@go-to-k/cdkd 0.283.34 → 0.283.36

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as getAccountInfo, $t as formatDockerLoginError, A as cyan, An as resolveBucketRegion, At as TemplateParser, B as stateKeySecretExposure, Bn as LocalInvokeBuildError$1, Bt as loadPublishableAssetManifest, C as makeCanonicalizePropertiesFn, Cn as expectedOwnerParam, Ct as s3BucketWebsiteUrl, D as renderStatefulReason, Dn as AssemblyReader, Dt as describeTypeWithThrottleRetry, E as isStatefulRecreateTargetSync, En as derivePartitionAndUrlSuffix, Et as INTRINSIC_KEYS, F as collectDeclaredOutputNames, Ft as AssetPublisher, G as findActionableSilentDrops, Gn as NestedStackChildDirectDestroyError, Gt as BOOTSTRAP_MARKER_PREFIX, H as collectInlinePolicyNamesManagedBySiblings, Hn as LocalStartServiceError, Ht as escapeRegExp, I as collectPublishedOutputNames, In as CdkdError, It as stringifyValue, J as slowCcOperationTimeoutMs, Jn as ResourceTimeoutError, Jt as parseBootstrapMarker, K as findSilentDropProperties, Kn as PartialFailureError, Kt as ensureAssetStorage, L as exportAliasCollisionScrubWarning, Lt as WorkGraph, M as green, Mn as getAwsClients, Mt as S3StateBackend, N as red, Nn as resetAwsClients, Nt as rebuildClientForBucketRegion, O as formatResourceLine, On as processStackMessages, Ot as withRetry, P as yellow, Pn as setAwsClients, Pt as shouldRetainResource, Q as cfnRefValueFromPhysicalId, Qt as buildDockerImage, R as isExportAliasCollision, Rt as buildAssetRedirectMap, S as unsupportedFinalSnapshotError, Sn as uploadCfnTemplate, St as s3BucketRegionalDomainName, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as canonicalizeRegion, Tt as DiffCalculator, U as clearOnUpdateRemoval, Ut as stripControlChars, V as IAMRoleProvider, Vn as LocalMigrateError, Vt as rewriteTemplateAssetReferences, W as ProviderRegistry, Wn as MissingCdkCliError, Wt as AssetModeResolver, X as isTerminationProtectionPropagationError, Xn as StackHasActiveImportsError, Xt as validateContainerRepoName, Y as disableInstanceApiTermination, Yn as ResourceUpdateNotSupportedError, Yt as validateAssetBucketName, Z as IntrinsicFunctionResolver, Zn as StackTerminationProtectionError, Zt as buildDenyExternalAccessPolicy, _ as buildFinalSnapshotIdentifier, _n as warnDeprecatedNoPrefixCliFlag, _t as redactSecretsForState, a as DeploymentEventsStore, an as Synthesizer, ar as isRetryableTransientError, at as coerceCfnBoolean, b as isFinalSnapshotError, bn as MIGRATE_TMP_PREFIX, bt as s3BucketDomainName, c as replayFailedOperations, cn as getLegacyStateBucketName, ct as readConfigString, d as deleteSkipReason, dn as resolveCaptureObservedState, dt as requireConfigObject, en as getDockerCmd, et as refStateLookupFromResource, f as withResourceDeadline, fn as resolveSkipPrefix, ft as requireConfigString, g as PRE_DELETE_SNAPSHOT_TYPES, gn as stateBucketExistenceConfirmed, gt as maskSecretsInText, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as resolveUseCdkBootstrapAssets, ht as TEMPLATE_SOURCED_RULES, i as DeploymentEventsReader, in as getDockerImageBySourceHash, ir as isMarkedNonRetryable, it as assertRegionMatch, j as gray, jn as AwsClients, jt as LockManager, k as bold, kt as DagBuilder, l as replayRollback, ln as resolveApp, lt as replayWarn, m as computeImplicitDeleteEdges, mn as resolveStateBucketWithDefaultAndSource, mt as STATE_SOURCED_READBACK_RULES, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as runDockerStreaming, nr as normalizeAwsError, nt as normalizeAwsTagsToCfn, o as planFailedOps, on as synthesisStatusMessage, or as isThrottlingError, ot as configBooleanRefusal, p as IMPLICIT_DELETE_DEPENDENCIES, pn as resolveStateBucketWithDefault, pt as STATE_SOURCED_CROSS_GENERATION_RULES, q as CloudControlProvider, qn as ProvisioningError, qt as getBootstrapMarkerKey, r as DeployEngine, rn as AssetManifestLoader, rr as withErrorHandling, rt as resolveExplicitPhysicalId, s as planRollback, sn as getDefaultStateBucketName, sr as markNonRetryable, st as configStringRefusal, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as runDockerForeground, tt as WAFv2WebACLProvider, u as UNSPECIFIED_SKIP_REASON, un as resolveAutoAssetStorage, ut as requireConfigArray, v as ccRoutedFinalSnapshotError, vn as CFN_TEMPLATE_BODY_LIMIT, vt as scrubResourceRecord, w as extractDeploymentEventError, wn as PARTITION_TABLE, wt as applyRoleArnIfSet, x as refusesFinalSnapshot, xn as findLargeInlineResources, xt as s3BucketDualStackDomainName, y as createPreDeleteFinalSnapshot, yn as CFN_TEMPLATE_URL_LIMIT, yt as s3BucketArn, z as secretBearingStateKeyWarning, zn as DeployCancelledError, zt as createAssetRedirectResolver } from "./deploy-engine-DlEg9thJ.js";
