raindancers-cloudfront 0.0.40 → 0.0.42

package/lib/cloudfront/lambda-bundled/hmacSecret/urllib3/util/url.py

@@ -2,6 +2,8 @@ from __future__ import annotations
 
 import re
 import typing
+from functools import partial
+from urllib.parse import unquote as _unquote
 
 from ..exceptions import LocationParseError
 from .util import to_str
@@ -13,7 +15,9 @@ _NORMALIZABLE_SCHEMES = ("http", "https", None)
 # Almost all of these patterns were derived from the
 # 'rfc3986' module: https://github.com/python-hyper/rfc3986
 _PERCENT_RE = re.compile(r"%[a-fA-F0-9]{2}")
+_HOST_PERCENT_RE = re.compile(r"%[a-fA-F0-9]{2}|%")
 _SCHEME_RE = re.compile(r"^(?:[a-zA-Z][a-zA-Z0-9+-]*:|/)")
+_HOST_INVALID_CHAR_RE = re.compile(r"[\x00-\x20\x7f]")
 _URI_RE = re.compile(
     r"^(?:([a-zA-Z][a-zA-Z0-9+.-]*):)?"
     r"(?://([^\\/?#]*))?"
@@ -55,7 +59,9 @@ _IPV6_ADDRZ_PAT = r"\[" + _IPV6_PAT + r"(?:" + _ZONE_ID_PAT + r")?\]"
 _REG_NAME_PAT = r"(?:[^\[\]%:/?#]|%[a-fA-F0-9]{2})*"
 _TARGET_RE = re.compile(r"^(/[^?#]*)(?:\?([^#]*))?(?:#.*)?$")
 
-_IPV4_RE = re.compile("^" + _IPV4_PAT + "$")
+_IPV4_RE = re.compile(
+    r"^(?:0[xX][0-9a-fA-F]+|[0-9]+)(?:\.(?:0[xX][0-9a-fA-F]+|[0-9]+)){0,3}$"
+)
 _IPV6_RE = re.compile("^" + _IPV6_PAT + "$")
 _IPV6_ADDRZ_RE = re.compile("^" + _IPV6_ADDRZ_PAT + "$")
 _BRACELESS_IPV6_ADDRZ_RE = re.compile("^" + _IPV6_ADDRZ_PAT[2:-2] + "$")
@@ -95,6 +101,10 @@ class Url(
     Data structure for representing an HTTP URL. Used as a return value for
     :func:`parse_url`. Both the scheme and host are normalized as they are
     both case-insensitive according to RFC 3986.
+
+    :param auth: User information as defined in RFC 3986 3.2.1. This
+        component is kept percent-encoded. Use :attr:`auth_decoded` or
+        :attr:`auth_decoded_joined` to get the decoded form.
     """
 
     def __new__(  # type: ignore[no-untyped-def]
@@ -113,6 +123,46 @@ class Url(
             scheme = scheme.lower()
         return super().__new__(cls, scheme, auth, host, port, path, query, fragment)
 
+    @property
+    def auth_decoded(self) -> tuple[None, None] | tuple[str, str | None]:
+        """
+        User information with %-escapes decoded as UTF-8, returned as a
+        ``(username, password)`` tuple.
+
+        Both values are ``None`` if ``auth`` is ``None``.
+        ``password`` is ``None`` if not present in the auth component.
+        """
+        if self.auth is None:
+            return None, None
+        username, sep, password = self.auth.partition(":")
+        return (
+            _unquote(username, encoding="utf-8"),
+            _unquote(password, encoding="utf-8") if sep else None,
+        )
+
+    @property
+    def auth_decoded_joined(self) -> str | None:
+        """
+        User information with %-escapes decoded as UTF-8, as a string
+        prepared for encoding into an 'authorization: basic ...' header.
+
+        This property does not choose the encoding used for an
+        'authorization: basic ...' header. Use the ``basic_auth_encoding`` or
+        ``proxy_basic_auth_encoding`` parameters of
+        :func:`urllib3.util.make_headers` when converting the returned string
+        into Basic authentication bytes.
+
+        This is a convenience property that joins the username and
+        password with a colon, if both are present.
+        If only the username is present, a trailing colon is still
+        appended.
+        If ``auth`` is ``None``, this returns ``None``.
+        """
+        username, password = self.auth_decoded
+        if username is None:
+            return None
+        return f"{username}:{password or ''}"
+
     @property
     def hostname(self) -> str | None:
         """For backwards-compatibility with urlparse. We're nice like that."""
@@ -154,7 +204,7 @@ class Url(
         """
         if self.host is None:
             return None
-        if self.port:
+        if self.port is not None:
             return f"{self.host}:{self.port}"
         return self.host
 
