alchemy 2.0.0-beta.75 → 2.0.0-beta.76

package/bin/exec.js

@@ -3531,7 +3531,7 @@ const excludeDeletedBindings = (bindings) => bindings.flatMap(({ action, sid, da
 }]);
 //#endregion
 //#region package.json
-var version = "2.0.0-beta.75";
+var version = "2.0.0-beta.76";
 //#endregion
 //#region lib/Telemetry/Attributes.js
 const ALCHEMY_DIR = nodePath.join(os$1.homedir(), ".alchemy");

package/lib/AWS/Cognito/ManagedLoginBranding.d.ts

@@ -0,0 +1,108 @@
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import type { Providers } from "../Providers.ts";
+/**
+ * An image asset (logo, favicon, background, …) attached to a managed login
+ * branding style, per color mode.
+ */
+export interface ManagedLoginBrandingAsset {
+    /** Which slot of the managed login pages the asset fills. */
+    category: "FAVICON_ICO" | "FAVICON_SVG" | "EMAIL_GRAPHIC" | "SMS_GRAPHIC" | "AUTH_APP_GRAPHIC" | "PASSWORD_GRAPHIC" | "PASSKEY_GRAPHIC" | "PAGE_HEADER_LOGO" | "PAGE_HEADER_BACKGROUND" | "PAGE_FOOTER_LOGO" | "PAGE_FOOTER_BACKGROUND" | "PAGE_BACKGROUND" | "FORM_BACKGROUND" | "FORM_LOGO" | "IDP_BUTTON_ICON";
+    /** The color scheme the asset applies to. */
+    colorMode: "LIGHT" | "DARK" | "DYNAMIC";
+    /** The file type of the asset. */
+    extension: "ICO" | "JPEG" | "PNG" | "SVG" | "WEBP";
+    /** The image file, as bytes (max 2 MB). */
+    bytes?: Uint8Array;
+    /** For `IDP_BUTTON_ICON` assets, the identity provider the icon is for. */
+    resourceId?: string;
+}
+export interface ManagedLoginBrandingProps {
+    /**
+     * The ID of the user pool the branding style belongs to. Changing this
+     * triggers a replacement.
+     */
+    userPoolId: string;
+    /**
+     * The ID of the app client the branding style is assigned to. Each app
+     * client can have exactly one style. Changing this triggers a
+     * replacement.
+     */
+    clientId: string;
+    /**
+     * Apply Cognito's default branding instead of custom `settings` /
+     * `assets`. This is what makes a fresh pool's managed login pages render
+     * without a one-time console step.
+     * @default true when neither `settings` nor `assets` is provided
+     */
+    useCognitoProvidedValues?: boolean;
+    /**
+     * The branding settings JSON document (colors, component styles, …) in
+     * the shape produced by the managed login branding designer / returned by
+     * `DescribeManagedLoginBranding`.
+     */
+    settings?: Record<string, unknown>;
+    /**
+     * Image assets for the branding style (logos, favicons, backgrounds),
+     * one per category + color mode.
+     */
+    assets?: ManagedLoginBrandingAsset[];
+}
+export interface ManagedLoginBranding extends Resource<"AWS.Cognito.ManagedLoginBranding", ManagedLoginBrandingProps, {
+    /** The generated ID of the branding style. */
+    managedLoginBrandingId: string;
+    /** The ID of the user pool the style belongs to. */
+    userPoolId: string;
+    /** The ID of the app client the style is assigned to. */
+    clientId: string;
+}, never, Providers> {
+}
+/**
+ * A managed login branding style for an Amazon Cognito user pool app
+ * client. Assigning a style (even just Cognito's provided defaults) is what
+ * activates the hosted managed login pages — a `UserPoolDomain` with
+ * `managedLoginVersion: 2` serves them end-to-end without any console step.
