@go-to-k/cdkd 0.214.0 → 0.216.0

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-DWUnLza1.js";
-import { $ as CFN_TEMPLATE_URL_LIMIT, A as DagBuilder, B as getDockerCmd, C as CloudControlProvider, D as IntrinsicFunctionResolver, Dt as withErrorHandling, E as isTerminationProtectionPropagationError, Et as normalizeAwsError, F as AssetPublisher, Ft as generateResourceName, G as getLegacyStateBucketName, H as runDockerStreaming, I as stringifyValue, It as generateResourceNameWithFallback, J as resolveSkipPrefix, K as resolveApp, L as WorkGraph, Lt as withSkipPrefix, M as LockManager, Mt as getLiveRenderer, N as S3StateBackend, Nt as PATTERN_B_NAME_PROPERTIES, O as applyRoleArnIfSet, P as shouldRetainResource, Pt as PATTERN_B_RESOURCE_TYPES, Q as CFN_TEMPLATE_BODY_LIMIT, R as buildDockerImage, Rt as withStackName, S as findActionableSilentDrops, T as disableInstanceApiTermination, U as Synthesizer, V as runDockerForeground, W as getDefaultStateBucketName, X as resolveStateBucketWithDefaultAndSource, Y as resolveStateBucketWithDefault, Z as warnDeprecatedNoPrefixCliFlag, _ as CDK_PATH_TAG, _t as ProvisioningError, a as withRetry, at as resolveBucketRegion, b as resolveExplicitPhysicalId, bt as StackHasActiveImportsError, c as formatResourceLine, d as gray, dt as LocalMigrateError, et as MIGRATE_TMP_PREFIX, f as green, ft as LocalStartServiceError, g as collectInlinePolicyNamesManagedBySiblings, gt as PartialFailureError, h as IAMRoleProvider, ht as NestedStackChildDirectDestroyError, i as withResourceDeadline, j as TemplateParser, jt as runStackBuffered, k as DiffCalculator, kt as getLogger, l as bold, m as yellow, mt as MissingCdkCliError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as uploadCfnTemplate, o as isRetryableTransientError, p as red, q as resolveCaptureObservedState, r as DeployEngine, rt as AssemblyReader, s as IMPLICIT_DELETE_DEPENDENCIES, st as CdkdError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as findLargeInlineResources, u as cyan, ut as LocalInvokeBuildError$1, v as matchesCdkPath, vt as ResourceTimeoutError, w as assertRegionMatch, x as ProviderRegistry, xt as StackTerminationProtectionError, y as normalizeAwsTagsToCfn, yt as ResourceUpdateNotSupportedError, z as formatDockerLoginError } from "./deploy-engine-DMggQBl4.js";
+import { $ as CFN_TEMPLATE_URL_LIMIT, A as DagBuilder, B as getDockerCmd, C as CloudControlProvider, D as IntrinsicFunctionResolver, Dt as withErrorHandling, E as isTerminationProtectionPropagationError, Et as normalizeAwsError, F as AssetPublisher, Ft as generateResourceName, G as getLegacyStateBucketName, H as runDockerStreaming, I as stringifyValue, It as generateResourceNameWithFallback, J as resolveSkipPrefix, K as resolveApp, L as WorkGraph, Lt as withSkipPrefix, M as LockManager, Mt as getLiveRenderer, N as S3StateBackend, Nt as PATTERN_B_NAME_PROPERTIES, O as applyRoleArnIfSet, P as shouldRetainResource, Pt as PATTERN_B_RESOURCE_TYPES, Q as CFN_TEMPLATE_BODY_LIMIT, R as buildDockerImage, Rt as withStackName, S as findActionableSilentDrops, T as disableInstanceApiTermination, U as Synthesizer, V as runDockerForeground, W as getDefaultStateBucketName, X as resolveStateBucketWithDefaultAndSource, Y as resolveStateBucketWithDefault, Z as warnDeprecatedNoPrefixCliFlag, _ as CDK_PATH_TAG, _t as ProvisioningError, a as withRetry, at as resolveBucketRegion, b as resolveExplicitPhysicalId, bt as StackHasActiveImportsError, c as formatResourceLine, d as gray, dt as LocalMigrateError, et as MIGRATE_TMP_PREFIX, f as green, ft as LocalStartServiceError, g as collectInlinePolicyNamesManagedBySiblings, gt as PartialFailureError, h as IAMRoleProvider, ht as NestedStackChildDirectDestroyError, i as withResourceDeadline, j as TemplateParser, jt as runStackBuffered, k as DiffCalculator, kt as getLogger, l as bold, m as yellow, mt as MissingCdkCliError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as uploadCfnTemplate, o as isRetryableTransientError, p as red, q as resolveCaptureObservedState, r as DeployEngine, rt as AssemblyReader, s as IMPLICIT_DELETE_DEPENDENCIES, st as CdkdError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as findLargeInlineResources, u as cyan, ut as LocalInvokeBuildError$1, v as matchesCdkPath, vt as ResourceTimeoutError, w as assertRegionMatch, x as ProviderRegistry, xt as StackTerminationProtectionError, y as normalizeAwsTagsToCfn, yt as ResourceUpdateNotSupportedError, z as formatDockerLoginError } from "./deploy-engine-hq-5c3kO.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -46,14 +46,14 @@ import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, Delet