+import { $ as getAccountInfo, $t as formatDockerLoginError, A as cyan, An as resolveBucketRegion, At as TemplateParser, B as stateKeySecretExposure, Bn as LocalInvokeBuildError$1, Bt as loadPublishableAssetManifest, C as makeCanonicalizePropertiesFn, Cn as expectedOwnerParam, Ct as s3BucketWebsiteUrl, D as renderStatefulReason, Dn as AssemblyReader, Dt as describeTypeWithThrottleRetry, E as isStatefulRecreateTargetSync, En as derivePartitionAndUrlSuffix, Et as INTRINSIC_KEYS, F as collectDeclaredOutputNames, Ft as AssetPublisher, G as findActionableSilentDrops, Gn as NestedStackChildDirectDestroyError, Gt as BOOTSTRAP_MARKER_PREFIX, H as collectInlinePolicyNamesManagedBySiblings, Hn as LocalStartServiceError, Ht as escapeRegExp, I as collectPublishedOutputNames, In as CdkdError, It as stringifyValue, J as slowCcOperationTimeoutMs, Jn as ResourceTimeoutError, Jt as parseBootstrapMarker, K as findSilentDropProperties, Kn as PartialFailureError, Kt as ensureAssetStorage, L as exportAliasCollisionScrubWarning, Lt as WorkGraph, M as green, Mn as getAwsClients, Mt as S3StateBackend, N as red, Nn as resetAwsClients, Nt as rebuildClientForBucketRegion, O as formatResourceLine, On as processStackMessages, Ot as withRetry, P as yellow, Pn as setAwsClients, Pt as shouldRetainResource, Q as cfnRefValueFromPhysicalId, Qt as buildDockerImage, R as isExportAliasCollision, Rt as buildAssetRedirectMap, S as unsupportedFinalSnapshotError, Sn as uploadCfnTemplate, St as s3BucketRegionalDomainName, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as canonicalizeRegion, Tt as DiffCalculator, U as clearOnUpdateRemoval, Ut as stripControlChars, V as IAMRoleProvider, Vn as LocalMigrateError, Vt as rewriteTemplateAssetReferences, W as ProviderRegistry, Wn as MissingCdkCliError, Wt as AssetModeResolver, X as isTerminationProtectionPropagationError, Xn as StackHasActiveImportsError, Xt as validateContainerRepoName, Y as disableInstanceApiTermination, Yn as ResourceUpdateNotSupportedError, Yt as validateAssetBucketName, Z as IntrinsicFunctionResolver, Zn as StackTerminationProtectionError, Zt as buildDenyExternalAccessPolicy, _ as buildFinalSnapshotIdentifier, _n as warnDeprecatedNoPrefixCliFlag, _t as redactSecretsForState, a as DeploymentEventsStore, an as Synthesizer, ar as isRetryableTransientError, at as coerceCfnBoolean, b as isFinalSnapshotError, bn as MIGRATE_TMP_PREFIX, bt as s3BucketDomainName, c as replayFailedOperations, cn as getLegacyStateBucketName, ct as readConfigString, d as deleteSkipReason, dn as resolveCaptureObservedState, dt as requireConfigObject, en as getDockerCmd, et as refStateLookupFromResource, f as withResourceDeadline, fn as resolveSkipPrefix, ft as requireConfigString, g as PRE_DELETE_SNAPSHOT_TYPES, gn as stateBucketExistenceConfirmed, gt as maskSecretsInText, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as resolveUseCdkBootstrapAssets, ht as TEMPLATE_SOURCED_RULES, i as DeploymentEventsReader, in as getDockerImageBySourceHash, ir as isMarkedNonRetryable, it as assertRegionMatch, j as gray, jn as AwsClients, jt as LockManager, k as bold, kt as DagBuilder, l as replayRollback, ln as resolveApp, lt as replayWarn, m as computeImplicitDeleteEdges, mn as resolveStateBucketWithDefaultAndSource, mt as STATE_SOURCED_READBACK_RULES, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as runDockerStreaming, nr as normalizeAwsError, nt as normalizeAwsTagsToCfn, o as planFailedOps, on as synthesisStatusMessage, or as isThrottlingError, ot as configBooleanRefusal, p as IMPLICIT_DELETE_DEPENDENCIES, pn as resolveStateBucketWithDefault, pt as STATE_SOURCED_CROSS_GENERATION_RULES, q as CloudControlProvider, qn as ProvisioningError, qt as getBootstrapMarkerKey, r as DeployEngine, rn as AssetManifestLoader, rr