@go-to-k/cdkd 0.283.36 → 0.284.1

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as getAccountInfo, $t as formatDockerLoginError, A as cyan, An as resolveBucketRegion, At as TemplateParser, B as stateKeySecretExposure, Bn as LocalInvokeBuildError$1, Bt as loadPublishableAssetManifest, C as makeCanonicalizePropertiesFn, Cn as expectedOwnerParam, Ct as s3BucketWebsiteUrl, D as renderStatefulReason, Dn as AssemblyReader, Dt as describeTypeWithThrottleRetry, E as isStatefulRecreateTargetSync, En as derivePartitionAndUrlSuffix, Et as INTRINSIC_KEYS, F as collectDeclaredOutputNames, Ft as AssetPublisher, G as findActionableSilentDrops, Gn as NestedStackChildDirectDestroyError, Gt as BOOTSTRAP_MARKER_PREFIX, H as collectInlinePolicyNamesManagedBySiblings, Hn as LocalStartServiceError, Ht as escapeRegExp, I as collectPublishedOutputNames, In as CdkdError, It as stringifyValue, J as slowCcOperationTimeoutMs, Jn as ResourceTimeoutError, Jt as parseBootstrapMarker, K as findSilentDropProperties, Kn as PartialFailureError, Kt as ensureAssetStorage, L as exportAliasCollisionScrubWarning, Lt as WorkGraph, M as green, Mn as getAwsClients, Mt as S3StateBackend, N as red, Nn as resetAwsClients, Nt as rebuildClientForBucketRegion, O as formatResourceLine, On as processStackMessages, Ot as withRetry, P as yellow, Pn as setAwsClients, Pt as shouldRetainResource, Q as cfnRefValueFromPhysicalId, Qt as buildDockerImage, R as isExportAliasCollision, Rt as buildAssetRedirectMap, S as unsupportedFinalSnapshotError, Sn as uploadCfnTemplate, St as s3BucketRegionalDomainName, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as canonicalizeRegion, Tt as DiffCalculator, U as clearOnUpdateRemoval, Ut as stripControlChars, V as IAMRoleProvider, Vn as LocalMigrateError, Vt as rewriteTemplateAssetReferences, W as ProviderRegistry, Wn as MissingCdkCliError, Wt as AssetModeResolver, X as isTerminationProtectionPropagationError, Xn as StackHasActiveImportsError, Xt as validateContainerRepoName, Y as disableInstanceApiTermination, Yn as ResourceUpdateNotSupportedError, Yt as validateAssetBucketName, Z as IntrinsicFunctionResolver, Zn as StackTerminationProtectionError, Zt as buildDenyExternalAccessPolicy, _ as buildFinalSnapshotIdentifier, _n as warnDeprecatedNoPrefixCliFlag, _t as redactSecretsForState, a as DeploymentEventsStore, an as Synthesizer, ar as isRetryableTransientError, at as coerceCfnBoolean, b as isFinalSnapshotError, bn as MIGRATE_TMP_PREFIX, bt as s3BucketDomainName, c as replayFailedOperations, cn as getLegacyStateBucketName, ct as readConfigString, d as deleteSkipReason, dn as resolveCaptureObservedState, dt as requireConfigObject, en as getDockerCmd, et as refStateLookupFromResource, f as withResourceDeadline, fn as resolveSkipPrefix, ft as requireConfigString, g as PRE_DELETE_SNAPSHOT_TYPES, gn as stateBucketExistenceConfirmed, gt as maskSecretsInText, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as resolveUseCdkBootstrapAssets, ht as TEMPLATE_SOURCED_RULES, i as DeploymentEventsReader, in as getDockerImageBySourceHash, ir as isMarkedNonRetryable, it as assertRegionMatch, j as gray, jn as AwsClients, jt as LockManager, k as bold, kt as DagBuilder, l as replayRollback, ln as resolveApp, lt as replayWarn, m as computeImplicitDeleteEdges, mn as resolveStateBucketWithDefaultAndSource, mt as