@go-to-k/cdkd 0.283.33 → 0.283.35

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as getAccountInfo, $t as formatDockerLoginError, A as cyan, An as resolveBucketRegion, At as TemplateParser, B as stateKeySecretExposure, Bn as LocalInvokeBuildError$1, Bt as loadPublishableAssetManifest, C as makeCanonicalizePropertiesFn, Cn as expectedOwnerParam, Ct as s3BucketWebsiteUrl, D as renderStatefulReason, Dn as AssemblyReader, Dt as describeTypeWithThrottleRetry, E as isStatefulRecreateTargetSync, En as derivePartitionAndUrlSuffix, Et as INTRINSIC_KEYS, F as collectDeclaredOutputNames, Ft as AssetPublisher, G as findActionableSilentDrops, Gn as NestedStackChildDirectDestroyError, Gt as BOOTSTRAP_MARKER_PREFIX, H as collectInlinePolicyNamesManagedBySiblings, Hn as LocalStartServiceError, Ht as escapeRegExp, I as collectPublishedOutputNames, In as CdkdError, It as stringifyValue, J as slowCcOperationTimeoutMs, Jn as ResourceTimeoutError, Jt as parseBootstrapMarker, K as findSilentDropProperties, Kn as PartialFailureError, Kt as ensureAssetStorage, L as exportAliasCollisionScrubWarning, Lt as WorkGraph, M as green, Mn as getAwsClients, Mt as S3StateBackend, N as red, Nn as resetAwsClients, Nt as rebuildClientForBucketRegion, O as formatResourceLine, On as processStackMessages, Ot as withRetry, P as yellow, Pn as setAwsClients, Pt as shouldRetainResource, Q as cfnRefValueFromPhysicalId, Qt as buildDockerImage, R as isExportAliasCollision, Rt as buildAssetRedirectMap, S as unsupportedFinalSnapshotError, Sn as uploadCfnTemplate, St as s3BucketRegionalDomainName, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as canonicalizeRegion, Tt as DiffCalculator, U as clearOnUpdateRemoval, Ut as stripControlChars, V as IAMRoleProvider, Vn as LocalMigrateError, Vt as rewriteTemplateAssetReferences, W as ProviderRegistry, Wn as MissingCdkCliError, Wt as AssetModeResolver, X as isTerminationProtectionPropagationError, Xn as StackHasActiveImportsError, Xt as validateContainerRepoName, Y as disableInstanceApiTermination, Yn as ResourceUpdateNotSupportedError, Yt as validateAssetBucketName, Z as IntrinsicFunctionResolver, Zn as StackTerminationProtectionError, Zt as buildDenyExternalAccessPolicy, _ as buildFinalSnapshotIdentifier, _n as warnDeprecatedNoPrefixCliFlag, _t as redactSecretsForState, a as DeploymentEventsStore, an as Synthesizer, ar as isRetryableTransientError, at as coerceCfnBoolean, b as isFinalSnapshotError, bn as MIGRATE_TMP_PREFIX, bt as s3BucketDomainName, c as replayFailedOperations, cn as getLegacyStateBucketName, ct as readConfigString, d as deleteSkipReason, dn as resolveCaptureObservedState, dt as requireConfigObject, en as getDockerCmd, et as refStateLookupFromResource, f as withResourceDeadline, fn as resolveSkipPrefix, ft as requireConfigString, g as PRE_DELETE_SNAPSHOT_TYPES, gn as stateBucketExistenceConfirmed, gt as maskSecretsInText, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as resolveUseCdkBootstrapAssets, ht as TEMPLATE_SOURCED_RULES, i as DeploymentEventsReader, in as getDockerImageBySourceHash, ir as isMarkedNonRetryable, it as assertRegionMatch, j as gray, jn as AwsClients, jt as LockManager, k as bold, kt as DagBuilder, l as replayRollback, ln as resolveApp, lt as replayWarn, m as computeImplicitDeleteEdges, mn as resolveStateBucketWithDefaultAndSource, mt as STATE_SOURCED_READBACK_RULES, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as runDockerStreaming, nr as normalizeAwsError, nt as normalizeAwsTagsToCfn, o as planFailedOps, on as synthesisStatusMessage, or as isThrottlingError, ot as configBooleanRefusal, p as IMPLICIT_DELETE_DEPENDENCIES, pn as resolveStateBucketWithDefault, pt as STATE_SOURCED_CROSS_GENERATION_RULES, q as CloudControlProvider, qn as ProvisioningError, qt as getBootstrapMarkerKey, r as DeployEngine, rn as AssetManifestLoader, rr as withErrorHandling, rt as resolveExplicitPhysicalId, s as planRollback, sn as getDefaultStateBucketName, sr as markNonRetryable, st as configStringRefusal, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as runDockerForeground, tt as WAFv2WebACLProvider, u as UNSPECIFIED_SKIP_REASON, un as resolveAutoAssetStorage, ut as requireConfigArray, v as ccRoutedFinalSnapshotError, vn as CFN_TEMPLATE_BODY_LIMIT, vt as scrubResourceRecord, w as extractDeploymentEventError, wn as PARTITION_TABLE, wt as applyRoleArnIfSet, x as refusesFinalSnapshot, xn as findLargeInlineResources, xt as s3BucketDualStackDomainName, y as createPreDeleteFinalSnapshot, yn as CFN_TEMPLATE_URL_LIMIT, yt as s3BucketArn, z as secretBearingStateKeyWarning, zn as DeployCancelledError, zt as createAssetRedirectResolver } from "./deploy-engine-Cg54H4pJ.js";
+import { $ as getAccountInfo, $t as formatDockerLoginError, A as cyan, An as resolveBucketRegion, At as TemplateParser, B as stateKeySecretExposure, Bn as LocalInvokeBuildError$1, Bt as loadPublishableAssetManifest, C as makeCanonicalizePropertiesFn, Cn as expectedOwnerParam, Ct as s3BucketWebsiteUrl, D as renderStatefulReason, Dn as AssemblyReader, Dt as describeTypeWithThrottleRetry, E as isStatefulRecreateTargetSync, En as derivePartitionAndUrlSuffix, Et as INTRINSIC_KEYS, F as collectDeclaredOutputNames, Ft as AssetPublisher, G as findActionableSilentDrops, Gn as NestedStackChildDirectDestroyError, Gt as BOOTSTRAP_MARKER_PREFIX, H as collectInlinePolicyNamesManagedBySiblings, Hn as LocalStartServiceError, Ht as escapeRegExp, I as collectPublishedOutputNames, In as CdkdError, It as stringifyValue, J as slowCcOperationTimeoutMs, Jn as ResourceTimeoutError, Jt as parseBootstrapMarker, K as findSilentDropProperties, Kn as PartialFailureError, Kt as ensureAssetStorage, L as exportAliasCollisionScrubWarning, Lt as WorkGraph, M as green, Mn as getAwsClients, Mt as S3StateBackend, N as red, Nn as resetAwsClients, Nt as rebuildClientForBucketRegion, O as formatResourceLine, On as processStackMessages, Ot as withRetry, P as yellow, Pn as setAwsClients, Pt as shouldRetainResource, Q as cfnRefValueFromPhysicalId, Qt as buildDockerImage, R as isExportAliasCollision, Rt as buildAssetRedirectMap, S as unsupportedFinalSnapshotError, Sn as uploadCfnTemplate, St as s3BucketRegionalDomainName, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as canonicalizeRegion, Tt as DiffCalculator, U as clearOnUpdateRemoval, Ut as stripControlChars, V as IAMRoleProvider, Vn as LocalMigrateError, Vt as rewriteTemplateAssetReferences, W