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$11, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-neptune";
 import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ListWebACLsCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$12, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
-import { CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-elasticache";
 import { CreatePrivateDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, UpdatePrivateDnsNamespaceCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$13, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetDatabasesCommand, GetJobCommand, GetSecurityConfigurationCommand, GetSecurityConfigurationsCommand, GetTableCommand, GetTablesCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, ListWorkflowsCommand, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$14, UpdateShardCountCommand } from "@aws-sdk/client-kinesis";
-import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, UpdateFileSystemCommand } from "@aws-sdk/client-efs";
+import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$9, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$1, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$1, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$10, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
@@ -24112,6 +24112,83 @@ function isEmptyObjectPlaceholder(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 0;
 }
 /**
+* The CFn `EnabledMfas` factor names AND their MFA-config-API meaning.
+*
+* `EnabledMfas` is a CFn-level `Array of String`, but Cognito has no
+* `EnabledMfas` field on `CreateUserPool` / `UpdateUserPool`. The factors are
+* activated via the separate `SetUserPoolMfaConfig` control-plane API, one
+* sub-block per factor:
+*
+* - `SMS_MFA`            -> `SmsMfaConfiguration` (needs the pool's
+*                           `SmsConfiguration` SNS-caller ARN to be set too)
+* - `SOFTWARE_TOKEN_MFA` -> `SoftwareTokenMfaConfiguration.Enabled = true`
+* - `EMAIL_OTP`          -> `EmailMfaConfiguration` (carries the email-OTP
+*                           message/subject template — i.e. CFn's
+*                           `EmailAuthenticationMessage` / `Subject`)
+*/
+const MFA_FACTOR_SMS = "SMS_MFA";
+const MFA_FACTOR_SOFTWARE_TOKEN = "SOFTWARE_TOKEN_MFA";
+const MFA_FACTOR_EMAIL_OTP = "EMAIL_OTP";
+/**
+* Build the `SetUserPoolMfaConfig` request from the CFn-level MFA properties,
+* or return `undefined` when none of the MFA-config-API-routed properties are
+* present (so the caller skips the extra control-plane call entirely).
+*
+* The properties that route through `SetUserPoolMfaConfig` (NOT CreateUserPool):
+* - `EnabledMfas`               -> per-factor sub-blocks (see constants above)
+* - `EmailAuthenticationMessage`/`EmailAuthenticationSubject` -> the
+*   `EmailMfaConfiguration` message/subject (email-OTP template)
+* - `WebAuthnRelyingPartyID`/`WebAuthnUserVerification` -> `WebAuthnConfiguration`
+*
+* `MfaConfiguration` (ON/OFF/OPTIONAL) MUST be threaded into this request:
+* `SetUserPoolMfaConfig` is a full-replace of the pool's MFA state, and an
+* omitted `MfaConfiguration` defaults to OFF on the wire — which resets the
+* pool to MFA-disabled and makes AWS reject (or silently drop) the per-factor
+* sub-blocks we are trying to enable. Use the template's `MfaConfiguration`
+* when present; default to `OPTIONAL` when factors are present but the template
+* omitted it (factors are meaningless under OFF, and OPTIONAL enables them
+* without forcing MFA on every user).
+*/
+/**
+* True when any MFA-config-API-routed property is present, i.e. a
+* `SetUserPoolMfaConfig` call will run post-create. When true, `create()` must
+* NOT forward `MfaConfiguration` to `CreateUserPool`: AWS rejects
+* `CreateUserPool` with `MfaConfiguration: ON/OPTIONAL` unless the pool already
+* has SMS configured (+ phone_number auto-verification) OR software-token MFA
+* enabled — but software-token / email-OTP MFA can only be enabled via the
+* post-create `SetUserPoolMfaConfig` call, not on `CreateUserPool`. So the
+* correct sequence is: `CreateUserPool` WITHOUT `MfaConfiguration` (defaults
+* OFF) -> `SetUserPoolMfaConfig` sets `MfaConfiguration` + the factor blocks
+* together (the factor satisfies the MFA requirement, no SMS needed). This
+* mirrors how CloudFormation/CDK sequence the two calls.