STATE_SOURCED_READBACK_RULES, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as runDockerStreaming, nr as normalizeAwsError, nt as normalizeAwsTagsToCfn, o as planFailedOps, on as synthesisStatusMessage, or as isThrottlingError, ot as configBooleanRefusal, p as IMPLICIT_DELETE_DEPENDENCIES, pn as resolveStateBucketWithDefault, pt as STATE_SOURCED_CROSS_GENERATION_RULES, q as CloudControlProvider, qn as ProvisioningError, qt as getBootstrapMarkerKey, r as DeployEngine, rn as AssetManifestLoader, rr as withErrorHandling, rt as resolveExplicitPhysicalId, s as planRollback, sn as getDefaultStateBucketName, sr as markNonRetryable, st as configStringRefusal, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as runDockerForeground, tt as WAFv2WebACLProvider, u as UNSPECIFIED_SKIP_REASON, un as resolveAutoAssetStorage, ut as requireConfigArray, v as ccRoutedFinalSnapshotError, vn as CFN_TEMPLATE_BODY_LIMIT, vt as scrubResourceRecord, w as extractDeploymentEventError, wn as PARTITION_TABLE, wt as applyRoleArnIfSet, x as refusesFinalSnapshot, xn as findLargeInlineResources, xt as s3BucketDualStackDomainName, y as createPreDeleteFinalSnapshot, yn as CFN_TEMPLATE_URL_LIMIT, yt as s3BucketArn, z as secretBearingStateKeyWarning, zn as DeployCancelledError, zt as createAssetRedirectResolver } from "./deploy-engine-Bhq_JPCc.js";
+import { $ as IntrinsicFunctionResolver, $n as StackTerminationProtectionError, $t as buildDenyExternalAccessPolicy, A as formatResourceLine, An as processStackMessages, At as withRetry, B as isExportAliasCollision, Bt as buildAssetRedirectMap, C as refusesFinalSnapshot, Cn as findLargeInlineResources, Ct as s3BucketDualStackDomainName, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as canonicalizeRegion, Dt as DiffCalculator, E as extractDeploymentEventError, En as PARTITION_TABLE, Et as applyRoleArnIfSet, F as red, Fn as resetAwsClients, Ft as rebuildClientForBucketRegion, G as clearOnUpdateRemoval, Gt as stripControlChars, H as stateKeySecretExposure, Hn as LocalInvokeBuildError$1, Ht as loadPublishableAssetManifest, I as yellow, In as setAwsClients, It as shouldRetainResource, J as findSilentDropProperties, Jn as PartialFailureError, Jt as ensureAssetStorage, K as ProviderRegistry, Kn as MissingCdkCliError, Kt as AssetModeResolver, L as collectDeclaredOutputNames, Lt as AssetPublisher, M as cyan, Mn as resolveBucketRegion, Mt as TemplateParser, N as gray, Nn as AwsClients, Nt as LockManager, O as isStatefulRecreateTargetSync, On as derivePartitionAndUrlSuffix, Ot as INTRINSIC_KEYS, P as green, Pn as getAwsClients, Pt as S3StateBackend, Q as isTerminationProtectionPropagationError, Qn as StackHasActiveImportsError, Qt as validateContainerRepoName, R as collectPublishedOutputNames, Rn as CdkdError, Rt as stringifyValue, S as isFinalSnapshotError, Sn as MIGRATE_TMP_PREFIX, St as s3BucketDomainName, T as makeCanonicalizePropertiesFn, Tn as expectedOwnerParam, Tt as s3BucketWebsiteUrl, U as IAMRoleProvider, Un as LocalMigrateError, Ut as rewriteTemplateAssetReferences, V as secretBearingStateKeyWarning, Vn as DeployCancelledError, Vt as createAssetRedirectResolver, W as collectInlinePolicyNamesManagedBySiblings, Wn as LocalStartServiceError, Wt as escapeRegExp, X as slowCcOperationTimeoutMs, Xn as ResourceTimeoutError, Xt as parseBootstrapMarker, Y as CloudControlProvider, Yn as ProvisioningError, Yt as