as ProviderRegistry, Wn as MissingCdkCliError, Wt as AssetModeResolver, X as isTerminationProtectionPropagationError, Xn as StackHasActiveImportsError, Xt as validateContainerRepoName, Y as disableInstanceApiTermination, Yn as ResourceUpdateNotSupportedError, Yt as validateAssetBucketName, Z as IntrinsicFunctionResolver, Zn as StackTerminationProtectionError, Zt as buildDenyExternalAccessPolicy, _ as buildFinalSnapshotIdentifier, _n as warnDeprecatedNoPrefixCliFlag, _t as redactSecretsForState, a as DeploymentEventsStore, an as Synthesizer, ar as isRetryableTransientError, at as coerceCfnBoolean, b as isFinalSnapshotError, bn as MIGRATE_TMP_PREFIX, bt as s3BucketDomainName, c as replayFailedOperations, cn as getLegacyStateBucketName, ct as readConfigString, d as deleteSkipReason, dn as resolveCaptureObservedState, dt as requireConfigObject, en as getDockerCmd, et as refStateLookupFromResource, f as withResourceDeadline, fn as resolveSkipPrefix, ft as requireConfigString, g as PRE_DELETE_SNAPSHOT_TYPES, gn as stateBucketExistenceConfirmed, gt as maskSecretsInText, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as resolveUseCdkBootstrapAssets, ht as TEMPLATE_SOURCED_RULES, i as DeploymentEventsReader, in as getDockerImageBySourceHash, ir as isMarkedNonRetryable, it as assertRegionMatch, j as gray, jn as AwsClients, jt as LockManager, k as bold, kt as DagBuilder, l as replayRollback, ln as resolveApp, lt as replayWarn, m as computeImplicitDeleteEdges, mn as resolveStateBucketWithDefaultAndSource, mt as STATE_SOURCED_READBACK_RULES, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as runDockerStreaming, nr as normalizeAwsError, nt as normalizeAwsTagsToCfn, o as planFailedOps, on as synthesisStatusMessage, or as isThrottlingError, ot as configBooleanRefusal, p as IMPLICIT_DELETE_DEPENDENCIES, pn as resolveStateBucketWithDefault, pt as STATE_SOURCED_CROSS_GENERATION_RULES, q as CloudControlProvider, qn as ProvisioningError, qt as getBootstrapMarkerKey, r as DeployEngine, rn as AssetManifestLoader, rr as withErrorHandling, rt as resolveExplicitPhysicalId, s as planRollback, sn as getDefaultStateBucketName, sr as markNonRetryable, st as configStringRefusal, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as runDockerForeground, tt as WAFv2WebACLProvider, u as UNSPECIFIED_SKIP_REASON, un as resolveAutoAssetStorage, ut as requireConfigArray, v as ccRoutedFinalSnapshotError, vn as CFN_TEMPLATE_BODY_LIMIT, vt as scrubResourceRecord, w as extractDeploymentEventError, wn as PARTITION_TABLE, wt as applyRoleArnIfSet, x as refusesFinalSnapshot, xn as findLargeInlineResources, xt as s3BucketDualStackDomainName, y as createPreDeleteFinalSnapshot, yn as CFN_TEMPLATE_URL_LIMIT, yt as s3BucketArn, z as secretBearingStateKeyWarning, zn as DeployCancelledError, zt as createAssetRedirectResolver } from "./deploy-engine-fBYrdrmB.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-ID5-zAwf.js";
+import { t as ASGProvider } from "./asg-provider-xC0UiCjt.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -14282,27 +14282,15 @@ function hasTransitionalIndex(indexes) {
 * Deliberately NOT keyed on the exception NAME: AWS reports this as a plain
 * `ResourceInUseException`, which is the same name it uses for genuinely
 * terminal conflicts (deleting a table that is `CREATING`, creating one that
-* already exists). Retrying on the name would turn those into a 47s stall
-* before the same failure.
+* already exists). Retrying on the name would spend the WHOLE budget on them —
+* a full settle poll plus a backoff step per attempt, i.e. minutes — before
+* failing identically.
 */
 const INDEX_BUSY_DELETE_MESSAGE = /cannot delete table while indexes are being/i;
 function isIndexBusyDeleteError(message) {
 	return INDEX_BUSY_DELETE_MESSAGE.test(message);
 }
 /**
-* Retry budget for the index-busy `DeleteTable` refusal (issue #1830).
-*
-* Left at `withRetry`'s own default of 8 rather than raised. Named rather than
-* inlined because passing it at all is what opts this call out of
-* `withRetry`'s dense IAM-propagation schedule, which would be wrong for a
-* condition measured in seconds-to-minutes rather than sub-second.
-*
-* The count MULTIPLIES the per-attempt re-arm poll below, so the two have to
-* be read together — see {@link DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS} for the
-* arithmetic and for why the poll is not a 15-minute one.
-*/
-const DELETE_INDEX_BUSY_MAX_RETRIES = 8;
-/**
 * `DescribeTable` polls (~1s apart) the index-busy `DeleteTable` retry spends
 * re-arming BEFORE each retry (issue #1830) — it returns on the first one that
 * reports every index settled.
@@ -14310,30 +14298,57 @@ const DELETE_INDEX_BUSY_MAX_RETRIES = 8;
 * Bounded well under the 15-minute default `GlobalTable`'s pre-delete #1521
 * gate uses, because THAT default is sized for a wait that runs once while
 * this one runs per retry: the caller's wall clock is
-* `DELETE_INDEX_BUSY_MAX_RETRIES x this + withRetry's ~47s of backoff`, and
-* `destroy-runner.ts` runs the delete under a per-resource deadline (30 min by
-* default; neither DynamoDB provider declares a `getMinResourceTimeoutMs` to
-* lift it). At 900 polls the product was ~2h, so a genuinely stuck index
-* produced a 30-minute wait ending in a generic `ResourceTimeoutError` that
-* never mentions indexes. At 60 the LOOP's worst case is ~8.8 min and the user
-* gets AWS's own actionable sentence instead.
+* `its retry budget x this x ~1.2s per poll + withRetry's backoff`, and `destroy-runner.ts` runs the delete under a per-resource
+* deadline (30 min by default; neither DynamoDB provider declares a
+* `getMinResourceTimeoutMs` to lift it). At 900 polls the product would be
+* ~4.2h, so a genuinely stuck index would produce a 30-minute wait ending in a
+* generic `ResourceTimeoutError` that never mentions indexes. At 60 the LOOP's
+* worst case is ~18.4 min on `AWS::DynamoDB::Table` and ~10.4 min on
+* `AWS::DynamoDB::GlobalTable` — see {@link TABLE_DELETE_INDEX_BUSY_MAX_RETRIES}
+* for every term of that product and for why the two budgets differ — and the
+* user gets AWS's own actionable sentence instead.
 *
 * **What that deadline actually wraps**, since the arithmetic depends on it:
 * NOT one `delete()` but `destroy-runner.ts`'s whole outer retry loop, which
 * calls `delete()` up to 4 times (`maxAttempts = 3`) inside the one deadline.