+ * ### Activating Managed Login
+ * **Example:** Default Branding for a Hosted Login Domain
+ * ```typescript
+ * import * as Cognito from "alchemy/AWS/Cognito";
+ *
+ * const pool = yield* Cognito.UserPool("Users", {});
+ * const client = yield* Cognito.UserPoolClient("Web", {
+ *   userPoolId: pool.userPoolId,
+ *   callbackUrls: ["https://example.com/callback"],
+ *   allowedOAuthFlowsUserPoolClient: true,
+ *   allowedOAuthFlows: ["code"],
+ *   allowedOAuthScopes: ["openid", "email"],
+ * });
+ * const domain = yield* Cognito.UserPoolDomain("AuthDomain", {
+ *   userPoolId: pool.userPoolId,
+ *   managedLoginVersion: 2,
+ * });
+ * yield* Cognito.ManagedLoginBranding("Branding", {
+ *   userPoolId: pool.userPoolId,
+ *   clientId: client.clientId,
+ * });
+ * ```
+ *
+ * ### Custom Branding
+ * **Example:** Custom Settings and a Logo Asset
+ * ```typescript
+ * yield* Cognito.ManagedLoginBranding("Branding", {
+ *   userPoolId: pool.userPoolId,
+ *   clientId: client.clientId,
+ *   settings: brandingSettings, // designer-exported JSON document
+ *   assets: [{
+ *     category: "FORM_LOGO",
+ *     colorMode: "LIGHT",
+ *     extension: "PNG",
+ *     bytes: logoBytes,
+ *   }],
+ * });
+ * ```
+ *
+ * @resource
+ */
+export declare const ManagedLoginBranding: import("../../Resource.ts").ResourceClass<ManagedLoginBranding>;
+export declare const ManagedLoginBrandingProvider: () => import("effect/Layer").Layer<Provider.Provider<ManagedLoginBranding>, never, import("@distilled.cloud/aws/Credentials").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=ManagedLoginBranding.d.ts.map

package/lib/AWS/Cognito/ManagedLoginBranding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ManagedLoginBranding.d.ts","sourceRoot":"","sources":["../../../src/AWS/Cognito/ManagedLoginBranding.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,6DAA6D;IAC7D,QAAQ,EACJ,aAAa,GACb,aAAa,GACb,eAAe,GACf,aAAa,GACb,kBAAkB,GAClB,kBAAkB,GAClB,iBAAiB,GACjB,kBAAkB,GAClB,wBAAwB,GACxB,kBAAkB,GAClB,wBAAwB,GACxB,iBAAiB,GACjB,iBAAiB,GACjB,WAAW,GACX,iBAAiB,CAAC;IACtB,6CAA6C;IAC7C,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IACxC,kCAAkC;IAClC,SAAS,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IACnD,2CAA2C;IAC3C,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;OAGG;IACH,MAAM,CAAC,EAAE,yBAAyB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,oBAAqB,SAAQ,QAAQ,CACpD,kCAAkC,EAClC,yBAAyB,EACzB;IACE,8CAA8C;IAC9C,sBAAsB,EAAE,MAAM,CAAC;IAC/B,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,oBAAoB,iEAEhC,CAAC;AAqDF,eAAO,MAAM,4BAA4B,mMAsJtC,CAAC"}

package/lib/AWS/Cognito/ManagedLoginBranding.js

@@ -0,0 +1,200 @@
+import * as cip from "@distilled.cloud/aws/cognito-identity-provider";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import { isResolved } from "../../Diff.js";
+import * as Provider from "../../Provider.js";
+import { Resource } from "../../Resource.js";
+/**
+ * A managed login branding style for an Amazon Cognito user pool app
+ * client. Assigning a style (even just Cognito's provided defaults) is what
+ * activates the hosted managed login pages — a `UserPoolDomain` with
+ * `managedLoginVersion: 2` serves them end-to-end without any console step.
+ * ### Activating Managed Login
+ * **Example:** Default Branding for a Hosted Login Domain
+ * ```typescript
+ * import * as Cognito from "alchemy/AWS/Cognito";
+ *
+ * const pool = yield* Cognito.UserPool("Users", {});
+ * const client = yield* Cognito.UserPoolClient("Web", {
+ *   userPoolId: pool.userPoolId,
+ *   callbackUrls: ["https://example.com/callback"],
+ *   allowedOAuthFlowsUserPoolClient: true,
+ *   allowedOAuthFlows: ["code"],
+ *   allowedOAuthScopes: ["openid", "email"],
+ * });
+ * const domain = yield* Cognito.UserPoolDomain("AuthDomain", {
+ *   userPoolId: pool.userPoolId,
+ *   managedLoginVersion: 2,
+ * });
+ * yield* Cognito.ManagedLoginBranding("Branding", {
+ *   userPoolId: pool.userPoolId,
+ *   clientId: client.clientId,
+ * });
+ * ```
+ *
+ * ### Custom Branding
+ * **Example:** Custom Settings and a Logo Asset
+ * ```typescript
+ * yield* Cognito.ManagedLoginBranding("Branding", {
+ *   userPoolId: pool.userPoolId,
+ *   clientId: client.clientId,
+ *   settings: brandingSettings, // designer-exported JSON document
+ *   assets: [{
+ *     category: "FORM_LOGO",
+ *     colorMode: "LIGHT",
+ *     extension: "PNG",
+ *     bytes: logoBytes,
+ *   }],
+ * });
+ * ```
+ *
+ * @resource
+ */
+export const ManagedLoginBranding = Resource("AWS.Cognito.ManagedLoginBranding");
+const toWireAssets = (assets) => assets?.map((asset) => ({
+    Category: asset.category,
+    ColorMode: asset.colorMode,
+    Extension: asset.extension,
+    Bytes: asset.bytes,
+    ResourceId: asset.resourceId,
+}));
+/** Canonicalize an asset list for order-insensitive comparison; bytes are
+ * folded to base64. */
+const canonicalAssets = (assets) => (assets ?? [])
+    .map((asset) => [
+    asset.Category,
+    asset.ColorMode,
+    asset.Extension,
+    asset.ResourceId ?? "",
+    asset.Bytes === undefined
+        ? ""
+        : Buffer.from(asset.Bytes).toString("base64"),
+].join(":"))
+    .sort()
+    .join(",");
+/**
+ * Whether the style should carry Cognito's provided default values: an
+ * explicit prop wins, otherwise defaults to `true` exactly when no custom
+ * settings/assets are declared.
