@go-to-k/cdkd 0.283.28 → 0.283.30

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveApp, A as cyan, An as LocalInvokeBuildError$1, At as createAssetRedirectResolver, B as findSilentDropProperties, Bn as StackHasActiveImportsError, Bt as validateContainerRepoName, C as makeCanonicalizePropertiesFn, Cn as resetAwsClients, Ct as S3StateBackend, D as renderStatefulReason, Dt as stringifyValue, E as isStatefulRecreateTargetSync, En as CdkdError, Et as AssetPublisher, F as IAMRoleProvider, Fn as NestedStackChildDirectDestroyError, Ft as BOOTSTRAP_MARKER_PREFIX, G as IntrinsicFunctionResolver, Gt as runDockerForeground, H as slowCcOperationTimeoutMs, Ht as buildDockerImage, I as collectInlinePolicyNamesManagedBySiblings, In as PartialFailureError, It as ensureAssetStorage, J as refStateLookupFromResource, Jn as isMarkedNonRetryable, Jt as getDockerImageBySourceHash, K as cfnRefValueFromPhysicalId, Kn as normalizeAwsError, Kt as runDockerStreaming, L as clearOnUpdateRemoval, Ln as ProvisioningError, Lt as getBootstrapMarkerKey, M as green, Mn as LocalStartServiceError, Mt as rewriteTemplateAssetReferences, N as red, Nt as escapeRegExp, O as formatResourceLine, Ot as WorkGraph, P as yellow, Pn as MissingCdkCliError, Pt as AssetModeResolver, Q as assertRegionMatch, Qt as getLegacyStateBucketName, R as ProviderRegistry, Rn as ResourceTimeoutError, Rt as parseBootstrapMarker, S as unsupportedFinalSnapshotError, Sn as getAwsClients, St as LockManager, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tt as shouldRetainResource, U as disableInstanceApiTermination, Ut as formatDockerLoginError, V as CloudControlProvider, Vn as StackTerminationProtectionError, Vt as buildDenyExternalAccessPolicy, W as isTerminationProtectionPropagationError, Wt as getDockerCmd, X as normalizeAwsTagsToCfn, Xn as isThrottlingError, Xt as synthesisStatusMessage, Y as WAFv2WebACLProvider, Yn as isRetryableTransientError, Yt as Synthesizer, Z as resolveExplicitPhysicalId, Zn as markNonRetryable, Zt as getDefaultStateBucketName, _ as buildFinalSnapshotIdentifier, _n as AssemblyReader, _t as INTRINSIC_KEYS, a as DeploymentEventsStore, an as resolveUseCdkBootstrapAssets, at as requireConfigObject, b as isFinalSnapshotError, bn as resolveBucketRegion, bt as DagBuilder, c as replayFailedOperations, cn as CFN_TEMPLATE_BODY_LIMIT, ct as redactSecretsForState, d as deleteSkipReason, dn as findLargeInlineResources, dt as s3BucketDomainName, en as resolveAutoAssetStorage, et as configBooleanRefusal, f as withResourceDeadline, fn as uploadCfnTemplate, ft as s3BucketDualStackDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as derivePartitionAndUrlSuffix, gt as DiffCalculator, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as canonicalizeRegion, ht as applyRoleArnIfSet, i as DeploymentEventsReader, in as resolveStateBucketWithDefaultAndSource, it as requireConfigArray, j as gray, jn as LocalMigrateError, jt as loadPublishableAssetManifest, k as bold, kn as DeployCancelledError, kt as buildAssetRedirectMap, l as replayRollback, ln as CFN_TEMPLATE_URL_LIMIT, lt as scrubResourceRecord, m as computeImplicitDeleteEdges, mn as PARTITION_TABLE, mt as s3BucketWebsiteUrl, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveSkipPrefix, nt as readConfigString, o as planFailedOps, on as stateBucketExistenceConfirmed, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as expectedOwnerParam, pt as s3BucketRegionalDomainName, q as getAccountInfo, qn as withErrorHandling, qt as AssetManifestLoader, r as DeployEngine, rn as resolveStateBucketWithDefault, rt as replayWarn, s as planRollback, sn as warnDeprecatedNoPrefixCliFlag, st as TEMPLATE_SOURCED_READBACK_RULES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveCaptureObservedState, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as MIGRATE_TMP_PREFIX, ut as s3BucketArn, v as ccRoutedFinalSnapshotError, vn as processStackMessages, vt as describeTypeWithThrottleRetry, w as extractDeploymentEventError, wn as setAwsClients, wt as rebuildClientForBucketRegion, x as refusesFinalSnapshot, xn as AwsClients, xt as TemplateParser, y as createPreDeleteFinalSnapshot, yt as withRetry, z as findActionableSilentDrops, zn as ResourceUpdateNotSupportedError, zt as validateAssetBucketName } from "./deploy-engine-5rA6lMn8.js";
+import { $ as coerceCfnBoolean, $t as resolveApp, A as cyan, An as LocalInvokeBuildError$1, At as createAssetRedirectResolver, B as findSilentDropProperties, Bn as StackHasActiveImportsError, Bt as validateContainerRepoName, C as makeCanonicalizePropertiesFn, Cn as resetAwsClients, Ct as S3StateBackend, D as renderStatefulReason, Dt as stringifyValue, E as isStatefulRecreateTargetSync, En as CdkdError, Et as AssetPublisher, F as IAMRoleProvider, Fn as NestedStackChildDirectDestroyError, Ft as BOOTSTRAP_MARKER_PREFIX, G as IntrinsicFunctionResolver, Gt as runDockerForeground, H as slowCcOperationTimeoutMs, Ht as buildDockerImage, I as collectInlinePolicyNamesManagedBySiblings, In as PartialFailureError, It as ensureAssetStorage, J as refStateLookupFromResource, Jn as isMarkedNonRetryable, Jt as getDockerImageBySourceHash, K