-* Four times ~8.8 min would blow straight through 30 min. It does not, and the
+* Four times ~18.4 min would blow straight through 30 min. It does not, and the
 * reason is load-bearing rather than incidental: that outer loop only retries
 * when `isRetryableTransientError` says so, and this refusal matches no entry
 * in `RETRYABLE_ERROR_MESSAGE_PATTERNS` (verified against the real classifier —
 * both AWS's raw sentence and the `Failed to delete DynamoDB table ...` wrap
 * return false), so the outer loop runs `delete()` exactly ONCE for it and the
 * budget below is not re-multiplied. Adding this message to those patterns
-* would silently make the worst case ~35 min — over the deadline.
+* would silently make the worst case ~74 min on `AWS::DynamoDB::Table` — well
+* over the deadline.
 *
 * The FIRST attempt is unaffected — it does not re-arm at all.
 */
 const DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS = 60;
 /**
+* Sleep between two `DescribeTable` polls of {@link waitForIndexesSettled}.
+*
+* Named rather than inlined because it is the unit every poll budget on the
+* DynamoDB DELETE path is denominated in — a poll count only becomes a wall
+* clock through this, and the deadline arguments at
+* {@link TABLE_DELETE_INDEX_BUSY_MAX_RETRIES} multiply it. Each of those counts
+* READS it, which is what makes the claim checkable rather than a convention:
+* this module's 60-poll re-arm; `GlobalTable`'s 900-poll #1521 pre-delete gate
+* (and the same 900-poll default its auto-scaling caller takes, since both go
+* through `waitForIndexesActive` -> {@link waitForIndexesSettled});
+* `GlobalTable`'s `waitForReplicaGone` and `waitForTableGone` at 600 polls
+* each; and the `Table` provider's 60-poll `waitForTableActiveAfterUpdate`.
+*
+* Deliberately NOT claimed for the whole file: `waitForReplicaActive` keeps its
+* own `1000`, and is left alone because it runs on the CREATE / UPDATE path,
+* which no arithmetic here prices.
+*
+* It is a FLOOR on the per-poll cost, never the whole of it — each poll also
+* pays a `DescribeTable` round trip, which is why the live run's 60-poll
+* re-arm took ~72s and not 60s, and why the arithmetic above prices a poll at
+* ~1.2s.
+*/
+const INDEX_SETTLE_POLL_INTERVAL_MS = 1e3;
+/**
 * What proceeding costs when a DELETE-path index-settle wait ends WITHOUT
 * confirming — passed as {@link waitForIndexesSettled}'s `proceedNote` by every
 * delete-path caller (`GlobalTable`'s #1521 pre-delete gate, and the #1830 /
@@ -14371,7 +14386,7 @@ async function waitForIndexesSettled(opts) {
 			const message = err instanceof Error ? err.message : String(err);
 			if (isThrottlingError(err)) {
 				logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
-				await new Promise((resolve) => setTimeout(resolve, 1e3));
+				await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 				continue;
 			}
 			if (err instanceof ResourceNotFoundException$1) {
@@ -14383,9 +14398,10 @@ async function waitForIndexesSettled(opts) {
 			logger.warn(`DescribeTable failed (${errorName}) while waiting for indexes on ${tableName} (${logicalId}), so cdkd stopped waiting; ${proceedNote} Re-run with --verbose for AWS's own message.`);
 			return;
 		}
-		await new Promise((resolve) => setTimeout(resolve, 1e3));
+		await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 	}
-	logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${maxAttempts} DescribeTable polls (~1s apart, so a little over ${maxAttempts}s of wall clock); ${proceedNote}`);
+	const pollSeconds = INDEX_SETTLE_POLL_INTERVAL_MS / 1e3;
+	logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${maxAttempts} DescribeTable polls (~${pollSeconds}s apart, so a little over ${maxAttempts * pollSeconds}s of wall clock); ${proceedNote}`);
 }
 /**
 * The ONE line the retry prints at default verbosity, for both providers.
@@ -14395,15 +14411,50 @@ async function waitForIndexesSettled(opts) {
 * and the bounded budget above can end in a timeout that has to be diagnosable
 * from an ordinary run's output.
 *
-* `attemptNumber` is the attempt now STARTING (2 for the first retry). The
-* remaining-attempt count is DERIVED from it and never spelled out: `withRetry`
-* runs `1 + maxRetries` attempts in total, and writing the number by hand is
-* how this line came to promise 8 further attempts when 7 were left.
+* `attemptNumber` is the attempt now STARTING (2 for the first retry), and
+* `maxRetries` is the CALLER's budget — the two types no longer share one (see
+* {@link TABLE_DELETE_INDEX_BUSY_MAX_RETRIES}), so a module-level constant here
+* would print the other type's promise. The remaining-attempt count is DERIVED
+* from the pair and never spelled out: `withRetry` runs `1 + maxRetries`
+* attempts in total, and writing the number by hand is how this line came to
+* promise 8 further attempts when 7 were left. Both figures are CLAMPED — the
+* attempt count at zero, the minutes at one, since the announced attempt
+* re-arms too: the function is exported, and an `attemptNumber` past the budget
+* otherwise printed "up to 0 more attempts" and then went negative.
 *
 * The per-attempt settle budget is attached to "this attempt plus the N more"
 * rather than to the N alone, because the re-arm runs before the attempt this
-* very line announces too — 8 re-arms for 7 remaining attempts. Saying "N more
-* attempts, each preceded by ..." made one sentence quote two different counts.
+* very line announces too — 14 re-arms for 13 remaining attempts on the `Table`
+* budget. Saying "N more attempts, each preceded by ..." made one sentence
+* quote two different counts.
+*
+* It also states how long the loop will keep GOING, as a floor (issue #1950).
+* At the `Table` budget the loop can run for the better part of twenty minutes,
+* and a user watching a destroy sit on one table for that long needs to tell
+* SETTLING from STUCK — an attempt count alone does not say how long it will
+* take.
+*
+* The wording is "will not give up for at least ~N more minutes", NOT "can keep
+* retrying for at least ~N". The re-arm returns on the first `DescribeTable`
+* that reports the indexes settled, so a table clearing in 90s prints this line
+* and then finishes immediately: read as a floor on the WAIT it would push the
+* user toward Ctrl-C, which is the opposite of what the line is for. It is a
+* floor on cdkd's PATIENCE, which is what the reader needs to decide whether to
+* keep waiting.
+*
+* A floor rather than an estimate because {@link INDEX_SETTLE_POLL_INTERVAL_MS}
+* is only the sleep: each poll also pays a `DescribeTable` round trip and
+* `withRetry` sleeps its backoff between attempts, so the true patience is
+* longer than the figure printed.
+*
+* The floor is conditioned on those waits RUNNING, which the sentence says out
+* loud rather than assuming. {@link waitForIndexesSettled} returns early on any
+* non-throttle `DescribeTable` failure (a describe-denied principal that can
+* still delete, say) and returns at once whenever the GSI-status proxy
+* disagrees with AWS's real refusal predicate — the gap named above. In those
+* runs every remaining retry pays only backoff, and cdkd gives up in ~1.6 min
+* having announced ~14. Unconditional, the figure would be plainly false
+* there.
 *
 * It must NOT carry AWS's own sentence: the `dynamodb-globaltable` integ greps
 * the destroy log for `Cannot delete table while indexes are being` to prove
@@ -14411,8 +14462,10 @@ async function waitForIndexesSettled(opts) {
 * the refusal having happened.