as withErrorHandling, rt as resolveExplicitPhysicalId, s as planRollback, sn as getDefaultStateBucketName, sr as markNonRetryable, st as configStringRefusal, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as runDockerForeground, tt as WAFv2WebACLProvider, u as UNSPECIFIED_SKIP_REASON, un as resolveAutoAssetStorage, ut as requireConfigArray, v as ccRoutedFinalSnapshotError, vn as CFN_TEMPLATE_BODY_LIMIT, vt as scrubResourceRecord, w as extractDeploymentEventError, wn as PARTITION_TABLE, wt as applyRoleArnIfSet, x as refusesFinalSnapshot, xn as findLargeInlineResources, xt as s3BucketDualStackDomainName, y as createPreDeleteFinalSnapshot, yn as CFN_TEMPLATE_URL_LIMIT, yt as s3BucketArn, z as secretBearingStateKeyWarning, zn as DeployCancelledError, zt as createAssetRedirectResolver } from "./deploy-engine-Bhq_JPCc.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-B1AQpZfU.js";
+import { t as ASGProvider } from "./asg-provider-BruE_3F2.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -38931,6 +38931,46 @@ const MFA_FACTOR_SMS = "SMS_MFA";
 const MFA_FACTOR_SOFTWARE_TOKEN = "SOFTWARE_TOKEN_MFA";
 const MFA_FACTOR_EMAIL_OTP = "EMAIL_OTP";
 /**
+* CFn path every `MfaConfiguration` shape refusal in this provider reports.
+* One constant so the three sites that READ the property -- `create`,
+* `update`, and `narrowMfaConfiguration` (the diff / effectiveProperties
+* side) -- cannot word the same fault differently. `buildMfaConfigRequest`
+* performs no read of its own; it is handed the already-guarded value.
+*/
+const MFA_CONFIGURATION_PATH = "AWS::Cognito::UserPool MfaConfiguration";
+function classifyDeclaredMfaConfiguration(raw) {
+	if (raw === void 0) return "absent";
+	if (typeof raw !== "string") return "refused";
+	return raw.trim() === "" ? "blank" : "usable";
+}
+/**
+* Read the template's `MfaConfiguration` through the shape guard AND fold a
+* TRIMMED-BLANK value to absence.
+*
+* The fold is the load-bearing half. `requireConfigString` short-circuits on
+* `fallback === '' && typeof value === 'string'` (config-shape.ts), so against
+* the blank fallback this site uses it returns ANY string verbatim --
+* including `'   '`. That value is truthy, so it rode the
+* `if (mfaConfiguration && ...)` gates onto `CreateUserPool` / `UpdateUserPool`
+* and the `|| default` in `buildMfaConfigRequest` onto `SetUserPoolMfaConfig`,
+* where AWS rejects the enum and the deploy fails -- while the blank-value
+* warning promised "the pool deploys with the default MFA configuration
+* instead". Two spellings of blank behaved differently and the message
+* described only one of them.
+*
+* Folding here rather than widening the guard keeps the change local to the
+* one site whose fallback is blank, and makes the wire behavior match what the
+* warning says: a blank declares nothing, so the default applies.
+*
+* Every read site MUST go through this, including `narrowMfaConfiguration` --
+* a diff side that folded differently from the wire is the phantom drift this
+* whole mechanism exists to remove.
+*/
+function readDeclaredMfaConfiguration(raw, options) {
+	const value = requireConfigString(raw, "", MFA_CONFIGURATION_PATH, options);
+	return value.trim() === "" ? "" : value;
+}
+/**
 * Read `EnabledMfas` as the pair (recognized list, "the template asked for a
 * factor at all").
 *
@@ -38954,14 +38994,16 @@ function readEnabledMfas(properties) {
 		return {
 			factors,
 			declaresFactor: factors.length > 0,
-			malformed: false
+			malformed: false,
+			blank: false
 		};
 	}
 	const malformed = raw !== void 0 && raw !== null && raw !== "";
 	return {
 		factors: void 0,
 		declaresFactor: malformed,
-		malformed
+		malformed,
+		blank: raw === ""
 	};
 }
 /**
@@ -39000,9 +39042,17 @@ function hasMfaConfigProps(properties) {
 * enables an MFA FACTOR — `OPTIONAL` if it does, `OFF` (CloudFormation's own
 * default) if it does not. The body comment on that decision explains why both
 * halves of the factor test are load-bearing.
+*
+* `declaredMfaConfiguration` is the caller's ALREADY-GUARDED read of
+* `properties['MfaConfiguration']` (issue #1925 item 2), with `''` meaning
+* "the template declared none, or declared a value the shape guard refused".