as cfnRefValueFromPhysicalId, Kn as normalizeAwsError, Kt as runDockerStreaming, L as clearOnUpdateRemoval, Ln as ProvisioningError, Lt as getBootstrapMarkerKey, M as green, Mn as LocalStartServiceError, Mt as rewriteTemplateAssetReferences, N as red, Nt as escapeRegExp, O as formatResourceLine, Ot as WorkGraph, P as yellow, Pn as MissingCdkCliError, Pt as AssetModeResolver, Q as assertRegionMatch, Qt as getLegacyStateBucketName, R as ProviderRegistry, Rn as ResourceTimeoutError, Rt as parseBootstrapMarker, S as unsupportedFinalSnapshotError, Sn as getAwsClients, St as LockManager, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tt as shouldRetainResource, U as disableInstanceApiTermination, Ut as formatDockerLoginError, V as CloudControlProvider, Vn as StackTerminationProtectionError, Vt as buildDenyExternalAccessPolicy, W as isTerminationProtectionPropagationError, Wt as getDockerCmd, X as normalizeAwsTagsToCfn, Xn as isThrottlingError, Xt as synthesisStatusMessage, Y as WAFv2WebACLProvider, Yn as isRetryableTransientError, Yt as Synthesizer, Z as resolveExplicitPhysicalId, Zn as markNonRetryable, Zt as getDefaultStateBucketName, _ as buildFinalSnapshotIdentifier, _n as AssemblyReader, _t as INTRINSIC_KEYS, a as DeploymentEventsStore, an as resolveUseCdkBootstrapAssets, at as requireConfigObject, b as isFinalSnapshotError, bn as resolveBucketRegion, bt as DagBuilder, c as replayFailedOperations, cn as CFN_TEMPLATE_BODY_LIMIT, ct as redactSecretsForState, d as deleteSkipReason, dn as findLargeInlineResources, dt as s3BucketDomainName, en as resolveAutoAssetStorage, et as configBooleanRefusal, f as withResourceDeadline, fn as uploadCfnTemplate, ft as s3BucketDualStackDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as derivePartitionAndUrlSuffix, gt as DiffCalculator, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as canonicalizeRegion, ht as applyRoleArnIfSet, i as DeploymentEventsReader, in as resolveStateBucketWithDefaultAndSource, it as requireConfigArray, j as gray, jn as LocalMigrateError, jt as loadPublishableAssetManifest, k as bold, kn as DeployCancelledError, kt as buildAssetRedirectMap, l as replayRollback, ln as CFN_TEMPLATE_URL_LIMIT, lt as scrubResourceRecord, m as computeImplicitDeleteEdges, mn as PARTITION_TABLE, mt as s3BucketWebsiteUrl, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveSkipPrefix, nt as readConfigString, o as planFailedOps, on as stateBucketExistenceConfirmed, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as expectedOwnerParam, pt as s3BucketRegionalDomainName, q as getAccountInfo, qn as withErrorHandling, qt as AssetManifestLoader, r as DeployEngine, rn as resolveStateBucketWithDefault, rt as replayWarn, s as planRollback, sn as warnDeprecatedNoPrefixCliFlag, st as TEMPLATE_SOURCED_READBACK_RULES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveCaptureObservedState, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as MIGRATE_TMP_PREFIX, ut as s3BucketArn, v as ccRoutedFinalSnapshotError, vn as processStackMessages, vt as describeTypeWithThrottleRetry, w as extractDeploymentEventError, wn as setAwsClients, wt as rebuildClientForBucketRegion, x as refusesFinalSnapshot, xn as AwsClients, xt as TemplateParser, y as createPreDeleteFinalSnapshot, yt as withRetry, z as findActionableSilentDrops, zn as ResourceUpdateNotSupportedError, zt as validateAssetBucketName } from "./deploy-engine-Bb4ECtz3.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DzaowTd_.js";
+import { t as ASGProvider } from "./asg-provider-BpVWOeU3.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -14192,6 +14192,274 @@ function isWarmThroughputDecrease(desired, live) {
 	return sawDecrease;
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-index-busy-delete.ts
+/**
+* The index-busy `DeleteTable` rule that `AWS::DynamoDB::Table` and
+* `AWS::DynamoDB::GlobalTable` both need, in ONE spelling.
+*
+* AWS refuses a `DeleteTable` while any of the table's global secondary
+* indexes is mid-transition:
+*
+*   Attempt to change a resource which is still in use: Cannot delete table
+*   while indexes are being created, updated, or deleted.
+*
+* The condition is TRANSIENT and self-resolving — a real
+* `dynamodb-globaltable` destroy (us-east-1, 2026-08-13) lost one table to it
+* and the very next `cdkd destroy` succeeded with no other change — and
+* application auto-scaling can start an index capacity change at any moment,
+* so any table with an autoscaled GSI can hit it. Surfacing it as a hard
+* `PartialFailureError` with state preserved makes the user re-run a destroy
+* for something that clears itself in seconds.
+*
+* **Provenance, stated precisely.** The rule shipped for
+* `AWS::DynamoDB::GlobalTable` first (issue #1830, PR #1930), provider-locally
+* — deliberately, since `src/deployment/retryable-errors.ts` was owned by
+* another lane at the time. Issue #1931 is the sibling `AWS::DynamoDB::Table`
+* gap that PR left: its `delete()` had no retry at all. Rather than write the
+* classifier, the budget and the warning a second time, they were LIFTED here
+* and both providers now read them.