 */
 function indexBusyRetryWarning(opts) {
-	const remainingAttempts = 9 - opts.attemptNumber;
-	return `DynamoDB ${opts.typeLabel} ${opts.logicalId}: AWS refused DeleteTable on ${opts.physicalId} because a global secondary index is still being created, updated or deleted — application auto-scaling can start an index capacity change at any moment, including during this destroy. Waiting for the index to settle and retrying (this attempt plus up to ${remainingAttempts} more attempts; each one first waits up to ${60} DescribeTable polls ~1s apart — a little over a minute of settling — before its DeleteTable). Nothing is wrong with the table; a large index backfill can outlast this budget, in which case the destroy fails with AWS's own message and re-running it succeeds once the index is ACTIVE.`;
+	const remainingAttempts = Math.max(0, 1 + opts.maxRetries - opts.attemptNumber);
+	const settleFloorMinutes = Math.max(1, Math.round((remainingAttempts + 1) * 60 * INDEX_SETTLE_POLL_INTERVAL_MS / 6e4));
+	const pollSeconds = INDEX_SETTLE_POLL_INTERVAL_MS / 1e3;
+	return `DynamoDB ${opts.typeLabel} ${opts.logicalId}: AWS refused DeleteTable on ${opts.physicalId} because a global secondary index is still being created, updated or deleted — application auto-scaling can start an index capacity change at any moment, including during this destroy. Waiting for the index to settle and retrying (this attempt plus up to ${remainingAttempts} more attempts; each one first waits up to ${60} DescribeTable polls ~${pollSeconds}s apart before its DeleteTable, so cdkd will not give up for at least ~${settleFloorMinutes} more minutes while those settle waits run). Nothing is wrong with the table; a large index backfill can outlast this budget, in which case the destroy fails with AWS's own message and re-running it succeeds once the index is ACTIVE.`;
 }
 /**
 * Issue the caller's `DeleteTable`, retrying ONLY the transient index-busy
@@ -14430,11 +14483,19 @@ function indexBusyRetryWarning(opts) {
 * index backfill outlasts any fixed backoff grid, while a settle poll returns
 * on its first `DescribeTable` once the index is ACTIVE.
 *
+* `maxRetries` is the CALLER's, not this module's: the two DynamoDB types have
+* different amounts of the per-resource deadline left by the time they reach
+* this loop, so they carry different budgets (see
+* {@link TABLE_DELETE_INDEX_BUSY_MAX_RETRIES} for both derivations). Passing it
+* rather than reading a module constant is also what keeps the two providers'
+* budgets visible at their call sites.
+*
 * `sleepSeam` is read per SLEEP rather than once when the options bag is built,
 * so a test that installs the no-op from INSIDE the first refusal — i.e. after
 * `delete()` has already built the bag — still gets it. A value captured at
 * construction time would be `undefined` there and would silently pay
-* `withRetry`'s real ~47s schedule. Passing `sleep` unconditionally is safe:
+* `withRetry`'s real backoff schedule (95s of sleep at the `Table` budget, 47s
+* at the `GlobalTable` one, on top of a full settle poll per attempt). Passing `sleep` unconditionally is safe:
 * `withRetry`'s dense-schedule detection keys on `maxRetries` /
 * `initialDelayMs` / `maxDelayMs` / `isRetryable`, all of which this caller
 * already sets.
@@ -14447,13 +14508,14 @@ async function deleteTableWithIndexBusyRetry(opts) {
 				typeLabel: opts.typeLabel,
 				logicalId: opts.logicalId,
 				physicalId: opts.physicalId,
-				attemptNumber: deleteAttempts
+				attemptNumber: deleteAttempts,
+				maxRetries: opts.maxRetries
 			}));
 			await opts.reArm();
 		}
 		await opts.deleteTable();
 	}, opts.logicalId, {
-		maxRetries: 8,
+		maxRetries: opts.maxRetries,
 		isRetryable: (message) => isIndexBusyDeleteError(message),
 		logger: opts.logger,
 		sleep: (ms) => opts.sleepSeam.sleep ? opts.sleepSeam.sleep(ms) : new Promise((resolve) => setTimeout(resolve, ms))
@@ -14992,7 +15054,8 @@ function desiredIndexEntriesByName(value) {
 * Test seam for the index-busy `DeleteTable` retry's backoff (issue #1931),
 * mirroring the sibling provider's export of the same name. Production leaves
 * `sleep` undefined so `withRetry`'s real schedule applies; a test injects a
-* no-op so the ~47s budget does not have to be waited out.
+* no-op so the ~95s of backoff at this type's budget
+* (`TABLE_DELETE_INDEX_BUSY_MAX_RETRIES`) does not have to be waited out.
 *
 * One seam PER PROVIDER rather than one on the shared module: a `Table` test
 * that silences this backoff must not also silence the `GlobalTable` one, since
@@ -15210,7 +15273,7 @@ var DynamoDBTableProvider = class {
 				}
 				await this.dynamoDBClient.send(new UpdateTableCommand(updateInput));
 				if (billingMode !== liveBillingMode) await this.waitForTableAndIndexesActive(physicalId, BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS);
-				else await this.waitForTableActiveAfterUpdate(physicalId, TABLE_ACTIVE_WAIT_ATTEMPTS);
+				else await this.waitForTableActiveAfterUpdate(physicalId, 60);
 				this.logger.debug(`Updated BillingMode/ProvisionedThroughput/TableClass on DynamoDB table ${physicalId}`);
 			}
 			if (JSON.stringify(properties["OnDemandThroughput"]) !== JSON.stringify(previousProperties["OnDemandThroughput"])) {
@@ -15338,6 +15401,7 @@ var DynamoDBTableProvider = class {
 				logicalId,
 				physicalId,
 				typeLabel: "table",
+				maxRetries: 14,
 				logger: this.logger,
 				deleteTable: async () => {
 					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
@@ -15697,10 +15761,10 @@ var DynamoDBTableProvider = class {
 	* blanket raise would turn every genuinely wedged capacity edit into a
 	* 10-minute hang.
 	*/
-	async waitForTableActiveAfterUpdate(tableName, maxAttempts = TABLE_ACTIVE_WAIT_ATTEMPTS) {
+	async waitForTableActiveAfterUpdate(tableName, maxAttempts = 60) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 			if ((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.TableStatus === "ACTIVE") return;
-			await new Promise((resolve) => setTimeout(resolve, 1e3));
+			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 		}
 		throw new Error(`Table ${tableName} did not reach ACTIVE status within ${maxAttempts} seconds after UpdateTable`);
 	}
@@ -17783,6 +17847,7 @@ var DynamoDBGlobalTableProvider = class {
 				logicalId,
 				physicalId,
 				typeLabel: "GlobalTable",
+				maxRetries: 8,
 				logger: this.logger,
 				deleteTable: async () => {
 					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
@@ -18456,10 +18521,10 @@ var DynamoDBGlobalTableProvider = class {
 	* Delete replica update. Replica deletion typically takes 1–5 min;
 	* cap at 10 min.
 	*/
-	async waitForReplicaGone(tableName, region, logicalId, maxAttempts = 600) {
+	async waitForReplicaGone(tableName, region, logicalId, maxAttempts = REPLICA_GONE_WAIT_ATTEMPTS) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
 			if (!(await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.Replicas?.find((r) => r.RegionName === region)) return;
-			await new Promise((resolve) => setTimeout(resolve, 1e3));
+			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$1) return;
 			throw err;
@@ -18480,7 +18545,7 @@ var DynamoDBGlobalTableProvider = class {
 	async waitForTableGone(tableName, logicalId, maxAttempts = 600) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
 			await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
-			await new Promise((resolve) => setTimeout(resolve, 1e3));
+			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$1) return;
 			throw err;
@@ -18575,10 +18640,33 @@ function autoScalingResourceId(tableName, indexName) {
 */
 const autoScalingRetryDelays = {};
 /**
+* Polls `waitForReplicaGone` spends waiting for a replica to disappear.