getBootstrapMarkerKey, Z as disableInstanceApiTermination, Zn as ResourceUpdateNotSupportedError, Zt as validateAssetBucketName, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as resolveUseCdkBootstrapAssets, _t as TEMPLATE_SOURCED_RULES, a as DeploymentEventsStore, an as AssetManifestLoader, ar as withErrorHandling, at as resolveExplicitPhysicalId, b as ccRoutedFinalSnapshotError, bn as CFN_TEMPLATE_BODY_LIMIT, bt as scrubResourceRecord, c as replayFailedOperations, cn as synthesisStatusMessage, cr as isThrottlingError, ct as configBooleanRefusal, d as updatePartialReason, dn as resolveApp, dt as replayWarn, en as buildDockerImage, et as cfnRefValueFromPhysicalId, f as UNSPECIFIED_SKIP_REASON, fn as resolveAutoAssetStorage, ft as requireConfigArray, g as computeImplicitDeleteEdges, gn as resolveStateBucketWithDefaultAndSource, gt as STATE_SOURCED_READBACK_RULES, h as IMPLICIT_DELETE_DEPENDENCIES, hn as resolveStateBucketWithDefault, ht as STATE_SOURCED_CROSS_GENERATION_RULES, i as DeploymentEventsReader, in as runDockerStreaming, ir as normalizeAwsError, it as normalizeAwsTagsToCfn, j as bold, jt as DagBuilder, k as renderStatefulReason, kn as AssemblyReader, kt as describeTypeWithThrottleRetry, l as replayRollback, ln as getDefaultStateBucketName, lr as markNonRetryable, lt as configStringRefusal, m as withResourceDeadline, mn as resolveSkipPrefix, mt as requireConfigString, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as getDockerCmd, nt as refStateLookupFromResource, o as planFailedOps, on as getDockerImageBySourceHash, or as isMarkedNonRetryable, ot as assertRegionMatch, p as deleteSkipReason, pn as resolveCaptureObservedState, pt as requireConfigObject, q as findActionableSilentDrops, qn as NestedStackChildDirectDestroyError, qt as BOOTSTRAP_MARKER_PREFIX, r as DeployEngine, rn as runDockerForeground, rt as WAFv2WebACLProvider, s as planRollback, sn as Synthesizer, sr as isRetryableTransientError, st as coerceCfnBoolean, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as formatDockerLoginError, tt as getAccountInfo, u as updatePartialMessage, un as getLegacyStateBucketName, ut as readConfigString, v as PRE_DELETE_SNAPSHOT_TYPES, vn as stateBucketExistenceConfirmed, vt as maskSecretsInText, w as unsupportedFinalSnapshotError, wn as uploadCfnTemplate, wt as s3BucketRegionalDomainName, x as createPreDeleteFinalSnapshot, xn as CFN_TEMPLATE_URL_LIMIT, xt as s3BucketArn, y as buildFinalSnapshotIdentifier, yn as warnDeprecatedNoPrefixCliFlag, yt as redactSecretsForState, z as exportAliasCollisionScrubWarning, zt as WorkGraph } from "./deploy-engine-CruC7Qxn.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-BruE_3F2.js";
+import { t as ASGProvider } from "./asg-provider-DDEsD6uA.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3098,18 +3098,27 @@ var IAMManagedPolicyProvider = class {
 			const reason = newPolicyName !== oldPolicyName ? "ManagedPolicyName" : newPath !== oldPath ? "Path" : "Description";
 			this.logger.debug(`${reason} changed, replacing managed policy: ${physicalId} (${reason} mutation)`);
 			const createResult = await this.create(logicalId, resourceType, properties);
+			let orphanReason;
 			try {
 				const deleteResult = await this.delete(logicalId, physicalId, resourceType, previousProperties);