@@ -235,6 +285,18 @@ def _encode_invalid_chars(
 
     component = to_str(component)
 
+    # Fast path: an ASCII component that consists only of allowed characters
+    # and contains no '%' needs neither encoding nor percent-normalization.
+    # Components containing '%' always take the general path below because
+    # how '%' is treated depends on whether the whole component is already
+    # percent-encoded.
+    if (
+        "%" not in component
+        and component.isascii()
+        and all(map(allowed_chars.__contains__, component))
+    ):
+        return component
+
     # Normalize existing percent-encoded bytes.
     # Try to see if the component we're encoding is already percent-encoded
     # so we can skip all '%' characters but still encode all others.
@@ -246,16 +308,14 @@ def _encode_invalid_chars(
     is_percent_encoded = percent_encodings == uri_bytes.count(b"%")
     encoded_component = bytearray()
 
-    for i in range(0, len(uri_bytes)):
-        # Will return a single character bytestring
-        byte = uri_bytes[i : i + 1]
-        byte_ord = ord(byte)
-        if (is_percent_encoded and byte == b"%") or (
-            byte_ord < 128 and byte.decode() in allowed_chars
+    # Iterating over bytes yields integers; 0x25 is '%'.
+    for byte_ord in uri_bytes:
+        if (is_percent_encoded and byte_ord == 0x25) or (
+            byte_ord < 128 and chr(byte_ord) in allowed_chars
         ):
-            encoded_component += byte
-            continue
-        encoded_component.extend(b"%" + (hex(byte_ord)[2:].encode().zfill(2).upper()))
+            encoded_component.append(byte_ord)
+        else:
+            encoded_component += b"%%%02X" % byte_ord
 
     return encoded_component.decode()
 
@@ -300,6 +360,12 @@ def _normalize_host(host: str, scheme: str | None) -> str: ...
 
 def _normalize_host(host: str | None, scheme: str | None) -> str | None:
     if host:
+        invalid_host_char = _HOST_INVALID_CHAR_RE.search(host)
+        if invalid_host_char:
+            raise LocationParseError(
+                f"Host {host!r} contains invalid character "
+                f"{invalid_host_char.group()!r}"
+            )
         if scheme in _NORMALIZABLE_SCHEMES:
             is_ipv6 = _IPV6_ADDRZ_RE.match(host)
             if is_ipv6:
@@ -315,11 +381,17 @@ def _normalize_host(host: str | None, scheme: str | None) -> str | None:
                         zone_id = zone_id[3:]
                     else:
                         zone_id = zone_id[1:]
+                    zone_id = _PERCENT_RE.sub(
+                        partial(_normalize_zone_id_percent_encoding, error_host=host),
+                        zone_id,
+                    )
                     zone_id = _encode_invalid_chars(zone_id, _UNRESERVED_CHARS)
                     return f"{host[:start].lower()}%{zone_id}{host[end:]}"
                 else:
                     return host.lower()
             elif not _IPV4_RE.match(host):
+                if "%" in host:
+                    host = _HOST_PERCENT_RE.sub(_normalize_host_percent_encoding, host)
                 return to_str(
                     b".".join([_idna_encode(label) for label in host.split(".")]),
                     "ascii",
@@ -327,6 +399,36 @@ def _normalize_host(host: str | None, scheme: str | None) -> str | None:
     return host
 