+* The read happens at the caller so it runs ONCE per deploy path — the value
+* is also needed for the `CreateUserPool` / `UpdateUserPool` forward — and so
+* the create path can REFUSE a malformed value while the update path only
+* warns, which is the split `requireConfigString`'s `onUnusable` encodes.
 */
-function buildMfaConfigRequest(physicalId, properties, logger) {
-	const { factors: enabledMfas, declaresFactor, malformed: enabledMfasMalformed } = readEnabledMfas(properties);
+function buildMfaConfigRequest(physicalId, properties, logger, declaredMfaConfiguration = "") {
+	const { factors: enabledMfas, declaresFactor, malformed: enabledMfasMalformed, blank: enabledMfasBlank } = readEnabledMfas(properties);
 	const emailMessage = properties["EmailAuthenticationMessage"] || void 0;
 	const emailSubject = properties["EmailAuthenticationSubject"] || void 0;
 	const webAuthnRpId = properties["WebAuthnRelyingPartyID"] || void 0;
@@ -39022,17 +39072,83 @@ function buildMfaConfigRequest(physicalId, properties, logger) {
 		...webAuthnUserVerification !== void 0 ? { UserVerification: webAuthnUserVerification } : {}
 	};
 	const enablesMfaFactor = declaresFactor || request.EmailMfaConfiguration !== void 0;
-	request.MfaConfiguration = properties["MfaConfiguration"] ?? (enablesMfaFactor ? "OPTIONAL" : "OFF");
+	request.MfaConfiguration = declaredMfaConfiguration || (enablesMfaFactor ? "OPTIONAL" : "OFF");
+	if (enabledMfasBlank) logger?.warn(`UserPool ${physicalId}: EnabledMfas is an empty string, which declares no MFA factor and is treated as absent — a mangled Fn::Join or an empty String parameter collapses to this shape. Nothing is enabled from it and MfaConfiguration is ${request.MfaConfiguration}; declare the factor names as a list (e.g. ["${MFA_FACTOR_SOFTWARE_TOKEN}"]) if a factor was intended.`);
+	const anyFactorBlock = request.SmsMfaConfiguration !== void 0 || request.SoftwareTokenMfaConfiguration !== void 0 || request.EmailMfaConfiguration !== void 0;
+	if (request.MfaConfiguration === "OFF" && anyFactorBlock) logger?.warn(`UserPool ${physicalId}: MfaConfiguration is pinned to OFF while an MFA factor block is configured. The factor configuration is still sent, but the pool deploys with MFA DISABLED. Remove MfaConfiguration (or set it to ON / OPTIONAL) to enable the declared factor.`);
 	const dropped = unrecognizedFactors.map((f) => JSON.stringify(f) ?? String(f));
 	if (enabledMfasMalformed) dropped.push(`${JSON.stringify(properties["EnabledMfas"])} (not a list)`);
 	if (dropped.length > 0) {
-		const anyFactorBlock = request.SmsMfaConfiguration !== void 0 || request.SoftwareTokenMfaConfiguration !== void 0 || request.EmailMfaConfiguration !== void 0;
 		const consequence = request.MfaConfiguration === "OFF" ? `MfaConfiguration is OFF, so this pool deploys with MFA DISABLED` : anyFactorBlock ? `MfaConfiguration is ${request.MfaConfiguration} and another factor block IS sent, so these entries are silently ignored rather than failing the call on their own` : `MfaConfiguration is ${request.MfaConfiguration} with no factor enabled, so AWS rejects this call rather than deploying the pool with MFA disabled`;
 		logger?.warn(`UserPool ${physicalId}: EnabledMfas entries ${dropped.join(", ")} do not map to an MFA factor block (known: ${MFA_FACTOR_SMS}, ${MFA_FACTOR_SOFTWARE_TOKEN}, ${MFA_FACTOR_EMAIL_OTP}); no factor is enabled from them. ${consequence}.`);
 	}
 	return request;
 }
 /**
+* The `MfaConfiguration` cdkd actually SENDS for this bag, or `undefined` when
+* no call carries the field at all (nothing declared and no MFA-routed
+* property, so AWS applies its own default of OFF).
+*
+* Exactly one call ever carries it: `SetUserPoolMfaConfig` owns it whenever any
+* MFA-routed property is present -- and always sets it, because that API is a
+* full replace -- otherwise the `CreateUserPool` / `UpdateUserPool` forward
+* carries it, and only when it is non-blank.
+*
+* Delegates to {@link buildMfaConfigRequest} rather than re-deriving the
+* OPTIONAL/OFF default, so the recorded value and the wire value cannot
+* disagree. That function is pure and synchronous, which is what lets
+* `canonicalizeDesiredProperties` -- which runs inside the diff -- call it too.
+* The empty `physicalId` and absent logger are unused on this path: every
+* message it can emit is behind `logger?.`, so passing none makes the call
+* silent, which is required of the diff side.