+*/
+function hasMfaConfigProps(properties) {
+	const enabledMfas = Array.isArray(properties["EnabledMfas"]) ? properties["EnabledMfas"] : void 0;
+	return enabledMfas !== void 0 && enabledMfas.length > 0 || !!properties["EmailAuthenticationMessage"] || !!properties["EmailAuthenticationSubject"] || !!properties["WebAuthnRelyingPartyID"] || !!properties["WebAuthnUserVerification"];
+}
+function buildMfaConfigRequest(physicalId, properties) {
+	const enabledMfas = Array.isArray(properties["EnabledMfas"]) ? properties["EnabledMfas"] : void 0;
+	const emailMessage = properties["EmailAuthenticationMessage"] || void 0;
+	const emailSubject = properties["EmailAuthenticationSubject"] || void 0;
+	const webAuthnRpId = properties["WebAuthnRelyingPartyID"] || void 0;
+	const webAuthnUserVerification = properties["WebAuthnUserVerification"] || void 0;
+	if (!hasMfaConfigProps(properties)) return void 0;
+	const request = { UserPoolId: physicalId };
+	request.MfaConfiguration = properties["MfaConfiguration"] ?? "OPTIONAL";
+	const factors = new Set(enabledMfas ?? []);
+	if (factors.has(MFA_FACTOR_SOFTWARE_TOKEN)) request.SoftwareTokenMfaConfiguration = { Enabled: true };
+	if (factors.has(MFA_FACTOR_SMS)) request.SmsMfaConfiguration = { ...properties["SmsConfiguration"] ? { SmsConfiguration: properties["SmsConfiguration"] } : {} };
+	if (factors.has(MFA_FACTOR_EMAIL_OTP) || emailMessage !== void 0 || emailSubject !== void 0) request.EmailMfaConfiguration = {
+		...emailMessage !== void 0 ? { Message: emailMessage } : {},
+		...emailSubject !== void 0 ? { Subject: emailSubject } : {}
+	};
+	if (webAuthnRpId !== void 0 || webAuthnUserVerification !== void 0) request.WebAuthnConfiguration = {
+		...webAuthnRpId !== void 0 ? { RelyingPartyId: webAuthnRpId } : {},
+		...webAuthnUserVerification !== void 0 ? { UserVerification: webAuthnUserVerification } : {}
+	};
+	return request;
+}
+/**
 * AWS Cognito User Pool Provider
 *
 * Implements resource provisioning for AWS::Cognito::UserPool using the Cognito SDK.
@@ -24146,8 +24223,15 @@ var CognitoUserPoolProvider = class {
 		"EmailVerificationMessage",
 		"EmailVerificationSubject",
 		"SmsAuthenticationMessage",
-		"SmsVerificationMessage"
+		"SmsVerificationMessage",
+		"UserPoolTier",
+		"EnabledMfas",
+		"EmailAuthenticationMessage",
+		"EmailAuthenticationSubject",
+		"WebAuthnRelyingPartyID",
+		"WebAuthnUserVerification"
 	])]]);
+	unhandledByDesign = new Map([["AWS::Cognito::UserPool", new Map([["WebAuthnFactorConfiguration", "No SDK wire path: @aws-sdk/client-cognito-identity-provider has no field accepting SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION (not on CreateUserPool/UpdateUserPool, nor SetUserPoolMfaConfig.WebAuthnConfiguration which only carries RelyingPartyId/UserVerification); CC-API-registry-only property"]])]]);
 	getClient() {
 		if (!this.cognitoClient) this.cognitoClient = new CognitoIdentityProviderClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.cognitoClient;
@@ -24158,6 +24242,7 @@ var CognitoUserPoolProvider = class {
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating Cognito User Pool ${logicalId}`);
 		const poolName = properties["UserPoolName"] || generateResourceName(logicalId, { maxLength: 128 });
+		let createdUserPoolId;
 		try {
 			const createParams = { PoolName: poolName };
 			if (properties["AutoVerifiedAttributes"]) createParams.AutoVerifiedAttributes = properties["AutoVerifiedAttributes"];
@@ -24168,7 +24253,7 @@ var CognitoUserPoolProvider = class {
 			}
 			if (properties["Schema"]) createParams.Schema = properties["Schema"];
 			if (properties["LambdaConfig"]) createParams.LambdaConfig = properties["LambdaConfig"];
-			if (properties["MfaConfiguration"]) createParams.MfaConfiguration = properties["MfaConfiguration"];
+			if (properties["MfaConfiguration"] && !hasMfaConfigProps(properties)) createParams.MfaConfiguration = properties["MfaConfiguration"];