 
+def _decode_percent_encoding(match: re.Match[str], *, error_host: str) -> str:
+    percent_encoded_octet = match.group(0)
+    decoded_octet = chr(int(percent_encoded_octet[1:], 16))
+    # Keep this narrower than _HOST_INVALID_CHAR_RE because "%20" is valid
+    # percent-encoding and remains encoded.
+    if decoded_octet < "\x20" or decoded_octet == "\x7f":
+        raise LocationParseError(
+            f"Host {error_host!r} contains invalid percent-encoded "
+            f"control character {percent_encoded_octet!r}"
+        )
+    return decoded_octet
+
+
+def _normalize_host_percent_encoding(match: re.Match[str]) -> str:
+    # Reject invalid percent encodings
+    if match.group(0) == "%":
+        raise LocationParseError(f"{match.string!r} is not a valid host")
+    decoded_octet = _decode_percent_encoding(match, error_host=match.string)
+    if decoded_octet in _UNRESERVED_CHARS:
+        return decoded_octet
+    return match.group(0).upper()
+
+
+def _normalize_zone_id_percent_encoding(
+    match: re.Match[str], *, error_host: str
+) -> str:
+    _decode_percent_encoding(match, error_host=error_host)
+    return match.group(0).upper()
+
+
 def _idna_encode(name: str) -> bytes:
     if not name.isascii():
         try:
@@ -343,7 +445,9 @@ def _idna_encode(name: str) -> bytes:
                 f"Name '{name}' is not a valid IDNA label"
             ) from None
 
-    return name.lower().encode("ascii")
+    return _PERCENT_RE.sub(lambda match: match.group(0).upper(), name.lower()).encode(
+        "ascii"
+    )
 
 
 def _encode_target(target: str) -> str:
@@ -396,7 +500,6 @@ def parse_url(url: str) -> Url:
         # Empty
         return Url()
 
-    source_url = url
     if not _SCHEME_RE.search(url):
         url = "//" + url
 
@@ -410,43 +513,48 @@ def parse_url(url: str) -> Url:
     query: str | None
     fragment: str | None
 
-    try:
-        scheme, authority, path, query, fragment = _URI_RE.match(url).groups()  # type: ignore[union-attr]
-        normalize_uri = scheme is None or scheme.lower() in _NORMALIZABLE_SCHEMES
-
-        if scheme:
-            scheme = scheme.lower()
-
-        if authority:
-            auth, _, host_port = authority.rpartition("@")
-            auth = auth or None
-            host, port = _HOST_PORT_RE.match(host_port).groups()  # type: ignore[union-attr]
-            if auth and normalize_uri:
-                auth = _encode_invalid_chars(auth, _USERINFO_CHARS)
-            if port == "":
-                port = None
-        else:
-            auth, host, port = None, None, None
-
-        if port is not None:
-            port_int = int(port)
-            if not (0 <= port_int <= 65535):
-                raise LocationParseError(url)
-        else:
-            port_int = None
-
-        host = _normalize_host(host, scheme)
-
-        if normalize_uri and path:
-            path = _remove_path_dot_segments(path)
-            path = _encode_invalid_chars(path, _PATH_CHARS)
-        if normalize_uri and query:
-            query = _encode_invalid_chars(query, _QUERY_CHARS)
-        if normalize_uri and fragment:
-            fragment = _encode_invalid_chars(fragment, _FRAGMENT_CHARS)
-
-    except (ValueError, AttributeError) as e:
-        raise LocationParseError(source_url) from e
+    scheme, authority, path, query, fragment = _URI_RE.match(url).groups()  # type: ignore[union-attr]
+    normalize_uri = scheme is None or scheme.lower() in _NORMALIZABLE_SCHEMES
+
+    if scheme:
+        scheme = scheme.lower()
+
+    if authority:
+        auth, _, host_port = authority.rpartition("@")
+        auth = auth or None
+        host_port_match = _HOST_PORT_RE.fullmatch(host_port)
+        if not host_port_match:
+            invalid_host_char = _HOST_INVALID_CHAR_RE.search(host_port)
+            if invalid_host_char:
+                raise LocationParseError(
+                    f"Host {host_port!r} contains invalid character "
+                    f"{invalid_host_char.group()!r}"
+                )
+            raise LocationParseError(f"{host_port!r} is not a valid host or port")
+        host, port = host_port_match.groups()
+        if auth and normalize_uri:
+            auth = _encode_invalid_chars(auth, _USERINFO_CHARS)
+        if port == "":
+            port = None
+    else:
+        auth, host, port = None, None, None
+
+    if port is not None:
+        port_int = int(port)
+        if not (0 <= port_int <= 65535):
+            raise LocationParseError(url)
+    else:
+        port_int = None
+
+    host = _normalize_host(host, scheme)
+
+    if normalize_uri and path:
+        path = _remove_path_dot_segments(path)
+        path = _encode_invalid_chars(path, _PATH_CHARS)
+    if normalize_uri and query:
+        query = _encode_invalid_chars(query, _QUERY_CHARS)
+    if normalize_uri and fragment:
+        fragment = _encode_invalid_chars(fragment, _FRAGMENT_CHARS)
 