+*
+* What did NOT change for `GlobalTable` is its AWS-FACING behaviour: the call
+* order, the budgets, the #1521 pre-delete gate and the replica teardown are
+* identical. Two LOG LINES did change, deliberately, and the claim is scoped
+* rather than blanket because a blanket one is falsifiable by the diff: the
+* unclassified-error arm now names the error CLASS at warn and keeps AWS's raw
+* text at debug (it leaked an account id and an assumed-role ARN at default
+* verbosity), and {@link indexBusyRetryWarning} was reworded so its own
+* arithmetic reads consistently. That provider's suite was updated to match.
+*
+* Living here rather than in either provider is the point: the classifier is a
+* single regex whose PRECISION is the whole safety argument (see
+* {@link INDEX_BUSY_DELETE_MESSAGE}), and the retry budget only makes sense
+* read together with the re-arm poll it multiplies. Two files spelling either
+* independently is two chances for a later "fix" to move one of them while the
+* sibling type silently keeps the old answer. Same class as
+* `dynamodb-warm-throughput.ts`, and the same reason.
+*
+* Deliberately NOT here: what only one provider has. `GlobalTable` keeps its
+* pre-delete #1521 gate (a 15-minute settle wait ahead of the retry loop, sized
+* for a wait that runs once) and its replica / auto-scaling teardown; the
+* `Table` provider has neither. What IS shared is everything a second
+* implementation would otherwise re-derive: the predicate, the classifier, the
+* two budgets, the proceed note, the warning text and the retry loop itself.
+*
+* Issues: #1830 / #1521 (GlobalTable, PR #1930), #1931 (Table).
+*/
+/**
+* The GSI states during which AWS refuses another `UpdateTable` or a
+* `DeleteTable` on the table (issue #1521) — a table is ACTIVE while one of
+* its indexes is still transitioning, which is what made the serialized
+* update sequence race and what left a table ORPHANED when the follow-up
+* destroy hit the same rule.
+*
+* `DELETING` is included because a dropped index keeps reporting until it is
+* actually gone. The test is on the TRANSITIONAL values rather than on
+* `!== 'ACTIVE'`: an absent or unrecognized status must not park the caller
+* for its whole cap on a table that is fine.
+*/
+const INDEX_TRANSITIONAL_STATUSES = /* @__PURE__ */ new Set([
+	"CREATING",
+	"UPDATING",
+	"DELETING"
+]);
+function hasTransitionalIndex(indexes) {
+	return (indexes ?? []).some((gsi) => INDEX_TRANSITIONAL_STATUSES.has(gsi.IndexStatus ?? ""));
+}
+/**
+* AWS's refusal when `DeleteTable` lands while one of the table's GSIs is
+* mid-transition (issue #1830). Observed verbatim on a real destroy:
+*
+*   Attempt to change a resource which is still in use: Cannot delete table
+*   while indexes are being created, updated, or deleted.
+*
+* Matched on the leading clause rather than on the whole sentence: the
+* trailing status list is AWS wording that can gain a state without changing
+* what the message MEANS, and the leading clause is already specific enough
+* that nothing else in the DynamoDB surface produces it. Case-insensitive
+* because the text arrives inside a wrapper prefix whose casing is not ours.
+*
+* Deliberately NOT keyed on the exception NAME: AWS reports this as a plain
+* `ResourceInUseException`, which is the same name it uses for genuinely
+* terminal conflicts (deleting a table that is `CREATING`, creating one that
+* already exists). Retrying on the name would turn those into a 47s stall
+* before the same failure.
+*/
+const INDEX_BUSY_DELETE_MESSAGE = /cannot delete table while indexes are being/i;
+function isIndexBusyDeleteError(message) {
+	return INDEX_BUSY_DELETE_MESSAGE.test(message);
+}
+/**
+* Retry budget for the index-busy `DeleteTable` refusal (issue #1830).
+*
+* Left at `withRetry`'s own default of 8 rather than raised. Named rather than
+* inlined because passing it at all is what opts this call out of
+* `withRetry`'s dense IAM-propagation schedule, which would be wrong for a
+* condition measured in seconds-to-minutes rather than sub-second.
+*
+* The count MULTIPLIES the per-attempt re-arm poll below, so the two have to
+* be read together — see {@link DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS} for the
+* arithmetic and for why the poll is not a 15-minute one.
+*/
+const DELETE_INDEX_BUSY_MAX_RETRIES = 8;
+/**
+* `DescribeTable` polls (~1s apart) the index-busy `DeleteTable` retry spends
+* re-arming BEFORE each retry (issue #1830) — it returns on the first one that
+* reports every index settled.
+*
+* Bounded well under the 15-minute default `GlobalTable`'s pre-delete #1521
+* gate uses, because THAT default is sized for a wait that runs once while
+* this one runs per retry: the caller's wall clock is
+* `DELETE_INDEX_BUSY_MAX_RETRIES x this + withRetry's ~47s of backoff`, and
+* `destroy-runner.ts` runs the delete under a per-resource deadline (30 min by
+* default; neither DynamoDB provider declares a `getMinResourceTimeoutMs` to
+* lift it). At 900 polls the product was ~2h, so a genuinely stuck index
+* produced a 30-minute wait ending in a generic `ResourceTimeoutError` that
+* never mentions indexes. At 60 the LOOP's worst case is ~8.8 min and the user
+* gets AWS's own actionable sentence instead.
+*
+* **What that deadline actually wraps**, since the arithmetic depends on it:
+* NOT one `delete()` but `destroy-runner.ts`'s whole outer retry loop, which
+* calls `delete()` up to 4 times (`maxAttempts = 3`) inside the one deadline.