 			if (properties["UserPoolTags"]) createParams.UserPoolTags = properties["UserPoolTags"];
 			if (properties["AdminCreateUserConfig"]) createParams.AdminCreateUserConfig = properties["AdminCreateUserConfig"];
 			if (properties["AccountRecoverySetting"]) createParams.AccountRecoverySetting = properties["AccountRecoverySetting"];
@@ -24185,13 +24270,16 @@ var CognitoUserPoolProvider = class {
 			if (properties["EmailVerificationSubject"]) createParams.EmailVerificationSubject = properties["EmailVerificationSubject"];
 			if (properties["SmsAuthenticationMessage"]) createParams.SmsAuthenticationMessage = properties["SmsAuthenticationMessage"];
 			if (properties["SmsVerificationMessage"]) createParams.SmsVerificationMessage = properties["SmsVerificationMessage"];
+			if (properties["UserPoolTier"]) createParams.UserPoolTier = properties["UserPoolTier"];
 			const userPool = (await this.getClient().send(new CreateUserPoolCommand(createParams))).UserPool;
 			if (!userPool?.Id) throw new Error("CreateUserPool did not return UserPool.Id");
 			const userPoolId = userPool.Id;
+			createdUserPoolId = userPoolId;
 			const userPoolArn = userPool.Arn;
 			const region = await this.getClient().config.region();
 			const providerName = `cognito-idp.${region}.amazonaws.com/${userPoolId}`;
 			const providerUrl = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`;
+			await this.applyMfaConfig(userPoolId, properties);
 			this.logger.debug(`Successfully created Cognito User Pool ${logicalId}: ${userPoolId}`);
 			return {
 				physicalId: userPoolId,
@@ -24203,11 +24291,46 @@ var CognitoUserPoolProvider = class {
 				}
 			};
 		} catch (error) {
+			if (createdUserPoolId) try {
+				await this.getClient().send(new DeleteUserPoolCommand({ UserPoolId: createdUserPoolId }));
+				this.logger.debug(`Rolled back partially-created Cognito User Pool ${createdUserPoolId}`);
+			} catch (rollbackError) {
+				this.logger.warn(`Failed to roll back partially-created Cognito User Pool ${createdUserPoolId}: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+			}
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, poolName, cause);
 		}
 	}
 	/**
+	* Apply the MFA-config-API-routed properties (EnabledMfas / email-OTP
+	* message+subject / WebAuthn) via SetUserPoolMfaConfig. No-op when none are
+	* present. Wrapped in a transient-error retry because back-to-back
+	* control-plane writes on a freshly-created pool can briefly conflict
+	* (mirrors DynamoDBTableProvider.retryOnTransientControlPlane).
+	*/
+	async applyMfaConfig(physicalId, properties) {
+		const request = buildMfaConfigRequest(physicalId, properties);
+		if (!request) return;
+		await this.retryOnTransientControlPlane(() => this.getClient().send(new SetUserPoolMfaConfigCommand(request)), `SetUserPoolMfaConfig(${physicalId})`);
+	}
+	/**
+	* Retry a Cognito control-plane call on transient "settling" errors. A
+	* SetUserPoolMfaConfig issued immediately after CreateUserPool (or another
+	* control-plane write) can briefly hit `ConcurrentModificationException` /
+	* "please retry". Backoff 1s -> 2s -> 4s, default 3 attempts.
+	*/
+	async retryOnTransientControlPlane(fn, label, maxAttempts = 3) {
+		for (let attempt = 1;; attempt++) try {
+			return await fn();
+		} catch (error) {
+			const msg = error instanceof Error ? error.message : String(error);
+			if (!((error instanceof Error ? error.name : "") === "ConcurrentModificationException" || /concurrent modification|please retry|try again|in progress/i.test(msg)) || attempt >= maxAttempts) throw error;
+			const delayMs = Math.min(1e3 * 2 ** (attempt - 1), 4e3);
+			this.logger.debug(`Transient error on "${label}" (attempt ${attempt}/${maxAttempts}): ${msg} — retrying in ${delayMs}ms`);
+			await new Promise((resolve) => setTimeout(resolve, delayMs));
+		}
+	}
+	/**
 	* Update a Cognito User Pool
 	*
 	* Note: PoolName (UserPoolName) and Schema are immutable and cannot be changed after creation.
