@venturekit/infra 0.0.29 → 0.0.31

package/dist/cdk/identity-stack.js

@@ -8,6 +8,9 @@
  *   - Federated provider Secrets Manager placeholder(s) holding
  *     `{clientId, clientSecret}` for Google / Apple / Meta /
  *     other OAuth providers declared in `auth.federated[]`
+ *   - Custom-sender KMS key + the pool's `LambdaConfig`
+ *     (`CustomEmailSender` / `CustomSMSSender` / `KMSKeyID`) when
+ *     `auth.customSender` points at a standalone function
  *
  * # Lifecycle position
  *
@@ -29,17 +32,37 @@
  *     (the canonical one app code reads)
  *   - `identityKeys.federatedSecretArn(authId, provider)` per
  *     provider in `auth.federated[]`
+ *   - `identityKeys.customSenderKmsKeyArn(authId)` when
+ *     `auth.customSender` is declared
+ *
+ * # Custom-sender triggers and the tier boundary
+ *
+ * `LambdaConfig` is a property of the pool, so it MUST be rendered
+ * here — but the trigger function is an app-tier Lambda, and the
+ * app tier already consumes this tier (pool ARN / IDs). Importing
+ * the function ARN back into this stack would be a cross-stack
+ * cycle. VentureKit's Lambda naming is deterministic
+ * (`<project>-<stage>-fn-<id>`, see `clampLambdaFunctionName`), so
+ * this stack computes the function ARN as a plain string instead of
+ * referencing the resource. Cognito stores the ARN without checking
+ * that the function exists (cross-account triggers are legal, and
+ * a deleted trigger only fails at invocation), so the identity tier
+ * can deploy first; the app tier then creates the function and
+ * attaches Cognito's invoke permission in the same `vk deploy`.
  *
  * # What this stack does NOT do
  *
  * - **No IAM grants.** Lambdas need
  *   `cognito-idp:AdminCreateUser` / `AdminInitiateAuth` /
- *   `AdminConfirmSignUp` etc. on the pool, and `secretsmanager:Get
- *   SecretValue` on each federated provider Secret. Those grants
+ *   `AdminConfirmSignUp` etc. on the pool, `secretsmanager:Get
+ *   SecretValue` on each federated provider Secret, and
+ *   `kms:Decrypt` on the custom-sender key. Those grants
  *   produce `AWS::IAM::Policy` resources attached to the
  *   shared-Lambda-role — which lives in the app stack. The app
- *   stack imports the pool ARN + secret ARNs via SSM and applies
- *   the grants there.
+ *   stack imports the pool ARN + secret / key ARNs via SSM and
+ *   applies the grants there, together with the resource-based
+ *   `lambda:InvokeFunction` permission Cognito needs on the
+ *   custom-sender function.
  *
  * - **No env-var injection.** The legacy single-stack code
  *   side-effected `this.ventureBaseEnv['COGNITO_USER_POOL_ID'] =
@@ -61,9 +84,12 @@
  */
 import * as cdk from 'aws-cdk-lib';
 import * as cognito from 'aws-cdk-lib/aws-cognito';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as kms from 'aws-cdk-lib/aws-kms';
 import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 import { DATA_SAFETY_CONFIG, isExternalAuthIntent, } from '@venturekit/core';
 import { writeSsm } from './shared/cross-stack-refs.js';
+import { customSenderFunctionArn, resolveCustomSender } from './shared/custom-sender.js';
 import { identityKeys } from './shared/ssm-keys.js';
 /**
  * Config vocabulary (`envConfig.identity.featurePlan`) → CDK enum.
@@ -89,6 +115,12 @@ export class VentureIdentityStack extends cdk.Stack {
      * SSM rather than this in-memory map.
      */
     federatedSecrets = new Map();
+    /**
+     * Custom-sender KMS keys, keyed by `auth.id`. Only populated for
+     * intents declaring `customSender`. The app stack grants
+     * `kms:Decrypt` on these to the shared Lambda role.
+     */
+    customSenderKeys = new Map();
     isStrictRetain;
     constructor(scope, id, props) {
         super(scope, id, props);
@@ -156,6 +188,61 @@ export class VentureIdentityStack extends cdk.Stack {
                 mutable: true,
             });
         }
+        // ── Custom-sender KMS key ─────────────────────────────────────
+        // Cognito encrypts the secret it hands a `CustomEmailSender` /
+        // `CustomSMSSender` trigger (verification code, OTP, temporary
+        // password) with a customer-managed symmetric key via the AWS
+        // Encryption SDK; the trigger decrypts it with the same key. The
+        // key lives in this tier with the pool it serves: losing it would
+        // not lose data (codes are minutes-lived) but it is referenced by
+        // the pool's `LambdaConfig.KMSKeyID`, so it follows the pool's
+        // removal policy. Created BEFORE the pool because CFN needs the
+        // key ARN in the pool's properties.
+        const customSender = resolveCustomSender(intent);
+        let customSenderKey;
+        if (customSender) {
+            customSenderKey = new kms.Key(this, `${logicalId}-custom-sender-key`, {
+                description: `Cognito custom-sender code encryption for ${projectName}-${intent.id}-${stage}`,
+                alias: `alias/${projectName}-${stage}-${intent.id}-cognito-custom-sender`,
+                // Rotation keeps prior key material for decryption, so a
+                // rotated key still opens ciphertext Cognito produced with
+                // the old material (codes only live minutes anyway).
+                enableKeyRotation: true,
+                removalPolicy: isStrictRetain ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY,
+            });
+            // The CDK default key policy already delegates to IAM for this
+            // account (root `kms:*`), which is what lets the CFN execution
+            // role create Cognito's one-time grant at pool create/update
+            // and the app stack grant `kms:Decrypt` to the Lambda role via
+            // an identity policy. This statement additionally lets the
+            // Cognito service principal encrypt with the key directly,
+            // scoped to calls made on behalf of this account. The pool ID
+            // is not known until the pool exists (and the pool references
+            // the key), so `kms:EncryptionContext:userpool-id` can't be
+            // used here without a cycle — `aws:SourceAccount` is the
+            // tightest cycle-free condition.
+            customSenderKey.addToResourcePolicy(new iam.PolicyStatement({
+                sid: 'AllowCognitoCustomSenderEncrypt',
+                effect: iam.Effect.ALLOW,
+                principals: [new iam.ServicePrincipal('cognito-idp.amazonaws.com')],
+                actions: [
+                    'kms:Encrypt',
+                    'kms:GenerateDataKey',
+                    'kms:GenerateDataKeyWithoutPlaintext',
+                    'kms:CreateGrant',
+                    'kms:DescribeKey',
+                ],
+                resources: ['*'],
+                conditions: {
+                    StringEquals: { 'aws:SourceAccount': this.account },
+                },
+            }));
+            this.customSenderKeys.set(intent.id, customSenderKey);
+            writeSsm(this, identityKeys.customSenderKmsKeyArn(projectName, stage, intent.id), customSenderKey.keyArn, {
+                description: `KMS key Cognito encrypts custom-sender codes with for auth pool '${intent.id}'. ` +
+                    `The trigger Lambda decrypts with it (COGNITO_CUSTOM_SENDER_KMS_KEY_ARN).`,
+            });
+        }
         const userPool = new cognito.UserPool(this, logicalId, {
             userPoolName: `${projectName}-${intent.id}-${stage}`,
             // Self-signup defaults OFF — most production apps use invite
@@ -202,11 +289,43 @@ export class VentureIdentityStack extends cdk.Stack {
                 : undefined,
             accountRecovery: cognito.AccountRecovery.EMAIL_ONLY,
             ...(customAttrNames.length > 0 ? { customAttributes } : {}),
+            // `LambdaConfig.KMSKeyID` — the key Cognito encrypts custom-
+            // sender payloads with. The trigger ARNs themselves are set as
+            // L1 overrides below (see the file header for why they are
+            // computed strings, not function references).
+            ...(customSenderKey ? { customSenderKmsKey: customSenderKey } : {}),
+            // Cognito rejects a `CustomSMSSender` on a pool without an SMS
+            // configuration (SNS role). CDK only creates that role when it
+            // infers SMS is needed (phone auto-verify / SMS MFA); force it
+            // whenever an SMS sender is declared so the pool validates
+            // even for email-only sign-in.
+            ...(customSender?.sms ? { enableSmsRole: true } : {}),
         });
+        const cfnPool = userPool.node.defaultChild;
         if (isStrictRetain) {
-            const cfnPool = userPool.node.defaultChild;
             cfnPool.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
         }
+        // ── Custom-sender triggers ────────────────────────────────────
+        // The trigger Lambda is created by the APP stack from
+        // `src/functions/<id>.ts`, so reference it by its deterministic
+        // name rather than by resource — the pool must not depend on the
+        // app tier. `LambdaVersion` is fixed at `V1_0`, the only version
+        // Cognito accepts for custom senders.
+        if (customSender) {
+            const triggerArn = (fnId) => customSenderFunctionArn(this, projectName, stage, fnId);
+            if (customSender.email) {
+                cfnPool.addPropertyOverride('LambdaConfig.CustomEmailSender', {
+                    LambdaArn: triggerArn(customSender.email),
+                    LambdaVersion: 'V1_0',
+                });
+            }
+            if (customSender.sms) {
+                cfnPool.addPropertyOverride('LambdaConfig.CustomSMSSender', {
+                    LambdaArn: triggerArn(customSender.sms),
+                    LambdaVersion: 'V1_0',
+                });
+            }
+        }
         this.userPools.set(intent.id, userPool);
         // ── App clients ───────────────────────────────────────────────
         const clients = intent.clients && intent.clients.length > 0
@@ -223,6 +342,14 @@ export class VentureIdentityStack extends cdk.Stack {
             ? intent.federated
             : [];
         const enableAdminAuth = federatedProviders.length > 0;
+        // Token lifetimes, when the intent declares them (`tokenValidity`); CDK
+        // leaves Cognito's defaults (1 h / 1 h / 30 d) in place for any it omits.