+*
+* Named rather than inlined because it is a TERM of the per-resource deadline
+* arithmetic on this type's delete path (see
+* `GLOBAL_TABLE_DELETE_INDEX_BUSY_MAX_RETRIES`), which prices it through
+* {@link INDEX_SETTLE_POLL_INTERVAL_MS} — the sleep this loop now reads rather
+* than spelling its own `1000`, so the two cannot drift while that arithmetic
+* claims they agree.
+*/
+const REPLICA_GONE_WAIT_ATTEMPTS = 600;
+/**
+* Polls `waitForTableGone` spends confirming the table is actually gone.
+*
+* EXPORTED, unlike its replica sibling, because the delete-path budget fence
+* reads it: this wait runs AFTER the index-busy retry loop and only when that
+* loop SUCCEEDS, which is what keeps it out of the loop's own worst case and
+* puts it into the late-success one (both spelled out on
+* `GLOBAL_TABLE_DELETE_INDEX_BUSY_MAX_RETRIES`).
+*/
+const TABLE_GONE_WAIT_ATTEMPTS = 600;
+/**
 * Test seam for the index-busy `DeleteTable` retry's backoff (issue #1830),
 * mirroring {@link autoScalingRetryDelays}. Production leaves `sleep`
 * undefined so `withRetry`'s real schedule applies; a test injects a no-op so
-* the ~47s budget does not have to be waited out. Kept SEPARATE from the
+* the ~47s of backoff at this type's budget
+* (`GLOBAL_TABLE_DELETE_INDEX_BUSY_MAX_RETRIES`) does not have to be waited
+* out. Kept SEPARATE from the
 * auto-scaling seam so a test can slow one path without silencing the other.
 */
 const deleteTableRetryDelays = {};
@@ -38843,6 +38931,46 @@ const MFA_FACTOR_SMS = "SMS_MFA";
 const MFA_FACTOR_SOFTWARE_TOKEN = "SOFTWARE_TOKEN_MFA";
 const MFA_FACTOR_EMAIL_OTP = "EMAIL_OTP";
 /**
+* CFn path every `MfaConfiguration` shape refusal in this provider reports.
+* One constant so the three sites that READ the property -- `create`,
+* `update`, and `narrowMfaConfiguration` (the diff / effectiveProperties
+* side) -- cannot word the same fault differently. `buildMfaConfigRequest`
+* performs no read of its own; it is handed the already-guarded value.
+*/
+const MFA_CONFIGURATION_PATH = "AWS::Cognito::UserPool MfaConfiguration";
+function classifyDeclaredMfaConfiguration(raw) {
+	if (raw === void 0) return "absent";
+	if (typeof raw !== "string") return "refused";
+	return raw.trim() === "" ? "blank" : "usable";
+}
+/**
+* Read the template's `MfaConfiguration` through the shape guard AND fold a
+* TRIMMED-BLANK value to absence.
+*
+* The fold is the load-bearing half. `requireConfigString` short-circuits on
+* `fallback === '' && typeof value === 'string'` (config-shape.ts), so against
+* the blank fallback this site uses it returns ANY string verbatim --
+* including `'   '`. That value is truthy, so it rode the
+* `if (mfaConfiguration && ...)` gates onto `CreateUserPool` / `UpdateUserPool`
+* and the `|| default` in `buildMfaConfigRequest` onto `SetUserPoolMfaConfig`,
+* where AWS rejects the enum and the deploy fails -- while the blank-value
+* warning promised "the pool deploys with the default MFA configuration
+* instead". Two spellings of blank behaved differently and the message
+* described only one of them.
+*
+* Folding here rather than widening the guard keeps the change local to the
+* one site whose fallback is blank, and makes the wire behavior match what the
+* warning says: a blank declares nothing, so the default applies.
+*
+* Every read site MUST go through this, including `narrowMfaConfiguration` --
+* a diff side that folded differently from the wire is the phantom drift this
+* whole mechanism exists to remove.
+*/
+function readDeclaredMfaConfiguration(raw, options) {
+	const value = requireConfigString(raw, "", MFA_CONFIGURATION_PATH, options);
+	return value.trim() === "" ? "" : value;
+}
+/**
 * Read `EnabledMfas` as the pair (recognized list, "the template asked for a
 * factor at all").
 *
@@ -38866,14 +38994,16 @@ function readEnabledMfas(properties) {
 		return {
 			factors,
 			declaresFactor: factors.length > 0,
-			malformed: false
+			malformed: false,
+			blank: false
 		};
 	}
 	const malformed = raw !== void 0 && raw !== null && raw !== "";
 	return {
 		factors: void 0,
 		declaresFactor: malformed,
-		malformed
+		malformed,
+		blank: raw === ""
 	};
 }
 /**
@@ -38912,9 +39042,17 @@ function hasMfaConfigProps(properties) {
 * enables an MFA FACTOR — `OPTIONAL` if it does, `OFF` (CloudFormation's own
 * default) if it does not. The body comment on that decision explains why both
 * halves of the factor test are load-bearing.
+*
+* `declaredMfaConfiguration` is the caller's ALREADY-GUARDED read of
+* `properties['MfaConfiguration']` (issue #1925 item 2), with `''` meaning
+* "the template declared none, or declared a value the shape guard refused".
+* The read happens at the caller so it runs ONCE per deploy path — the value
+* is also needed for the `CreateUserPool` / `UpdateUserPool` forward — and so
+* the create path can REFUSE a malformed value while the update path only
+* warns, which is the split `requireConfigString`'s `onUnusable` encodes.
