
-    customMessage?: string | CloudFormationGetAtt;
-    customEmailSender?: string | CloudFormationGetAtt;
-    customSMSSender?: string | CloudFormationGetAtt;
-};
-type CreateAuthTemplateParams = {
-    autoVerifiedAttributes?: Array<'email' | 'phone_number'> | null | false;
-    identityPool?: IdentityPoolConfig;
-    schema?: SchemaAttribute[];
-    usernameAttributes?: Array<'email' | 'phone_number'> | null;
-    lambdaTriggers?: LambdaTriggers;
-    deletionProtection?: 'ACTIVE' | 'INACTIVE';
-};
-declare const createAuthTemplate: {
-    ({ autoVerifiedAttributes, identityPool, schema, usernameAttributes, lambdaTriggers, deletionProtection, }?: CreateAuthTemplateParams): CloudFormationTemplate;
-    CognitoUserPoolLogicalId: string;
-    CognitoUserPoolClientLogicalId: string;
-    CognitoIdentityPoolLogicalId: string;
-    IdentityPoolAuthenticatedIAMRoleLogicalId: string;
-    IdentityPoolUnauthenticatedIAMRoleLogicalId: string;
-};
-
-export { PASSWORD_MINIMUM_LENGTH, createAuthTemplate };

package/dist/index.d.ts

@@ -1,62 +0,0 @@
-import { Policy, CloudFormationGetAtt, CloudFormationTemplate } from '@ttoss/cloudformation';
-export { CloudFormationTemplate } from '@ttoss/cloudformation';
-
-declare const PASSWORD_MINIMUM_LENGTH = 8;
-
-type SchemaAttribute = {
-    attributeDataType?: 'Boolean' | 'DateTime' | 'Number' | 'String';
-    developerOnlyAttribute?: boolean;
-    mutable?: boolean;
-    name?: string;
-    numberAttributeConstraints?: {
-        maxValue?: string;
-        minValue?: string;
-    };
-    required?: boolean;
-    stringAttributeConstraints?: {
-        maxLength: string;
-        minLength: string;
-    };
-};
-type IdentityPoolConfig = {
-    enabled?: boolean;
-    name?: string;
-    allowUnauthenticatedIdentities?: boolean;
-    authenticatedRoleArn?: string;
-    authenticatedPolicies?: Policy[];
-    unauthenticatedRoleArn?: string;
-    unauthenticatedPolicies?: Policy[];
-    principalTags?: Record<string, string> | boolean;
-};
-type LambdaTriggers = {
-    preSignUp?: string | CloudFormationGetAtt;
-    postConfirmation?: string | CloudFormationGetAtt;
-    preAuthentication?: string | CloudFormationGetAtt;
-    postAuthentication?: string | CloudFormationGetAtt;
-    defineAuthChallenge?: string | CloudFormationGetAtt;
-    createAuthChallenge?: string | CloudFormationGetAtt;
-    verifyAuthChallengeResponse?: string | CloudFormationGetAtt;
-    preTokenGeneration?: string | CloudFormationGetAtt;
-    userMigration?: string | CloudFormationGetAtt;
-    customMessage?: string | CloudFormationGetAtt;
-    customEmailSender?: string | CloudFormationGetAtt;
-    customSMSSender?: string | CloudFormationGetAtt;
-};
-type CreateAuthTemplateParams = {
-    autoVerifiedAttributes?: Array<'email' | 'phone_number'> | null | false;
-    identityPool?: IdentityPoolConfig;
-    schema?: SchemaAttribute[];
-    usernameAttributes?: Array<'email' | 'phone_number'> | null;
-    lambdaTriggers?: LambdaTriggers;
-    deletionProtection?: 'ACTIVE' | 'INACTIVE';
-};
-declare const createAuthTemplate: {
-    ({ autoVerifiedAttributes, identityPool, schema, usernameAttributes, lambdaTriggers, deletionProtection, }?: CreateAuthTemplateParams): CloudFormationTemplate;
-    CognitoUserPoolLogicalId: string;
-    CognitoUserPoolClientLogicalId: string;
-    CognitoIdentityPoolLogicalId: string;
-    IdentityPoolAuthenticatedIAMRoleLogicalId: string;
-    IdentityPoolUnauthenticatedIAMRoleLogicalId: string;
-};
-
-export { PASSWORD_MINIMUM_LENGTH, createAuthTemplate };

package/dist/index.js

@@ -1,417 +0,0 @@
-/** Powered by @ttoss/config. https://ttoss.dev/docs/modules/packages/config/ */
-"use strict";
-
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __name = (target, value) => __defProp(target, "name", {
-  value,
-  configurable: true
-});
-var __export = (target, all) => {
-  for (var name in all) __defProp(target, name, {
-    get: all[name],
-    enumerable: true
-  });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from)) if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-      get: () => from[key],
-      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-    });
-  }
-  return to;
-};
-var __toCommonJS = mod => __copyProps(__defProp({}, "__esModule", {
-  value: true
-}), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  PASSWORD_MINIMUM_LENGTH: () => PASSWORD_MINIMUM_LENGTH,