-				if (deleteResult?.outcome === "skipped") this.logger.warn(`Skipped deleting old managed policy ${physicalId} during replacement: ${deleteResult.reason}. The old policy may be orphaned and require manual cleanup.`);
+				if (deleteResult?.outcome === "skipped") {
+					orphanReason = `old managed policy ${physicalId} was not deleted: ${deleteResult.reason}`;
+					this.logger.warn(`Skipped deleting old managed policy ${physicalId} during replacement: ${deleteResult.reason}. The old policy may be orphaned and require manual cleanup.`);
+				}
 			} catch (error) {
+				orphanReason = `old managed policy ${physicalId} could not be deleted: ${String(error)}`;
 				this.logger.warn(`Failed to delete old managed policy ${physicalId} during replacement: ${String(error)}. The old policy may be orphaned and require manual cleanup.`);
 			}
-			const result = {
+			const base = {
 				physicalId: createResult.physicalId,
-				wasReplaced: true
+				wasReplaced: true,
+				...createResult.attributes ? { attributes: createResult.attributes } : {}
 			};
-			if (createResult.attributes) result.attributes = createResult.attributes;
-			return result;
+			return orphanReason !== void 0 ? {
+				...base,
+				outcome: "partial",
+				reason: orphanReason
+			} : base;
 		}
 		try {
 			const newDocument = properties["PolicyDocument"];
@@ -26244,16 +26253,23 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 		if (newPathPart !== oldPathPart) {
 			this.logger.debug(`PathPart changed from "${oldPathPart}" to "${newPathPart}", replacing resource`);
 			const createResult = await this.createResource(logicalId, resourceType, properties);
+			let orphanReason;
 			try {
 				await this.deleteResource(logicalId, physicalId, resourceType, previousProperties);
 			} catch (error) {
+				orphanReason = `old API Gateway Resource ${physicalId} could not be deleted: ${String(error)}`;
 				this.logger.warn(`Failed to delete old API Gateway Resource ${physicalId} during replacement: ${String(error)}. The old resource may be orphaned and require manual cleanup.`);
 			}
-			return {
+			const base = {
 				physicalId: createResult.physicalId,
 				wasReplaced: true,
 				attributes: createResult.attributes ?? {}
 			};
+			return orphanReason !== void 0 ? {
+				...base,
+				outcome: "partial",
+				reason: orphanReason
+			} : base;
 		}
 		return {
 			physicalId,
@@ -39034,10 +39050,17 @@ function hasMfaConfigProps(properties) {
 * - `WebAuthnRelyingPartyID`/`WebAuthnUserVerification` -> `WebAuthnConfiguration`
 *
 * `MfaConfiguration` (ON/OFF/OPTIONAL) MUST be threaded into this request:
-* `SetUserPoolMfaConfig` is a full-replace of the pool's MFA state, and an
-* omitted `MfaConfiguration` defaults to OFF on the wire — which resets the
-* pool to MFA-disabled and makes AWS reject (or silently drop) the per-factor
-* sub-blocks we are trying to enable. Use the template's `MfaConfiguration`
+* `SetUserPoolMfaConfig` is a full-replace of the pool's MFA state, and AWS
+* reads an omitted `MfaConfiguration` as OFF. That splits into two MUTUALLY
+* EXCLUSIVE arms — both MEASURED against THIS API, not read off
+* `UpdateUserPool`'s blanket reset sentence, which holds only field by field:
+*
+* - WITH a per-factor sub-block in the request, AWS REJECTS the call: nothing
+*   is reset, and the deploy FAILS.
+* - WITHOUT one, AWS accepts the call and the pool is silently reset to
+*   MFA-disabled.