@@ -24238,7 +24361,9 @@ var CognitoUserPoolProvider = class {
 			if (properties["EmailVerificationSubject"] !== void 0) updateParams.EmailVerificationSubject = properties["EmailVerificationSubject"];
 			if (properties["SmsAuthenticationMessage"] !== void 0) updateParams.SmsAuthenticationMessage = properties["SmsAuthenticationMessage"];
 			if (properties["SmsVerificationMessage"] !== void 0) updateParams.SmsVerificationMessage = properties["SmsVerificationMessage"];
+			if (properties["UserPoolTier"]) updateParams.UserPoolTier = properties["UserPoolTier"];
 			await this.getClient().send(new UpdateUserPoolCommand(updateParams));
+			await this.applyMfaConfig(physicalId, properties);
 			this.logger.debug(`Successfully updated Cognito User Pool ${logicalId}`);
 			const userPool = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool;
 			const region = await this.getClient().config.region();
@@ -24372,6 +24497,21 @@ var CognitoUserPoolProvider = class {
 			for (const [k, v] of Object.entries(pool.UserPoolTags)) if (!k.startsWith("aws:")) userTags[k] = v;
 		}
 		result["UserPoolTags"] = userTags;
+		result["UserPoolTier"] = pool.UserPoolTier ?? "ESSENTIALS";
+		try {
+			const mfa = await this.getClient().send(new GetUserPoolMfaConfigCommand({ UserPoolId: physicalId }));
+			const enabledMfas = [];
+			if (mfa.SmsMfaConfiguration) enabledMfas.push(MFA_FACTOR_SMS);
+			if (mfa.SoftwareTokenMfaConfiguration?.Enabled) enabledMfas.push(MFA_FACTOR_SOFTWARE_TOKEN);
+			if (mfa.EmailMfaConfiguration) enabledMfas.push(MFA_FACTOR_EMAIL_OTP);
+			result["EnabledMfas"] = enabledMfas;
+			result["EmailAuthenticationMessage"] = mfa.EmailMfaConfiguration?.Message ?? "";
+			result["EmailAuthenticationSubject"] = mfa.EmailMfaConfiguration?.Subject ?? "";
+			result["WebAuthnRelyingPartyID"] = mfa.WebAuthnConfiguration?.RelyingPartyId ?? "";
+			result["WebAuthnUserVerification"] = mfa.WebAuthnConfiguration?.UserVerification ?? "";
+		} catch (mfaErr) {
+			this.logger.debug(`GetUserPoolMfaConfig failed for ${physicalId}, skipping MFA-derived drift keys: ${mfaErr instanceof Error ? mfaErr.message : String(mfaErr)}`);
+		}
 		return result;
 	}
 	/**
@@ -29112,7 +29252,13 @@ var EFSProvider = class {
 			"KmsKeyId",
 			"PerformanceMode",
 			"ThroughputMode",
-			"ProvisionedThroughputInMibps"
+			"ProvisionedThroughputInMibps",
+			"AvailabilityZoneName",
+			"LifecyclePolicies",
+			"BackupPolicy",
+			"FileSystemPolicy",
+			"BypassPolicyLockoutSafetyCheck",
+			"FileSystemProtection"
 		])],
 		["AWS::EFS::MountTarget", new Set([
 			"FileSystemId",
@@ -29126,7 +29272,7 @@ var EFSProvider = class {
 			"AccessPointTags"
 		])]
 	]);
-	unhandledByDesign = new Map([["AWS::EFS::AccessPoint", new Map([["ClientToken", "AWS SDK manages this idempotency token internally on CreateAccessPoint; no user-supplied value is honored"]])]]);
+	unhandledByDesign = new Map([["AWS::EFS::FileSystem", new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]])], ["AWS::EFS::AccessPoint", new Map([["ClientToken", "AWS SDK manages this idempotency token internally on CreateAccessPoint; no user-supplied value is honored"]])]]);
 	getClient() {
 		if (!this.client) this.client = new EFSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -29165,7 +29311,8 @@ var EFSProvider = class {
 		for (const key of [
 			"Encrypted",
 			"KmsKeyId",
-			"PerformanceMode"
+			"PerformanceMode",
+			"AvailabilityZoneName"
 		]) {
 			const next = properties[key];
 			const prev = previousProperties[key];
@@ -29177,7 +29324,12 @@ var EFSProvider = class {
 		const oldProvisioned = previousProperties["ProvisionedThroughputInMibps"];
 		const throughputModeChanged = newThroughputMode !== void 0 && newThroughputMode !== oldThroughputMode;
 		const provisionedChanged = newProvisioned !== void 0 && newProvisioned !== oldProvisioned;
-		if (!throughputModeChanged && !provisionedChanged) {
+		const changed = (key) => JSON.stringify(properties[key]) !== JSON.stringify(previousProperties[key]);
+		const lifecycleChanged = changed("LifecyclePolicies");
+		const backupChanged = changed("BackupPolicy");
+		const policyChanged = changed("FileSystemPolicy") || changed("BypassPolicyLockoutSafetyCheck");
