@go-to-k/cdkd 0.284.13 → 0.284.14

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isTerminationProtectionPropagationError, $n as ResourceUpdateNotSupportedError, $t as validateAssetBucketName, A as renderStatefulReason, An as derivePartitionAndUrlSuffix, At as INTRINSIC_KEYS, B as exportAliasCollisionScrubWarning, Bn as CdkdError, Bt as stringifyValue, C as isFinalSnapshotError, Cn as CFN_TEMPLATE_URL_LIMIT, Ct as s3BucketArn, D as extractDeploymentEventError, Dn as expectedOwnerParam, Dt as s3BucketWebsiteUrl, E as makeCanonicalizePropertiesFn, En as uploadCfnTemplate, Et as s3BucketRegionalDomainName, F as green, Fn as AwsClients, Ft as LockManager, G as collectInlinePolicyNamesManagedBySiblings, Gn as LocalMigrateError, Gt as rewriteTemplateAssetReferences, H as secretBearingStateKeyWarning, Ht as buildAssetRedirectMap, I as red, In as getAwsClients, It as S3StateBackend, J as findActionableSilentDrops, Jn as MissingCdkCliError, Jt as AssetModeResolver, K as clearOnUpdateRemoval, Kn as LocalStartServiceError, Kt as escapeRegExp, L as yellow, Ln as resetAwsClients, Lt as rebuildClientForBucketRegion, M as bold, Mn as processStackMessages, Mt as withRetry, N as cyan, Nt as DagBuilder, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as PARTITION_TABLE, Ot as applyRoleArnIfSet, P as gray, Pn as resolveBucketRegion, Pt as TemplateParser, Q as disableInstanceApiTermination, Qn as ResourceTimeoutError, Qt as parseBootstrapMarker, R as collectDeclaredOutputNames, Rn as setAwsClients, Rt as shouldRetainResource, S as createPreDeleteFinalSnapshot, Sn as CFN_TEMPLATE_BODY_LIMIT, St as scrubResourceRecord, T as unsupportedFinalSnapshotError, Tn as findLargeInlineResources, Tt as s3BucketDualStackDomainName, U as stateKeySecretExposure, Un as DeployCancelledError, Ut as createAssetRedirectResolver, V as isExportAliasCollision, Vt as WorkGraph, W as IAMRoleProvider, Wn as LocalInvokeBuildError$1, Wt as loadPublishableAssetManifest, X as CloudControlProvider, Xn as PartialFailureError, Xt as ensureAssetStorage, Y as findSilentDropProperties, Yn as NestedStackChildDirectDestroyError, Yt as BOOTSTRAP_MARKER_PREFIX, Z as slowCcOperationTimeoutMs, Zn as ProvisioningError, Zt as getBootstrapMarkerKey, _ as computeImplicitDeleteEdges, _n as resolveStateBucketWithDefault, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as runDockerForeground, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as stateBucketExistenceConfirmed, bt as maskSecretsInText, c as replayFailedOperations, cn as getDockerImageBySourceHash, cr as isMarkedNonRetryable, ct as coerceCfnBoolean, d as updatePartialReason, dn as getDefaultStateBucketName, dr as markNonRetryable, dt as readConfigString, en as validateContainerRepoName, er as StackHasActiveImportsError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as getLegacyStateBucketName, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveSkipPrefix, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as resolveCaptureObservedState, ht as requireConfigString, i as DeploymentEventsReader, in as getDockerCmd, it as WAFv2WebACLProvider, j as formatResourceLine, jn as AssemblyReader, jt as describeTypeWithThrottleRetry, k as isStatefulRecreateTargetSync, kn as canonicalizeRegion, kt as DiffCalculator, l as replayRollback, ln as Synthesizer, lr as isRetryableTransientError, lt as configBooleanRefusal, m as withResourceDeadline, mn as