     # For the sake of backwards compatibility we put empty
     # string values for path if there are any defined values

package/lib/cloudfront/lambda-bundled/hmacSecret/{urllib3-2.7.0.dist-info → urllib3-2.8.0.dist-info}/METADATA

@@ -1,11 +1,12 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: urllib3
-Version: 2.7.0
+Version: 2.8.0
 Summary: HTTP library with thread-safe connection pooling, file post, and more.
 Project-URL: Changelog, https://github.com/urllib3/urllib3/blob/main/CHANGES.rst
 Project-URL: Documentation, https://urllib3.readthedocs.io
 Project-URL: Code, https://github.com/urllib3/urllib3
 Project-URL: Issue tracker, https://github.com/urllib3/urllib3/issues
+Project-URL: Security policy, https://urllib3.readthedocs.io/en/latest/security.html
 Author-email: Andrey Petrov <andrey.petrov@shazow.net>
 Maintainer-email: Seth Michael Larson <sethmichaellarson@gmail.com>, Quentin Pradet <quentin@pradet.me>, Illia Volochii <illia.volochii@gmail.com>
 License-Expression: MIT
@@ -22,6 +23,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Programming Language :: Python :: Free Threading :: 2 - Beta
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy
@@ -118,9 +120,15 @@ collaborating with other contributors. Drop by and say hello 👋
 
 ## Contributing
 
-urllib3 happily accepts contributions. Please see our
+urllib3 welcomes contributions. Please read our
 [contributing documentation](https://urllib3.readthedocs.io/en/latest/contributing.html)
-for some tips on getting started.
+before starting work.
+
+Check for existing pull requests addressing the same issue, and share feedback
+and suggestions in the existing pull request and issue. Duplicate pull
+requests, including alternative solutions, will be rejected without review
+unless a maintainer has approved opening an alternative pull request in
+advance.
 
 
 ## Security Disclosures
@@ -129,6 +137,10 @@ To report a security vulnerability, please use the
 [Tidelift security contact](https://tidelift.com/security).
 Tidelift will coordinate the fix and disclosure with maintainers.
 
+See the repository
+[Security Policy](https://urllib3.readthedocs.io/en/latest/security.html)
+for more details.
+
 
 ## Maintainers
 

package/lib/cloudfront/lambda-bundled/hmacSecret/{urllib3-2.7.0.dist-info → urllib3-2.8.0.dist-info}/RECORD