+* Four times ~8.8 min would blow straight through 30 min. It does not, and the
+* reason is load-bearing rather than incidental: that outer loop only retries
+* when `isRetryableTransientError` says so, and this refusal matches no entry
+* in `RETRYABLE_ERROR_MESSAGE_PATTERNS` (verified against the real classifier —
+* both AWS's raw sentence and the `Failed to delete DynamoDB table ...` wrap
+* return false), so the outer loop runs `delete()` exactly ONCE for it and the
+* budget below is not re-multiplied. Adding this message to those patterns
+* would silently make the worst case ~35 min — over the deadline.
+*
+* The FIRST attempt is unaffected — it does not re-arm at all.
+*/
+const DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS = 60;
+/**
+* What proceeding costs when a DELETE-path index-settle wait ends WITHOUT
+* confirming — passed as {@link waitForIndexesSettled}'s `proceedNote` by every
+* delete-path caller (`GlobalTable`'s #1521 pre-delete gate, and the #1830 /
+* #1931 retry re-arm on both providers).
+*
+* The note is caller-supplied because the consequence genuinely differs: the
+* delete path has a backstop — `DeleteTable` follows immediately and AWS
+* refuses it again if the index is still transitioning — while
+* `GlobalTable`'s auto-scaling caller has none (`reconcileAutoScalingTargets`
+* skips an index that is not ready and nothing downstream notices). One
+* sentence per caller, so neither claims the other's safety net.
+*/
+const DELETE_INDEX_WAIT_PROCEED_NOTE = `the DeleteTable goes ahead anyway and AWS's own refusal stays the backstop.`;
+/**
+* Poll `DescribeTable` until no GSI is transitioning, bounded by
+* `maxAttempts` (~1s apart).
+*
+* **Best-effort by design**: on timeout it warns and returns rather than
+* throwing. Index backfill on a large table can take a long time, and a throw
+* here would fail a caller whose actual resources are all correct — on the
+* delete path it would STRAND the resource, which is the failure this whole
+* module exists to remove.
+*
+* `maxAttempts` and `proceedNote` are required rather than defaulted: the two
+* callers differ on both (a wait that runs ONCE versus one that runs per retry
+* and multiplies; a caller with a backstop versus one without), and a default
+* would silently give one caller the other's answer.
+*/
+async function waitForIndexesSettled(opts) {
+	const { tableName, logicalId, logger, describeTable, maxAttempts, proceedNote } = opts;
+	for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+		try {
+			if (!hasTransitionalIndex((await describeTable()).Table?.GlobalSecondaryIndexes ?? [])) return;
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			if (isThrottlingError(err)) {
+				logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
+				await new Promise((resolve) => setTimeout(resolve, 1e3));
+				continue;
+			}
+			if (err instanceof ResourceNotFoundException$1) {
+				logger.debug(`Table ${tableName} (${logicalId}) no longer exists while waiting for indexes`);
+				return;
+			}
+			const errorName = err instanceof Error ? err.name : typeof err;
+			logger.debug(`DescribeTable failed while waiting for indexes on ${tableName} (${logicalId}): ${message}`);
+			logger.warn(`DescribeTable failed (${errorName}) while waiting for indexes on ${tableName} (${logicalId}), so cdkd stopped waiting; ${proceedNote} Re-run with --verbose for AWS's own message.`);
+			return;
+		}
+		await new Promise((resolve) => setTimeout(resolve, 1e3));
+	}
+	logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${maxAttempts} DescribeTable polls (~1s apart, so a little over ${maxAttempts}s of wall clock); ${proceedNote}`);
+}
+/**
+* The ONE line the retry prints at default verbosity, for both providers.
+*
+* `withRetry` announces its retries through `opts.logger?.debug`, so without
+* this a delete spending minutes re-polling printed nothing naming the cause —
+* and the bounded budget above can end in a timeout that has to be diagnosable
+* from an ordinary run's output.
+*
+* `attemptNumber` is the attempt now STARTING (2 for the first retry). The
+* remaining-attempt count is DERIVED from it and never spelled out: `withRetry`
+* runs `1 + maxRetries` attempts in total, and writing the number by hand is
+* how this line came to promise 8 further attempts when 7 were left.
+*
+* The per-attempt settle budget is attached to "this attempt plus the N more"
+* rather than to the N alone, because the re-arm runs before the attempt this
+* very line announces too — 8 re-arms for 7 remaining attempts. Saying "N more
+* attempts, each preceded by ..." made one sentence quote two different counts.
+*
+* It must NOT carry AWS's own sentence: the `dynamodb-globaltable` integ greps
+* the destroy log for `Cannot delete table while indexes are being` to prove
+* AWS really refused, and a cdkd-authored copy would satisfy that grep without
+* the refusal having happened.
+*/
+function indexBusyRetryWarning(opts) {
+	const remainingAttempts = 9 - opts.attemptNumber;
+	return `DynamoDB ${opts.typeLabel} ${opts.logicalId}: AWS refused DeleteTable on ${opts.physicalId} because a global secondary index is still being created, updated or deleted — application auto-scaling can start an index capacity change at any moment, including during this destroy. Waiting for the index to settle and retrying (this attempt plus up to ${remainingAttempts} more attempts; each one first waits up to ${60} DescribeTable polls ~1s apart — a little over a minute of settling — before its DeleteTable). Nothing is wrong with the table; a large index backfill can outlast this budget, in which case the destroy fails with AWS's own message and re-running it succeeds once the index is ACTIVE.`;
+}
+/**
+* Issue the caller's `DeleteTable`, retrying ONLY the transient index-busy
+* refusal and re-arming on the CONDITION between attempts.
+*
+* Retried here rather than by widening the shared
+* `RETRYABLE_ERROR_MESSAGE_PATTERNS`: the same `ResourceInUseException` text
+* also surfaces on CREATE / UPDATE paths where it is NOT self-clearing, and a
+* `DeleteTable` is the one call site that can legitimately wait it out. Same
+* scoping rationale as `isNameCooldownError` / `isRecreateRetryableError`.