+*
+* Use the template's `MfaConfiguration`
 * when present; when the template omitted it, default by whether this call
 * enables an MFA FACTOR — `OPTIONAL` if it does, `OFF` (CloudFormation's own
 * default) if it does not. The body comment on that decision explains why both
@@ -39075,11 +39098,11 @@ function buildMfaConfigRequest(physicalId, properties, logger, declaredMfaConfig
 	request.MfaConfiguration = declaredMfaConfiguration || (enablesMfaFactor ? "OPTIONAL" : "OFF");
 	if (enabledMfasBlank) logger?.warn(`UserPool ${physicalId}: EnabledMfas is an empty string, which declares no MFA factor and is treated as absent — a mangled Fn::Join or an empty String parameter collapses to this shape. Nothing is enabled from it and MfaConfiguration is ${request.MfaConfiguration}; declare the factor names as a list (e.g. ["${MFA_FACTOR_SOFTWARE_TOKEN}"]) if a factor was intended.`);
 	const anyFactorBlock = request.SmsMfaConfiguration !== void 0 || request.SoftwareTokenMfaConfiguration !== void 0 || request.EmailMfaConfiguration !== void 0;
-	if (request.MfaConfiguration === "OFF" && anyFactorBlock) logger?.warn(`UserPool ${physicalId}: MfaConfiguration is pinned to OFF while an MFA factor block is configured. The factor configuration is still sent, but the pool deploys with MFA DISABLED. Remove MfaConfiguration (or set it to ON / OPTIONAL) to enable the declared factor.`);
+	if (request.MfaConfiguration === "OFF" && anyFactorBlock) logger?.warn(`UserPool ${physicalId}: MfaConfiguration is pinned to OFF while an MFA factor block is configured. AWS REJECTS that combination ("Invalid MFA configuration given, can't turn off MFA and configure an MFA together"), so this deploy FAILS rather than producing a pool with MFA disabled. Remove MfaConfiguration (or set it to ON / OPTIONAL) to enable the declared factor.`);
 	const dropped = unrecognizedFactors.map((f) => JSON.stringify(f) ?? String(f));
 	if (enabledMfasMalformed) dropped.push(`${JSON.stringify(properties["EnabledMfas"])} (not a list)`);
 	if (dropped.length > 0) {
-		const consequence = request.MfaConfiguration === "OFF" ? `MfaConfiguration is OFF, so this pool deploys with MFA DISABLED` : anyFactorBlock ? `MfaConfiguration is ${request.MfaConfiguration} and another factor block IS sent, so these entries are silently ignored rather than failing the call on their own` : `MfaConfiguration is ${request.MfaConfiguration} with no factor enabled, so AWS rejects this call rather than deploying the pool with MFA disabled`;
+		const consequence = request.MfaConfiguration === "OFF" && anyFactorBlock ? "MfaConfiguration is OFF while another factor block IS sent, so AWS REJECTS this call outright and the deploy fails" : request.MfaConfiguration === "OFF" ? `MfaConfiguration is OFF, so this pool deploys with MFA DISABLED` : anyFactorBlock ? `MfaConfiguration is ${request.MfaConfiguration} and another factor block IS sent, so these entries are silently ignored rather than failing the call on their own` : `MfaConfiguration is ${request.MfaConfiguration} with no factor enabled, so AWS rejects this call rather than deploying the pool with MFA disabled`;
 		logger?.warn(`UserPool ${physicalId}: EnabledMfas entries ${dropped.join(", ")} do not map to an MFA factor block (known: ${MFA_FACTOR_SMS}, ${MFA_FACTOR_SOFTWARE_TOKEN}, ${MFA_FACTOR_EMAIL_OTP}); no factor is enabled from them. ${consequence}.`);
 	}
 	return request;
@@ -39243,9 +39266,52 @@ var CognitoUserPoolProvider = class {
 	/**
 	* Build the SDK `Policies` input from the CFn `Policies` blob. Both
 	* sub-keys must be forwarded: `SignInPolicy` (passwordless first-auth
-	* factors) was silently dropped before issue #1380, and UpdateUserPool
-	* resets omitted attributes to their defaults, so leaving it out also
-	* wipes an existing sign-in policy on every update.
+	* factors) was silently dropped before issue #1380, so a template that
+	* declared -- or later CHANGED -- the allowed first-auth factors never
+	* reached AWS at all.