resolveAutoAssetStorage, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as buildDockerImage, nt as getAccountInfo, o as planFailedOps, on as runDockerStreaming, or as normalizeAwsError, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as resolveApp, pt as requireConfigArray, q as ProviderRegistry, qt as stripControlChars, r as DeployEngine, rn as formatDockerLoginError, rt as refStateLookupFromResource, s as planRollback, sn as AssetManifestLoader, sr as withErrorHandling, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDenyExternalAccessPolicy, tr as StackTerminationProtectionError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as synthesisStatusMessage, ur as isThrottlingError, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveStateBucketWithDefaultAndSource, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as MIGRATE_TMP_PREFIX, wt as s3BucketDomainName, x as ccRoutedFinalSnapshotError, xn as warnDeprecatedNoPrefixCliFlag, xt as redactSecretsForState, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveUseCdkBootstrapAssets, yt as createSecretMasker, z as collectPublishedOutputNames, zt as AssetPublisher } from "./deploy-engine-4Eh5Qqlm.js";
+import { $ as isTerminationProtectionPropagationError, $n as ResourceUpdateNotSupportedError, $t as validateAssetBucketName, A as renderStatefulReason, An as derivePartitionAndUrlSuffix, At as INTRINSIC_KEYS, B as exportAliasCollisionScrubWarning, Bn as CdkdError, Bt as stringifyValue, C as isFinalSnapshotError, Cn as CFN_TEMPLATE_URL_LIMIT, Ct as s3BucketArn, D as extractDeploymentEventError, Dn as expectedOwnerParam, Dt as s3BucketWebsiteUrl, E as makeCanonicalizePropertiesFn, En as uploadCfnTemplate, Et as s3BucketRegionalDomainName, F as green, Fn as AwsClients, Ft as LockManager, G as collectInlinePolicyNamesManagedBySiblings, Gn as LocalMigrateError, Gt as rewriteTemplateAssetReferences, H as secretBearingStateKeyWarning, Ht as buildAssetRedirectMap, I as red, In as getAwsClients, It as S3StateBackend, J as findActionableSilentDrops, Jn as MissingCdkCliError, Jt as AssetModeResolver, K as clearOnUpdateRemoval, Kn as LocalStartServiceError, Kt as escapeRegExp, L as yellow, Ln as resetAwsClients, Lt as rebuildClientForBucketRegion, M as bold, Mn as processStackMessages, Mt as withRetry, N as cyan, Nt as DagBuilder, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as PARTITION_TABLE, Ot as applyRoleArnIfSet, P as gray, Pn as resolveBucketRegion, Pt as TemplateParser, Q as disableInstanceApiTermination, Qn as ResourceTimeoutError, Qt as parseBootstrapMarker, R as collectDeclaredOutputNames, Rn as setAwsClients, Rt as shouldRetainResource, S as createPreDeleteFinalSnapshot, Sn as CFN_TEMPLATE_BODY_LIMIT, St as scrubResourceRecord, T as unsupportedFinalSnapshotError, Tn as findLargeInlineResources, Tt as s3BucketDualStackDomainName, U as stateKeySecretExposure, Un as DeployCancelledError, Ut as createAssetRedirectResolver, V as isExportAliasCollision, Vt as WorkGraph, W as IAMRoleProvider, Wn as LocalInvokeBuildError$1, Wt as loadPublishableAssetManifest, X as CloudControlProvider, Xn as PartialFailureError, Xt as ensureAssetStorage, Y as findSilentDropProperties, Yn as NestedStackChildDirectDestroyError, Yt as BOOTSTRAP_MARKER_PREFIX, Z as slowCcOperationTimeoutMs, Zn as ProvisioningError, Zt as getBootstrapMarkerKey, _ as computeImplicitDeleteEdges, _n as resolveStateBucketWithDefault, _t