-  createAuthTemplate: () => createAuthTemplate
-});
-module.exports = __toCommonJS(index_exports);
-
-// src/config.ts
-var PASSWORD_MINIMUM_LENGTH = 8;
-
-// src/template.ts
-var CognitoUserPoolLogicalId = "CognitoUserPool";
-var CognitoUserPoolClientLogicalId = "CognitoUserPoolClient";
-var CognitoIdentityPoolLogicalId = "CognitoIdentityPool";
-var IdentityPoolAuthenticatedIAMRoleLogicalId = "IdentityPoolAuthenticatedIAMRole";
-var IdentityPoolUnauthenticatedIAMRoleLogicalId = "IdentityPoolUnauthenticatedIAMRole";
-var DenyStatement = {
-  Effect: "Deny",
-  Action: ["*"],
-  Resource: ["*"]
-};
-var defaultPrincipalTags = {
-  appClientId: "aud",
-  userId: "sub"
-};
-var createAuthTemplate = /* @__PURE__ */__name(({
-  autoVerifiedAttributes = ["email"],
-  identityPool,
-  schema,
-  usernameAttributes = ["email"],
-  lambdaTriggers,
-  deletionProtection
-} = {}) => {
-  const AutoVerifiedAttributes = Array.isArray(autoVerifiedAttributes) && autoVerifiedAttributes.length > 0 ? autoVerifiedAttributes : [];
-  const template = {
-    AWSTemplateFormatVersion: "2010-09-09",
-    Resources: {
-      [CognitoUserPoolLogicalId]: {
-        /**
-        * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html
-        */
-        Type: "AWS::Cognito::UserPool",
-        Properties: {
-          AutoVerifiedAttributes,
-          Policies: {
-            PasswordPolicy: {
-              MinimumLength: PASSWORD_MINIMUM_LENGTH,
-              RequireLowercase: false,
-              RequireNumbers: false,
-              RequireSymbols: false,
-              RequireUppercase: false,
-              TemporaryPasswordValidityDays: 30
-            }
-          },
-          UsernameAttributes: usernameAttributes,
-          UsernameConfiguration: {
-            CaseSensitive: false
-          },
-          UserPoolName: {
-            Ref: "AWS::StackName"
-          },
-          ...(deletionProtection && {
-            DeletionProtection: deletionProtection
-          })
-        }
-      },
-      [CognitoUserPoolClientLogicalId]: {
-        /**
-        * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.html
-        */
-        Type: "AWS::Cognito::UserPoolClient",
-        Properties: {
-          SupportedIdentityProviders: ["COGNITO"],
-          UserPoolId: {
-            Ref: "CognitoUserPool"
-          }
-        }
-      }
-    },
-    Outputs: {
-      Region: {
-        Description: "You use this value on Amplify Auth `region`.",
-        Value: {
-          Ref: "AWS::Region"
-        },
-        Export: {
-          Name: {
-            "Fn::Join": [":", [{
-              Ref: "AWS::StackName"
-            }, "Region"]]
-          }
-        }
-      },
-      UserPoolId: {
-        Description: "You use this value on Amplify Auth `userPoolId`.",
-        Value: {
-          Ref: CognitoUserPoolLogicalId
-        },
-        Export: {
-          Name: {
-            "Fn::Join": [":", [{
-              Ref: "AWS::StackName"
-            }, "UserPoolId"]]
-          }
-        }
-      },
-      AppClientId: {
-        Description: "You use this value on Amplify Auth `userPoolWebClientId`.",
-        Value: {
-          Ref: CognitoUserPoolClientLogicalId
-        },
-        Export: {
-          Name: {
-            "Fn::Join": [":", [{
-              Ref: "AWS::StackName"
-            }, "AppClientId"]]
-          }
-        }
-      }
-    }
-  };
-  if (schema) {
-    const Schema = schema.map(attribute => {
-      let NumberAttributeConstraints = void 0;
-      if (attribute.numberAttributeConstraints) {
-        NumberAttributeConstraints = {
-          MaxValue: attribute.numberAttributeConstraints?.maxValue,
-          MinValue: attribute.numberAttributeConstraints?.minValue
-        };
-      }
-      let StringAttributeConstraints = void 0;
-      if (attribute.stringAttributeConstraints) {
-        StringAttributeConstraints = {
-          MaxLength: attribute.stringAttributeConstraints?.maxLength,
-          MinLength: attribute.stringAttributeConstraints?.minLength
-        };
-      }
-      return {
-        AttributeDataType: attribute.attributeDataType,
-        DeveloperOnlyAttribute: attribute.developerOnlyAttribute,
-        Mutable: attribute.mutable,
-        Name: attribute.name,
-        NumberAttributeConstraints,