+	*
+	* **Forwarding is what APPLIES a declared value; it is NOT what keeps an
+	* existing one alive.** The original rationale here was AWS's blanket "if
+	* you don't provide a value for an attribute, Amazon Cognito sets it to its
+	* default value", i.e. that omitting `SignInPolicy` would WIPE it. MEASURED
+	* us-east-1 2026-08-19 (issue #1968), on a pool created with
+	* `SignInPolicy.AllowedFirstAuthFactors = [PASSWORD, EMAIL_OTP]` on the
+	* default `ESSENTIALS` tier -- no explicit `UserPoolTier` was needed for the
+	* field to be settable:
+	*
+	* - `UpdateUserPool` sending `Policies` with ONLY `PasswordPolicy` left
+	*   `SignInPolicy` at `[PASSWORD, EMAIL_OTP]`. Control: that same call's
+	*   `--auto-verified-attributes email` applied, so the update really ran.
+	* - `UpdateUserPool` omitting `Policies` entirely left BOTH sub-keys intact
+	*   (a non-default `RequireSymbols: false` survived too), while
+	*   `AutoVerifiedAttributes` reset from `[email]` to none in that very call
+	*   -- the control proving the omission was processed, not ignored.
+	* - An explicit `SignInPolicy` write landed in both directions
+	*   (`[PASSWORD]`, then back to `[PASSWORD, EMAIL_OTP]`), so the field is
+	*   reachable and writable here rather than silently dropped.
+	* - The MIRROR image holds too, so the ledger entry is measured rather than
+	*   generalised from one sub-key: a container carrying ONLY `SignInPolicy`
+	*   updated it to `[PASSWORD, WEB_AUTHN]` while leaving a non-default
+	*   `PasswordPolicy` (`MinimumLength: 12`, `RequireSymbols: false`) intact,
+	*   with the same `--auto-verified-attributes` control.
+	*
+	* So the forwarding stays -- it is the only way a CHANGED sign-in policy is
+	* applied -- but on the measured reason, not the blanket sentence. Do not
+	* generalise that sentence to another field from this site: see
+	* `readLiveMfaConfiguration`'s docstring, which carries the one ledger of
+	* which fields were measured to reset and which were not.
+	*
+	* **Consequence of that measurement, NOT fixed here: there is no removal
+	* path.** This builder forwards only what the template DECLARES, so deleting
+	* `SignInPolicy` from a template sends nothing for it -- and nothing sent
+	* means nothing changed. A user tightening their auth by removing a
+	* passwordless first-auth factor therefore leaves it live on the pool
+	* indefinitely, and `readCurrentState` keeps reporting a drift that
+	* `cdkd drift --revert` cannot clear, since the revert routes through this
+	* same builder. Clearing it needs an explicit reset value on the wire, which
+	* is a behavior change with its own integ and is out of this lane's scope.
+	* Whether CloudFormation removes it on the same template edit is UNMEASURED
+	* -- do not assume parity in either direction.
 	*/
 	toSdkUserPoolPolicies(policies) {
 		const result = {};
@@ -39402,10 +39468,37 @@ var CognitoUserPoolProvider = class {
 	* `--auto-verified-attributes` change in the same request applied) and that
 	* the field is writable here rather than ignored (an explicit
 	* `--mfa-configuration OFF` did reset it). So AWS's blanket "unspecified
-	* parameters are set to their default value" holds field by field —
-	* `AutoVerifiedAttributes` DOES reset, `MfaConfiguration` does not — and
+	* parameters are set to their default value" holds field by field — and
 	* there is no MFA-OFF window to design around.
 	*
+	* **This paragraph is the single ledger of that field-by-field result; a
+	* per-field verdict belongs at that field's own site, pointing here.** Every
+	* line below was taken with a control proving the omitting call really ran.
+	*
+	* `UpdateUserPool`, on omission:
+	*
+	* - `AutoVerifiedAttributes` — DOES reset when omitted (2026-08-18).
+	* - `MfaConfiguration` — does NOT reset when omitted (2026-08-18, above).