+ */
+const desiredUseProvidedValues = (news) => news.useCognitoProvidedValues ??
+    (news.settings === undefined && news.assets === undefined);
+/**
+ * Bounded retry over the concurrent-modification window (branding updates
+ * can race domain/pool operations). Explicitly typed so the conditional
+ * `Retry.Return` type never leaks into declaration emit.
+ */
+const retryWhileConcurrent = (self) => Effect.retry(self, {
+    while: (e) => e._tag === "ConcurrentModificationException",
+    schedule: Schedule.max([Schedule.fixed("2 seconds"), Schedule.recurs(10)]),
+});
+export const ManagedLoginBrandingProvider = () => Provider.effect(ManagedLoginBranding, Effect.gen(function* () {
+    const describeById = Effect.fn(function* (userPoolId, managedLoginBrandingId) {
+        return yield* cip
+            .describeManagedLoginBranding({
+            UserPoolId: userPoolId,
+            ManagedLoginBrandingId: managedLoginBrandingId,
+        })
+            .pipe(Effect.map((r) => r.ManagedLoginBranding), Effect.catchTag("ResourceNotFoundException", () => Effect.succeed(undefined)));
+    });
+    const describeByClient = Effect.fn(function* (userPoolId, clientId) {
+        return yield* cip
+            .describeManagedLoginBrandingByClient({
+            UserPoolId: userPoolId,
+            ClientId: clientId,
+        })
+            .pipe(Effect.map((r) => r.ManagedLoginBranding), Effect.catchTag("ResourceNotFoundException", () => Effect.succeed(undefined)));
+    });
+    return ManagedLoginBranding.Provider.of({
+        stables: ["managedLoginBrandingId", "userPoolId", "clientId"],
+        // Sub-resource keyed entirely by its user pool (userPoolId) with no
+        // global enumeration API of its own — nuke reaches it through the
+        // parent's deletion, so enumeration returns empty per the
+        // ProviderService doctrine.
+        list: () => Effect.succeed([]),
+        read: Effect.fn(function* ({ olds, output }) {
+            const userPoolId = output?.userPoolId ?? olds?.userPoolId;
+            const clientId = output?.clientId ?? olds?.clientId;
+            if (userPoolId === undefined)
+                return undefined;
+            const observed = output?.managedLoginBrandingId !== undefined
+                ? yield* describeById(userPoolId, output.managedLoginBrandingId)
+                : clientId !== undefined
+                    ? yield* describeByClient(userPoolId, clientId)
+                    : undefined;
+            if (observed?.ManagedLoginBrandingId === undefined)
+                return undefined;
+            return {
+                managedLoginBrandingId: observed.ManagedLoginBrandingId,
+                userPoolId,
+                clientId: clientId,
+            };
+        }),
+        diff: Effect.fn(function* ({ news, olds }) {
+            if (!isResolved(news))
+                return undefined;
+            if (olds?.userPoolId !== news?.userPoolId ||
+                olds?.clientId !== news?.clientId) {
+                return { action: "replace" };
+            }
+        }),
+        reconcile: Effect.fn(function* ({ news, output, session }) {
+            const { userPoolId, clientId } = news;
+            const useProvided = desiredUseProvidedValues(news);
+            // 1. OBSERVE — output.managedLoginBrandingId is only a cache;
+            //    fall back to the by-client lookup so state loss converges.