-        Required: attribute.required,
-        StringAttributeConstraints
-      };
-    });
-    template.Resources[CognitoUserPoolLogicalId].Properties = {
-      ...template.Resources[CognitoUserPoolLogicalId].Properties,
-      Schema
-    };
-  }
-  if (identityPool?.enabled) {
-    template.Resources[CognitoIdentityPoolLogicalId] = {
-      /**
-      * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypool.html
-      */
-      Type: "AWS::Cognito::IdentityPool",
-      Properties: {
-        AllowUnauthenticatedIdentities: identityPool.allowUnauthenticatedIdentities || false,
-        CognitoIdentityProviders: [{
-          ClientId: {
-            Ref: CognitoUserPoolClientLogicalId
-          },
-          ProviderName: {
-            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
-          }
-        }]
-      }
-    };
-    if (identityPool.name) {
-      template.Resources[CognitoIdentityPoolLogicalId].Properties = {
-        ...template.Resources[CognitoIdentityPoolLogicalId].Properties,
-        IdentityPoolName: identityPool.name
-      };
-    }
-    template.Resources.CognitoIdentityPoolRoleAttachment = {
-      /**
-      * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypoolroleattachment.html
-      */
-      Type: "AWS::Cognito::IdentityPoolRoleAttachment",
-      Properties: {
-        IdentityPoolId: {
-          Ref: CognitoIdentityPoolLogicalId
-        },
-        Roles: {}
-      }
-    };
-    if (!identityPool.authenticatedRoleArn) {
-      template.Resources[IdentityPoolAuthenticatedIAMRoleLogicalId] = {
-        Type: "AWS::IAM::Role",
-        Properties: {
-          AssumeRolePolicyDocument: {
-            Version: "2012-10-17",
-            Statement: [{
-              Effect: "Allow",
-              Principal: {
-                Federated: "cognito-identity.amazonaws.com"
-              },
-              Action: ["sts:AssumeRoleWithWebIdentity", "sts:TagSession"],
-              Condition: {
-                StringEquals: {
-                  "cognito-identity.amazonaws.com:aud": {
-                    Ref: CognitoIdentityPoolLogicalId
-                  }
-                },
-                "ForAnyValue:StringLike": {
-                  "cognito-identity.amazonaws.com:amr": "authenticated"
-                }
-              }
-            }]
-          },
-          Policies: identityPool.authenticatedPolicies || [{
-            PolicyName: "IdentityPoolAuthenticatedIAMRolePolicyName",
-            PolicyDocument: {
-              Version: "2012-10-17",
-              Statement: [DenyStatement]
-            }
-          }]
-        }
-      };
-      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
-        authenticated: {
-          "Fn::GetAtt": [IdentityPoolAuthenticatedIAMRoleLogicalId, "Arn"]
-        }
-      });
-    } else {
-      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
-        authenticated: identityPool.authenticatedRoleArn
-      });
-    }
-    if (!identityPool.unauthenticatedRoleArn) {
-      template.Resources[IdentityPoolUnauthenticatedIAMRoleLogicalId] = {
-        Type: "AWS::IAM::Role",
-        Properties: {
-          AssumeRolePolicyDocument: {
-            Version: "2012-10-17",
-            Statement: [{
-              Effect: "Allow",
-              Principal: {
-                Federated: "cognito-identity.amazonaws.com"
-              },
-              Action: "sts:AssumeRoleWithWebIdentity",
-              Condition: {
-                StringEquals: {
-                  "cognito-identity.amazonaws.com:aud": {
-                    Ref: CognitoIdentityPoolLogicalId
-                  }
-                },
-                "ForAnyValue:StringLike": {
-                  "cognito-identity.amazonaws.com:amr": "unauthenticated"
-                }
-              }
-            }]
-          },
-          Policies: identityPool.unauthenticatedPolicies || [{
-            PolicyName: "IdentityPoolUnauthenticatedIAMRolePolicyName",
-            PolicyDocument: {
-              Version: "2012-10-17",
-              Statement: [DenyStatement]
-            }
-          }]
-        }
-      };
-      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
-        unauthenticated: {
-          "Fn::GetAtt": [IdentityPoolUnauthenticatedIAMRoleLogicalId, "Arn"]
-        }
-      });
-    } else {