+*/
+function resolveSentMfaConfiguration(properties, declaredMfaConfiguration) {
+	const request = buildMfaConfigRequest("", properties, void 0, declaredMfaConfiguration);
+	if (request) return request.MfaConfiguration;
+	return declaredMfaConfiguration || void 0;
+}
+/**
+* Replace a DECLARED-but-unusable `MfaConfiguration` with the value cdkd
+* actually sends, or drop the key when nothing is sent. Returns the input
+* object unchanged when nothing applies, so the common case compares
+* byte-for-byte as before.
+*
+* ONE helper feeding BOTH sides of the decision, per `.claude/rules/
+* providers.md`: the provisioning path returns it as `effectiveProperties` so
+* STATE describes what AWS holds, and `canonicalizeDesiredProperties` applies
+* it to the DESIRED bag so the next diff compares the same thing. Shipping
+* only the first half is worse than shipping neither -- the template would keep
+* declaring the malformed value, and every later deploy would read the
+* narrowing back as a user-made change.
+*
+* Without this, all three substitution arms (the replay-CREATE downgrade, the
+* update-path warn-and-default, and the blank-string default) recorded the
+* declared `null` / `''` while AWS held `OPTIONAL` / `OFF` -- permanent phantom
+* drift that `cdkd drift --revert` re-issues forever with nothing to apply.
+*
+* A value that is merely ABSENT is deliberately NOT filled in. Reaching for
+* `effectiveProperties` is licensed only where the provider KNOWS it
+* substituted something it was told, and an omitted property was never a
+* declaration to contradict; writing the resolved default into the DESIRED
+* baseline there would also disable the #1160 absent-field removal derivation,
+* which reads that side.
+*/
+function narrowMfaConfiguration(properties) {
+	const raw = properties["MfaConfiguration"];
+	if (raw === void 0) return properties;
+	const sent = resolveSentMfaConfiguration(properties, readDeclaredMfaConfiguration(raw, { onUnusable: () => {} }));
+	if (sent === raw) return properties;
+	if (sent === void 0) {
+		const withoutMfaConfiguration = { ...properties };
+		delete withoutMfaConfiguration["MfaConfiguration"];
+		return withoutMfaConfiguration;
+	}
+	return {
+		...properties,
+		MfaConfiguration: sent
+	};
+}
+/**
 * AWS Cognito User Pool Provider
 *
 * Implements resource provisioning for AWS::Cognito::UserPool using the Cognito SDK.
@@ -39076,6 +39192,50 @@ var CognitoUserPoolProvider = class {
 		"WebAuthnUserVerification"
 	])]]);
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Map([["WebAuthnFactorConfiguration", "No SDK wire path: @aws-sdk/client-cognito-identity-provider has no field accepting SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION (not on CreateUserPool/UpdateUserPool, nor SetUserPoolMfaConfig.WebAuthnConfiguration which only carries RelyingPartyId/UserVerification); CC-API-registry-only property"]])]]);
+	/**
+	* Warn when `MfaConfiguration` is declared as a BLANK string (issue #1925
+	* item 2, review round 2).
+	*
+	* `requireConfigString` accepts any string against a blank fallback, so `''`
+	* passes the shape guard and is then substituted by the OPTIONAL/OFF default
+	* downstream. That is the exact silent-default class the guard exists to
+	* kill, reached one shape further in: on main a WebAuthn-only pool declaring
+	* `MfaConfiguration: ''` failed LOUDLY with an AWS enum rejection, and with
+	* the guard alone it would deploy MFA OFF with no message anywhere. A
+	* collapsed `Fn::Join` or an empty `String` parameter produces exactly this.
+	*
+	* The twin of the blank-`EnabledMfas` warning one property over, and warned
+	* for the same reason it is: the value stays absence ON THE WIRE (the
+	* substitution is what CloudFormation's own default does), so only the
+	* silence is removed.
+	*
+	* `.trim()` matches the fold in {@link readDeclaredMfaConfiguration}, and the
+	* two must agree: `requireConfigString` does NOT treat whitespace-only as
+	* blank against the blank fallback this site uses, so before that fold a
+	* `'   '` was warned about here and then sent to AWS verbatim -- this message
+	* describing a default that never applied.
+	*/
+	warnOnBlankMfaConfiguration(raw) {
+		if (typeof raw !== "string" || raw.trim() !== "") return;
+		this.logger.warn("AWS::Cognito::UserPool MfaConfiguration is an empty string, which declares no MFA mode and is treated as absent -- a collapsed Fn::Join or an empty String parameter produces this shape. The pool deploys with the default MFA configuration instead; declare ON / OPTIONAL / OFF explicitly, or omit the property, to say which was meant.");
+	}
+	/**
+	* The DIFF-side half of the `MfaConfiguration` substitution record.