+        const validity = intent.tokenValidity ?? {};
+        const tokenValidity = {
+            ...(validity.accessMinutes !== undefined ? { accessTokenValidity: cdk.Duration.minutes(validity.accessMinutes) } : {}),
+            ...(validity.idMinutes !== undefined ? { idTokenValidity: cdk.Duration.minutes(validity.idMinutes) } : {}),
+            ...(validity.refreshDays !== undefined ? { refreshTokenValidity: cdk.Duration.days(validity.refreshDays) } : {}),
+        };
         let primaryClient;
         for (const client of clients) {
             const appClient = userPool.addClient(client.name, {
@@ -231,6 +358,7 @@ export class VentureIdentityStack extends cdk.Stack {
                     userSrp: true,
                     ...(enableAdminAuth ? { adminUserPassword: true } : {}),
                 },
+                ...tokenValidity,
                 // Hide whether a username exists from failed sign-in errors —
                 // standard credential-stuffing / user-enumeration defense.
                 preventUserExistenceErrors: true,

package/dist/cdk/identity-stack.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-stack.js","sourceRoot":"","sources":["../../src/cdk/identity-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GAIrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;GAIG;AACH,MAAM,aAAa,GAAoD;IACrE,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;IAC9B,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,UAAU;IAC1C,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;CAC/B,CAAC;AAmBF,MAAM,OAAO,oBAAqB,SAAQ,GAAG,CAAC,KAAK;IACjD;;;;OAIG;IACa,SAAS,GAAkC,IAAI,GAAG,EAAE,CAAC;IAErD,UAAU,GAAwC,IAAI,GAAG,EAAE,CAAC;IAE5E;;;;OAIG;IACa,gBAAgB,GAAuC,IAAI,GAAG,EAAE,CAAC;IAEhE,cAAc,CAAU;IAEzC,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAgC;QACxE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACxB,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QAChE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,cAAc,GAAG,gBAAgB,CAAC,aAAa,KAAK,QAAQ,CAAC;QAElE,IAAI,CAAC,cAAc,CAAC,IAAI;YAAE,OAAO;QACjC,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;YACzC,6DAA6D;YAC7D,+DAA+D;YAC/D,8DAA8D;YAC9D,IAAI,oBAAoB,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC3C,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAEO,UAAU,CAChB,MAAW,EACX,WAAmB,EACnB,KAAa,EACb,SAAoB;QAEpB,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC3C,+DAA+D;QAC/D,gEAAgE;QAChE,MAAM,SAAS,GAAG,QAAQ,MAAM,CAAC,EAAE,EAAE,CAAC;QAEtC,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,0DAA0D;QAC1D,gEAAgE;QAChE,gEAAgE;QAChE,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAElE,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,KAAK,QAAQ;YACzD,CAAC,CAAC;gBACE,SAAS,EAAE,EAAE;gBACb,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB,EAAE,IAAI;gBACtB,aAAa,EAAE,IAAI;gBACnB,cAAc,EAAE,IAAI;aACrB;YACH,CAAC,CAAC;gBACE,SAAS,EAAE,CAAC;gBACZ,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB,EAAE,IAAI;gBACtB,aAAa,EAAE,IAAI;gBACnB,cAAc,EAAE,KAAK;aACtB,CAAC;QAEN,iEAAiE;QACjE,+DAA+D;QAC/D,kEAAkE;QAClE,0DAA0D;QAC1D,gEAAgE;QAChE,gEAAgE;QAChE,mDAAmD;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,0DAA0D;QAC1D,cAAc;QACd,MAAM,eAAe,GAAa,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;YACtE,CAAC,CAAC,MAAM,CAAC,gBAAgB;YACzB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,gBAAgB,GAA6C,EAAE,CAAC;QACtE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,eAAe,CAAC;gBACnD,MAAM,EAAE,CAAC;gBACT,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE;YACrD,YAAY,EAAE,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,IAAI,KAAK,EAAE;YACpD,6DAA6D;YAC7D,gEAAgE;YAChE,iBAAiB,EAAE,MAAM,CAAC,WAAW,IAAI,KAAK;YAC9C,4DAA4D;YAC5D,2DAA2D;YAC3D,4DAA4D;YAC5D,aAAa,EAAE;gBACb,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI;gBACnD,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK;gBACpD,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK;aAC3D;YACD,UAAU,EAAE;gBACV,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI;gBACnD,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK;aACrD;YACD,cAAc;YACd,GAAG,EAAE,MAAM,CAAC,GAAG,KAAK,UAAU;gBAC5B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ;gBACtB,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU;oBACzB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ;oBACtB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG;YACrB,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;YACpF,2DAA2D;YAC3D,4DAA4D;YAC5D,4DAA4D;YAC5D,2DAA2D;YAC3D,8DAA8D;YAC9D,8DAA8D;YAC9D,kBAAkB,EAAE,cAAc;YAClC,8DAA8D;YAC9D,gEAAgE;YAChE,iEAAiE;YACjE,8DAA8D;YAC9D,mBAAmB;YACnB,WAAW;YACX,yDAAyD;YACzD,8DAA8D;YAC9D,yDAAyD;YACzD,+DAA+D;YAC/D,oBAAoB,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,IAAI;gBAC5D,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ;gBACvC,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,UAAU;YACnD,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC,CAAC;QAEH,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,YAA+B,CAAC;YAC9D,OAAO,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAExC,iEAAiE;QACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAE1B,+DAA+D;QAC/D,2DAA2D;QAC3D,iEAAiE;QACjE,0DAA0D;QAC1D,8DAA8D;QAC9D,+DAA+D;QAC/D,mCAAmC;QACnC,MAAM,kBAAkB,GAAa,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,SAAS;YAClB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;QAEtD,IAAI,aAAiD,CAAC;QACtD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE;gBAChD,SAAS,EAAE;oBACT,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,IAAI;oBACb,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD;gBACD,8DAA8D;gBAC9D,2DAA2D;gBAC3D,0BAA0B,EAAE,IAAI;gBAChC,4DAA4D;gBAC5D,4DAA4D;gBAC5D,yDAAyD;gBACzD,wDAAwD;gBACxD,2DAA2D;gBAC3D,4DAA4D;gBAC5D,gDAAgD;gBAChD,wDAAwD;gBACxD,yCAAyC;aAC1C,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,aAAa,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,mDAAmD;QACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,aAAc,CAAC,CAAC;QAE/C,kEAAkE;QAClE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,UAAU,EAAE;YAC1F,WAAW,EAAE,kCAAkC,MAAM,CAAC,EAAE,GAAG;SAC5D,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,WAAW,EAAE;YAC5F,WAAW,EAAE,uEAAuE;SACrF,CAAC,CAAC;QACH,QAAQ,CACN,IAAI,EACJ,YAAY,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC3D,aAAc,CAAC,gBAAgB,EAC/B,EAAE,WAAW,EAAE,2CAA2C,MAAM,CAAC,EAAE,GAAG,EAAE,CACzE,CAAC;QAEF,kEAAkE;QAClE,4DAA4D;QAC5D,kEAAkE;QAClE,gEAAgE;QAChE,kDAAkD;QAClD,EAAE;QACF,4DAA4D;QAC5D,4DAA4D;QAC5D,EAAE;QACF,wDAAwD;QACxD,qDAAqD;QACrD,4DAA4D;QAC5D,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CACtC,IAAI,EACJ,GAAG,SAAS,cAAc,QAAQ,EAAE,EACpC;gBACE,UAAU,EAAE,cAAc,WAAW,IAAI,KAAK,SAAS,MAAM,CAAC,EAAE,IAAI,QAAQ,EAAE;gBAC9E,WAAW,EACT,gCAAgC,QAAQ,qBAAqB;oBAC7D,iBAAiB,MAAM,CAAC,EAAE,iCAAiC;gBAC7D,iBAAiB,EAAE;oBACjB,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC;oBACxD,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC;iBAC7D;gBACD,yDAAyD;gBACzD,0DAA0D;gBAC1D,0DAA0D;gBAC1D,qDAAqD;gBACrD,yDAAyD;gBACzD,4CAA4C;gBAC5C,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;aACrF,CACF,CAAC;YACF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9D,QAAQ,CACN,IAAI,EACJ,YAAY,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,EACxE,MAAM,CAAC,SAAS,EAChB;gBACE,WAAW,EACT,aAAa,QAAQ,oCAAoC,MAAM,CAAC,EAAE,KAAK;oBACvE,+DAA+D;aAClE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"identity-stack.js","sourceRoot":"","sources":["../../src/cdk/identity-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GAIrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD;;;;GAIG;AACH,MAAM,aAAa,GAAoD;IACrE,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;IAC9B,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,UAAU;IAC1C,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;CAC/B,CAAC;AAmBF,MAAM,OAAO,oBAAqB,SAAQ,GAAG,CAAC,KAAK;IACjD;;;;OAIG;IACa,SAAS,GAAkC,IAAI,GAAG,EAAE,CAAC;IAErD,UAAU,GAAwC,IAAI,GAAG,EAAE,CAAC;IAE5E;;;;OAIG;IACa,gBAAgB,GAAuC,IAAI,GAAG,EAAE,CAAC;IAEjF;;;;OAIG;IACa,gBAAgB,GAAyB,IAAI,GAAG,EAAE,CAAC;IAElD,cAAc,CAAU;IAEzC,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAgC;QACxE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACxB,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QAChE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,cAAc,GAAG,gBAAgB,CAAC,aAAa,KAAK,QAAQ,CAAC;QAElE,IAAI,CAAC,cAAc,CAAC,IAAI;YAAE,OAAO;QACjC,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;YACzC,6DAA6D;YAC7D,+DAA+D;YAC/D,8DAA8D;YAC9D,IAAI,oBAAoB,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC3C,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAEO,UAAU,CAChB,MAAW,EACX,WAAmB,EACnB,KAAa,EACb,SAAoB;QAEpB,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC3C,+DAA+D;QAC/D,gEAAgE;QAChE,MAAM,SAAS,GAAG,QAAQ,MAAM,CAAC,EAAE,EAAE,CAAC;QAEtC,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,0DAA0D;QAC1D,gEAAgE;QAChE,gEAAgE;QAChE,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAElE,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,KAAK,QAAQ;YACzD,CAAC,CAAC;gBACE,SAAS,EAAE,EAAE;gBACb,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB,EAAE,IAAI;gBACtB,aAAa,EAAE,IAAI;gBACnB,cAAc,EAAE,IAAI;aACrB;YACH,CAAC,CAAC;gBACE,SAAS,EAAE,CAAC;gBACZ,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB,EAAE,IAAI;gBACtB,aAAa,EAAE,IAAI;gBACnB,cAAc,EAAE,KAAK;aACtB,CAAC;QAEN,iEAAiE;QACjE,+DAA+D;QAC/D,kEAAkE;QAClE,0DAA0D;QAC1D,gEAAgE;QAChE,gEAAgE;QAChE,mDAAmD;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,0DAA0D;QAC1D,cAAc;QACd,MAAM,eAAe,GAAa,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;YACtE,CAAC,CAAC,MAAM,CAAC,gBAAgB;YACzB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,gBAAgB,GAA6C,EAAE,CAAC;QACtE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,eAAe,CAAC;gBACnD,MAAM,EAAE,CAAC;gBACT,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED,iEAAiE;QACjE,+DAA+D;QAC/D,+DAA+D;QAC/D,8DAA8D;QAC9D,iEAAiE;QACjE,kEAAkE;QAClE,kEAAkE;QAClE,+DAA+D;QAC/D,gEAAgE;QAChE,oCAAoC;QACpC,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,eAAoC,CAAC;QACzC,IAAI,YAAY,EAAE,CAAC;YACjB,eAAe,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,SAAS,oBAAoB,EAAE;gBACpE,WAAW,EACT,6CAA6C,WAAW,IAAI,MAAM,CAAC,EAAE,IAAI,KAAK,EAAE;gBAClF,KAAK,EAAE,SAAS,WAAW,IAAI,KAAK,IAAI,MAAM,CAAC,EAAE,wBAAwB;gBACzE,yDAAyD;gBACzD,2DAA2D;gBAC3D,qDAAqD;gBACrD,iBAAiB,EAAE,IAAI;gBACvB,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;aACrF,CAAC,CAAC;YACH,+DAA+D;YAC/D,+DAA+D;YAC/D,6DAA6D;YAC7D,+DAA+D;YAC/D,2DAA2D;YAC3D,2DAA2D;YAC3D,8DAA8D;YAC9D,8DAA8D;YAC9D,4DAA4D;YAC5D,yDAAyD;YACzD,iCAAiC;YACjC,eAAe,CAAC,mBAAmB,CACjC,IAAI,GAAG,CAAC,eAAe,CAAC;gBACtB,GAAG,EAAE,iCAAiC;gBACtC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;gBACxB,UAAU,EAAE,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;gBACnE,OAAO,EAAE;oBACP,aAAa;oBACb,qBAAqB;oBACrB,qCAAqC;oBACrC,iBAAiB;oBACjB,iBAAiB;iBAClB;gBACD,SAAS,EAAE,CAAC,GAAG,CAAC;gBAChB,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,OAAO,EAAE;iBACpD;aACF,CAAC,CACH,CAAC;YACF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;YACtD,QAAQ,CACN,IAAI,EACJ,YAAY,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACjE,eAAe,CAAC,MAAM,EACtB;gBACE,WAAW,EACT,oEAAoE,MAAM,CAAC,EAAE,KAAK;oBAClF,0EAA0E;aAC7E,CACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE;YACrD,YAAY,EAAE,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,IAAI,KAAK,EAAE;YACpD,6DAA6D;YAC7D,gEAAgE;YAChE,iBAAiB,EAAE,MAAM,CAAC,WAAW,IAAI,KAAK;YAC9C,4DAA4D;YAC5D,2DAA2D;YAC3D,4DAA4D;YAC5D,aAAa,EAAE;gBACb,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI;gBACnD,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK;gBACpD,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK;aAC3D;YACD,UAAU,EAAE;gBACV,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI;gBACnD,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK;aACrD;YACD,cAAc;YACd,GAAG,EAAE,MAAM,CAAC,GAAG,KAAK,UAAU;gBAC5B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ;gBACtB,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU;oBACzB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ;oBACtB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG;YACrB,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;YACpF,2DAA2D;YAC3D,4DAA4D;YAC5D,4DAA4D;YAC5D,2DAA2D;YAC3D,8DAA8D;YAC9D,8DAA8D;YAC9D,kBAAkB,EAAE,cAAc;YAClC,8DAA8D;YAC9D,gEAAgE;YAChE,iEAAiE;YACjE,8DAA8D;YAC9D,mBAAmB;YACnB,WAAW;YACX,yDAAyD;YACzD,8DAA8D;YAC9D,yDAAyD;YACzD,+DAA+D;YAC/D,oBAAoB,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,IAAI;gBAC5D,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ;gBACvC,CAAC,CAAC,SAAS;YACb,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,UAAU;YACnD,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,6DAA6D;YAC7D,+DAA+D;YAC/D,2DAA2D;YAC3D,8CAA8C;YAC9C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,+DAA+D;YAC/D,+DAA+D;YAC/D,+DAA+D;YAC/D,2DAA2D;YAC3D,+BAA+B;YAC/B,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAmC,CAAC;QAClE,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACxE,CAAC;QAED,iEAAiE;QACjE,sDAAsD;QACtD,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,sCAAsC;QACtC,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC7F,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;gBACvB,OAAO,CAAC,mBAAmB,CAAC,gCAAgC,EAAE;oBAC5D,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC;oBACzC,aAAa,EAAE,MAAM;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC;gBACrB,OAAO,CAAC,mBAAmB,CAAC,8BAA8B,EAAE;oBAC1D,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC;oBACvC,aAAa,EAAE,MAAM;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAExC,iEAAiE;QACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAE1B,+DAA+D;QAC/D,2DAA2D;QAC3D,iEAAiE;QACjE,0DAA0D;QAC1D,8DAA8D;QAC9D,+DAA+D;QAC/D,mCAAmC;QACnC,MAAM,kBAAkB,GAAa,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,SAAS;YAClB,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;QAEtD,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;QAC5C,MAAM,aAAa,GAAG;YACpB,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtH,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1G,GAAG,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjH,CAAC;QAEF,IAAI,aAAiD,CAAC;QACtD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE;gBAChD,SAAS,EAAE;oBACT,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,IAAI;oBACb,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD;gBACD,GAAG,aAAa;gBAChB,8DAA8D;gBAC9D,2DAA2D;gBAC3D,0BAA0B,EAAE,IAAI;gBAChC,4DAA4D;gBAC5D,4DAA4D;gBAC5D,yDAAyD;gBACzD,wDAAwD;gBACxD,2DAA2D;gBAC3D,4DAA4D;gBAC5D,gDAAgD;gBAChD,wDAAwD;gBACxD,yCAAyC;aAC1C,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,aAAa,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,mDAAmD;QACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,aAAc,CAAC,CAAC;QAE/C,kEAAkE;QAClE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,UAAU,EAAE;YAC1F,WAAW,EAAE,kCAAkC,MAAM,CAAC,EAAE,GAAG;SAC5D,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,WAAW,EAAE;YAC5F,WAAW,EAAE,uEAAuE;SACrF,CAAC,CAAC;QACH,QAAQ,CACN,IAAI,EACJ,YAAY,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC3D,aAAc,CAAC,gBAAgB,EAC/B,EAAE,WAAW,EAAE,2CAA2C,MAAM,CAAC,EAAE,GAAG,EAAE,CACzE,CAAC;QAEF,kEAAkE;QAClE,4DAA4D;QAC5D,kEAAkE;QAClE,gEAAgE;QAChE,kDAAkD;QAClD,EAAE;QACF,4DAA4D;QAC5D,4DAA4D;QAC5D,EAAE;QACF,wDAAwD;QACxD,qDAAqD;QACrD,4DAA4D;QAC5D,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CACtC,IAAI,EACJ,GAAG,SAAS,cAAc,QAAQ,EAAE,EACpC;gBACE,UAAU,EAAE,cAAc,WAAW,IAAI,KAAK,SAAS,MAAM,CAAC,EAAE,IAAI,QAAQ,EAAE;gBAC9E,WAAW,EACT,gCAAgC,QAAQ,qBAAqB;oBAC7D,iBAAiB,MAAM,CAAC,EAAE,iCAAiC;gBAC7D,iBAAiB,EAAE;oBACjB,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC;oBACxD,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC;iBAC7D;gBACD,yDAAyD;gBACzD,0DAA0D;gBAC1D,0DAA0D;gBAC1D,qDAAqD;gBACrD,yDAAyD;gBACzD,4CAA4C;gBAC5C,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO;aACrF,CACF,CAAC;YACF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9D,QAAQ,CACN,IAAI,EACJ,YAAY,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,EACxE,MAAM,CAAC,SAAS,EAChB;gBACE,WAAW,EACT,aAAa,QAAQ,oCAAoC,MAAM,CAAC,EAAE,KAAK;oBACvE,+DAA+D;aAClE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/cdk/messaging-stack.d.ts

@@ -42,7 +42,9 @@
  *     notifyBounceDlqArn` per `notify[]` intent
  *   - `configKeys.notifyEventsTopicArn /
  *     notifyConfigurationSetName / whatsappTokenSecretArn` per
- *     notify intent. (These straddle the messaging-vs-config
+ *     notify intent, plus `whatsappAppSecretArn /
+ *     whatsappVerifyTokenSecretArn` when `whatsapp.webhooks` is
+ *     set. (These straddle the messaging-vs-config
  *     boundary in the SSM key namespace because the operator pastes
  *     the WhatsApp token by hand and the SES configuration-set name
  *     is operator-facing identity, not just plumbing — but they're
@@ -102,6 +104,18 @@ export declare class VentureMessagingStack extends cdk.Stack {
     readonly notifyDispatcherDlqs: Map<string, sqs.Queue>;
     readonly notifyBounceDlqs: Map<string, sqs.Queue>;
     readonly whatsappTokenSecrets: Map<string, secretsmanager.Secret>;
+    /**
+     * Meta App Secret per `notify` intent (only when
+     * `whatsapp.webhooks: true`). Verifies `x-hub-signature-256` on
+     * incoming webhooks.