+            let observed = output?.managedLoginBrandingId !== undefined
+                ? yield* describeById(userPoolId, output.managedLoginBrandingId)
+                : undefined;
+            if (observed === undefined) {
+                observed = yield* describeByClient(userPoolId, clientId);
+            }
+            // 2. ENSURE — create when missing; a branding created out-of-band
+            //    (or by a concurrent run) for the same client surfaces as
+            //    ManagedLoginBrandingExistsException and is taken over.
+            if (observed === undefined) {
+                observed = yield* cip
+                    .createManagedLoginBranding({
+                    UserPoolId: userPoolId,
+                    ClientId: clientId,
+                    UseCognitoProvidedValues: useProvided,
+                    Settings: news.settings,
+                    Assets: toWireAssets(news.assets),
+                })
+                    .pipe(Effect.map((r) => r.ManagedLoginBranding), Effect.catchTag("ManagedLoginBrandingExistsException", () => describeByClient(userPoolId, clientId)));
+            }
+            const managedLoginBrandingId = observed?.ManagedLoginBrandingId;
+            // 3. SYNC — diff observed style against desired; skip the update
+            //    entirely on no-op.
+            const drift = (observed?.UseCognitoProvidedValues ?? false) !== useProvided ||
+                (news.settings !== undefined &&
+                    JSON.stringify(news.settings) !==
+                        JSON.stringify(observed?.Settings)) ||
+                (news.assets !== undefined &&
+                    canonicalAssets(toWireAssets(news.assets)) !==
+                        canonicalAssets(observed?.Assets));
+            if (drift) {
+                yield* cip
+                    .updateManagedLoginBranding({
+                    UserPoolId: userPoolId,
+                    ManagedLoginBrandingId: managedLoginBrandingId,
+                    UseCognitoProvidedValues: useProvided,
+                    Settings: news.settings,
+                    Assets: toWireAssets(news.assets),
+                })
+                    .pipe(retryWhileConcurrent);
+            }
+            yield* session.note(managedLoginBrandingId);
+            return { managedLoginBrandingId, userPoolId, clientId };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            yield* cip
+                .deleteManagedLoginBranding({
+                UserPoolId: output.userPoolId,
+                ManagedLoginBrandingId: output.managedLoginBrandingId,
+            })
+                .pipe(Effect.catchTag("ResourceNotFoundException", () => Effect.void), retryWhileConcurrent);
+        }),
+    });
+}));
+//# sourceMappingURL=ManagedLoginBranding.js.map

package/lib/AWS/Cognito/ManagedLoginBranding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ManagedLoginBranding.js","sourceRoot":"","sources":["../../../src/AWS/Cognito/ManagedLoginBranding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,gDAAgD,CAAC;AACtE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAkF7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAC1C,kCAAkC,CACnC,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,MAA+C,EAClB,EAAE,CAC/B,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;IACxB,SAAS,EAAE,KAAK,CAAC,SAAS;IAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;IAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;IAClB,UAAU,EAAE,KAAK,CAAC,UAAU;CAC7B,CAAC,CAAC,CAAC;AAEN;uBACuB;AACvB,MAAM,eAAe,GAAG,CAAC,MAAmC,EAAE,EAAE,CAC9D,CAAC,MAAM,IAAI,EAAE,CAAC;KACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACb;IACE,KAAK,CAAC,QAAQ;IACd,KAAK,CAAC,SAAS;IACf,KAAK,CAAC,SAAS;IACf,KAAK,CAAC,UAAU,IAAI,EAAE;IACtB,KAAK,CAAC,KAAK,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;CAChD,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ;KACA,IAAI,EAAE;KACN,IAAI,CAAC,GAAG,CAAC,CAAC;AAEf;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,CAAC,IAA+B,EAAE,EAAE,CACnE,IAAI,CAAC,wBAAwB;IAC7B,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;AAE7D;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,CAC3B,IAA4B,EACJ,EAAE,CAC1B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;IACjB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iCAAiC;IAC1D,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;CAC3E,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,EAAE,CAC/C,QAAQ,CAAC,MAAM,CACb,oBAAoB,EACpB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EACtC,UAAkB,EAClB,sBAA8B;QAE9B,OAAO,KAAK,CAAC,CAAC,GAAG;aACd,4BAA4B,CAAC;YAC5B,UAAU,EAAE,UAAU;YACtB,sBAAsB,EAAE,sBAAsB;SAC/C,CAAC;aACD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,EACzC