as STATE_SOURCED_READBACK_RULES, a as DeploymentEventsStore, an as runDockerForeground, at as normalizeAwsTagsToCfn, b as buildFinalSnapshotIdentifier, bn as stateBucketExistenceConfirmed, bt as maskSecretsInText, c as replayFailedOperations, cn as getDockerImageBySourceHash, cr as isMarkedNonRetryable, ct as coerceCfnBoolean, d as updatePartialReason, dn as getDefaultStateBucketName, dr as markNonRetryable, dt as readConfigString, en as validateContainerRepoName, er as StackHasActiveImportsError, et as IntrinsicFunctionResolver, f as UNSPECIFIED_SKIP_REASON, fn as getLegacyStateBucketName, ft as replayWarn, g as IMPLICIT_DELETE_DEPENDENCIES, gn as resolveSkipPrefix, gt as STATE_SOURCED_CROSS_GENERATION_RULES, h as maskingRetryLogger, hn as resolveCaptureObservedState, ht as requireConfigString, i as DeploymentEventsReader, in as getDockerCmd, it as WAFv2WebACLProvider, j as formatResourceLine, jn as AssemblyReader, jt as describeTypeWithThrottleRetry, k as isStatefulRecreateTargetSync, kn as canonicalizeRegion, kt as DiffCalculator, l as replayRollback, ln as Synthesizer, lr as isRetryableTransientError, lt as configBooleanRefusal, m as withResourceDeadline, mn as resolveAutoAssetStorage, mt as requireConfigObject, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as buildDockerImage, nt as getAccountInfo, o as planFailedOps, on as runDockerStreaming, or as normalizeAwsError, ot as resolveExplicitPhysicalId, p as deleteSkipReason, pn as resolveApp, pt as requireConfigArray, q as ProviderRegistry, qt as stripControlChars, r as DeployEngine, rn as formatDockerLoginError, rt as refStateLookupFromResource, s as planRollback, sn as AssetManifestLoader, sr as withErrorHandling, st as assertRegionMatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDenyExternalAccessPolicy, tr as StackTerminationProtectionError, tt as cfnRefValueFromPhysicalId, u as updatePartialMessage, un as synthesisStatusMessage, ur as isThrottlingError, ut as configStringRefusal, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as resolveStateBucketWithDefaultAndSource, vt as TEMPLATE_SOURCED_RULES, w as refusesFinalSnapshot, wn as MIGRATE_TMP_PREFIX, wt as s3BucketDomainName, x as ccRoutedFinalSnapshotError, xn as warnDeprecatedNoPrefixCliFlag, xt as redactSecretsForState, y as PRE_DELETE_SNAPSHOT_TYPES, yn as resolveUseCdkBootstrapAssets, yt as createSecretMasker, z as collectPublishedOutputNames, zt as AssetPublisher } from "./deploy-engine-C2OBi4mp.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-H-Dl8qng.js";
+import { t as ASGProvider } from "./asg-provider-DZAeGqBC.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -40034,8 +40034,7 @@ function buildMfaConfigRequest(physicalId, properties, logger, declaredMfaConfig
 	const enablesMfaFactor = declaresFactor || request.EmailMfaConfiguration !== void 0;
 	request.MfaConfiguration = declaredMfaConfiguration || (enablesMfaFactor ? "OPTIONAL" : "OFF");
 	if (enabledMfasBlank) warn(`UserPool ${physicalId}: EnabledMfas is an empty string, which declares no MFA factor and is treated as absent — a mangled Fn::Join or an empty String parameter collapses to this shape. Nothing is enabled from it and MfaConfiguration is ${request.MfaConfiguration}; declare the factor names as a list (e.g. ["${MFA_FACTOR_SOFTWARE_TOKEN}"]) if a factor was intended.`);