+     */
+    readonly whatsappAppSecretSecrets: Map<string, secretsmanager.Secret>;
+    /**
+     * Webhook verify token per `notify` intent (only when
+     * `whatsapp.webhooks: true`). Shared secret for the one-time Meta
+     * subscription handshake.
+     */
+    readonly whatsappVerifyTokenSecrets: Map<string, secretsmanager.Secret>;
     /** EventBridge custom buses for OWNED `events` intents (external ones create nothing here). */
     readonly eventBuses: Map<string, events.EventBus>;
     private readonly isStrictRetain;

package/dist/cdk/messaging-stack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"messaging-stack.d.ts","sourceRoot":"","sources":["../../src/cdk/messaging-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAC;AAGjD,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAsB,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAI1F,MAAM,WAAW,0BAA2B,SAAQ,GAAG,CAAC,UAAU;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IACrB,gEAAgE;IAChE,cAAc,EAAE,aAAa,CAAC;CAC/B;AAED,qBAAa,qBAAsB,SAAQ,GAAG,CAAC,KAAK;IAClD,SAAgB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC;QAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAA;KAAE,CAAC,CAAa;IACtF,SAAgB,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAa;IACvE,SAAgB,2BAA2B,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAa;IAC7E,SAAgB,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAa;IACzE,SAAgB,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAa;IACrE,SAAgB,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAa;IACrF,+FAA+F;IAC/F,SAAgB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAErE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;gBAEtC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B;IA6B3E,OAAO,CAAC,WAAW;IAqEnB,OAAO,CAAC,YAAY;IAsNpB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;CA4BvB"}
+{"version":3,"file":"messaging-stack.d.ts","sourceRoot":"","sources":["../../src/cdk/messaging-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAC;AAGjD,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAsB,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAI1F,MAAM,WAAW,0BAA2B,SAAQ,GAAG,CAAC,UAAU;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IACrB,gEAAgE;IAChE,cAAc,EAAE,aAAa,CAAC;CAC/B;AAED,qBAAa,qBAAsB,SAAQ,GAAG,CAAC,KAAK;IAClD,SAAgB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC;QAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAA;KAAE,CAAC,CAAa;IACtF,SAAgB,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAa;IACvE,SAAgB,2BAA2B,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAa;IAC7E,SAAgB,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAa;IACzE,SAAgB,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAa;IACrE,SAAgB,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAa;IACrF;;;;OAIG;IACH,SAAgB,wBAAwB,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAa;IACzF;;;;OAIG;IACH,SAAgB,0BAA0B,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAa;IAC3F,+FAA+F;IAC/F,SAAgB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAErE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;gBAEtC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B;IA6B3E,OAAO,CAAC,WAAW;IAqEnB,OAAO,CAAC,YAAY;IAySpB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;CA4BvB"}

package/dist/cdk/messaging-stack.js

@@ -42,7 +42,9 @@
  *     notifyBounceDlqArn` per `notify[]` intent
  *   - `configKeys.notifyEventsTopicArn /
  *     notifyConfigurationSetName / whatsappTokenSecretArn` per
- *     notify intent. (These straddle the messaging-vs-config
+ *     notify intent, plus `whatsappAppSecretArn /
+ *     whatsappVerifyTokenSecretArn` when `whatsapp.webhooks` is
+ *     set. (These straddle the messaging-vs-config
  *     boundary in the SSM key namespace because the operator pastes
  *     the WhatsApp token by hand and the SES configuration-set name
  *     is operator-facing identity, not just plumbing — but they're
@@ -95,6 +97,18 @@ export class VentureMessagingStack extends cdk.Stack {
     notifyDispatcherDlqs = new Map();
     notifyBounceDlqs = new Map();
     whatsappTokenSecrets = new Map();
+    /**
+     * Meta App Secret per `notify` intent (only when
+     * `whatsapp.webhooks: true`). Verifies `x-hub-signature-256` on
+     * incoming webhooks.
+     */
+    whatsappAppSecretSecrets = new Map();
+    /**
+     * Webhook verify token per `notify` intent (only when
+     * `whatsapp.webhooks: true`). Shared secret for the one-time Meta
+     * subscription handshake.
+     */
+    whatsappVerifyTokenSecrets = new Map();
     /** EventBridge custom buses for OWNED `events` intents (external ones create nothing here). */
     eventBuses = new Map();
     isStrictRetain;
@@ -284,6 +298,12 @@ export class VentureMessagingStack extends cdk.Stack {
         this.notifyConfigurationSetNames.set(intent.id, configurationSetName);
         writeSsm(this, configKeys.notifyConfigurationSetName(projectName, stage, intent.id), configurationSetName, { description: `SES configuration set name — every SendEmail uses it.` });
         // ── WhatsApp token secret ────────────────────────────────────
+        if (intent.whatsapp?.webhooks && !channels.includes('whatsapp')) {
+            throw new Error(`[venturekit] notify intent '${intent.id}' sets 'whatsapp.webhooks: true' ` +
+                `but 'whatsapp' is not in 'channels'. The webhook secrets are only ` +
+                `provisioned alongside the WhatsApp channel — add 'whatsapp' to ` +
+                `'channels' or remove the flag.`);
+        }
         if (channels.includes('whatsapp')) {
             if (!intent.whatsapp?.phoneNumberId) {
                 throw new Error(`[venturekit] notify intent '${intent.id}' has 'whatsapp' channel ` +
@@ -321,6 +341,57 @@ export class VentureMessagingStack extends cdk.Stack {
                 description: `WhatsApp token Secret ARN. Operators populate via ` +
                     `'aws secretsmanager put-secret-value'.`,
             });
+            // ── Webhook verification secrets (opt-in via whatsapp.webhooks) ──
+            // The App Secret verifies x-hub-signature-256 on every incoming
+            // webhook; the verify token is the shared secret Meta echoes
+            // during the one-time subscription handshake. Both are
+            // operator-paste-in Secrets Manager secrets, same pattern as the
+            // token above: GenerateSecretString at create time (never a
+            // managed SecretString), RETAIN under strict, raw string value
+            // matching createSecretsTokenResolver's default wiring.