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAC1C,UAAkB,EAClB,QAAgB;QAEhB,OAAO,KAAK,CAAC,CAAC,GAAG;aACd,oCAAoC,CAAC;YACpC,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,QAAQ;SACnB,CAAC;aACD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,EACzC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,OAAO,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,CAAC,wBAAwB,EAAE,YAAY,EAAE,UAAU,CAAC;QAE7D,oEAAoE;QACpE,kEAAkE;QAClE,0DAA0D;QAC1D,4BAA4B;QAC5B,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAE9B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;YACzC,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,UAAU,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,CAAC;YACpD,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC/C,MAAM,QAAQ,GACZ,MAAM,EAAE,sBAAsB,KAAK,SAAS;gBAC1C,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,sBAAsB,CAAC;gBAChE,CAAC,CAAC,QAAQ,KAAK,SAAS;oBACtB,CAAC,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC;oBAC/C,CAAC,CAAC,SAAS,CAAC;YAClB,IAAI,QAAQ,EAAE,sBAAsB,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACrE,OAAO;gBACL,sBAAsB,EAAE,QAAQ,CAAC,sBAAsB;gBACvD,UAAU;gBACV,QAAQ,EAAE,QAAS;aACpB,CAAC;QACJ,CAAC,CAAC;QAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,IACE,IAAI,EAAE,UAAU,KAAK,IAAI,EAAE,UAAU;gBACrC,IAAI,EAAE,QAAQ,KAAK,IAAI,EAAE,QAAQ,EACjC,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;QACH,CAAC,CAAC;QAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;YACvD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;YACtC,MAAM,WAAW,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAEnD,8DAA8D;YAC9D,gEAAgE;YAChE,IAAI,QAAQ,GACV,MAAM,EAAE,sBAAsB,KAAK,SAAS;gBAC1C,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,sBAAsB,CAAC;gBAChE,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,QAAQ,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC3D,CAAC;YAED,kEAAkE;YAClE,8DAA8D;YAC9D,4DAA4D;YAC5D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG;qBAClB,0BAA0B,CAAC;oBAC1B,UAAU,EAAE,UAAU;oBACtB,QAAQ,EAAE,QAAQ;oBAClB,wBAAwB,EAAE,WAAW;oBACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;iBAClC,CAAC;qBACD,IAAI,CACH,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,EACzC,MAAM,CAAC,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE,CAC1D,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CACvC,CACF,CAAC;YACN,CAAC;YAED,MAAM,sBAAsB,GAAG,QAAQ,EAAE,sBAAuB,CAAC;YAEjE,iEAAiE;YACjE,wBAAwB;YACxB,MAAM,KAAK,GACT,CAAC,QAAQ,EAAE,wBAAwB,IAAI,KAAK,CAAC,KAAK,WAAW;gBAC7D,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;oBAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;wBAC3B,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBACvC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;oBACxB,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBACxC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YACzC,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,CAAC,CAAC,GAAG;qBACP,0BAA0B,CAAC;oBAC1B,UAAU,EAAE,UAAU;oBACtB,sBAAsB,EAAE,sBAAsB;oBAC9C,wBAAwB,EAAE,WAAW;oBACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;iBAClC,CAAC;qBACD,IAAI,CAAC,oBAAoB,CAAC,CAAC;YAChC,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YAC5C,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QAC1D,CAAC,CAAC;QAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,KAAK,CAAC,CAAC,GAAG;iBACP,0BAA0B,CAAC;gBAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;aACtD,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC/D,oBAAoB,CACrB,CAAC;QACN,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC,CAAC,CACH,CAAC"}

package/lib/AWS/Cognito/UserPool.d.ts

@@ -180,6 +180,46 @@ export interface UserPoolCustomEmailSender {
      */
     lambdaVersion?: "V1_0";
 }
+/**
+ * How the user pool delivers its email messages (verification codes, OTPs,
+ * invitations): either Cognito's built-in, rate-limited delivery
+ * (`COGNITO_DEFAULT`) or your own verified Amazon SES identity
+ * (`DEVELOPER`). With `DEVELOPER`, the SES identity's policy must grant
+ * `cognito-idp.amazonaws.com` permission to send
+ * (`SES.EmailIdentityPolicy`).
+ */
+export interface UserPoolEmailConfiguration {
+    /**
+     * Which sending account delivers the pool's email. `COGNITO_DEFAULT`
+     * uses Cognito's built-in delivery (limited daily volume);
+     * `DEVELOPER` sends through your own SES identity (`sourceArn`
+     * required) at your SES quota.
+     * @default "COGNITO_DEFAULT"
+     */
+    emailSendingAccount?: "COGNITO_DEFAULT" | "DEVELOPER";
+    /**
+     * ARN of a verified SES email identity (address or domain) in a
+     * supported region. Required when `emailSendingAccount` is `DEVELOPER`;
+     * with `COGNITO_DEFAULT` it customizes the FROM address while Cognito
+     * still handles delivery.