+*
+* `reArm` runs BEFORE every retry and never before the first attempt. It is the
+* caller's because the poll needs the caller's client, but every caller is
+* expected to bound it with {@link DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS}: an
+* index backfill outlasts any fixed backoff grid, while a settle poll returns
+* on its first `DescribeTable` once the index is ACTIVE.
+*
+* `sleepSeam` is read per SLEEP rather than once when the options bag is built,
+* so a test that installs the no-op from INSIDE the first refusal — i.e. after
+* `delete()` has already built the bag — still gets it. A value captured at
+* construction time would be `undefined` there and would silently pay
+* `withRetry`'s real ~47s schedule. Passing `sleep` unconditionally is safe:
+* `withRetry`'s dense-schedule detection keys on `maxRetries` /
+* `initialDelayMs` / `maxDelayMs` / `isRetryable`, all of which this caller
+* already sets.
+*/
+async function deleteTableWithIndexBusyRetry(opts) {
+	let deleteAttempts = 0;
+	await withRetry(async () => {
+		if (deleteAttempts++ > 0) {
+			if (deleteAttempts === 2) opts.logger.warn(indexBusyRetryWarning({
+				typeLabel: opts.typeLabel,
+				logicalId: opts.logicalId,
+				physicalId: opts.physicalId,
+				attemptNumber: deleteAttempts
+			}));
+			await opts.reArm();
+		}
+		await opts.deleteTable();
+	}, opts.logicalId, {
+		maxRetries: 8,
+		isRetryable: (message) => isIndexBusyDeleteError(message),
+		logger: opts.logger,
+		sleep: (ms) => opts.sleepSeam.sleep ? opts.sleepSeam.sleep(ms) : new Promise((resolve) => setTimeout(resolve, ms))
+	});
+}
+
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
 /**
@@ -14720,6 +14988,18 @@ function desiredIndexEntriesByName(value) {
 	}
 	return byName;
 }
+/**
+* Test seam for the index-busy `DeleteTable` retry's backoff (issue #1931),
+* mirroring the sibling provider's export of the same name. Production leaves
+* `sleep` undefined so `withRetry`'s real schedule applies; a test injects a
+* no-op so the ~47s budget does not have to be waited out.
+*
+* One seam PER PROVIDER rather than one on the shared module: a `Table` test
+* that silences this backoff must not also silence the `GlobalTable` one, since
+* the two suites run in the same worker and a suite that stopped paying a delay
+* it meant to exercise fails silently — it just gets faster.
+*/
+const deleteTableRetryDelays$1 = {};
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
 	logger = getLogger().child("DynamoDBTableProvider");
@@ -15054,7 +15334,24 @@ var DynamoDBTableProvider = class {
 			if (!(flipError instanceof ResourceNotFoundException$1)) this.logger.debug(`Could not disable DeletionProtectionEnabled on ${physicalId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`);
 		}
 		try {
-			await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
+			await deleteTableWithIndexBusyRetry({
+				logicalId,
+				physicalId,
+				typeLabel: "table",
+				logger: this.logger,
+				deleteTable: async () => {
+					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
+				},
+				reArm: () => waitForIndexesSettled({
+					tableName: physicalId,
+					logicalId,
+					logger: this.logger,
+					describeTable: () => this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId })),
+					maxAttempts: 60,
+					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE
+				}),
+				sleepSeam: deleteTableRetryDelays$1
+			});
 			this.logger.debug(`Successfully deleted DynamoDB table ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$1) {
@@ -17482,24 +17779,19 @@ var DynamoDBGlobalTableProvider = class {
 				this.logger.debug(`Waiting for indexes on ${physicalId} to settle before DeleteTable (issue #1521)`);
 				await this.waitForIndexesActive(physicalId, logicalId, { proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE });
 			}
-			let deleteAttempts = 0;
-			await withRetry(async () => {
-				if (deleteAttempts++ > 0) {
-					if (deleteAttempts === 2) {
-						const remainingAttempts = 1 + DELETE_INDEX_BUSY_MAX_RETRIES - deleteAttempts;
-						this.logger.warn(`DynamoDB GlobalTable ${logicalId}: AWS refused DeleteTable on ${physicalId} because a global secondary index is still being created, updated or deleted — application auto-scaling can start an index capacity change at any moment, including during this destroy. Waiting for the index to settle and retrying (up to ${remainingAttempts} more attempts, each preceded by up to ${DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS} DescribeTable polls ~1s apart — a little over a minute of settling per attempt). Nothing is wrong with the table; a large index backfill can outlast this budget, in which case the destroy fails with AWS's own message and re-running it succeeds once the index is ACTIVE.`);
-					}
-					await this.waitForIndexesActive(physicalId, logicalId, {
-						maxAttempts: DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS,
-						proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE
-					});
-				}
-				await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
-			}, logicalId, {
-				maxRetries: DELETE_INDEX_BUSY_MAX_RETRIES,
-				isRetryable: (message) => isIndexBusyDeleteError(message),
+			await deleteTableWithIndexBusyRetry({
+				logicalId,
+				physicalId,
+				typeLabel: "GlobalTable",
 				logger: this.logger,
-				sleep: (ms) => deleteTableRetryDelays.sleep ? deleteTableRetryDelays.sleep(ms) : new Promise((resolve) => setTimeout(resolve, ms))
+				deleteTable: async () => {
+					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
+				},
+				reArm: () => this.waitForIndexesActive(physicalId, logicalId, {
+					maxAttempts: 60,
+					proceedNote: DELETE_INDEX_WAIT_PROCEED_NOTE
+				}),
+				sleepSeam: deleteTableRetryDelays
 			});
 			await this.waitForTableGone(physicalId, logicalId);
 			this.logger.debug(`Successfully deleted DynamoDB GlobalTable ${logicalId}`);
@@ -18137,28 +18429,14 @@ var DynamoDBGlobalTableProvider = class {
 	* passes {@link DELETE_INDEX_WAIT_PROCEED_NOTE}.