-	const anyFactorBlock = request.SmsMfaConfiguration !== void 0 || request.SoftwareTokenMfaConfiguration !== void 0 || request.EmailMfaConfiguration !== void 0;
-	if (request.MfaConfiguration === "OFF" && anyFactorBlock) warn(`UserPool ${physicalId}: MfaConfiguration is pinned to OFF while an MFA factor block is configured. AWS REJECTS that combination ("Invalid MFA configuration given, can't turn off MFA and configure an MFA together"), so this deploy FAILS rather than producing a pool with MFA disabled. Remove MfaConfiguration (or set it to ON / OPTIONAL) to enable the declared factor.`);
+	const anyFactorBlock = hasAnyMfaFactorBlock(request);
 	const maskDeep = (v, depth = 0) => {
 		if (typeof v === "string") return maskSecrets(v);
 		if (depth >= MASK_WALK_MAX_DEPTH) return v;
@@ -40046,7 +40045,7 @@ function buildMfaConfigRequest(physicalId, properties, logger, declaredMfaConfig
 	const dropped = unrecognizedFactors.map((f) => JSON.stringify(maskDeep(f)) ?? String(f));
 	if (enabledMfasMalformed) dropped.push(`${JSON.stringify(maskDeep(properties["EnabledMfas"]))} (not a list)`);
 	if (dropped.length > 0) {
-		const consequence = request.MfaConfiguration === "OFF" && anyFactorBlock ? "MfaConfiguration is OFF while another factor block IS sent, so AWS REJECTS this call outright and the deploy fails" : request.MfaConfiguration === "OFF" ? `MfaConfiguration is OFF, so this pool deploys with MFA DISABLED` : anyFactorBlock ? `MfaConfiguration is ${request.MfaConfiguration} and another factor block IS sent, so these entries are silently ignored rather than failing the call on their own` : `MfaConfiguration is ${request.MfaConfiguration} with no factor enabled, so AWS rejects this call rather than deploying the pool with MFA disabled`;
+		const consequence = request.MfaConfiguration === "OFF" ? `MfaConfiguration is OFF, so this pool deploys with MFA DISABLED` : anyFactorBlock ? `MfaConfiguration is ${request.MfaConfiguration} and another factor block IS sent, so these entries are silently ignored rather than failing the call on their own` : `MfaConfiguration is ${request.MfaConfiguration} with no factor enabled, so AWS rejects this call rather than deploying the pool with MFA disabled`;
 		warn(`UserPool ${physicalId}: EnabledMfas entries ${dropped.join(", ")} do not map to an MFA factor block (known: ${MFA_FACTOR_SMS}, ${MFA_FACTOR_SOFTWARE_TOKEN}, ${MFA_FACTOR_EMAIL_OTP}); no factor is enabled from them. ${consequence}.`);
 	}
 	return request;
@@ -40075,6 +40074,248 @@ function resolveSentMfaConfiguration(properties, declaredMfaConfiguration) {
 	return declaredMfaConfiguration || void 0;
 }
 /**
+* "This `SetUserPoolMfaConfig` request carries an MFA FACTOR sub-block."
+*
+* ONE definition, shared by `buildMfaConfigRequest`'s dropped-entry warning and
+* by the pre-flight refusal below, so the message and the refusal cannot
+* disagree about the same request. It is precisely
+* `{Sms, SoftwareToken, Email}MfaConfiguration` -- `WebAuthnConfiguration` is
+* deliberately NOT a member, because WebAuthn is not an MFA factor and rides
+* alongside `MfaConfiguration: OFF` on every passkey-only pool (issue #1920).
+*/
+function hasAnyMfaFactorBlock(request) {
+	return request.SmsMfaConfiguration !== void 0 || request.SoftwareTokenMfaConfiguration !== void 0 || request.EmailMfaConfiguration !== void 0;
+}
+/**
+* The `Policies.SignInPolicy.AllowedFirstAuthFactors` members AWS refuses to
+* combine with MFA (issue #1975).