+     */
+    sourceArn?: string;
+    /**
+     * The FROM address, either bare (`no-reply@example.com`) or with a
+     * friendly display name (`"My App <no-reply@example.com>"`). Must be
+     * covered by the `sourceArn` identity.
+     */
+    from?: string;
+    /**
+     * The destination for replies to the pool's messages.
+     */
+    replyToEmailAddress?: string;
+    /**
+     * Name of an SES configuration set applied to email sent by the pool
+     * (event publishing, IP pool selection). `DEVELOPER` only.
+     */
+    configurationSet?: string;
+}
 /**
  * An account recovery mechanism with its priority (1 is highest).
  */
@@ -283,6 +323,14 @@ export interface UserPoolProps {
      * never affected by adding or removing it.
      */
     customEmailSender?: UserPoolCustomEmailSender;
+    /**
+     * How the pool delivers its email messages: Cognito's built-in delivery
+     * (`COGNITO_DEFAULT`, the service default) or a verified SES identity
+     * (`DEVELOPER`) — no custom sender Lambda required. When omitted, an
+     * observed email configuration is preserved rather than reset to the
+     * service default.
+     */
+    emailConfiguration?: UserPoolEmailConfiguration;
     /**
      * ARN of the symmetric KMS key Cognito uses to encrypt the codes it
      * passes to the custom sender function(s) (`LambdaConfig.KMSKeyID`).
@@ -348,6 +396,38 @@ export interface UserPool extends Resource<"AWS.Cognito.UserPool", UserPoolProps
  * });
  * ```
  *
+ * ### Sending Email Through SES
+ * **Example:** OTP and Verification Email from a Verified SES Identity
+ * ```typescript
+ * const identity = yield* SES.EmailIdentity("Sender", {
+ *   emailIdentity: "mail.example.com",
+ * });
+ * // allow Cognito to send through the identity
+ * yield* SES.EmailIdentityPolicy("CognitoSend", {
+ *   emailIdentity: identity.emailIdentity,
+ *   policyName: "cognito",
+ *   policy: {
+ *     Version: "2012-10-17",
+ *     Statement: [{
+ *       Effect: "Allow",
+ *       Principal: { Service: "cognito-idp.amazonaws.com" },
+ *       Action: ["ses:SendEmail", "ses:SendRawEmail"],
+ *       Resource: identity.identityArn,
+ *     }],
+ *   },
+ * });
+ * const pool = yield* Cognito.UserPool("Users", {
+ *   usernameAttributes: ["email"],
+ *   autoVerifiedAttributes: ["email"],
+ *   emailConfiguration: {
+ *     emailSendingAccount: "DEVELOPER",
+ *     sourceArn: identity.identityArn,
+ *     from: "My App <no-reply@mail.example.com>",
+ *     replyToEmailAddress: "support@example.com",
+ *   },
+ * });
+ * ```
+ *
  * ### Email OTP with a Custom Email Sender
  * **Example:** Passwordless Email OTP Delivered by Your Own Lambda
  * ```typescript

package/lib/AWS/Cognito/UserPool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserPool.d.ts","sourceRoot":"","sources":["../../../src/AWS/Cognito/UserPool.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAMjD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,iBAAiB,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IACjE;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D;;;OAGG;IACH,iBAAiB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,kBAAkB,GAClB,mBAAmB,GACnB,oBAAoB,GACpB,eAAe,GACf,qBAAqB,GACrB,qBAAqB,GACrB,6BAA6B,GAC7B,oBAAoB,GACpB,eAAe,CAAC;AAepB;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,OAAO,CACnD,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CACpC;CAAG;AAEJ;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC;;;;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,gCAE9C;IACA,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,CAAC;CAAG;;;;AAEL;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,kCAEhD;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;CAAG;AAEL;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,WAAW,GACX,SAAS,GACT,WAAW,CAAC;AAEhB;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAChD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,wBAAwB;IACxB,IAAI,EAAE,gBAAgB,GAAG,uBAAuB,GAAG,YAAY,CAAC;IAChE,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,GAAG,cAAc,CAAC,EAAE,CAAC;IAClD;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,GAAG,cAAc,GAAG,oBAAoB,CAAC,EAAE,CAAC;IACtE;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,CAAC,OAAO,GAAG,cAAc,CAAC,EAAE,CAAC;IACtD;;;OAGG;IACH,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACnC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,KAAK,GAAG,UAAU,GAAG,IAAI,CAAC;IAC7C;;;OAGG;IACH,eAAe,CAAC,EAAE,yBAAyB,EAAE,CAAC;IAC9C;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,MAAM,CAAC;IACtC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,sBAAsB,EACtB,aAAa,EACb;IACE,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,YAAY,EAAE,MAAM,CAAC;CACtB,EACD,eAAe,EACf,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AACH,eAAO,MAAM,QAAQ,qDAA6C,CAAC;AA4HnE,eAAO,MAAM,gBAAgB,yPAohB1B,CAAC"}