 */
-function buildMfaConfigRequest(physicalId, properties, logger) {
-	const { factors: enabledMfas, declaresFactor, malformed: enabledMfasMalformed } = readEnabledMfas(properties);
+function buildMfaConfigRequest(physicalId, properties, logger, declaredMfaConfiguration = "") {
+	const { factors: enabledMfas, declaresFactor, malformed: enabledMfasMalformed, blank: enabledMfasBlank } = readEnabledMfas(properties);
 	const emailMessage = properties["EmailAuthenticationMessage"] || void 0;
 	const emailSubject = properties["EmailAuthenticationSubject"] || void 0;
 	const webAuthnRpId = properties["WebAuthnRelyingPartyID"] || void 0;
@@ -38934,17 +39072,83 @@ function buildMfaConfigRequest(physicalId, properties, logger) {
 		...webAuthnUserVerification !== void 0 ? { UserVerification: webAuthnUserVerification } : {}
 	};
 	const enablesMfaFactor = declaresFactor || request.EmailMfaConfiguration !== void 0;
-	request.MfaConfiguration = properties["MfaConfiguration"] ?? (enablesMfaFactor ? "OPTIONAL" : "OFF");
+	request.MfaConfiguration = declaredMfaConfiguration || (enablesMfaFactor ? "OPTIONAL" : "OFF");
+	if (enabledMfasBlank) logger?.warn(`UserPool ${physicalId}: EnabledMfas is an empty string, which declares no MFA factor and is treated as absent — a mangled Fn::Join or an empty String parameter collapses to this shape. Nothing is enabled from it and MfaConfiguration is ${request.MfaConfiguration}; declare the factor names as a list (e.g. ["${MFA_FACTOR_SOFTWARE_TOKEN}"]) if a factor was intended.`);
+	const anyFactorBlock = request.SmsMfaConfiguration !== void 0 || request.SoftwareTokenMfaConfiguration !== void 0 || request.EmailMfaConfiguration !== void 0;
+	if (request.MfaConfiguration === "OFF" && anyFactorBlock) logger?.warn(`UserPool ${physicalId}: MfaConfiguration is pinned to OFF while an MFA factor block is configured. The factor configuration is still sent, but the pool deploys with MFA DISABLED. Remove MfaConfiguration (or set it to ON / OPTIONAL) to enable the declared factor.`);
 	const dropped = unrecognizedFactors.map((f) => JSON.stringify(f) ?? String(f));
 	if (enabledMfasMalformed) dropped.push(`${JSON.stringify(properties["EnabledMfas"])} (not a list)`);
 	if (dropped.length > 0) {
-		const anyFactorBlock = request.SmsMfaConfiguration !== void 0 || request.SoftwareTokenMfaConfiguration !== void 0 || request.EmailMfaConfiguration !== void 0;
 		const consequence = request.MfaConfiguration === "OFF" ? `MfaConfiguration is OFF, so this pool deploys with MFA DISABLED` : anyFactorBlock ? `MfaConfiguration is ${request.MfaConfiguration} and another factor block IS sent, so these entries are silently ignored rather than failing the call on their own` : `MfaConfiguration is ${request.MfaConfiguration} with no factor enabled, so AWS rejects this call rather than deploying the pool with MFA disabled`;
 		logger?.warn(`UserPool ${physicalId}: EnabledMfas entries ${dropped.join(", ")} do not map to an MFA factor block (known: ${MFA_FACTOR_SMS}, ${MFA_FACTOR_SOFTWARE_TOKEN}, ${MFA_FACTOR_EMAIL_OTP}); no factor is enabled from them. ${consequence}.`);
 	}
 	return request;
 }
 /**
+* The `MfaConfiguration` cdkd actually SENDS for this bag, or `undefined` when
+* no call carries the field at all (nothing declared and no MFA-routed
+* property, so AWS applies its own default of OFF).
+*
+* Exactly one call ever carries it: `SetUserPoolMfaConfig` owns it whenever any
+* MFA-routed property is present -- and always sets it, because that API is a
+* full replace -- otherwise the `CreateUserPool` / `UpdateUserPool` forward
+* carries it, and only when it is non-blank.
+*
+* Delegates to {@link buildMfaConfigRequest} rather than re-deriving the
+* OPTIONAL/OFF default, so the recorded value and the wire value cannot
+* disagree. That function is pure and synchronous, which is what lets
+* `canonicalizeDesiredProperties` -- which runs inside the diff -- call it too.
+* The empty `physicalId` and absent logger are unused on this path: every
+* message it can emit is behind `logger?.`, so passing none makes the call
+* silent, which is required of the diff side.
+*/
+function resolveSentMfaConfiguration(properties, declaredMfaConfiguration) {
+	const request = buildMfaConfigRequest("", properties, void 0, declaredMfaConfiguration);
+	if (request) return request.MfaConfiguration;
+	return declaredMfaConfiguration || void 0;
+}
+/**
+* Replace a DECLARED-but-unusable `MfaConfiguration` with the value cdkd
+* actually sends, or drop the key when nothing is sent. Returns the input
+* object unchanged when nothing applies, so the common case compares
+* byte-for-byte as before.
+*
+* ONE helper feeding BOTH sides of the decision, per `.claude/rules/
+* providers.md`: the provisioning path returns it as `effectiveProperties` so
+* STATE describes what AWS holds, and `canonicalizeDesiredProperties` applies
+* it to the DESIRED bag so the next diff compares the same thing. Shipping
+* only the first half is worse than shipping neither -- the template would keep
+* declaring the malformed value, and every later deploy would read the
+* narrowing back as a user-made change.
+*
+* Without this, all three substitution arms (the replay-CREATE downgrade, the
+* update-path warn-and-default, and the blank-string default) recorded the
+* declared `null` / `''` while AWS held `OPTIONAL` / `OFF` -- permanent phantom
+* drift that `cdkd drift --revert` re-issues forever with nothing to apply.
+*
+* A value that is merely ABSENT is deliberately NOT filled in. Reaching for
+* `effectiveProperties` is licensed only where the provider KNOWS it
+* substituted something it was told, and an omitted property was never a
+* declaration to contradict; writing the resolved default into the DESIRED
+* baseline there would also disable the #1160 absent-field removal derivation,
+* which reads that side.
+*/
+function narrowMfaConfiguration(properties) {
+	const raw = properties["MfaConfiguration"];
+	if (raw === void 0) return properties;
+	const sent = resolveSentMfaConfiguration(properties, readDeclaredMfaConfiguration(raw, { onUnusable: () => {} }));
+	if (sent === raw) return properties;
+	if (sent === void 0) {
+		const withoutMfaConfiguration = { ...properties };
+		delete withoutMfaConfiguration["MfaConfiguration"];
+		return withoutMfaConfiguration;
+	}
+	return {
+		...properties,
+		MfaConfiguration: sent
+	};
+}
+/**
 * AWS Cognito User Pool Provider
 *
 * Implements resource provisioning for AWS::Cognito::UserPool using the Cognito SDK.
@@ -38988,6 +39192,50 @@ var CognitoUserPoolProvider = class {
 		"WebAuthnUserVerification"
 	])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Map([["WebAuthnFactorConfiguration", "No SDK wire path: @aws-sdk/client-cognito-identity-provider has no field accepting SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION (not on CreateUserPool/UpdateUserPool, nor SetUserPoolMfaConfig.WebAuthnConfiguration which only carries RelyingPartyId/UserVerification); CC-API-registry-only property"]])]]);
+	/**
+	* Warn when `MfaConfiguration` is declared as a BLANK string (issue #1925
+	* item 2, review round 2).
+	*
+	* `requireConfigString` accepts any string against a blank fallback, so `''`
+	* passes the shape guard and is then substituted by the OPTIONAL/OFF default
+	* downstream. That is the exact silent-default class the guard exists to
+	* kill, reached one shape further in: on main a WebAuthn-only pool declaring
+	* `MfaConfiguration: ''` failed LOUDLY with an AWS enum rejection, and with
+	* the guard alone it would deploy MFA OFF with no message anywhere. A
+	* collapsed `Fn::Join` or an empty `String` parameter produces exactly this.
+	*
+	* The twin of the blank-`EnabledMfas` warning one property over, and warned
+	* for the same reason it is: the value stays absence ON THE WIRE (the
+	* substitution is what CloudFormation's own default does), so only the
+	* silence is removed.
+	*
+	* `.trim()` matches the fold in {@link readDeclaredMfaConfiguration}, and the
+	* two must agree: `requireConfigString` does NOT treat whitespace-only as
+	* blank against the blank fallback this site uses, so before that fold a
+	* `'   '` was warned about here and then sent to AWS verbatim -- this message
+	* describing a default that never applied.