+	*
+	* Applied by `DiffCalculator` to BOTH comparison sides, so a template that
+	* declares a malformed / blank `MfaConfiguration` compares equal to the state
+	* record holding the value cdkd actually sent for it. Without this half, the
+	* `effectiveProperties` above would make every later deploy read the
+	* substitution back as a user-made change and re-run the update forever.
+	*
+	* Shares ONE helper with the provisioning path rather than re-deriving the
+	* rule, per `.claude/rules/providers.md` -- state and template narrowed by
+	* different code is how this fix would become the bug.
+	*/
+	canonicalizeDesiredProperties(resourceType, properties) {
+		if (resourceType !== "AWS::Cognito::UserPool") return properties;
+		return narrowMfaConfiguration(properties);
+	}
 	getClient() {
 		if (!this.cognitoClient) this.cognitoClient = new CognitoIdentityProviderClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.cognitoClient;
@@ -39096,9 +39256,16 @@ var CognitoUserPoolProvider = class {
 	/**
 	* Create a Cognito User Pool
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Cognito User Pool ${logicalId}`);
 		const poolName = properties["UserPoolName"] || generateResourceName(logicalId, { maxLength: 128 });
+		let mfaConfiguration;
+		try {
+			mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], replayWarn(this.logger, context));
+			this.warnOnBlankMfaConfiguration(properties["MfaConfiguration"]);
+		} catch (error) {
+			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, poolName, error instanceof Error ? error : void 0);
+		}
 		let createdUserPoolId;
 		try {
 			const createParams = { PoolName: poolName };
@@ -39110,7 +39277,7 @@ var CognitoUserPoolProvider = class {
 			}
 			if (properties["Schema"]) createParams.Schema = properties["Schema"];
 			if (properties["LambdaConfig"]) createParams.LambdaConfig = properties["LambdaConfig"];
-			if (properties["MfaConfiguration"] && !hasMfaConfigProps(properties)) createParams.MfaConfiguration = properties["MfaConfiguration"];
+			if (mfaConfiguration && !hasMfaConfigProps(properties)) createParams.MfaConfiguration = mfaConfiguration;
 			if (properties["UserPoolTags"]) createParams.UserPoolTags = properties["UserPoolTags"];
 			if (properties["AdminCreateUserConfig"]) createParams.AdminCreateUserConfig = properties["AdminCreateUserConfig"];
 			if (properties["AccountRecoverySetting"]) createParams.AccountRecoverySetting = properties["AccountRecoverySetting"];
@@ -39137,8 +39304,9 @@ var CognitoUserPoolProvider = class {
 			const { urlSuffix } = derivePartitionAndUrlSuffix(region);
 			const providerName = `cognito-idp.${region}.${urlSuffix}/${userPoolId}`;
 			const providerUrl = `https://cognito-idp.${region}.${urlSuffix}/${userPoolId}`;
-			await this.applyMfaConfig(userPoolId, properties);
+			await this.applyMfaConfig(userPoolId, properties, mfaConfiguration);
 			this.logger.debug(`Successfully created Cognito User Pool ${logicalId}: ${userPoolId}`);
+			const effectiveProperties = narrowMfaConfiguration(properties);
 			return {
 				physicalId: userPoolId,
 				attributes: {
@@ -39146,7 +39314,8 @@ var CognitoUserPoolProvider = class {
 					ProviderName: providerName,
 					ProviderURL: providerUrl,
 					UserPoolId: userPoolId
-				}
+				},
+				...effectiveProperties !== properties ? { effectiveProperties } : {}
 			};
 		} catch (error) {
 			if (createdUserPoolId) try {
@@ -39166,10 +39335,109 @@ var CognitoUserPoolProvider = class {
 	* control-plane writes on a freshly-created pool can briefly conflict
 	* (mirrors DynamoDBTableProvider.retryOnTransientControlPlane).
 	*/
-	async applyMfaConfig(physicalId, properties) {
-		const request = buildMfaConfigRequest(physicalId, properties, this.logger);
+	async applyMfaConfig(physicalId, properties, declaredMfaConfiguration, options = {}) {
+		const request = buildMfaConfigRequest(physicalId, properties, this.logger, declaredMfaConfiguration);
 		if (!request) return;
 		await this.retryOnTransientControlPlane(() => this.getClient().send(new SetUserPoolMfaConfigCommand(request)), `SetUserPoolMfaConfig(${physicalId})`);
+		this.reportMfaConfigurationOff(physicalId, request, declaredMfaConfiguration, options);
+	}
+	/**
+	* Say so when this deploy sends `MfaConfiguration=OFF` without the template
+	* having asked for OFF (issue #1925, third item).
+	*
+	* Everything here keys on the BUILT request, so there is exactly one
+	* definition of "this deploy resolves to OFF", and on `declaredMfaConfiguration
+	* === ''`, i.e. the template did not pin a usable value. `create()` passes
+	* neither a live value nor a `declaredKind`, so it reports nothing -- correct,
+	* since a fresh pool has no value to downgrade.