+	* - `Policies` — neither sub-key resets, measured in BOTH directions
+	*   (2026-08-19, issue #1968; details at `toSdkUserPoolPolicies`): a
+	*   container sent without `SignInPolicy` left `SignInPolicy` intact, a
+	*   container sent without `PasswordPolicy` left `PasswordPolicy` intact,
+	*   and omitting the container outright left both. Forwarding is still
+	*   REQUIRED to APPLY a changed sub-key — preservation is not application —
+	*   and no omission can express a REMOVAL.
+	*
+	* `SetUserPoolMfaConfig` — a DIFFERENT API with a DIFFERENT rule, kept in
+	* its own section so neither list is read as evidence for the other:
+	*
+	* - `MfaConfiguration` — an omitted value is read as OFF. With a factor
+	*   sub-block in the request AWS REJECTS the call; with none it accepts and
+	*   resets the pool to MFA-disabled. An EXPLICIT OFF beside a block is
+	*   rejected the same way (2026-08-19, issue #1968; the transcript lives at
+	*   the pinned-OFF warning in `buildMfaConfigRequest`).
+	*
+	* Nothing here licenses a claim about a field on neither list, or about one
+	* API from the other's section. Measure it.
+	*
 	* The earlier ordering was reached from that doc sentence alone and is kept
 	* only because it is strictly safer and already tested: reading first cannot
 	* report a value this same call clobbered, whatever AWS does later. Do not
@@ -56621,6 +56714,26 @@ var WaitConditionHandleProvider = class {
 //#endregion
 //#region src/provisioning/providers/acm-certificate-provider.ts
 /**
+* True for ACM's refusal to delete a certificate a consumer still references
+* (issue [#1922](https://github.com/go-to-k/cdkd/issues/1922)).
+*
+* Matched by error NAME first, with a message fallback: the SDK raises
+* `ResourceInUseException`, but a wrapped / re-thrown error can lose the class
+* while keeping the text. Deliberately narrow — this only picks the
+* remediation wording and the reason phrasing, and every other failure still
+* reaches the same `'partial'` outcome, so a miss degrades to a less specific
+* message rather than to the pre-#1922 silence.
+*/
+function isCertificateInUseError(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current instanceof Error; depth++) {
+		if (current.name === "ResourceInUseException") return true;
+		current = current.cause;
+	}
+	const message = error instanceof Error ? error.message : String(error);
+	return /ResourceInUseException|in use/i.test(message);
+}
+/**
 * AWS ACM Certificate Provider
 *
 * Implements `AWS::CertificateManager::Certificate` using the ACM SDK.
@@ -56718,18 +56831,28 @@ var ACMCertificateProvider = class {
 		if (changedImmutable) {
 			this.logger.debug(`${changedImmutable} changed, replacing ACM certificate: ${physicalId}`);
 			const createResult = await this.create(logicalId, resourceType, properties);
+			let orphanReason;
 			try {
 				const deleteResult = await this.delete(logicalId, physicalId, resourceType, previousProperties);
-				if (deleteResult?.outcome === "skipped") this.logger.warn(`Skipped deleting old ACM certificate ${physicalId} during replacement: ${deleteResult.reason}. The old certificate may be orphaned and require manual cleanup.`);
+				if (deleteResult?.outcome === "skipped") {
+					orphanReason = `old certificate ${physicalId} was not deleted: ${deleteResult.reason}`;
+					this.logger.warn(`Skipped deleting old ACM certificate ${physicalId} during replacement: ${deleteResult.reason}. The old certificate may be orphaned and require manual cleanup.`);
+				}
 			} catch (error) {
-				this.logger.warn(`Failed to delete old ACM certificate ${physicalId} during replacement: ${String(error)}. The old certificate may be orphaned and require manual cleanup.`);
+				const inUse = isCertificateInUseError(error);
+				orphanReason = inUse ? `old certificate ${physicalId} is still in use by another resource and was not deleted` : `old certificate ${physicalId} could not be deleted: ${String(error)}`;