+            if (intent.whatsapp?.webhooks) {
+                const appSecret = new secretsmanager.Secret(this, `${logicalId}-whatsapp-app-secret`, {
+                    secretName: `venturekit/${projectName}/${stage}/notify-${intent.id}-whatsapp-app-secret`,
+                    description: `Meta App Secret for webhook signature verification (notify '${intent.id}'). ` +
+                        `After first deploy, paste the App Secret from Meta App Dashboard ` +
+                        `→ Settings → Basic via 'aws secretsmanager put-secret-value'.`,
+                    generateSecretString: {
+                        passwordLength: 64,
+                        excludePunctuation: true,
+                    },
+                    removalPolicy: this.removalPolicy,
+                });
+                if (this.isStrictRetain) {
+                    const cfn = appSecret.node.defaultChild;
+                    cfn.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+                }
+                this.whatsappAppSecretSecrets.set(intent.id, appSecret);
+                writeSsm(this, configKeys.whatsappAppSecretArn(projectName, stage, intent.id), appSecret.secretArn, {
+                    description: `WhatsApp App Secret ARN (webhook signature verification). ` +
+                        `Operators populate via 'aws secretsmanager put-secret-value'.`,
+                });
+                const verifyTokenSecret = new secretsmanager.Secret(this, `${logicalId}-whatsapp-verify-token`, {
+                    secretName: `venturekit/${projectName}/${stage}/notify-${intent.id}-whatsapp-verify-token`,
+                    description: `Webhook verify token for Meta subscription handshake (notify '${intent.id}'). ` +
+                        `After first deploy, paste your chosen verify token via ` +
+                        `'aws secretsmanager put-secret-value' and type the SAME value ` +
+                        `into the Meta App Dashboard callback config.`,
+                    generateSecretString: {
+                        passwordLength: 48,
+                        excludePunctuation: true,
+                    },
+                    removalPolicy: this.removalPolicy,
+                });
+                if (this.isStrictRetain) {
+                    const cfn = verifyTokenSecret.node.defaultChild;
+                    cfn.cfnOptions.updateReplacePolicy = cdk.CfnDeletionPolicy.RETAIN;
+                }
+                this.whatsappVerifyTokenSecrets.set(intent.id, verifyTokenSecret);
+                writeSsm(this, configKeys.whatsappVerifyTokenSecretArn(projectName, stage, intent.id), verifyTokenSecret.secretArn, {
+                    description: `WhatsApp webhook verify token Secret ARN. ` +
+                        `Operators populate via 'aws secretsmanager put-secret-value'.`,
+                });
+            }
         }
         // ── Dispatcher + bounce DLQs ─────────────────────────────────
         // The dispatcher Lambda (cron-triggered, drains the outbox table

package/dist/cdk/messaging-stack.js.map

@@ -1 +1 @@
-{"version":3,"file":"messaging-stack.js","sourceRoot":"","sources":["../../src/cdk/messaging-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAC;AACjD,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAsC,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAUjE,MAAM,OAAO,qBAAsB,SAAQ,GAAG,CAAC,KAAK;IAClC,MAAM,GAAsD,IAAI,GAAG,EAAE,CAAC;IACtE,kBAAkB,GAA2B,IAAI,GAAG,EAAE,CAAC;IACvD,2BAA2B,GAAwB,IAAI,GAAG,EAAE,CAAC;IAC7D,oBAAoB,GAA2B,IAAI,GAAG,EAAE,CAAC;IACzD,gBAAgB,GAA2B,IAAI,GAAG,EAAE,CAAC;IACrD,oBAAoB,GAAuC,IAAI,GAAG,EAAE,CAAC;IACrF,+FAA+F;IAC/E,UAAU,GAAiC,IAAI,GAAG,EAAE,CAAC;IAEpD,cAAc,CAAU;IACxB,aAAa,CAAoB;IAElD,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAiC;QACzE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACxB,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QAChE,IAAI,CAAC,cAAc,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;QAC1F,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC;QAEhG,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;YAC1B,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC3C,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;YAC1B,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC3C,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;YAC1B,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC3C,8DAA8D;gBAC9D,+DAA+D;gBAC/D,wDAAwD;gBACxD,IAAI,MAAM,CAAC,QAAQ;oBAAE,SAAS;gBAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IAEhE,WAAW,CAAC,MAAW,EAAE,WAAmB,EAAE,KAAa;QACjE,MAAM,SAAS,GAAG,SAAS,MAAM,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzD,+DAA+D;QAC/D,oCAAoC;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,MAAM,EAAE;YAClD,SAAS,EAAE,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,QAAQ,KAAK,GAAG,UAAU,EAAE;YAClE,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM;YAC5B,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,UAAU,EAAE,GAAG,CAAC,eAAe,CAAC,WAAW;YAC3C,0DAA0D;YAC1D,+DAA+D;YAC/D,8DAA8D;YAC9D,qDAAqD;YACrD,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QAEH,gEAAgE;QAChE,gEAAgE;QAChE,kEAAkE;QAClE,8DAA8D;QAC9D,2BAA2B;QAC3B,MAAM,wBAAwB,GAAG,MAAM,CAAC,wBAAwB;eAC3D,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;QAEhC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE;YAC3C,SAAS,EAAE,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,IAAI,KAAK,GAAG,UAAU,EAAE;YAC9D,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM;YAC5B,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,wBAAwB,CAAC;YACjE,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;YAC7D,UAAU,EAAE,GAAG,CAAC,eAAe,CAAC,WAAW;YAC3C,eAAe,EAAE;gBACf,KAAK,EAAE,GAAG;gBACV,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC;aAC7C;YACD,8DAA8D;YAC9D,0DAA0D;YAC1D,6DAA6D;YAC7D,2CAA2C;YAC3C,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAE3C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE;YACpF,WAAW,EAAE,sBAAsB,MAAM,CAAC,EAAE,yBAAyB;SACtE,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE;YACpF,WAAW,EAAE,gDAAgD;SAC9D,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE;YACrF,WAAW,EAAE,8BAA8B,MAAM,CAAC,EAAE,IAAI;SACzD,CAAC,CAAC;QACH,QAAQ,CACN,IAAI,EACJ,aAAa,CAAC,6BAA6B,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC1E,MAAM,CAAC,wBAAwB,CAAC,EAChC;YACE,WAAW,EACT,6DAA6D;gBAC7D,4DAA4D;gBAC5D,sDAAsD;SACzD,CACF,CAAC;IACJ,CAAC;IAED,wEAAwE;IAEhE,YAAY,CAAC,MAAW,EAAE,WAAmB,EAAE,KAAa;QAClE,MAAM,SAAS,GAAG,UAAU,MAAM,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAa,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,oBAAoB,GACxB,MAAM,CAAC,oBAAoB,IAAI,GAAG,WAAW,IAAI,KAAK,WAAW,MAAM,CAAC,EAAE,EAAE,CAAC;QAE/E,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,0CAA0C;QAC1C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,SAAS,EAAE;YAC7D,SAAS,EAAE,GAAG,WAAW,IAAI,KAAK,WAAW,MAAM,CAAC,EAAE,SAAS;YAC/D,WAAW,EAAE,gCAAgC,MAAM,CAAC,EAAE,KAAK,KAAK,GAAG;SACpE,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,YAA+B,CAAC;YAC7D,GAAG,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC7D,GAAG,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QAEpD,QAAQ,CACN,IAAI,EACJ,UAAU,CAAC,oBAAoB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC9D,WAAW,CAAC,QAAQ,EACpB,EAAE,WAAW,EAAE,oCAAoC,MAAM,CAAC,EAAE,IAAI,EAAE,CACnE,CAAC;QAEF,gEAAgE;QAChE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,SAAS,SAAS,EAAE;gBACxE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC5C,WAAW,EAAE,IAAI;gBACjB,4DAA4D;gBAC5D,6DAA6D;gBAC7D,wCAAwC;gBACxC,kBAAkB,EAAE,KAAK;aAC1B,CAAC,CAAC;YAEH,6DAA6D;YAC7D,6DAA6D;YAC7D,MAAM,UAAU,GAAG;gBACjB,EAAE,IAAI,EAAE,cAAc,CAAC,iBAAiB,EAAE,KAAK,EAAE,cAAc,CAAC,kBAAkB,EAAE;gBACpF,EAAE,IAAI,EAAE,cAAc,CAAC,iBAAiB,EAAE,KAAK,EAAE,cAAc,CAAC,kBAAkB,EAAE;gBACpF,EAAE,IAAI,EAAE,cAAc,CAAC,iBAAiB,EAAE,KAAK,EAAE,cAAc,CAAC,kBAAkB,EAAE;aACrF,CAAC;YAEF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxB,2DAA2D;gBAC3D,uDAAuD;gBACvD,6DAA6D;gBAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,wBAAwB,CACtD,IAAI,EACJ,GAAG,SAAS,OAAO,EACnB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAC/D,CAAC;gBACF,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;oBAC5B,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,SAAS,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE;wBACjE,IAAI;wBACJ,yDAAyD;wBACzD,uDAAuD;wBACvD,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,aAAa;wBACpC,UAAU,EAAE,GAAG,GAAG,CAAC,KAAK,qBAAqB;wBAC7C,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;qBAC7B,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;YACD,8DAA8D;YAC9D,8DAA8D;YAC9D,0DAA0D;YAC1D,8DAA8D;QAChE,CAAC;aAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,SAAS,QAAQ,EAAE;gBAChD,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;gBAChD,6DAA6D;gBAC7D,+BAA+B;gBAC/B,kBAAkB,EAAE,KAAK;aAC1B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,CAAC,EAAE,wBAAwB;gBAChE,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,SAAS,aAAa,EAAE;YAC1E,oBAAoB;YACpB,cAAc,EAAE,IAAI;YACpB,gEAAgE;YAChE,0DAA0D;YAC1D,iBAAiB,EAAE,IAAI;YACvB,SAAS,EAAE,GAAG,CAAC,yBAAyB,CAAC,OAAO;SACjD,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,gCAAgC,CAAC,IAAI,EAAE,GAAG,SAAS,aAAa,EAAE;YACxE,gBAAgB,EAAE,SAAS;YAC3B,WAAW,EAAE,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC;YACvD,0DAA0D;YAC1D,+DAA+D;YAC/D,wDAAwD;YACxD,2CAA2C;YAC3C,MAAM,EAAE;gBACN,GAAG,CAAC,iBAAiB,CAAC,IAAI;gBAC1B,GAAG,CAAC,iBAAiB,CAAC,MAAM;gBAC5B,GAAG,CAAC,iBAAiB,CAAC,MAAM;gBAC5B,GAAG,CAAC,iBAAiB,CAAC,SAAS;gBAC/B,GAAG,CAAC,iBAAiB,CAAC,QAAQ;gBAC9B,GAAG,CAAC,iBAAiB,CAAC,IAAI;gBAC1B,GAAG,CAAC,iBAAiB,CAAC,KAAK;aAC5B;YACD,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACtE,QAAQ,CACN,IAAI,EACJ,UAAU,CAAC,0BAA0B,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACpE,oBAAoB,EACpB,EAAE,WAAW,EAAE,uDAAuD,EAAE,CACzE,CAAC;QAEF,gEAAgE;QAChE,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,CAAC,EAAE,2BAA2B;oBACnE,mEAAmE;oBACnE,yBAAyB,CAC1B,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CACtC,IAAI,EACJ,GAAG,SAAS,iBAAiB,EAC7B;gBACE,UAAU,EAAE,cAAc,WAAW,IAAI,KAAK,WAAW,MAAM,CAAC,EAAE,iBAAiB;gBACnF,WAAW,EACT,oDAAoD,MAAM,CAAC,EAAE,KAAK;oBAClE,mEAAmE;oBACnE,gEAAgE;oBAChE,mDAAmD;gBACrD,oEAAoE;gBACpE,oDAAoD;gBACpD,mEAAmE;gBACnE,qEAAqE;gBACrE,qEAAqE;gBACrE,kEAAkE;gBAClE,qEAAqE;gBACrE,8DAA8D;gBAC9D,mEAAmE;gBACnE,sEAAsE;gBACtE,oBAAoB,EAAE;oBACpB,cAAc,EAAE,EAAE;oBAClB,kBAAkB,EAAE,IAAI;iBACzB;gBACD,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CACF,CAAC;YACF,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAA+B,CAAC;gBACxD,GAAG,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;YACpE,CAAC;YACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACjD,QAAQ,CACN,IAAI,EACJ,UAAU,CAAC,sBAAsB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAChE,MAAM,CAAC,SAAS,EAChB;gBACE,WAAW,EACT,oDAAoD;oBACpD,wCAAwC;aAC3C,CACF,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,mEAAmE;QACnE,0DAA0D;QAC1D,8DAA8D;QAC9D,sBAAsB;QACtB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,iBAAiB,EAAE;YACvE,SAAS,EAAE,GAAG,WAAW,IAAI,KAAK,WAAW,MAAM,CAAC,EAAE,iBAAiB;YACvE,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,UAAU,EAAE,GAAG,CAAC,eAAe,CAAC,WAAW;YAC3C,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,aAAa,EAAE;YAC/D,SAAS,EAAE,GAAG,WAAW,IAAI,KAAK,WAAW,MAAM,CAAC,EAAE,aAAa;YACnE,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,UAAU,EAAE,GAAG,CAAC,eAAe,CAAC,WAAW;YAC3C,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAEhD,QAAQ,CACN,IAAI,EACJ,aAAa,CAAC,sBAAsB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACnE,aAAa,CAAC,QAAQ,EACtB,EAAE,WAAW,EAAE,uCAAuC,EAAE,CACzD,CAAC;QACF,QAAQ,CACN,IAAI,EACJ,aAAa,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC/D,SAAS,CAAC,QAAQ,EAClB,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,wEAAwE;IAExE;;;;;;;;;;OAUG;IACK,cAAc,CAAC,MAAW,EAAE,WAAmB,EAAE,KAAa;QACpE,MAAM,SAAS,GAAG,UAAU,MAAM,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,GAAG,WAAW,IAAI,KAAK,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QAEzE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QAE5E,iEAAiE;QACjE,gEAAgE;QAChE,oEAAoE;QACpE,iEAAiE;QACjE,gEAAgE;QAChE,+DAA+D;QAC/D,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,YAA+B,CAAC;YACrD,GAAG,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC7D,GAAG,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAEpC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,YAAY,EAAE;YAC1F,WAAW,EACT,6BAA6B,MAAM,CAAC,EAAE,yBAAyB;gBAC/D,0DAA0D;SAC7D,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,WAAW,EAAE;YACxF,WAAW,EAAE,4BAA4B,MAAM,CAAC,EAAE,0CAA0C;SAC7F,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"messaging-stack.js","sourceRoot":"","sources":["../../src/cdk/messaging-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAC;AACjD,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,OAAO,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAsC,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAUjE,MAAM,OAAO,qBAAsB,SAAQ,GAAG,CAAC,KAAK;IAClC,MAAM,GAAsD,IAAI,GAAG,EAAE,CAAC;IACtE,kBAAkB,GAA2B,IAAI,GAAG,EAAE,CAAC;IACvD,2BAA2B,GAAwB,IAAI,GAAG,EAAE,CAAC;IAC7D,oBAAoB,GAA2B,IAAI,GAAG,EAAE,CAAC;IACzD,gBAAgB,GAA2B,IAAI,GAAG,EAAE,CAAC;IACrD,oBAAoB,GAAuC,IAAI,GAAG,EAAE,CAAC;IACrF;;;;OAIG;IACa,wBAAwB,GAAuC,IAAI,GAAG,EAAE,CAAC;IACzF;;;;OAIG;IACa,0BAA0B,GAAuC,IAAI,GAAG,EAAE,CAAC;IAC3F,+FAA+F;IAC/E,UAAU,GAAiC,IAAI,GAAG,EAAE,CAAC;IAEpD,cAAc,CAAU;IACxB,aAAa,CAAoB;IAElD,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAiC;QACzE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACxB,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QAChE,IAAI,CAAC,cAAc,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;QAC1F,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC;QAEhG,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;YAC1B,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC3C,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;YAC1B,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC3C,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;YAC1B,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC3C,8DAA8D;gBAC9D,+DAA+D;gBAC/D,wDAAwD;gBACxD,IAAI,MAAM,CAAC,QAAQ;oBAAE,SAAS;gBAC9B,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IAEhE,WAAW,CAAC,MAAW,EAAE,WAAmB,EAAE,KAAa;QACjE,MAAM,SAAS,GAAG,SAAS,MAAM,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzD,+DAA+D;QAC/D,oCAAoC;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,MAAM,EAAE;YAClD,SAAS,EAAE,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,QAAQ,KAAK,GAAG,UAAU,EAAE;YAClE,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM;YAC5B,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,UAAU,EAAE,GAAG,CAAC,eAAe,CAAC,WAAW;YAC3C,0DAA0D;YAC1D,+DAA+D;YAC/D,8DAA8D;YAC9D,qDAAqD;YACrD,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QAEH,gEAAgE;QAChE,gEAAgE;QAChE,kEAAkE;QAClE,8DAA8D;QAC9D,2BAA2B;QAC3B,MAAM,wBAAwB,GAAG,MAAM,CAAC,wBAAwB;eAC3D,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;QAEhC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE;YAC3C,SAAS,EAAE,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,IAAI,KAAK,GAAG,UAAU,EAAE;YAC9D,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM;YAC5B,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,wBAAwB,CAAC;YACjE,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;YAC7D,UAAU,EAAE,GAAG,CAAC,eAAe,CAAC,WAAW;YAC3C,eAAe,EAAE;gBACf,KAAK,EAAE,GAAG;gBACV,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC;aAC7C;YACD,8DAA8D;YAC9D,0DAA0D;YAC1D,6DAA6D;YAC7D,2CAA2C;YAC3C,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAE3C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE;YACpF,WAAW,EAAE,sBAAsB,MAAM,CAAC,EAAE,yBAAyB;SACtE,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE;YACpF,WAAW,EAAE,gDAAgD;SAC9D,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE;YACrF,WAAW,EAAE,8BAA8B,MAAM,CAAC,EAAE,IAAI;SACzD,CAAC,CAAC;QACH,QAAQ,CACN,IAAI,EACJ,aAAa,CAAC,6BAA6B,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC1E,MAAM,CAAC,wBAAwB,CAAC,EAChC;YACE,WAAW,EACT,6DAA6D;gBAC7D,4DAA4D;gBAC5D,sDAAsD;SACzD,CACF,CAAC;IACJ,CAAC;IAED,wEAAwE;IAEhE,YAAY,CAAC,MAAW,EAAE,WAAmB,EAAE,KAAa;QAClE,MAAM,SAAS,GAAG,UAAU,MAAM,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAa,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,oBAAoB,GACxB,MAAM,CAAC,oBAAoB,IAAI,GAAG,WAAW,IAAI,KAAK,WAAW,MAAM,CAAC,EAAE,EAAE,CAAC;QAE/E,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,0CAA0C;QAC1C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,SAAS,EAAE;YAC7D,SAAS,EAAE,GAAG,WAAW,IAAI,KAAK,WAAW,MAAM,CAAC,EAAE,SAAS;YAC/D,WAAW,EAAE,gCAAgC,MAAM,CAAC,EAAE,KAAK,KAAK,GAAG;SACpE,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,YAA+B,CAAC;YAC7D,GAAG,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC7D,GAAG,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QAEpD,QAAQ,CACN,IAAI,EACJ,UAAU,CAAC,oBAAoB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC9D,WAAW,CAAC,QAAQ,EACpB,EAAE,WAAW,EAAE,oCAAoC,MAAM,CAAC,EAAE,IAAI,EAAE,CACnE,CAAC;QAEF,gEAAgE;QAChE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,SAAS,SAAS,EAAE;gBACxE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC5C,WAAW,EAAE,IAAI;gBACjB,4DAA4D;gBAC5D,6DAA6D;gBAC7D,wCAAwC;gBACxC,kBAAkB,EAAE,KAAK;aAC1B,CAAC,CAAC;YAEH,6DAA6D;YAC7D,6DAA6D;YAC7D,MAAM,UAAU,GAAG;gBACjB,EAAE,IAAI,EAAE,cAAc,CAAC,iBAAiB,EAAE,KAAK,EAAE,cAAc,CAAC,kBAAkB,EAAE;gBACpF,EAAE,IAAI,EAAE,cAAc,CAAC,iBAAiB,EAAE,KAAK,EAAE,cAAc,CAAC,kBAAkB,EAAE;gBACpF,EAAE,IAAI,EAAE,cAAc,CAAC,iBAAiB,EAAE,KAAK,EAAE,cAAc,CAAC,kBAAkB,EAAE;aACrF,CAAC;YAEF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxB,2DAA2D;gBAC3D,uDAAuD;gBACvD,6DAA6D;gBAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,wBAAwB,CACtD,IAAI,EACJ,GAAG,SAAS,OAAO,EACnB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAC/D,CAAC;gBACF,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;oBAC5B,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,SAAS,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE;wBACjE,IAAI;wBACJ,yDAAyD;wBACzD,uDAAuD;wBACvD,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,aAAa;wBACpC,UAAU,EAAE,GAAG,GAAG,CAAC,KAAK,qBAAqB;wBAC7C,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;qBAC7B,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;YACD,8DAA8D;YAC9D,8DAA8D;YAC9D,0DAA0D;YAC1D,8DAA8D;QAChE,CAAC;aAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,SAAS,QAAQ,EAAE;gBAChD,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;gBAChD,6DAA6D;gBAC7D,+BAA+B;gBAC/B,kBAAkB,EAAE,KAAK;aAC1B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,CAAC,EAAE,wBAAwB;gBAChE,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,SAAS,aAAa,EAAE;YAC1E,oBAAoB;YACpB,cAAc,EAAE,IAAI;YACpB,gEAAgE;YAChE,0DAA0D;YAC1D,iBAAiB,EAAE,IAAI;YACvB,SAAS,EAAE,GAAG,CAAC,yBAAyB,CAAC,OAAO;SACjD,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,gCAAgC,CAAC,IAAI,EAAE,GAAG,SAAS,aAAa,EAAE;YACxE,gBAAgB,EAAE,SAAS;YAC3B,WAAW,EAAE,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC;YACvD,0DAA0D;YAC1D,+DAA+D;YAC/D,wDAAwD;YACxD,2CAA2C;YAC3C,MAAM,EAAE;gBACN,GAAG,CAAC,iBAAiB,CAAC,IAAI;gBAC1B,GAAG,CAAC,iBAAiB,CAAC,MAAM;gBAC5B,GAAG,CAAC,iBAAiB,CAAC,MAAM;gBAC5B,GAAG,CAAC,iBAAiB,CAAC,SAAS;gBAC/B,GAAG,CAAC,iBAAiB,CAAC,QAAQ;gBAC9B,GAAG,CAAC,iBAAiB,CAAC,IAAI;gBAC1B,GAAG,CAAC,iBAAiB,CAAC,KAAK;aAC5B;YACD,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACtE,QAAQ,CACN,IAAI,EACJ,UAAU,CAAC,0BAA0B,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACpE,oBAAoB,EACpB,EAAE,WAAW,EAAE,uDAAuD,EAAE,CACzE,CAAC;QAEF,gEAAgE;QAChE,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,CAAC,EAAE,mCAAmC;gBAC3E,oEAAoE;gBACpE,iEAAiE;gBACjE,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,CAAC,EAAE,2BAA2B;oBACnE,mEAAmE;oBACnE,yBAAyB,CAC1B,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CACtC,IAAI,EACJ,GAAG,SAAS,iBAAiB,EAC7B;gBACE,UAAU,EAAE,cAAc,WAAW,IAAI,KAAK,WAAW,MAAM,CAAC,EAAE,iBAAiB;gBACnF,WAAW,EACT,oDAAoD,MAAM,CAAC,EAAE,KAAK;oBAClE,mEAAmE;oBACnE,gEAAgE;oBAChE,mDAAmD;gBACrD,oEAAoE;gBACpE,oDAAoD;gBACpD,mEAAmE;gBACnE,qEAAqE;gBACrE,qEAAqE;gBACrE,kEAAkE;gBAClE,qEAAqE;gBACrE,8DAA8D;gBAC9D,mEAAmE;gBACnE,sEAAsE;gBACtE,oBAAoB,EAAE;oBACpB,cAAc,EAAE,EAAE;oBAClB,kBAAkB,EAAE,IAAI;iBACzB;gBACD,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CACF,CAAC;YACF,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAA+B,CAAC;gBACxD,GAAG,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;YACpE,CAAC;YACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACjD,QAAQ,CACN,IAAI,EACJ,UAAU,CAAC,sBAAsB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAChE,MAAM,CAAC,SAAS,EAChB;gBACE,WAAW,EACT,oDAAoD;oBACpD,wCAAwC;aAC3C,CACF,CAAC;YAEF,oEAAoE;YACpE,gEAAgE;YAChE,6DAA6D;YAC7D,uDAAuD;YACvD,iEAAiE;YACjE,4DAA4D;YAC5D,+DAA+D;YAC/D,wDAAwD;YACxD,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;gBAC9B,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC,MAAM,CACzC,IAAI,EACJ,GAAG,SAAS,sBAAsB,EAClC;oBACE,UAAU,EAAE,cAAc,WAAW,IAAI,KAAK,WAAW,MAAM,CAAC,EAAE,sBAAsB;oBACxF,WAAW,EACT,+DAA+D,MAAM,CAAC,EAAE,MAAM;wBAC9E,mEAAmE;wBACnE,+DAA+D;oBACjE,oBAAoB,EAAE;wBACpB,cAAc,EAAE,EAAE;wBAClB,kBAAkB,EAAE,IAAI;qBACzB;oBACD,aAAa,EAAE,IAAI,CAAC,aAAa;iBAClC,CACF,CAAC;gBACF,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;oBACxB,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,YAA+B,CAAC;oBAC3D,GAAG,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;gBACpE,CAAC;gBACD,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBACxD,QAAQ,CACN,IAAI,EACJ,UAAU,CAAC,oBAAoB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC9D,SAAS,CAAC,SAAS,EACnB;oBACE,WAAW,EACT,4DAA4D;wBAC5D,+DAA+D;iBAClE,CACF,CAAC;gBAEF,MAAM,iBAAiB,GAAG,IAAI,cAAc,CAAC,MAAM,CACjD,IAAI,EACJ,GAAG,SAAS,wBAAwB,EACpC;oBACE,UAAU,EAAE,cAAc,WAAW,IAAI,KAAK,WAAW,MAAM,CAAC,EAAE,wBAAwB;oBAC1F,WAAW,EACT,iEAAiE,MAAM,CAAC,EAAE,MAAM;wBAChF,yDAAyD;wBACzD,gEAAgE;wBAChE,8CAA8C;oBAChD,oBAAoB,EAAE;wBACpB,cAAc,EAAE,EAAE;wBAClB,kBAAkB,EAAE,IAAI;qBACzB;oBACD,aAAa,EAAE,IAAI,CAAC,aAAa;iBAClC,CACF,CAAC;gBACF,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;oBACxB,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,YAA+B,CAAC;oBACnE,GAAG,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;gBACpE,CAAC;gBACD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;gBAClE,QAAQ,CACN,IAAI,EACJ,UAAU,CAAC,4BAA4B,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACtE,iBAAiB,CAAC,SAAS,EAC3B;oBACE,WAAW,EACT,4CAA4C;wBAC5C,+DAA+D;iBAClE,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,iEAAiE;QACjE,iEAAiE;QACjE,mEAAmE;QACnE,0DAA0D;QAC1D,8DAA8D;QAC9D,sBAAsB;QACtB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,iBAAiB,EAAE;YACvE,SAAS,EAAE,GAAG,WAAW,IAAI,KAAK,WAAW,MAAM,CAAC,EAAE,iBAAiB;YACvE,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,UAAU,EAAE,GAAG,CAAC,eAAe,CAAC,WAAW;YAC3C,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,aAAa,EAAE;YAC/D,SAAS,EAAE,GAAG,WAAW,IAAI,KAAK,WAAW,MAAM,CAAC,EAAE,aAAa;YACnE,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,UAAU,EAAE,GAAG,CAAC,eAAe,CAAC,WAAW;YAC3C,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAEhD,QAAQ,CACN,IAAI,EACJ,aAAa,CAAC,sBAAsB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EACnE,aAAa,CAAC,QAAQ,EACtB,EAAE,WAAW,EAAE,uCAAuC,EAAE,CACzD,CAAC;QACF,QAAQ,CACN,IAAI,EACJ,aAAa,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAC/D,SAAS,CAAC,QAAQ,EAClB,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,wEAAwE;IAExE;;;;;;;;;;OAUG;IACK,cAAc,CAAC,MAAW,EAAE,WAAmB,EAAE,KAAa;QACpE,MAAM,SAAS,GAAG,UAAU,MAAM,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,GAAG,WAAW,IAAI,KAAK,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QAEzE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QAE5E,iEAAiE;QACjE,gEAAgE;QAChE,oEAAoE;QACpE,iEAAiE;QACjE,gEAAgE;QAChE,+DAA+D;QAC/D,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,YAA+B,CAAC;YACrD,GAAG,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC7D,GAAG,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAEpC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,YAAY,EAAE;YAC1F,WAAW,EACT,6BAA6B,MAAM,CAAC,EAAE,yBAAyB;gBAC/D,0DAA0D;SAC7D,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,WAAW,EAAE;YACxF,WAAW,EAAE,4BAA4B,MAAM,CAAC,EAAE,0CAA0C;SAC7F,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/cdk/shared/custom-sender.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Cognito custom-sender (`auth[].customSender`) helpers shared by the
+ * identity tier (which renders the pool's `LambdaConfig`) and the app
+ * tier (which owns the trigger Lambda and Cognito's invoke permission).
+ *
+ * # Why a shared module
+ *
+ * The feature straddles the identity / app stack boundary: the pool
+ * must name the trigger function by its deterministic ARN because the
+ * app tier already depends on the identity tier, and the app tier must
+ * later prove that function exists and let `cognito-idp` invoke it.
+ * Both tiers therefore need the same view of "which functions[] ids
+ * does this intent reference" — resolved here, once, so a typo is
+ * rejected identically on both sides and `app-stack.ts` only carries a
+ * one-line hook instead of the full wiring (that file is the merge
+ * hot-spot of the package).
+ */
+import * as cdk from 'aws-cdk-lib';
+import type * as lambda from 'aws-cdk-lib/aws-lambda';
+import { type AuthIntent, type OwnedAuthIntent } from '@venturekit/core';
+/** Normalised `AuthIntent.customSender` — `undefined` when nothing is declared. */
+export interface ResolvedCustomSender {
+    email?: string;
+    sms?: string;
+}
+/**
+ * Validate + normalise `intent.customSender`. Returns `undefined` for
+ * absent / empty declarations (and for `external` intents, which never
+ * own a pool) so callers can branch on truthiness. Function ids are
+ * checked for the character set the file-based discovery produces
+ * (`src/functions/<id>.ts`, nested dirs joined with `-`) because the
+ * id becomes part of a Lambda ARN string in the identity tier, without
+ * a resource reference that would otherwise catch the typo at synth.