@@ -1,8 +1,8 @@
-urllib3-2.7.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
-urllib3-2.7.0.dist-info/METADATA,sha256=ZhR4VtMLu2vtAcbOMybQ9I2E7V8oasF3YzoUhrgurOU,6852
-urllib3-2.7.0.dist-info/RECORD,,
-urllib3-2.7.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-urllib3-2.7.0.dist-info/licenses/LICENSE.txt,sha256=Ew46ZNX91dCWp1JpRjSn2d8oRGnehuVzIQAmgEHj1oY,1093
+urllib3-2.8.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
+urllib3-2.8.0.dist-info/METADATA,sha256=EImMYg6AB8Aw4H-lYitoNYpDAQAl3714oct5dpneK7Q,7389
+urllib3-2.8.0.dist-info/RECORD,,
+urllib3-2.8.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+urllib3-2.8.0.dist-info/licenses/LICENSE.txt,sha256=Ew46ZNX91dCWp1JpRjSn2d8oRGnehuVzIQAmgEHj1oY,1093
 urllib3/__init__.py,sha256=JMo1tg1nIV1AeJ2vENC_Txfl0e5h6Gzl9DGVk1rWRbo,6979
 urllib3/__pycache__/__init__.cpython-312.pyc,,
 urllib3/__pycache__/_base_connection.cpython-312.pyc,,
@@ -17,11 +17,11 @@ urllib3/__pycache__/filepost.cpython-312.pyc,,
 urllib3/__pycache__/poolmanager.cpython-312.pyc,,
 urllib3/__pycache__/response.cpython-312.pyc,,
 urllib3/_base_connection.py,sha256=HzcSEHexgDrRUr60jNniB2KQjdw97SedD5luRfHtCXg,5580
-urllib3/_collections.py,sha256=aOVm2mKilvuvT1efAGtkA7pi65C1NC3HJfpFxvYBS8A,17522
+urllib3/_collections.py,sha256=H6yLqGWdZNkZ0Lm_fnLEyqulnOcW6qtXCh2qzxg73xU,17669
 urllib3/_request_methods.py,sha256=gCeF85SO_UU4WoPwYHIoz_tw-eM_EVOkLFp8OFsC7DA,9931
-urllib3/_version.py,sha256=-gMrKhsPiOj0XzUezVFa59d1S6QgQiKgQT5gGgyM8-w,520
-urllib3/connection.py,sha256=Zos3qxKDW9-GQ6aVqfBQVRM5soB0IjHxY_xXWpJaFTI,42786
-urllib3/connectionpool.py,sha256=sGFnddXYwlx7KC4JCP1gKvdNGLNK-YTCJDdGACGj3Y8,44164
+urllib3/_version.py,sha256=e4QyAYanoYBRNP2K6qDVCOgBFoUa7L0j91YQQsUHO9Q,520
+urllib3/connection.py,sha256=ilnas9e2oOGzil_W5WXvakk4G7mVcp0BXk9kQKuFI-A,47903
+urllib3/connectionpool.py,sha256=ahR4aSFrlESaBT6GnUMRy6IylFUcg-4g_l0vHq_1Cj4,45250
 urllib3/contrib/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 urllib3/contrib/__pycache__/__init__.cpython-312.pyc,,
 urllib3/contrib/__pycache__/pyopenssl.cpython-312.pyc,,
@@ -37,8 +37,8 @@ urllib3/contrib/emscripten/emscripten_fetch_worker.js,sha256=z1k3zZ4_hDKd3-tN7wz
 urllib3/contrib/emscripten/fetch.py,sha256=5xcd--viFxZd2nBy0aK73dtJ9Tsh1yYZU_SUXwnwibk,23520
 urllib3/contrib/emscripten/request.py,sha256=mL28szy1KvE3NJhWor5jNmarp8gwplDU-7gwGZY5g0Q,566
 urllib3/contrib/emscripten/response.py,sha256=CDpY0GFoluR3IxECkM2gH5uDfYDM0EL1FWr7B76wtgM,9719
-urllib3/contrib/pyopenssl.py,sha256=XZY-QzyT7s8d43qisA4o-eSZYBeIkPyBMZhtj2kkLZs,19734
-urllib3/contrib/socks.py,sha256=rSuklfha4-vto-8qSLhSPmf5lmRPIYuqdAxKe9bg2RA,7639
+urllib3/contrib/pyopenssl.py,sha256=Ws8vCuZSfgI6QDHaVSJGYA9udTWB9KL0wZ_018iKgjA,21494
+urllib3/contrib/socks.py,sha256=gRQfcI1pKOAh5iI4_TDAkKaAP3N_H2IN5J5mBlKZBpE,7566