+		const protectionChanged = changed("FileSystemProtection");
+		if (!throughputModeChanged && !provisionedChanged && !lifecycleChanged && !backupChanged && !policyChanged && !protectionChanged) {
 			this.logger.debug(`No mutable diff for EFS FileSystem ${logicalId}, skipping update`);
 			return {
 				physicalId,
@@ -29186,12 +29338,18 @@ var EFSProvider = class {
 		}
 		this.logger.debug(`Updating EFS FileSystem ${logicalId}: ${physicalId}`);
 		try {
-			await this.getClient().send(new UpdateFileSystemCommand({
-				FileSystemId: physicalId,
-				...throughputModeChanged && { ThroughputMode: newThroughputMode },
-				...provisionedChanged && { ProvisionedThroughputInMibps: newProvisioned }
-			}));
-			await this.waitForFileSystemAvailable(physicalId, logicalId, resourceType);
+			if (throughputModeChanged || provisionedChanged) {
+				await this.getClient().send(new UpdateFileSystemCommand({
+					FileSystemId: physicalId,
+					...throughputModeChanged && { ThroughputMode: newThroughputMode },
+					...provisionedChanged && { ProvisionedThroughputInMibps: newProvisioned }
+				}));
+				await this.waitForFileSystemAvailable(physicalId, logicalId, resourceType);
+			}
+			if (lifecycleChanged) await this.applyLifecyclePolicies(physicalId, properties["LifecyclePolicies"], previousProperties["LifecyclePolicies"]);
+			if (backupChanged) await this.applyBackupPolicy(physicalId, properties["BackupPolicy"]);
+			if (policyChanged) await this.applyFileSystemPolicy(physicalId, properties["FileSystemPolicy"], properties["BypassPolicyLockoutSafetyCheck"]);
+			if (protectionChanged) await this.applyFileSystemProtection(physicalId, properties["FileSystemProtection"]);
 			this.logger.debug(`Successfully updated EFS FileSystem ${logicalId}`);
 			return {
 				physicalId,
@@ -29240,6 +29398,7 @@ var EFSProvider = class {
 		this.logger.debug(`Creating EFS FileSystem ${logicalId}`);
 		const creationToken = `cdkd-${logicalId}`;
 		const tags = properties["FileSystemTags"];
+		let fileSystemId;
 		try {
 			const response = await this.getClient().send(new CreateFileSystemCommand({
 				CreationToken: creationToken,
@@ -29248,14 +29407,19 @@ var EFSProvider = class {
 				PerformanceMode: properties["PerformanceMode"],
 				ThroughputMode: properties["ThroughputMode"],
 				ProvisionedThroughputInMibps: properties["ProvisionedThroughputInMibps"],
+				AvailabilityZoneName: properties["AvailabilityZoneName"],
 				Tags: tags?.map((t) => ({
 					Key: t.Key,
 					Value: t.Value
 				}))
 			}));
-			const fileSystemId = response.FileSystemId;
+			fileSystemId = response.FileSystemId;
 			const arn = response.FileSystemArn;
 			await this.waitForFileSystemAvailable(fileSystemId, logicalId, resourceType);
+			await this.applyLifecyclePolicies(fileSystemId, properties["LifecyclePolicies"]);
+			await this.applyBackupPolicy(fileSystemId, properties["BackupPolicy"]);
+			await this.applyFileSystemPolicy(fileSystemId, properties["FileSystemPolicy"], properties["BypassPolicyLockoutSafetyCheck"]);
+			await this.applyFileSystemProtection(fileSystemId, properties["FileSystemProtection"]);
 			this.logger.debug(`Successfully created EFS FileSystem ${logicalId}: ${fileSystemId}`);
 			return {
 				physicalId: fileSystemId,
@@ -29265,10 +29429,100 @@ var EFSProvider = class {
 				}
 			};
 		} catch (error) {
+			if (fileSystemId !== void 0) try {
+				await this.getClient().send(new DeleteFileSystemCommand({ FileSystemId: fileSystemId }));
+				this.logger.debug(`Rolled back partially-created EFS FileSystem ${fileSystemId}`);
+			} catch (cleanupError) {
+				this.logger.warn(`Failed to roll back partially-created EFS FileSystem ${fileSystemId}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+			}
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create EFS FileSystem ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
+	/**
+	* Apply `LifecyclePolicies` via `PutLifecycleConfiguration`. CFn shape is an
+	* array of `{ TransitionToIA?, TransitionToPrimaryStorageClass?,
+	* TransitionToArchive? }`. An empty / dropped array clears all lifecycle
+	* policies (PutLifecycleConfiguration with `LifecyclePolicies: []`).