 	*/
 	async waitForIndexesActive(tableName, logicalId, opts) {
-		const maxAttempts = opts?.maxAttempts ?? 900;
-		const proceedNote = opts?.proceedNote ?? "auto-scaling registration for a still-building index may have been skipped. The next deploy re-asserts it.";
-		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-			try {
-				if (!hasTransitionalIndex((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.GlobalSecondaryIndexes ?? [])) return;
-			} catch (err) {
-				const message = err instanceof Error ? err.message : String(err);
-				if (isThrottlingError(err)) {
-					this.logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
-					await new Promise((resolve) => setTimeout(resolve, 1e3));
-					continue;
-				}
-				if (err instanceof ResourceNotFoundException$1) {
-					this.logger.debug(`Table ${tableName} (${logicalId}) no longer exists while waiting for indexes`);
-					return;
-				}
-				this.logger.warn(`DescribeTable failed while waiting for indexes on ${tableName} (${logicalId}), so cdkd stopped waiting; ${proceedNote} DescribeTable error: ${message}`);
-				return;
-			}
-			await new Promise((resolve) => setTimeout(resolve, 1e3));
-		}
-		this.logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${maxAttempts} DescribeTable polls (~1s apart, so a little over ${maxAttempts}s of wall clock); ${proceedNote}`);
+		await waitForIndexesSettled({
+			tableName,
+			logicalId,
+			logger: this.logger,
+			describeTable: () => this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName })),
+			maxAttempts: opts?.maxAttempts ?? 900,
+			proceedNote: opts?.proceedNote ?? "auto-scaling registration for a still-building index may have been skipped. The next deploy re-asserts it."
+		});
 	}
 	/**
 	* Wait until a specific replica's `ReplicaStatus` flips to ACTIVE.
@@ -18439,100 +18717,6 @@ function asRecord$1(value) {
 */
 const ON_DEMAND_LIMIT_RESET = -1;
 /**
-* The GSI states during which AWS refuses another `UpdateTable` or a
-* `DeleteTable` on the table (issue #1521) — a table is ACTIVE while one of
-* its indexes is still transitioning, which is what made the serialized
-* update sequence race and what left a table ORPHANED when the follow-up
-* destroy hit the same rule.
-*
-* `DELETING` is included because a dropped index keeps reporting until it is
-* actually gone. The test is on the TRANSITIONAL values rather than on
-* `!== 'ACTIVE'`: an absent or unrecognized status must not park the caller
-* for its whole cap on a table that is fine.
-*/
-const INDEX_TRANSITIONAL_STATUSES = /* @__PURE__ */ new Set([
-	"CREATING",
-	"UPDATING",
-	"DELETING"
-]);
-function hasTransitionalIndex(indexes) {
-	return (indexes ?? []).some((gsi) => INDEX_TRANSITIONAL_STATUSES.has(gsi.IndexStatus ?? ""));
-}
-/**
-* AWS's refusal when `DeleteTable` lands while one of the table's GSIs is
-* mid-transition (issue #1830). Observed verbatim on a real destroy:
-*
-*   Attempt to change a resource which is still in use: Cannot delete table
-*   while indexes are being created, updated, or deleted.
-*
-* Matched on the leading clause rather than on the whole sentence: the
-* trailing status list is AWS wording that can gain a state without changing
-* what the message MEANS, and the leading clause is already specific enough
-* that nothing else in the DynamoDB surface produces it. Case-insensitive
-* because the text arrives inside a wrapper prefix whose casing is not ours.
-*
-* Deliberately NOT keyed on the exception NAME: AWS reports this as a plain
-* `ResourceInUseException`, which is the same name it uses for genuinely
-* terminal conflicts (deleting a table that is `CREATING`, creating one that
-* already exists). Retrying on the name would turn those into a 47s stall
-* before the same failure.
-*/
-const INDEX_BUSY_DELETE_MESSAGE = /cannot delete table while indexes are being/i;
-function isIndexBusyDeleteError(message) {
-	return INDEX_BUSY_DELETE_MESSAGE.test(message);
-}
-/**
-* Retry budget for the index-busy `DeleteTable` refusal (issue #1830).
-*
-* Left at `withRetry`'s own default of 8 rather than raised. Named rather than
-* inlined because passing it at all is what opts this call out of
-* `withRetry`'s dense IAM-propagation schedule, which would be wrong for a
-* condition measured in seconds-to-minutes rather than sub-second.
-*
-* The count MULTIPLIES the per-attempt re-arm poll below, so the two have to
-* be read together — see {@link DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS} for the
-* arithmetic and for why the poll is not the 15-minute one.
-*/
-const DELETE_INDEX_BUSY_MAX_RETRIES = 8;
-/**
-* Seconds the index-busy `DeleteTable` retry spends re-arming BEFORE each
-* retry (issue #1830) — one `DescribeTable` per second, and it returns on the
-* first one that reports every index settled.
-*
-* Bounded well under
-* {@link DynamoDBGlobalTableProvider['waitForIndexesActive']}'s 15-minute
-* default because THAT default is sized for a wait that runs once, while this
-* one runs per retry: the caller's wall clock is
-* `DELETE_INDEX_BUSY_MAX_RETRIES x this + withRetry's ~47s of backoff`, and
-* `destroy-runner.ts` caps a single `delete()` at the per-resource deadline
-* (30 min by default; this provider declares no `getMinResourceTimeoutMs` to
-* lift it). At 900s the product was ~2h, so a genuinely stuck index produced a
-* 30-minute wait ending in a generic `ResourceTimeoutError` that never
-* mentions indexes. At 60s the worst case is ~8.8 min and the user gets AWS's
-* own actionable sentence instead.