+{"version":3,"file":"UserPool.d.ts","sourceRoot":"","sources":["../../../src/AWS/Cognito/UserPool.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAMjD,OAAO,KAAK,QAAQ,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,iBAAiB,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IACjE;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D;;;OAGG;IACH,iBAAiB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,kBAAkB,GAClB,mBAAmB,GACnB,oBAAoB,GACpB,eAAe,GACf,qBAAqB,GACrB,qBAAqB,GACrB,6BAA6B,GAC7B,oBAAoB,GACpB,eAAe,CAAC;AAepB;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,OAAO,CACnD,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CACpC;CAAG;AAEJ;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC;;;;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,gCAE9C;IACA,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,CAAC;CAAG;;;;AAEL;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,kCAEhD;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;CAAG;AAEL;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,WAAW,GACX,SAAS,GACT,WAAW,CAAC;AAEhB;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAChD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,iBAAiB,GAAG,WAAW,CAAC;IACtD;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,wBAAwB;IACxB,IAAI,EAAE,gBAAgB,GAAG,uBAAuB,GAAG,YAAY,CAAC;IAChE,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,GAAG,cAAc,CAAC,EAAE,CAAC;IAClD;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,GAAG,cAAc,GAAG,oBAAoB,CAAC,EAAE,CAAC;IACtE;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,CAAC,OAAO,GAAG,cAAc,CAAC,EAAE,CAAC;IACtD;;;OAGG;IACH,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACnC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,KAAK,GAAG,UAAU,GAAG,IAAI,CAAC;IAC7C;;;OAGG;IACH,eAAe,CAAC,EAAE,yBAAyB,EAAE,CAAC;IAC9C;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,MAAM,CAAC;IACtC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IAChD;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,QAAS,SAAQ,QAAQ,CACxC,sBAAsB,EACtB,aAAa,EACb;IACE,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,YAAY,EAAE,MAAM,CAAC;CACtB,EACD,eAAe,EACf,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2GG;AACH,eAAO,MAAM,QAAQ,qDAA6C,CAAC;AA8JnE,eAAO,MAAM,gBAAgB,yPA2iB1B,CAAC"}

package/lib/AWS/Cognito/UserPool.js

@@ -77,6 +77,38 @@ export class InvalidUserPoolConfiguration extends Data.TaggedError("InvalidUserP
  * });
  * ```
  *
+ * ### Sending Email Through SES
+ * **Example:** OTP and Verification Email from a Verified SES Identity
+ * ```typescript
+ * const identity = yield* SES.EmailIdentity("Sender", {
+ *   emailIdentity: "mail.example.com",
+ * });
+ * // allow Cognito to send through the identity
+ * yield* SES.EmailIdentityPolicy("CognitoSend", {
+ *   emailIdentity: identity.emailIdentity,
+ *   policyName: "cognito",
+ *   policy: {
+ *     Version: "2012-10-17",
+ *     Statement: [{
+ *       Effect: "Allow",
+ *       Principal: { Service: "cognito-idp.amazonaws.com" },
+ *       Action: ["ses:SendEmail", "ses:SendRawEmail"],
+ *       Resource: identity.identityArn,
+ *     }],
+ *   },
+ * });
+ * const pool = yield* Cognito.UserPool("Users", {
+ *   usernameAttributes: ["email"],
+ *   autoVerifiedAttributes: ["email"],
+ *   emailConfiguration: {
+ *     emailSendingAccount: "DEVELOPER",
+ *     sourceArn: identity.identityArn,
+ *     from: "My App <no-reply@mail.example.com>",
+ *     replyToEmailAddress: "support@example.com",
+ *   },
+ * });
+ * ```
+ *
  * ### Email OTP with a Custom Email Sender
  * **Example:** Passwordless Email OTP Delivered by Your Own Lambda
  * ```typescript
@@ -154,6 +186,25 @@ const toWireAccountRecovery = (mechanisms) => mechanisms === undefined
 const toWireSignInPolicy = (policy) => policy === undefined
     ? undefined
     : { AllowedFirstAuthFactors: policy.allowedFirstAuthFactors };
+const toWireEmailConfiguration = (config) => config === undefined
+    ? undefined
+    : {
+        EmailSendingAccount: config.emailSendingAccount ?? "COGNITO_DEFAULT",
+        SourceArn: config.sourceArn,
+        From: config.from,
+        ReplyToEmailAddress: config.replyToEmailAddress,
+        ConfigurationSet: config.configurationSet,
+    };
+/** Observed/desired email configuration with the service default filled in,
+ * for order- and absence-insensitive comparison (`JSON.stringify` drops the
+ * `undefined` members on both sides). */
+const normalizedEmailConfiguration = (config) => ({
+    emailSendingAccount: config?.EmailSendingAccount ?? "COGNITO_DEFAULT",
+    sourceArn: config?.SourceArn,
+    from: config?.From,
+    replyToEmailAddress: config?.ReplyToEmailAddress,
+    configurationSet: config?.ConfigurationSet,
+});
 const toWireCustomEmailSender = (sender) => sender === undefined
     ? undefined
     : {
@@ -173,12 +224,17 @@ const validateProps = (props) => props.customEmailSender !== undefined && props.