 urllib3/exceptions.py,sha256=hQPHoqo4yw46esNSVkciVQXVUgAxWAglsh6MbyQta-Q,9945
 urllib3/fields.py,sha256=aGLFAVZpVU-FbJlllve4Ahg0-pH9ZZBQ2Iz7lfpkjkM,10801
 urllib3/filepost.py,sha256=U8eNZ-mpKKHhrlbHEEiTxxgK16IejhEa7uz42yqA_dI,2388
@@ -46,11 +46,11 @@ urllib3/http2/__init__.py,sha256=xzrASH7R5ANRkPJOot5lGnATOq3KKuyXzI42rcnwmqs,174
 urllib3/http2/__pycache__/__init__.cpython-312.pyc,,
 urllib3/http2/__pycache__/connection.cpython-312.pyc,,
 urllib3/http2/__pycache__/probe.cpython-312.pyc,,
-urllib3/http2/connection.py,sha256=bHMH6fNvatwXPrKqrcn74yA3pUWcqPDppnK1LcKCbP8,12578
+urllib3/http2/connection.py,sha256=njlgr4wLhiAJvtUqxEEn4S95vifblTRrmraRHoCcv60,12613
 urllib3/http2/probe.py,sha256=nnAkqbhAakOiF75rz7W0udZ38Eeh_uD8fjV74N73FEI,3014
-urllib3/poolmanager.py,sha256=c0rh0rcUC1t5tDGuUeGIgAzlErasPOwWwLiB67lX8pM,23895
+urllib3/poolmanager.py,sha256=RmVFBjOP-aDnm67vikCa99N6rQAWMxUDhKHrSl0f9Ms,25026
 urllib3/py.typed,sha256=UaCuPFa3H8UAakbt-5G8SPacldTOGvJv18pPjUJ5gDY,93
-urllib3/response.py,sha256=9SX4BkkdoLgsx1ne6hpt-5PncrnDzPzeqC1DaShSc-M,53219
+urllib3/response.py,sha256=DkVZxzeRTU-PlB3Kns-vbK7GeSJYMCv_7HuLQdrjxxo,54628
 urllib3/util/__init__.py,sha256=-qeS0QceivazvBEKDNFCAI-6ACcdDOE4TMvo7SLNlAQ,1001
 urllib3/util/__pycache__/__init__.cpython-312.pyc,,
 urllib3/util/__pycache__/connection.cpython-312.pyc,,
@@ -67,13 +67,13 @@ urllib3/util/__pycache__/util.cpython-312.pyc,,
 urllib3/util/__pycache__/wait.cpython-312.pyc,,
 urllib3/util/connection.py,sha256=JjO722lzHlzLXPTkr9ZWBdhseXnMVjMSb1DJLVrXSnQ,4444
 urllib3/util/proxy.py,sha256=seP8-Q5B6bB0dMtwPj-YcZZQ30vHuLqRu-tI0JZ2fzs,1148
-urllib3/util/request.py,sha256=itpnC8ug7D4nVfDmGUCRMlgkARUQ13r_XMxSnzTwmpE,8363
+urllib3/util/request.py,sha256=2a87euUwnjylB3fyeZSz_Vs66zLGqqRKJS3bpTZsibA,10228
 urllib3/util/response.py,sha256=vQE639uoEhj1vpjEdxu5lNIhJCSUZkd7pqllUI0BZOA,3374
-urllib3/util/retry.py,sha256=2YnSX-_FecMShD61Mx5s68J0_btUHZrrc_BkFVRS1P4,19577
-urllib3/util/ssl_.py,sha256=Oqe3rIhUU3e3GVgZob2hxmR8Q0ZDhrhESPlPP_GLaVQ,17742
+urllib3/util/retry.py,sha256=D9wmtn0ezEKwyrOXLyC7ByhNeD9Nwxg5T-i5kJjEKSU,20151
+urllib3/util/ssl_.py,sha256=csd5wT9uKvoiFJ11-YpfqwzciGGTUV2drmLhI1T9YcQ,17856
 urllib3/util/ssl_match_hostname.py,sha256=Ft44KJzTzGMmKff_ZXP91li2V4WhmvEy16PKBcv4vZk,5479
 urllib3/util/ssltransport.py,sha256=Ez4O8pR_vT8dan_FvqBYS6dgDfBXEMfVfrzcdUoWfi4,8847
 urllib3/util/timeout.py,sha256=4eT1FVeZZU7h7mYD1Jq2OXNe4fxekdNvhoWUkZusRpA,10346
-urllib3/util/url.py,sha256=WRh-TMYXosmgp8m8lT4H5spoHw5yUjlcMCfU53AkoAs,15205
+urllib3/util/url.py,sha256=aigU2RmH3ZcoJ41BOhVO5Sd7FcsmLZlFQlN38qaTMR8,19579
 urllib3/util/util.py,sha256=j3lbZK1jPyiwD34T8IgJzdWEZVT-4E-0vYIJi9UjeNA,1146
 urllib3/util/wait.py,sha256=_ph8IrUR3sqPqi0OopQgJUlH4wzkGeM5CiyA7XGGtmI,4423