+ */
+export declare function resolveCustomSender(intent: Pick<OwnedAuthIntent, 'id' | 'customSender'> | AuthIntent): ResolvedCustomSender | undefined;
+/** Distinct `functions[]` ids a resolved sender references (email + sms may share one). */
+export declare function customSenderFunctionIds(sender: ResolvedCustomSender | undefined): string[];
+/**
+ * ARN of the standalone function `<project>-<stage>-fn-<id>` in
+ * `stack`'s account + region. Mirrors `createStandaloneFunction` in
+ * the app stack, so the identity tier can point `LambdaConfig` at the
+ * trigger without importing the resource (that would be a cross-stack
+ * cycle — the app tier already consumes the identity tier).
+ */
+export declare function customSenderFunctionArn(stack: cdk.Stack, projectName: string, stage: string, fnId: string): string;
+/**
+ * Let Cognito invoke the standalone function(s) each `auth[]` intent
+ * names in `customSender`. One `AWS::Lambda::Permission` per
+ * (function, pool) pair — a handler serving both `email` and `sms` of
+ * the same pool gets a single statement; the same handler on two
+ * pools gets two, each scoped to its own pool ARN.
+ *
+ * Throws when the referenced function was not discovered: the
+ * identity tier has already pointed the pool at
+ * `<project>-<stage>-fn-<id>`, so a missing handler would leave
+ * Cognito invoking a function that does not exist and every code
+ * email / SMS silently undelivered.
+ */
+export declare function grantCustomSenderInvoke(stack: cdk.Stack, authIntents: readonly AuthIntent[], functionLambdas: ReadonlyMap<string, lambda.Function>, userPoolArnsByAuthId: ReadonlyMap<string, string> | undefined): void;
+//# sourceMappingURL=custom-sender.d.ts.map

package/dist/cdk/shared/custom-sender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-sender.d.ts","sourceRoot":"","sources":["../../../src/cdk/shared/custom-sender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AAEnC,OAAO,KAAK,KAAK,MAAM,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAwB,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAG/F,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,cAAc,CAAC,GAAG,UAAU,GAChE,oBAAoB,GAAG,SAAS,CAuBlC;AAED,2FAA2F;AAC3F,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GAAG,MAAM,EAAE,CAG1F;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,GAAG,CAAC,KAAK,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,MAAM,CAOR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,GAAG,CAAC,KAAK,EAChB,WAAW,EAAE,SAAS,UAAU,EAAE,EAClC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EACrD,oBAAoB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC5D,IAAI,CA8BN"}

package/dist/cdk/shared/custom-sender.js

@@ -0,0 +1,114 @@
+/**
+ * Cognito custom-sender (`auth[].customSender`) helpers shared by the
+ * identity tier (which renders the pool's `LambdaConfig`) and the app
+ * tier (which owns the trigger Lambda and Cognito's invoke permission).
+ *
+ * # Why a shared module
+ *
+ * The feature straddles the identity / app stack boundary: the pool
+ * must name the trigger function by its deterministic ARN because the
+ * app tier already depends on the identity tier, and the app tier must
+ * later prove that function exists and let `cognito-idp` invoke it.
+ * Both tiers therefore need the same view of "which functions[] ids
+ * does this intent reference" — resolved here, once, so a typo is
+ * rejected identically on both sides and `app-stack.ts` only carries a
+ * one-line hook instead of the full wiring (that file is the merge
+ * hot-spot of the package).
+ */
+import * as cdk from 'aws-cdk-lib';
+import * as iam from 'aws-cdk-lib/aws-iam';
+import { isExternalAuthIntent } from '@venturekit/core';
+import { clampLambdaFunctionName } from './lambda-helpers.js';
+/**
+ * Validate + normalise `intent.customSender`. Returns `undefined` for
+ * absent / empty declarations (and for `external` intents, which never
+ * own a pool) so callers can branch on truthiness. Function ids are
+ * checked for the character set the file-based discovery produces
+ * (`src/functions/<id>.ts`, nested dirs joined with `-`) because the
+ * id becomes part of a Lambda ARN string in the identity tier, without
+ * a resource reference that would otherwise catch the typo at synth.
+ */
+export function resolveCustomSender(intent) {
+    if (isExternalAuthIntent(intent))
+        return undefined;
+    const raw = intent.customSender;
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (typeof raw !== 'object' || Array.isArray(raw)) {
+        throw new Error(`[venturekit] auth '${intent.id}': customSender must be an object with email and/or sms function ids.`);
+    }
+    const pick = (channel) => {
+        const v = raw[channel];
+        if (v === undefined || v === null || v === '')
+            return undefined;
+        if (typeof v !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(v)) {
+            throw new Error(`[venturekit] auth '${intent.id}': customSender.${channel} must be a functions[] id ` +
+                `(the dash-delimited name of a handler under src/functions/), got ${JSON.stringify(v)}.`);
+        }
+        return v;
+    };
+    const email = pick('email');
+    const sms = pick('sms');
+    return email || sms ? { email, sms } : undefined;
+}
+/** Distinct `functions[]` ids a resolved sender references (email + sms may share one). */
+export function customSenderFunctionIds(sender) {
+    if (!sender)
+        return [];
+    return [...new Set([sender.email, sender.sms].filter((v) => !!v))];
+}
+/**
+ * ARN of the standalone function `<project>-<stage>-fn-<id>` in
+ * `stack`'s account + region. Mirrors `createStandaloneFunction` in
+ * the app stack, so the identity tier can point `LambdaConfig` at the
+ * trigger without importing the resource (that would be a cross-stack
+ * cycle — the app tier already consumes the identity tier).
+ */
+export function customSenderFunctionArn(stack, projectName, stage, fnId) {
+    return stack.formatArn({
+        service: 'lambda',
+        resource: 'function',
+        resourceName: clampLambdaFunctionName(`${projectName}-${stage}-fn-${fnId}`),
+        arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME,
+    });
+}
+/**
+ * Let Cognito invoke the standalone function(s) each `auth[]` intent
+ * names in `customSender`. One `AWS::Lambda::Permission` per
+ * (function, pool) pair — a handler serving both `email` and `sms` of
+ * the same pool gets a single statement; the same handler on two
+ * pools gets two, each scoped to its own pool ARN.
+ *
+ * Throws when the referenced function was not discovered: the
+ * identity tier has already pointed the pool at
+ * `<project>-<stage>-fn-<id>`, so a missing handler would leave
+ * Cognito invoking a function that does not exist and every code
+ * email / SMS silently undelivered.
+ */
+export function grantCustomSenderInvoke(stack, authIntents, functionLambdas, userPoolArnsByAuthId) {
+    for (const auth of authIntents) {
+        const fnIds = customSenderFunctionIds(resolveCustomSender(auth));
+        if (fnIds.length === 0)
+            continue;
+        const poolArn = userPoolArnsByAuthId?.get(auth.id);
+        if (!poolArn) {
+            throw new Error(`[venturekit] auth '${auth.id}' declares customSender but no user pool ARN was ` +
+                `imported for it. Pass imports.userPoolArnsByAuthId (the generator does this ` +
+                `automatically when the identity tier is deployed).`);
+        }
+        for (const fnId of fnIds) {
+            const fn = functionLambdas.get(fnId);
+            if (!fn) {
+                throw new Error(`[venturekit] auth '${auth.id}' customSender references function '${fnId}' but no ` +
+                    `handler was discovered. Add a handler at src/functions/${fnId}.ts.`);
+            }
+            fn.addPermission(`cognito-custom-sender-${auth.id}`, {
+                principal: new iam.ServicePrincipal('cognito-idp.amazonaws.com'),
+                action: 'lambda:InvokeFunction',
+                sourceArn: poolArn,
+                sourceAccount: stack.account,
+            });
+        }
+    }
+}
+//# sourceMappingURL=custom-sender.js.map

package/dist/cdk/shared/custom-sender.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-sender.js","sourceRoot":"","sources":["../../../src/cdk/shared/custom-sender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAE3C,OAAO,EAAE,oBAAoB,EAAyC,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAQ9D;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAiE;IAEjE,IAAI,oBAAoB,CAAC,MAAoB,CAAC;QAAE,OAAO,SAAS,CAAC;IACjE,MAAM,GAAG,GAAI,MAA0B,CAAC,YAAY,CAAC;IACrD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,sBAAsB,MAAM,CAAC,EAAE,uEAAuE,CACvG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,OAAwB,EAAsB,EAAE;QAC5D,MAAM,CAAC,GAAY,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;QAChE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACb,sBAAsB,MAAM,CAAC,EAAE,mBAAmB,OAAO,4BAA4B;gBACrF,oEAAoE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CACzF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CAAC,MAAwC;IAC9E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAgB,EAChB,WAAmB,EACnB,KAAa,EACb,IAAY;IAEZ,OAAO,KAAK,CAAC,SAAS,CAAC;QACrB,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,uBAAuB,CAAC,GAAG,WAAW,IAAI,KAAK,OAAO,IAAI,EAAE,CAAC;QAC3E,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,mBAAmB;KAC7C,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAgB,EAChB,WAAkC,EAClC,eAAqD,EACrD,oBAA6D;IAE7D,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,uBAAuB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEjC,MAAM,OAAO,GAAG,oBAAoB,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,CAAC,EAAE,mDAAmD;gBAChF,8EAA8E;gBAC9E,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,CAAC,EAAE,uCAAuC,IAAI,WAAW;oBACnF,0DAA0D,IAAI,MAAM,CACrE,CAAC;YACJ,CAAC;YACD,EAAE,CAAC,aAAa,CAAC,yBAAyB,IAAI,CAAC,EAAE,EAAE,EAAE;gBACnD,SAAS,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;gBAChE,MAAM,EAAE,uBAAuB;gBAC/B,SAAS,EAAE,OAAO;gBAClB,aAAa,EAAE,KAAK,CAAC,OAAO;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC"}