     ? Effect.fail(new InvalidUserPoolConfiguration({
         reason: "customEmailSender requires kmsKeyId — Cognito encrypts the codes it passes to the custom sender with that KMS key",
     }))
-    : props.tier === "LITE" &&
-        (props.signInPolicy?.allowedFirstAuthFactors ?? []).some((factor) => PASSWORDLESS_AUTH_FACTORS.includes(factor))
+    : props.emailConfiguration?.emailSendingAccount === "DEVELOPER" &&
+        props.emailConfiguration.sourceArn === undefined
         ? Effect.fail(new InvalidUserPoolConfiguration({
-            reason: "passwordless first-auth factors (EMAIL_OTP / SMS_OTP / WEB_AUTHN) require the ESSENTIALS or PLUS tier, not LITE",
+            reason: "emailConfiguration with emailSendingAccount DEVELOPER requires sourceArn — the ARN of the verified SES identity Cognito sends from",
         }))
-        : Effect.void;
+        : props.tier === "LITE" &&
+            (props.signInPolicy?.allowedFirstAuthFactors ?? []).some((factor) => PASSWORDLESS_AUTH_FACTORS.includes(factor))
+            ? Effect.fail(new InvalidUserPoolConfiguration({
+                reason: "passwordless first-auth factors (EMAIL_OTP / SMS_OTP / WEB_AUTHN) require the ESSENTIALS or PLUS tier, not LITE",
+            }))
+            : Effect.void;
 const tagRecordOf = (tags) => Object.fromEntries(Object.entries(tags ?? {}).filter((entry) => entry[1] !== undefined));
 /**
  * The wire name an observed pool attribute would have for a declared custom
@@ -299,6 +355,12 @@ export const UserPoolProvider = () => Provider.effect(UserPool, Effect.gen(funct
             : toWireSignInPolicy(news.signInPolicy);
         return {
             LambdaConfig: lambdaConfig,
+            // updateUserPool resets an omitted EmailConfiguration to the
+            // service default — echo the OBSERVED configuration back when the
+            // prop is undefined so unrelated updates never clear it.
+            EmailConfiguration: news.emailConfiguration === undefined
+                ? observed.EmailConfiguration
+                : toWireEmailConfiguration(news.emailConfiguration),
             Policies: PasswordPolicy === undefined && SignInPolicy === undefined
                 ? undefined
                 : { PasswordPolicy, SignInPolicy },
@@ -389,6 +451,11 @@ export const UserPoolProvider = () => Provider.effect(UserPool, Effect.gen(funct
             (observed.MfaConfiguration ?? "OFF")) {
             return true;
         }
+        if (news.emailConfiguration !== undefined &&
+            JSON.stringify(normalizedEmailConfiguration(toWireEmailConfiguration(news.emailConfiguration))) !==
+                JSON.stringify(normalizedEmailConfiguration(observed.EmailConfiguration))) {
+            return true;
+        }
         if (news.adminCreateUserOnly !== undefined &&
             news.adminCreateUserOnly !==
                 (observed.AdminCreateUserConfig?.AllowAdminCreateUserOnly ?? false)) {
@@ -501,6 +568,7 @@ export const UserPoolProvider = () => Provider.effect(UserPool, Effect.gen(funct
                     DeletionProtection: news.deletionProtection
                         ? "ACTIVE"
                         : "INACTIVE",
+                    EmailConfiguration: toWireEmailConfiguration(news.emailConfiguration),
                     UsernameAttributes: news.usernameAttributes,
                     AliasAttributes: news.aliasAttributes,
                     AutoVerifiedAttributes: news.autoVerifiedAttributes,