+	*
+	* Three outcomes rather than one, because the live value can be KNOWN,
+	* known-and-harmless, or UNAVAILABLE, and only the first is a downgrade that
+	* can be named:
+	*
+	*  - live `ON` / `OPTIONAL` -- a real downgrade; name the value being lost.
+	*  - live `OFF` -- not a downgrade at all; say nothing. This is the arm the
+	*    live-value test protects, and it is load-bearing in the SILENT
+	*    direction: without it every already-OFF pool and every failed probe
+	*    warned, the latter reading `live value was undefined`.
+	*  - live UNKNOWN (the probe failed) -- the case that made this necessary.
+	*    A malformed but TRUTHY value used to reach `UpdateUserPool`, AWS
+	*    rejected the enum, MFA stayed as it was and the deploy failed; now the
+	*    guard substitutes and the deploy exits 0 with MFA off. On a role lacking
+	*    `cognito-idp:GetUserPoolMfaConfig` -- exactly the role this arm exists
+	*    for -- the probe returns nothing, so without this the ONLY path that got
+	*    quieter than main would say nothing at all.
+	*/
+	reportMfaConfigurationOff(physicalId, request, declaredMfaConfiguration, options) {
+		if (declaredMfaConfiguration !== "" || request.MfaConfiguration !== "OFF") return;
+		const kind = options.declaredKind ?? "absent";
+		const cause = kind === "refused" ? "the declared MfaConfiguration was refused as malformed (see the warning above), so this update sent MfaConfiguration=OFF instead" : kind === "blank" ? "the declared MfaConfiguration is blank, so it is treated as absent and this update sent MfaConfiguration=OFF" : "the template declares no MfaConfiguration, so this update sent MfaConfiguration=OFF (CloudFormation's own default)";
+		const remedy = (value) => kind === "absent" ? `Declare MfaConfiguration: ${value} in the template to keep it.` : `Repair MfaConfiguration to a literal ${value} to keep it.`;
+		if (options.liveMfaConfiguration === "ON" || options.liveMfaConfiguration === "OPTIONAL") {
+			this.logger.warn(`UserPool ${physicalId}: ${cause} to a pool whose live value was ${options.liveMfaConfiguration} — SetUserPoolMfaConfig is a full replace, so MFA is now OFF. ${remedy(options.liveMfaConfiguration)}`);
+			return;
+		}
+		if (options.liveReadFailed !== true) return;
+		const declaredClause = kind === "absent" ? `the template declares no MfaConfiguration` : `the declared MfaConfiguration could not be used`;
+		this.logger.warn(`UserPool ${physicalId}: ${declaredClause}, so this update sent MfaConfiguration=OFF — and the pool's previous MFA setting could not be read, so cdkd cannot say whether that turned MFA off. Grant cognito-idp:GetUserPoolMfaConfig to the deploy role to have this reported precisely. ${remedy("ON or OPTIONAL")}`);
+	}
+	/**
+	* Read the pool's live `MfaConfiguration` for the undeclared-downgrade
+	* announcement (issue #1925, third item), or `undefined` when it cannot be
+	* determined.
+	*
+	* `SetUserPoolMfaConfig` is a full replace and this provider re-issues it on
+	* every update carrying an MFA-routed property, unconditioned on the MFA
+	* configuration having CHANGED. So a WebAuthn-only template applied to a pool
+	* whose live `MfaConfiguration` is `ON` / `OPTIONAL` — console drift, or a
+	* `cdkd import` of an MFA-enabled pool — writes `OFF` on the next unrelated
+	* property change. That is defensible template-is-truth / CloudFormation
+	* parity and is NOT changed here; only its silence is.
+	*
+	* **Called BEFORE `UpdateUserPool`, defensively — NOT because AWS resets the
+	* field.** MEASURED us-east-1 2026-08-18: a pool at `ON` with software-token
+	* enabled keeps `ON` through an `UpdateUserPool` that omits
+	* `MfaConfiguration`, confirmed by both `get-user-pool-mfa-config` and
+	* `describe-user-pool`, with controls proving the call really ran (a
+	* `--auto-verified-attributes` change in the same request applied) and that
+	* the field is writable here rather than ignored (an explicit
+	* `--mfa-configuration OFF` did reset it). So AWS's blanket "unspecified
+	* parameters are set to their default value" holds field by field —
+	* `AutoVerifiedAttributes` DOES reset, `MfaConfiguration` does not — and
+	* there is no MFA-OFF window to design around.
+	*
+	* The earlier ordering was reached from that doc sentence alone and is kept
+	* only because it is strictly safer and already tested: reading first cannot
+	* report a value this same call clobbered, whatever AWS does later. Do not
+	* re-derive a redesign from the doc sentence — it has been measured.
+	*
+	* Best-effort by construction: the read exists only to ANNOUNCE, so a
+	* failure must not fail the update the user asked for.