+	*/
+	warnOnBlankMfaConfiguration(raw) {
+		if (typeof raw !== "string" || raw.trim() !== "") return;
+		this.logger.warn("AWS::Cognito::UserPool MfaConfiguration is an empty string, which declares no MFA mode and is treated as absent -- a collapsed Fn::Join or an empty String parameter produces this shape. The pool deploys with the default MFA configuration instead; declare ON / OPTIONAL / OFF explicitly, or omit the property, to say which was meant.");
+	}
+	/**
+	* The DIFF-side half of the `MfaConfiguration` substitution record.
+	*
+	* Applied by `DiffCalculator` to BOTH comparison sides, so a template that
+	* declares a malformed / blank `MfaConfiguration` compares equal to the state
+	* record holding the value cdkd actually sent for it. Without this half, the
+	* `effectiveProperties` above would make every later deploy read the
+	* substitution back as a user-made change and re-run the update forever.
+	*
+	* Shares ONE helper with the provisioning path rather than re-deriving the
+	* rule, per `.claude/rules/providers.md` -- state and template narrowed by
+	* different code is how this fix would become the bug.
+	*/
+	canonicalizeDesiredProperties(resourceType, properties) {
+		if (resourceType !== "AWS::Cognito::UserPool") return properties;
+		return narrowMfaConfiguration(properties);
+	}
 	getClient() {
 		if (!this.cognitoClient) this.cognitoClient = new CognitoIdentityProviderClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.cognitoClient;
@@ -39008,9 +39256,16 @@ var CognitoUserPoolProvider = class {
 	/**
 	* Create a Cognito User Pool
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Cognito User Pool ${logicalId}`);
 		const poolName = properties["UserPoolName"] || generateResourceName(logicalId, { maxLength: 128 });
+		let mfaConfiguration;
+		try {
+			mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], replayWarn(this.logger, context));
+			this.warnOnBlankMfaConfiguration(properties["MfaConfiguration"]);
+		} catch (error) {
+			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, poolName, error instanceof Error ? error : void 0);
+		}
 		let createdUserPoolId;
 		try {
 			const createParams = { PoolName: poolName };
@@ -39022,7 +39277,7 @@ var CognitoUserPoolProvider = class {
 			}
 			if (properties["Schema"]) createParams.Schema = properties["Schema"];
 			if (properties["LambdaConfig"]) createParams.LambdaConfig = properties["LambdaConfig"];
-			if (properties["MfaConfiguration"] && !hasMfaConfigProps(properties)) createParams.MfaConfiguration = properties["MfaConfiguration"];
+			if (mfaConfiguration && !hasMfaConfigProps(properties)) createParams.MfaConfiguration = mfaConfiguration;
 			if (properties["UserPoolTags"]) createParams.UserPoolTags = properties["UserPoolTags"];
 			if (properties["AdminCreateUserConfig"]) createParams.AdminCreateUserConfig = properties["AdminCreateUserConfig"];
 			if (properties["AccountRecoverySetting"]) createParams.AccountRecoverySetting = properties["AccountRecoverySetting"];
@@ -39049,8 +39304,9 @@ var CognitoUserPoolProvider = class {
 			const { urlSuffix } = derivePartitionAndUrlSuffix(region);
 			const providerName = `cognito-idp.${region}.${urlSuffix}/${userPoolId}`;
 			const providerUrl = `https://cognito-idp.${region}.${urlSuffix}/${userPoolId}`;
-			await this.applyMfaConfig(userPoolId, properties);
+			await this.applyMfaConfig(userPoolId, properties, mfaConfiguration);
 			this.logger.debug(`Successfully created Cognito User Pool ${logicalId}: ${userPoolId}`);
+			const effectiveProperties = narrowMfaConfiguration(properties);
 			return {
 				physicalId: userPoolId,
 				attributes: {
@@ -39058,7 +39314,8 @@ var CognitoUserPoolProvider = class {
 					ProviderName: providerName,
 					ProviderURL: providerUrl,
 					UserPoolId: userPoolId
-				}
+				},
+				...effectiveProperties !== properties ? { effectiveProperties } : {}
 			};
 		} catch (error) {
 			if (createdUserPoolId) try {
@@ -39078,10 +39335,109 @@ var CognitoUserPoolProvider = class {
 	* control-plane writes on a freshly-created pool can briefly conflict
 	* (mirrors DynamoDBTableProvider.retryOnTransientControlPlane).
 	*/
-	async applyMfaConfig(physicalId, properties) {
-		const request = buildMfaConfigRequest(physicalId, properties, this.logger);
+	async applyMfaConfig(physicalId, properties, declaredMfaConfiguration, options = {}) {
+		const request = buildMfaConfigRequest(physicalId, properties, this.logger, declaredMfaConfiguration);
 		if (!request) return;
 		await this.retryOnTransientControlPlane(() => this.getClient().send(new SetUserPoolMfaConfigCommand(request)), `SetUserPoolMfaConfig(${physicalId})`);
+		this.reportMfaConfigurationOff(physicalId, request, declaredMfaConfiguration, options);
+	}
+	/**
+	* Say so when this deploy sends `MfaConfiguration=OFF` without the template
+	* having asked for OFF (issue #1925, third item).
+	*
+	* Everything here keys on the BUILT request, so there is exactly one
+	* definition of "this deploy resolves to OFF", and on `declaredMfaConfiguration
+	* === ''`, i.e. the template did not pin a usable value. `create()` passes
+	* neither a live value nor a `declaredKind`, so it reports nothing -- correct,
+	* since a fresh pool has no value to downgrade.
+	*
+	* Three outcomes rather than one, because the live value can be KNOWN,
+	* known-and-harmless, or UNAVAILABLE, and only the first is a downgrade that
+	* can be named:
+	*
+	*  - live `ON` / `OPTIONAL` -- a real downgrade; name the value being lost.
+	*  - live `OFF` -- not a downgrade at all; say nothing. This is the arm the
+	*    live-value test protects, and it is load-bearing in the SILENT
+	*    direction: without it every already-OFF pool and every failed probe
+	*    warned, the latter reading `live value was undefined`.
+	*  - live UNKNOWN (the probe failed) -- the case that made this necessary.
+	*    A malformed but TRUTHY value used to reach `UpdateUserPool`, AWS
+	*    rejected the enum, MFA stayed as it was and the deploy failed; now the
+	*    guard substitutes and the deploy exits 0 with MFA off. On a role lacking
+	*    `cognito-idp:GetUserPoolMfaConfig` -- exactly the role this arm exists
+	*    for -- the probe returns nothing, so without this the ONLY path that got
+	*    quieter than main would say nothing at all.
+	*/
+	reportMfaConfigurationOff(physicalId, request, declaredMfaConfiguration, options) {
+		if (declaredMfaConfiguration !== "" || request.MfaConfiguration !== "OFF") return;
+		const kind = options.declaredKind ?? "absent";
+		const cause = kind === "refused" ? "the declared MfaConfiguration was refused as malformed (see the warning above), so this update sent MfaConfiguration=OFF instead" : kind === "blank" ? "the declared MfaConfiguration is blank, so it is treated as absent and this update sent MfaConfiguration=OFF" : "the template declares no MfaConfiguration, so this update sent MfaConfiguration=OFF (CloudFormation's own default)";
+		const remedy = (value) => kind === "absent" ? `Declare MfaConfiguration: ${value} in the template to keep it.` : `Repair MfaConfiguration to a literal ${value} to keep it.`;
+		if (options.liveMfaConfiguration === "ON" || options.liveMfaConfiguration === "OPTIONAL") {
+			this.logger.warn(`UserPool ${physicalId}: ${cause} to a pool whose live value was ${options.liveMfaConfiguration} — SetUserPoolMfaConfig is a full replace, so MFA is now OFF. ${remedy(options.liveMfaConfiguration)}`);
+			return;
+		}
+		if (options.liveReadFailed !== true) return;
+		const declaredClause = kind === "absent" ? `the template declares no MfaConfiguration` : `the declared MfaConfiguration could not be used`;
+		this.logger.warn(`UserPool ${physicalId}: ${declaredClause}, so this update sent MfaConfiguration=OFF — and the pool's previous MFA setting could not be read, so cdkd cannot say whether that turned MFA off. Grant cognito-idp:GetUserPoolMfaConfig to the deploy role to have this reported precisely. ${remedy("ON or OPTIONAL")}`);
+	}
+	/**
+	* Read the pool's live `MfaConfiguration` for the undeclared-downgrade
+	* announcement (issue #1925, third item), or `undefined` when it cannot be
+	* determined.