+				this.logger.warn(`Failed to delete old ACM certificate ${physicalId} during replacement: ${String(error)}. ` + (inUse ? "This usually means a consumer (e.g. a CloudFront distribution) still references it; it can be deleted once DescribeCertificate.InUseBy is empty. " : "") + `The old certificate may be orphaned and require manual cleanup.`);
 			}
-			const result = {
+			const base = {
 				physicalId: createResult.physicalId,
-				wasReplaced: true
+				wasReplaced: true,
+				...createResult.attributes ? { attributes: createResult.attributes } : {}
 			};
-			if (createResult.attributes) result.attributes = createResult.attributes;
-			return result;
+			return orphanReason !== void 0 ? {
+				...base,
+				outcome: "partial",
+				reason: orphanReason
+			} : base;
 		}
 		try {
 			const newCt = properties["CertificateTransparencyLoggingPreference"];
@@ -57590,9 +57713,11 @@ async function deployCommand(stacks, options) {
 				logger.info(`\n${bold("Deployment Summary:")}`);
 				logger.info(`  Stack: ${bold(cyan(deployResult.stackName))}`);
 				logger.info(`  Created: ${deployResult.created > 0 ? green(deployResult.created) : gray(deployResult.created)}`);
-				logger.info(`  Updated: ${deployResult.updated > 0 ? yellow(deployResult.updated) : gray(deployResult.updated)}`);
+				const updatedTotal = deployResult.updated + deployResult.updatePartial;
+				logger.info(`  Updated: ${updatedTotal > 0 ? yellow(updatedTotal) : gray(updatedTotal)}`);
 				logger.info(`  Deleted: ${deployResult.deleted > 0 ? red(deployResult.deleted) : gray(deployResult.deleted)}`);
 				if (deployResult.deleteSkipped > 0) logger.info(`  Skipped (not deleted): ${yellow(deployResult.deleteSkipped)}`);
+				if (deployResult.updatePartial > 0) logger.info(`    of which left an orphaned predecessor: ${yellow(deployResult.updatePartial)}`);
 				logger.info(`  Unchanged: ${gray(deployResult.unchanged)}`);
 				logger.info(`  Duration: ${cyan((deployResult.durationMs / 1e3).toFixed(2) + "s")}`);
 				if (deployResult.attributeFallbackCount > 0) logger.warn(`${deployResult.attributeFallbackCount} attribute resolution(s) fell back to the physical ID (potentially wrong values); re-run with --strict-getatt to fail on these`);
@@ -57604,9 +57729,9 @@ async function deployCommand(stacks, options) {
 				else logger.info(`\n${green("✓")} ${bold("Deployment completed successfully")}`);
 				recordRunSucceeded(eventRecorder, stackInfo.stackName, {
 					created: deployResult.created,
-					updated: deployResult.updated,
+					updated: deployResult.updated + deployResult.updatePartial,
 					deleted: deployResult.deleted,
-					...deployResult.deleteSkipped > 0 && { skipped: deployResult.deleteSkipped }
+					...deployResult.deleteSkipped + deployResult.updatePartial > 0 && { skipped: deployResult.deleteSkipped + deployResult.updatePartial }
 				}, deployResult.durationMs);
 			} catch (deployError) {
 				if (deployError instanceof DeployCancelledError) return;
@@ -62214,7 +62339,9 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 				try {
 					const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties, { desiredFromAwsReadback: true }), outcome.logicalId, { logger: { debug: (msg) => logger.debug(maskSecretsInText(msg, secrets)) } });
 					totalSucceeded++;
-					logger.info(`  ✓ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted.`);
+					const revertPartial = updatePartialReason(updateResult);
+					if (revertPartial !== void 0) logger.warn(`  ✓ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, ${maskSecretsInText(updatePartialMessage(revertPartial), secrets)}`);
+					else logger.info(`  ✓ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted.`);
 					try {
 						if (updateResult?.effectiveProperties) {
 							const delta = collectNarrowedTopLevelKeys(newProperties, updateResult.effectiveProperties);
@@ -81246,7 +81373,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.36");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.1");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;