-*
-* The FIRST attempt is unaffected — it does not re-arm at all, and the #1521
-* pre-delete gate ahead of the loop keeps its full 15-minute poll.
-*/
-const DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS = 60;
-/**
-* What proceeding costs when a DELETE-path index-settle wait ends WITHOUT
-* confirming — passed as
-* {@link DynamoDBGlobalTableProvider['waitForIndexesActive']}'s `proceedNote`
-* by BOTH delete-path callers (the #1521 pre-delete gate and the #1830 retry
-* re-arm).
-*
-* The default note that helper falls back to is the auto-scaling caller's, and
-* it is not merely unhelpful here but wrong: nothing on the delete path
-* re-asserts anything on a later deploy. Conversely the delete path really
-* does have a backstop — `DeleteTable` follows immediately and AWS refuses it
-* again if the index is still transitioning — which the auto-scaling caller
-* does not: `reconcileAutoScalingTargets` skips an index that is not ready and
-* nothing downstream notices. One sentence per caller, so neither claims the
-* other's safety net.
-*/
-const DELETE_INDEX_WAIT_PROCEED_NOTE = `the DeleteTable goes ahead anyway and AWS's own refusal stays the backstop.`;
-/**
 * Build the {@link ThroughputDiagnostic} for a `WarmThroughput` block that did
 * not survive coercion intact, or `undefined` when it did.
 *
@@ -38659,6 +38843,56 @@ const MFA_FACTOR_SMS = "SMS_MFA";
 const MFA_FACTOR_SOFTWARE_TOKEN = "SOFTWARE_TOKEN_MFA";
 const MFA_FACTOR_EMAIL_OTP = "EMAIL_OTP";
 /**
+* Read `EnabledMfas` as the pair (recognized list, "the template asked for a
+* factor at all").
+*
+* The second half exists because `Array.isArray` is not the same question as
+* "did the user declare a factor". A hand-written YAML scalar
+* (`EnabledMfas: SOFTWARE_TOKEN_MFA`) or an intrinsic that resolves to a String
+* parameter is a factor DECLARATION that happens to be mis-shaped. Treating it
+* as absence lets the MfaConfiguration default resolve to `OFF`, which AWS
+* ACCEPTS — so the pool ships with MFA disabled and the declared factor
+* dropped, silently. Treating it as intent keeps the default at `OPTIONAL`
+* instead, which AWS refuses loudly — unless the template pinned
+* `MfaConfiguration: OFF`, or another factor is enabled. The warning in
+* `buildMfaConfigRequest` reports which of those three actually happened.
+* Same reasoning as the unrecognized-spelling case there; this is that hole
+* reached through the SHAPE instead of the spelling.
+*/
+function readEnabledMfas(properties) {
+	const raw = properties["EnabledMfas"];
+	if (Array.isArray(raw)) {
+		const factors = raw;
+		return {
+			factors,
+			declaresFactor: factors.length > 0,
+			malformed: false
+		};
+	}
+	const malformed = raw !== void 0 && raw !== null && raw !== "";
+	return {
+		factors: void 0,
+		declaresFactor: malformed,
+		malformed
+	};
+}
+/**
+* True when any MFA-config-API-routed property is present, i.e. a
+* `SetUserPoolMfaConfig` call will run post-create. When true, `create()` must
+* NOT forward `MfaConfiguration` to `CreateUserPool`: AWS rejects
+* `CreateUserPool` with `MfaConfiguration: ON/OPTIONAL` unless the pool already
+* has SMS configured (+ phone_number auto-verification) OR software-token MFA
+* enabled — but software-token / email-OTP MFA can only be enabled via the
+* post-create `SetUserPoolMfaConfig` call, not on `CreateUserPool`. So the
+* correct sequence is: `CreateUserPool` WITHOUT `MfaConfiguration` (defaults
+* OFF) -> `SetUserPoolMfaConfig` sets `MfaConfiguration` + the factor blocks
+* together (the factor satisfies the MFA requirement, no SMS needed). This
+* mirrors how CloudFormation/CDK sequence the two calls.
+*/
+function hasMfaConfigProps(properties) {
+	return readEnabledMfas(properties).declaresFactor || !!properties["EmailAuthenticationMessage"] || !!properties["EmailAuthenticationSubject"] || !!properties["WebAuthnRelyingPartyID"] || !!properties["WebAuthnUserVerification"];
+}
+/**
 * Build the `SetUserPoolMfaConfig` request from the CFn-level MFA properties,
 * or return `undefined` when none of the MFA-config-API-routed properties are
 * present (so the caller skips the extra control-plane call entirely).
@@ -38674,37 +38908,21 @@ const MFA_FACTOR_EMAIL_OTP = "EMAIL_OTP";
 * omitted `MfaConfiguration` defaults to OFF on the wire — which resets the
 * pool to MFA-disabled and makes AWS reject (or silently drop) the per-factor
 * sub-blocks we are trying to enable. Use the template's `MfaConfiguration`
-* when present; default to `OPTIONAL` when factors are present but the template
-* omitted it (factors are meaningless under OFF, and OPTIONAL enables them
-* without forcing MFA on every user).
+* when present; when the template omitted it, default by whether this call
+* enables an MFA FACTOR — `OPTIONAL` if it does, `OFF` (CloudFormation's own
+* default) if it does not. The body comment on that decision explains why both
+* halves of the factor test are load-bearing.