package/lib/cloudfront/lambda-bundled/hmacSecret/{urllib3-2.7.0.dist-info → urllib3-2.8.0.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.29.0
+Generator: hatchling 1.32.0
 Root-Is-Purelib: true
 Tag: py3-none-any

package/lib/cloudfront/patterns/cognitoCustomerPool.d.ts

@@ -1,5 +1,5 @@
 import * as core from 'aws-cdk-lib';
-import { aws_cognito as cognito, aws_iam as iam, aws_lambda as lambda } from 'aws-cdk-lib';
+import { aws_cognito as cognito, aws_iam as iam, aws_kms as kms, aws_lambda as lambda } from 'aws-cdk-lib';
 import * as constructs from 'constructs';
 type AccountTakeoverRiskConfig = cognito.CfnUserPoolRiskConfigurationAttachment.AccountTakeoverRiskConfigurationTypeProperty;
 type CompromisedCredentialsRiskConfig = cognito.CfnUserPoolRiskConfigurationAttachment.CompromisedCredentialsRiskConfigurationTypeProperty;
@@ -76,6 +76,36 @@ export interface CognitoCustomerPoolProps {
      * created. Pass your own to customise emitted claims.
      */
     readonly preTokenGenerationLambda?: lambda.IFunction;
+    /**
+     * Enable email one-time-password (`EMAIL_OTP`) as the MFA second factor, delivered
+     * by {@link customEmailSenderLambda}. This is set via an L1 override on the
+     * underlying `CfnUserPool` (`EnabledMfas: ['EMAIL_OTP']`) rather than
+     * `mfaSecondFactor.email`, because the CDK L2 requires a managed (`DEVELOPER`) SES
+     * `email` config for `mfaSecondFactor.email` — which is incompatible with a
+     * custom-email-sender-only delivery path. Requires {@link customEmailSenderLambda}
+     * and {@link customSenderKmsKey}, and a pool feature plan of Essentials or higher.
+     * When true, any `otp`/`sms` in {@link mfaSecondFactor} is ignored — EMAIL_OTP is
+     * the sole factor.
+     * @default false
+     */
+    readonly emailOtpMfa?: boolean;
+    /**
+     * Custom Email Sender Lambda. When set (together with {@link customSenderKmsKey}),
+     * it is wired to the pool via the `CUSTOM_EMAIL_SENDER` trigger and Cognito
+     * delivers all customer emails (MFA codes, verification, temporary passwords)
+     * through this Lambda instead of its default sender or a managed SES sender.
+     * Cognito encrypts each code to {@link customSenderKmsKey}; the Lambda decrypts
+     * it with the AWS Encryption SDK before sending. Requires {@link customSenderKmsKey}.
+     * @default - Cognito's default email delivery
+     */
+    readonly customEmailSenderLambda?: lambda.IFunction;
+    /**
+     * Symmetric KMS key Cognito uses to encrypt codes for {@link customEmailSenderLambda}.
+     * Required when a custom email sender is provided; ignored otherwise. Cognito is
+     * granted encrypt/decrypt on it; the Lambda must be separately granted decrypt.
+     * @default - no key (only valid when no custom email sender is set)
+     */
+    readonly customSenderKmsKey?: kms.IKey;
     /**
      * L1 account-takeover risk configuration (requires {@link advancedSecurityMode}
      * ENFORCED/AUDIT). Passed through to CfnUserPoolRiskConfigurationAttachment.