+	*
+	* `SetUserPoolMfaConfig` is a full replace and this provider re-issues it on
+	* every update carrying an MFA-routed property, unconditioned on the MFA
+	* configuration having CHANGED. So a WebAuthn-only template applied to a pool
+	* whose live `MfaConfiguration` is `ON` / `OPTIONAL` — console drift, or a
+	* `cdkd import` of an MFA-enabled pool — writes `OFF` on the next unrelated
+	* property change. That is defensible template-is-truth / CloudFormation
+	* parity and is NOT changed here; only its silence is.
+	*
+	* **Called BEFORE `UpdateUserPool`, defensively — NOT because AWS resets the
+	* field.** MEASURED us-east-1 2026-08-18: a pool at `ON` with software-token
+	* enabled keeps `ON` through an `UpdateUserPool` that omits
+	* `MfaConfiguration`, confirmed by both `get-user-pool-mfa-config` and
+	* `describe-user-pool`, with controls proving the call really ran (a
+	* `--auto-verified-attributes` change in the same request applied) and that
+	* the field is writable here rather than ignored (an explicit
+	* `--mfa-configuration OFF` did reset it). So AWS's blanket "unspecified
+	* parameters are set to their default value" holds field by field —
+	* `AutoVerifiedAttributes` DOES reset, `MfaConfiguration` does not — and
+	* there is no MFA-OFF window to design around.
+	*
+	* The earlier ordering was reached from that doc sentence alone and is kept
+	* only because it is strictly safer and already tested: reading first cannot
+	* report a value this same call clobbered, whatever AWS does later. Do not
+	* re-derive a redesign from the doc sentence — it has been measured.
+	*
+	* Best-effort by construction: the read exists only to ANNOUNCE, so a
+	* failure must not fail the update the user asked for.
+	*
+	* **This adds `cognito-idp:GetUserPoolMfaConfig` to the permissions a deploy
+	* role wants.** The action was previously needed only by `readCurrentState`
+	* (drift / import), so a role scoped to deploying could legitimately lack it.
+	*
+	* A failure is REPORTED rather than swallowed, but not here: this method's
+	* gate is a deliberate SUPERSET of the announcement condition (see the call
+	* site in `update()`), so warning at the point of failure fired on templates
+	* that structurally cannot downgrade -- an `EnabledMfas` with no
+	* `MfaConfiguration` resolves to OPTIONAL, and a least-privileged role saw
+	* "cdkd cannot say whether it turns MFA off" on every deploy of it. The flag
+	* returned here is consumed by `reportMfaConfigurationOff`, which speaks only
+	* where the request actually resolves to OFF.
+	*/
+	async readLiveMfaConfiguration(physicalId) {
+		try {
+			const live = await this.getClient().send(new GetUserPoolMfaConfigCommand({ UserPoolId: physicalId }));
+			return live.MfaConfiguration !== void 0 ? {
+				value: live.MfaConfiguration,
+				failed: false
+			} : { failed: false };
+		} catch (error) {
+			this.logger.debug(`GetUserPoolMfaConfig failed for UserPool ${physicalId} (${error instanceof Error ? error.name : typeof error}): ${error instanceof Error ? error.message : String(error)}`);
+			return { failed: true };
+		}
 	}
 	/**
 	* Retry a Cognito control-plane call on transient "settling" errors. A
@@ -39111,6 +39467,9 @@ var CognitoUserPoolProvider = class {
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Cognito User Pool ${logicalId}: ${physicalId}`);
+		const mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], { onUnusable: (message) => this.logger.warn(message) });
+		this.warnOnBlankMfaConfiguration(properties["MfaConfiguration"]);
+		const liveMfa = mfaConfiguration === "" && hasMfaConfigProps(properties) ? await this.readLiveMfaConfiguration(physicalId) : void 0;
 		try {
 			const updateParams = { UserPoolId: physicalId };
 			if (properties["Policies"]) {
@@ -39119,7 +39478,7 @@ var CognitoUserPoolProvider = class {
 			}
 			if (properties["LambdaConfig"]) updateParams.LambdaConfig = properties["LambdaConfig"];
 			if (properties["AutoVerifiedAttributes"]) updateParams.AutoVerifiedAttributes = properties["AutoVerifiedAttributes"];
-			if (properties["MfaConfiguration"]) updateParams.MfaConfiguration = properties["MfaConfiguration"];
+			if (mfaConfiguration && !hasMfaConfigProps(properties)) updateParams.MfaConfiguration = mfaConfiguration;
 			if (properties["AdminCreateUserConfig"]) updateParams.AdminCreateUserConfig = properties["AdminCreateUserConfig"];
 			if (properties["AccountRecoverySetting"]) updateParams.AccountRecoverySetting = properties["AccountRecoverySetting"];
 			if (properties["UserPoolTags"]) updateParams.UserPoolTags = properties["UserPoolTags"];
@@ -39137,13 +39496,18 @@ var CognitoUserPoolProvider = class {
 			if (properties["UserPoolTier"]) updateParams.UserPoolTier = properties["UserPoolTier"];
 			await this.getClient().send(new UpdateUserPoolCommand(updateParams));
 			await this.reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, properties["Schema"], previousProperties["Schema"]);
-			await this.applyMfaConfig(physicalId, properties);
+			await this.applyMfaConfig(physicalId, properties, mfaConfiguration, {
+				...liveMfa?.value !== void 0 ? { liveMfaConfiguration: liveMfa.value } : {},
+				...liveMfa?.failed === true ? { liveReadFailed: true } : {},
+				declaredKind: classifyDeclaredMfaConfiguration(properties["MfaConfiguration"])
+			});
 			this.logger.debug(`Successfully updated Cognito User Pool ${logicalId}`);
 			const userPool = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool;
 			const region = await this.getClient().config.region();
 			const { urlSuffix } = derivePartitionAndUrlSuffix(region);
 			const providerName = `cognito-idp.${region}.${urlSuffix}/${physicalId}`;
 			const providerUrl = `https://cognito-idp.${region}.${urlSuffix}/${physicalId}`;
+			const effectiveProperties = narrowMfaConfiguration(properties);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -39152,7 +39516,8 @@ var CognitoUserPoolProvider = class {
 					ProviderName: providerName,
 					ProviderURL: providerUrl,
 					UserPoolId: physicalId
-				}
+				},
+				...effectiveProperties !== properties ? { effectiveProperties } : {}
 			};
 		} catch (error) {
 			if (error instanceof ResourceUpdateNotSupportedError || error instanceof ProvisioningError) throw error;
@@ -80881,7 +81246,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.33");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.35");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;