-      Object.assign(template.Resources.CognitoIdentityPoolRoleAttachment.Properties?.Roles, {
-        unauthenticated: identityPool.unauthenticatedRoleArn
-      });
-    }
-    if (identityPool.principalTags || identityPool.principalTags === void 0) {
-      const PrincipalTags = (() => {
-        if (typeof identityPool.principalTags === "boolean") {
-          return defaultPrincipalTags;
-        }
-        if (identityPool.principalTags === void 0) {
-          return defaultPrincipalTags;
-        }
-        return identityPool.principalTags;
-      })();
-      template.Resources.CognitoIdentityPoolPrincipalTag = {
-        Type: "AWS::Cognito::IdentityPoolPrincipalTag",
-        Properties: {
-          IdentityPoolId: {
-            Ref: CognitoIdentityPoolLogicalId
-          },
-          IdentityProviderName: {
-            "Fn::GetAtt": [CognitoUserPoolLogicalId, "ProviderName"]
-          },
-          PrincipalTags,
-          UseDefaults: false
-        }
-      };
-    }
-    template.Outputs = {
-      ...template.Outputs,
-      IdentityPoolId: {
-        Description: "You use this value on Amplify Auth `identityPoolId`.",
-        Value: {
-          Ref: CognitoIdentityPoolLogicalId
-        },
-        Export: {
-          Name: {
-            "Fn::Join": [":", [{
-              Ref: "AWS::StackName"
-            }, "CognitoIdentityPoolId"]]
-          }
-        }
-      }
-    };
-  }
-  if (lambdaTriggers) {
-    const LambdaConfig = {};
-    if (lambdaTriggers.preSignUp) {
-      LambdaConfig.PreSignUp = lambdaTriggers.preSignUp;
-    }
-    if (lambdaTriggers.postConfirmation) {
-      LambdaConfig.PostConfirmation = lambdaTriggers.postConfirmation;
-    }
-    if (lambdaTriggers.preAuthentication) {
-      LambdaConfig.PreAuthentication = lambdaTriggers.preAuthentication;
-    }
-    if (lambdaTriggers.postAuthentication) {
-      LambdaConfig.PostAuthentication = lambdaTriggers.postAuthentication;
-    }
-    if (lambdaTriggers.defineAuthChallenge) {
-      LambdaConfig.DefineAuthChallenge = lambdaTriggers.defineAuthChallenge;
-    }
-    if (lambdaTriggers.createAuthChallenge) {
-      LambdaConfig.CreateAuthChallenge = lambdaTriggers.createAuthChallenge;
-    }
-    if (lambdaTriggers.verifyAuthChallengeResponse) {
-      LambdaConfig.VerifyAuthChallengeResponse = lambdaTriggers.verifyAuthChallengeResponse;
-    }
-    if (lambdaTriggers.preTokenGeneration) {
-      LambdaConfig.PreTokenGeneration = lambdaTriggers.preTokenGeneration;
-    }
-    if (lambdaTriggers.userMigration) {
-      LambdaConfig.UserMigration = lambdaTriggers.userMigration;
-    }
-    if (lambdaTriggers.customMessage) {
-      LambdaConfig.CustomMessage = lambdaTriggers.customMessage;
-    }
-    if (lambdaTriggers.customEmailSender) {
-      LambdaConfig.CustomEmailSender = lambdaTriggers.customEmailSender;
-    }
-    if (lambdaTriggers.customSMSSender) {
-      LambdaConfig.CustomSMSSender = lambdaTriggers.customSMSSender;
-    }
-    if (Object.keys(LambdaConfig).length > 0) {
-      template.Resources[CognitoUserPoolLogicalId].Properties = {
-        ...template.Resources[CognitoUserPoolLogicalId].Properties,
-        LambdaConfig
-      };
-    }
-    for (const [key, lambdaTrigger] of Object.entries(LambdaConfig)) {
-      const permissionLogicalId = `${key}PermissionFor${CognitoUserPoolLogicalId}`.slice(0, 255);
-      template.Resources[permissionLogicalId] = {
-        Type: "AWS::Lambda::Permission",
-        Properties: {
-          Action: "lambda:InvokeFunction",
-          FunctionName: lambdaTrigger,
-          Principal: "cognito-idp.amazonaws.com",
-          SourceArn: {
-            "Fn::GetAtt": [CognitoUserPoolLogicalId, "Arn"]
-          }
-        }
-      };
-    }
-  }
-  return template;
-}, "createAuthTemplate");
-createAuthTemplate.CognitoUserPoolLogicalId = CognitoUserPoolLogicalId;
-createAuthTemplate.CognitoUserPoolClientLogicalId = CognitoUserPoolClientLogicalId;
-createAuthTemplate.CognitoIdentityPoolLogicalId = CognitoIdentityPoolLogicalId;
-createAuthTemplate.IdentityPoolAuthenticatedIAMRoleLogicalId = IdentityPoolAuthenticatedIAMRoleLogicalId;
-createAuthTemplate.IdentityPoolUnauthenticatedIAMRoleLogicalId = IdentityPoolUnauthenticatedIAMRoleLogicalId;
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  PASSWORD_MINIMUM_LENGTH,
-  createAuthTemplate
-});