+	*
+	* **This adds `cognito-idp:GetUserPoolMfaConfig` to the permissions a deploy
+	* role wants.** The action was previously needed only by `readCurrentState`
+	* (drift / import), so a role scoped to deploying could legitimately lack it.
+	*
+	* A failure is REPORTED rather than swallowed, but not here: this method's
+	* gate is a deliberate SUPERSET of the announcement condition (see the call
+	* site in `update()`), so warning at the point of failure fired on templates
+	* that structurally cannot downgrade -- an `EnabledMfas` with no
+	* `MfaConfiguration` resolves to OPTIONAL, and a least-privileged role saw
+	* "cdkd cannot say whether it turns MFA off" on every deploy of it. The flag
+	* returned here is consumed by `reportMfaConfigurationOff`, which speaks only
+	* where the request actually resolves to OFF.
+	*/
+	async readLiveMfaConfiguration(physicalId) {
+		try {
+			const live = await this.getClient().send(new GetUserPoolMfaConfigCommand({ UserPoolId: physicalId }));
+			return live.MfaConfiguration !== void 0 ? {
+				value: live.MfaConfiguration,
+				failed: false
+			} : { failed: false };
+		} catch (error) {
+			this.logger.debug(`GetUserPoolMfaConfig failed for UserPool ${physicalId} (${error instanceof Error ? error.name : typeof error}): ${error instanceof Error ? error.message : String(error)}`);
+			return { failed: true };
+		}
 	}
 	/**
 	* Retry a Cognito control-plane call on transient "settling" errors. A
@@ -39199,6 +39467,9 @@ var CognitoUserPoolProvider = class {
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Cognito User Pool ${logicalId}: ${physicalId}`);
+		const mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], { onUnusable: (message) => this.logger.warn(message) });
+		this.warnOnBlankMfaConfiguration(properties["MfaConfiguration"]);
+		const liveMfa = mfaConfiguration === "" && hasMfaConfigProps(properties) ? await this.readLiveMfaConfiguration(physicalId) : void 0;
 		try {
 			const updateParams = { UserPoolId: physicalId };
 			if (properties["Policies"]) {
@@ -39207,7 +39478,7 @@ var CognitoUserPoolProvider = class {
 			}
 			if (properties["LambdaConfig"]) updateParams.LambdaConfig = properties["LambdaConfig"];
 			if (properties["AutoVerifiedAttributes"]) updateParams.AutoVerifiedAttributes = properties["AutoVerifiedAttributes"];
-			if (properties["MfaConfiguration"]) updateParams.MfaConfiguration = properties["MfaConfiguration"];
+			if (mfaConfiguration && !hasMfaConfigProps(properties)) updateParams.MfaConfiguration = mfaConfiguration;
 			if (properties["AdminCreateUserConfig"]) updateParams.AdminCreateUserConfig = properties["AdminCreateUserConfig"];
 			if (properties["AccountRecoverySetting"]) updateParams.AccountRecoverySetting = properties["AccountRecoverySetting"];
 			if (properties["UserPoolTags"]) updateParams.UserPoolTags = properties["UserPoolTags"];
@@ -39225,13 +39496,18 @@ var CognitoUserPoolProvider = class {
 			if (properties["UserPoolTier"]) updateParams.UserPoolTier = properties["UserPoolTier"];
 			await this.getClient().send(new UpdateUserPoolCommand(updateParams));
 			await this.reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, properties["Schema"], previousProperties["Schema"]);
-			await this.applyMfaConfig(physicalId, properties);
+			await this.applyMfaConfig(physicalId, properties, mfaConfiguration, {
+				...liveMfa?.value !== void 0 ? { liveMfaConfiguration: liveMfa.value } : {},
+				...liveMfa?.failed === true ? { liveReadFailed: true } : {},
+				declaredKind: classifyDeclaredMfaConfiguration(properties["MfaConfiguration"])
+			});
 			this.logger.debug(`Successfully updated Cognito User Pool ${logicalId}`);
 			const userPool = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool;
 			const region = await this.getClient().config.region();
 			const { urlSuffix } = derivePartitionAndUrlSuffix(region);
 			const providerName = `cognito-idp.${region}.${urlSuffix}/${physicalId}`;
 			const providerUrl = `https://cognito-idp.${region}.${urlSuffix}/${physicalId}`;
+			const effectiveProperties = narrowMfaConfiguration(properties);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -39240,7 +39516,8 @@ var CognitoUserPoolProvider = class {
 					ProviderName: providerName,
 					ProviderURL: providerUrl,
 					UserPoolId: physicalId
-				}
+				},
+				...effectiveProperties !== properties ? { effectiveProperties } : {}
 			};
 		} catch (error) {
 			if (error instanceof ResourceUpdateNotSupportedError || error instanceof ProvisioningError) throw error;
@@ -80969,7 +81246,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.34");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.36");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;