+	*/
+	async applyLifecyclePolicies(fileSystemId, spec, previousSpec) {
+		if (spec === void 0) {
+			if (previousSpec === void 0) return;
+		}
+		const policies = spec ?? [];
+		await this.retryOnTransientControlPlane(() => this.getClient().send(new PutLifecycleConfigurationCommand({
+			FileSystemId: fileSystemId,
+			LifecyclePolicies: policies
+		})), `set LifecyclePolicies on ${fileSystemId}`);
+		this.logger.debug(`Set ${policies.length} LifecyclePolicy entry(ies) on EFS FileSystem ${fileSystemId}`);
+	}
+	/**
+	* Apply `BackupPolicy` via `PutBackupPolicy`. CFn shape is
+	* `{ Status: 'ENABLED' | 'DISABLED' }`.
+	*/
+	async applyBackupPolicy(fileSystemId, spec) {
+		if (spec === void 0 || spec === null) return;
+		const status = spec.Status;
+		if (status === void 0) return;
+		await this.retryOnTransientControlPlane(() => this.getClient().send(new PutBackupPolicyCommand({
+			FileSystemId: fileSystemId,
+			BackupPolicy: { Status: status }
+		})), `set BackupPolicy on ${fileSystemId}`);
+		this.logger.debug(`Set BackupPolicy Status=${status} on EFS FileSystem ${fileSystemId}`);
+	}
+	/**
+	* Apply `FileSystemPolicy` via `PutFileSystemPolicy`. The CFn `FileSystemPolicy`
+	* property is a JSON policy *object* but the SDK's `Policy` field is a JSON
+	* *string*, so an object value is `JSON.stringify`'d. `BypassPolicyLockoutSafetyCheck`
+	* is a field ON `PutFileSystemPolicy` (not a standalone resource property), so
+	* the two wire together.
+	*/
+	async applyFileSystemPolicy(fileSystemId, policy, bypass) {
+		if (policy === void 0 || policy === null) return;
+		const policyString = typeof policy === "string" ? policy : JSON.stringify(policy);
+		await this.retryOnTransientControlPlane(() => this.getClient().send(new PutFileSystemPolicyCommand({
+			FileSystemId: fileSystemId,
+			Policy: policyString,
+			BypassPolicyLockoutSafetyCheck: bypass === void 0 ? void 0 : Boolean(bypass)
+		})), `set FileSystemPolicy on ${fileSystemId}`);
+		this.logger.debug(`Set FileSystemPolicy on EFS FileSystem ${fileSystemId}`);
+	}
+	/**
+	* Apply `FileSystemProtection` via `UpdateFileSystemProtection`. CFn shape is
+	* `{ ReplicationOverwriteProtection: 'ENABLED' | 'DISABLED' | 'REPLICATING' }`.
+	*/
+	async applyFileSystemProtection(fileSystemId, spec) {
+		if (spec === void 0 || spec === null) return;
+		const protection = spec.ReplicationOverwriteProtection;
+		if (protection === void 0) return;
+		await this.retryOnTransientControlPlane(() => this.getClient().send(new UpdateFileSystemProtectionCommand({
+			FileSystemId: fileSystemId,
+			ReplicationOverwriteProtection: protection
+		})), `set FileSystemProtection on ${fileSystemId}`);
+		this.logger.debug(`Set ReplicationOverwriteProtection=${protection} on EFS FileSystem ${fileSystemId}`);
+	}
+	/**
+	* Retry an EFS control-plane call on the transient "settling" errors AWS
+	* returns when two file-system-modifying operations land back-to-back (e.g.
+	* a `PutLifecycleConfiguration` immediately followed by a `PutBackupPolicy`).
+	* `IncorrectFileSystemLifeCycleState` / `ThrottlingException` /
+	* `ConflictException` and the message-pattern set below are the same class.
+	* Backoff: ~2s,4s,8s,16s,30s,30s... bounded to ~2min total.