 */
-/**
-* True when any MFA-config-API-routed property is present, i.e. a
-* `SetUserPoolMfaConfig` call will run post-create. When true, `create()` must
-* NOT forward `MfaConfiguration` to `CreateUserPool`: AWS rejects
-* `CreateUserPool` with `MfaConfiguration: ON/OPTIONAL` unless the pool already
-* has SMS configured (+ phone_number auto-verification) OR software-token MFA
-* enabled — but software-token / email-OTP MFA can only be enabled via the
-* post-create `SetUserPoolMfaConfig` call, not on `CreateUserPool`. So the
-* correct sequence is: `CreateUserPool` WITHOUT `MfaConfiguration` (defaults
-* OFF) -> `SetUserPoolMfaConfig` sets `MfaConfiguration` + the factor blocks
-* together (the factor satisfies the MFA requirement, no SMS needed). This
-* mirrors how CloudFormation/CDK sequence the two calls.
-*/
-function hasMfaConfigProps(properties) {
-	const enabledMfas = Array.isArray(properties["EnabledMfas"]) ? properties["EnabledMfas"] : void 0;
-	return enabledMfas !== void 0 && enabledMfas.length > 0 || !!properties["EmailAuthenticationMessage"] || !!properties["EmailAuthenticationSubject"] || !!properties["WebAuthnRelyingPartyID"] || !!properties["WebAuthnUserVerification"];
-}
-function buildMfaConfigRequest(physicalId, properties) {
-	const enabledMfas = Array.isArray(properties["EnabledMfas"]) ? properties["EnabledMfas"] : void 0;
+function buildMfaConfigRequest(physicalId, properties, logger) {
+	const { factors: enabledMfas, declaresFactor, malformed: enabledMfasMalformed } = readEnabledMfas(properties);
 	const emailMessage = properties["EmailAuthenticationMessage"] || void 0;
 	const emailSubject = properties["EmailAuthenticationSubject"] || void 0;
 	const webAuthnRpId = properties["WebAuthnRelyingPartyID"] || void 0;
 	const webAuthnUserVerification = properties["WebAuthnUserVerification"] || void 0;
 	if (!hasMfaConfigProps(properties)) return void 0;
 	const request = { UserPoolId: physicalId };
-	request.MfaConfiguration = properties["MfaConfiguration"] ?? "OPTIONAL";
 	const factors = new Set(enabledMfas ?? []);
+	const unrecognizedFactors = [...factors].filter((factor) => factor !== MFA_FACTOR_SMS && factor !== MFA_FACTOR_SOFTWARE_TOKEN && factor !== MFA_FACTOR_EMAIL_OTP);
 	if (factors.has(MFA_FACTOR_SOFTWARE_TOKEN)) request.SoftwareTokenMfaConfiguration = { Enabled: true };
 	if (factors.has(MFA_FACTOR_SMS)) request.SmsMfaConfiguration = { ...properties["SmsConfiguration"] ? { SmsConfiguration: properties["SmsConfiguration"] } : {} };
 	if (factors.has(MFA_FACTOR_EMAIL_OTP) || emailMessage !== void 0 || emailSubject !== void 0) request.EmailMfaConfiguration = {
@@ -38715,6 +38933,15 @@ function buildMfaConfigRequest(physicalId, properties) {
 		...webAuthnRpId !== void 0 ? { RelyingPartyId: webAuthnRpId } : {},
 		...webAuthnUserVerification !== void 0 ? { UserVerification: webAuthnUserVerification } : {}
 	};
+	const enablesMfaFactor = declaresFactor || request.EmailMfaConfiguration !== void 0;
+	request.MfaConfiguration = properties["MfaConfiguration"] ?? (enablesMfaFactor ? "OPTIONAL" : "OFF");
+	const dropped = unrecognizedFactors.map((f) => JSON.stringify(f) ?? String(f));
+	if (enabledMfasMalformed) dropped.push(`${JSON.stringify(properties["EnabledMfas"])} (not a list)`);
+	if (dropped.length > 0) {
+		const anyFactorBlock = request.SmsMfaConfiguration !== void 0 || request.SoftwareTokenMfaConfiguration !== void 0 || request.EmailMfaConfiguration !== void 0;
+		const consequence = request.MfaConfiguration === "OFF" ? `MfaConfiguration is OFF, so this pool deploys with MFA DISABLED` : anyFactorBlock ? `MfaConfiguration is ${request.MfaConfiguration} and another factor block IS sent, so these entries are silently ignored rather than failing the call on their own` : `MfaConfiguration is ${request.MfaConfiguration} with no factor enabled, so AWS rejects this call rather than deploying the pool with MFA disabled`;
+		logger?.warn(`UserPool ${physicalId}: EnabledMfas entries ${dropped.join(", ")} do not map to an MFA factor block (known: ${MFA_FACTOR_SMS}, ${MFA_FACTOR_SOFTWARE_TOKEN}, ${MFA_FACTOR_EMAIL_OTP}); no factor is enabled from them. ${consequence}.`);
+	}
 	return request;
 }
 /**
@@ -38852,7 +39079,7 @@ var CognitoUserPoolProvider = class {
 	* (mirrors DynamoDBTableProvider.retryOnTransientControlPlane).
 	*/
 	async applyMfaConfig(physicalId, properties) {
-		const request = buildMfaConfigRequest(physicalId, properties);
+		const request = buildMfaConfigRequest(physicalId, properties, this.logger);
 		if (!request) return;
 		await this.retryOnTransientControlPlane(() => this.getClient().send(new SetUserPoolMfaConfigCommand(request)), `SetUserPoolMfaConfig(${physicalId})`);
 	}
@@ -80107,7 +80334,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.28");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.30");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;