+	*/
+	async retryOnTransientControlPlane(op, label, maxAttempts = 8) {
+		let delayMs = 2e3;
+		for (let attempt = 1;; attempt++) try {
+			return await op();
+		} catch (error) {
+			const msg = error instanceof Error ? error.message : String(error);
+			const name = error instanceof Error ? error.name : "";
+			if (!(/in progress|please retry|incorrect file system life ?cycle state|being (updated|modified)|try again/i.test(msg) || name === "IncorrectFileSystemLifeCycleState" || name === "ConflictException" || name === "ThrottlingException") || attempt >= maxAttempts) throw error;
+			this.logger.debug(`Transient error on "${label}" (attempt ${attempt}/${maxAttempts}): ${msg} — retrying in ${delayMs}ms`);
+			await new Promise((resolve) => setTimeout(resolve, delayMs));
+			delayMs = Math.min(delayMs * 2, 3e4);
+		}
+	}
 	async deleteFileSystem(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting EFS FileSystem ${logicalId}: ${physicalId}`);
 		try {
@@ -29430,10 +29684,11 @@ var EFSProvider = class {
 	*
 	* Dispatch per resource type:
 	*  - `FileSystem` → `DescribeFileSystems` filtered by id (PerformanceMode,
-	*    ThroughputMode, Encrypted, KmsKeyId, ProvisionedThroughputInMibps),
-	*    plus optional `DescribeLifecycleConfiguration` and
-	*    `DescribeBackupPolicy` enrichment. Each enrichment call is wrapped
-	*    in its own try/catch so a "not configured" error on either omits
+	*    ThroughputMode, Encrypted, KmsKeyId, ProvisionedThroughputInMibps,
+	*    AvailabilityZoneName, FileSystemProtection), plus optional
+	*    `DescribeLifecycleConfiguration`, `DescribeBackupPolicy`, and
+	*    `DescribeFileSystemPolicy` enrichment. Each enrichment call is wrapped
+	*    in its own try/catch so a "not configured" error on any of them omits
 	*    the corresponding key without failing the whole snapshot.
 	*  - `AccessPoint` → `DescribeAccessPoints` filtered by id (PosixUser,
 	*    RootDirectory).
@@ -29473,8 +29728,11 @@ var EFSProvider = class {
 		if (fs.Encrypted !== void 0) result["Encrypted"] = fs.Encrypted;
 		if (fs.KmsKeyId !== void 0) result["KmsKeyId"] = fs.KmsKeyId;
 		if (fs.ProvisionedThroughputInMibps !== void 0) result["ProvisionedThroughputInMibps"] = fs.ProvisionedThroughputInMibps;
+		if (fs.AvailabilityZoneName !== void 0) result["AvailabilityZoneName"] = fs.AvailabilityZoneName;
+		if (fs.FileSystemProtection?.ReplicationOverwriteProtection !== void 0) result["FileSystemProtection"] = { ReplicationOverwriteProtection: fs.FileSystemProtection.ReplicationOverwriteProtection };
 		try {
-			result["LifecyclePolicies"] = ((await this.getClient().send(new DescribeLifecycleConfigurationCommand({ FileSystemId: physicalId }))).LifecyclePolicies ?? []).map((p) => {
+			const policies = (await this.getClient().send(new DescribeLifecycleConfigurationCommand({ FileSystemId: physicalId }))).LifecyclePolicies ?? [];
+			if (policies.length > 0) result["LifecyclePolicies"] = policies.map((p) => {
 				const out = {};
 				if (p.TransitionToIA !== void 0) out["TransitionToIA"] = p.TransitionToIA;
 				if (p.TransitionToPrimaryStorageClass !== void 0) out["TransitionToPrimaryStorageClass"] = p.TransitionToPrimaryStorageClass;
@@ -29491,6 +29749,16 @@ var EFSProvider = class {
 		} catch (err) {
 			if (err instanceof FileSystemNotFound) return void 0;
 		}
+		try {
+			const resp = await this.getClient().send(new DescribeFileSystemPolicyCommand({ FileSystemId: physicalId }));
+			if (resp.Policy !== void 0) try {
+				result["FileSystemPolicy"] = JSON.parse(resp.Policy);
+			} catch {
+				result["FileSystemPolicy"] = resp.Policy;
+			}
+		} catch (err) {
+			if (err instanceof FileSystemNotFound) return void 0;
+		}
 		result["FileSystemTags"] = normalizeAwsTagsToCfn(fs.Tags);
 		return result;
 	}
@@ -52905,7 +53173,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.214.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.216.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());