+*
+* A DENY-list, deliberately, even though the AWS message states an ALLOW-list
+* ("Only PASSWORD and WEB_AUTHN (if configured) can be enabled as an auth
+* factor if MFA is enabled"). Written from the allow-list, a member AWS adds
+* LATER would be refused by cdkd on the day it starts working -- the same
+* reason the unrecognized-`EnabledMfas` case in `buildMfaConfigRequest` warns
+* rather than throws, since that set is a hardcoded mirror of an AWS enum. The
+* cost of the deny-list is the reverse and is the cheaper one: a future
+* incompatible factor is simply not pre-flighted, which is the pre-#1975
+* behavior (a loud AWS rejection), not a regression.
+*
+* The two members ARE the whole of today's `AuthFactorType` enum outside the
+* allowed pair (`EMAIL_OTP`, `PASSWORD`, `SMS_OTP`, `WEB_AUTHN` --
+* `@aws-sdk/client-cognito-identity-provider`), so the deny-list and the
+* allow-list agree on every value that exists right now.
+*
+* BOTH members are MEASURED (us-east-1, 2026-08-19, issue #1975) -- neither is
+* extrapolated from the other, which is the failure mode this file's own
+* unrecognized-factor comment warns about:
+*
+*   [PASSWORD, EMAIL_OTP] + SetUserPoolMfaConfig(ON) -> REJECTED
+*   [PASSWORD, SMS_OTP]   + SetUserPoolMfaConfig(ON) -> REJECTED, same message
+*
+* The `SMS_OTP` probe needed a precondition worth recording, because without it
+* the interesting call is never reached: on a pool with NO `SmsConfiguration`,
+* `CreateUserPool` refuses the factor outright ("SMS_OTP can not be configured
+* as AuthFactor as user pool is missing valid SMS configuration"), so the probe
+* had to stand up an SNS-caller IAM role + ExternalId first. That earlier,
+* different refusal is AWS's own and is NOT something this pre-flight
+* duplicates.
+*
+* Typed `satisfies AuthFactorType[]` rather than left as `string[]`: the values
+* mirror an SDK enum, so a rename upstream should be a COMPILE error here
+* rather than a silently-never-matching deny-list.
+*/
+const MFA_INCOMPATIBLE_FIRST_AUTH_FACTORS = ["EMAIL_OTP", "SMS_OTP"];
+/**
+* `Policies.SignInPolicy.AllowedFirstAuthFactors` as a list of STRINGS, or an
+* empty list when the template declares nothing usable there.
+*
+* Every mis-shape reads as ABSENT rather than as a violation: this feeds a
+* REFUSAL, so guessing at a container cdkd could not read would block a deploy
+* over a value it never understood. A genuinely broken `Policies` blob is AWS's
+* to reject, with its own message.
+*
+* The two containers are traversed with `?.` rather than with the
+* `typeof x === 'object' && !Array.isArray(x)` guard `config-shape.ts` uses,
+* and that is deliberate rather than sloppy: those guards are load-bearing
+* THERE because the helper REFUSES a non-object, while here the only outcome is
+* "no factors", which is exactly what indexing a string / number / array
+* already yields. The version carrying them was written first and MEASURED
+* inert -- deleting either clause failed no test and could not be made to,
+* since no template value indexes to anything at those keys. `?.` keeps the one
+* behaviour that is real (a declared `null` throws on a bare index) and leaves
+* nothing unfalsifiable behind.
+*
+* The two filters below are NOT the same kind of thing, and saying so matters
+* because an earlier revision of this comment claimed both were load-bearing and
+* "each fenced by a test" -- which was false for one of them, and a false fence
+* claim is what stops the next reader re-checking.
+*
+*  - `Array.isArray` is a RUNTIME guard and IS fenced: without it a scalar
+*    `AllowedFirstAuthFactors: 'EMAIL_OTP'` is read as a declaration and
+*    refused, and the test for that shape reds when it is dropped.
+*  - The string filter is a TYPE NARROWING and is INERT at runtime. `includes`
+*    compares by SameValueZero, so a non-string member can never equal a
+*    deny-list entry however it is spelled; deleting the filter fails NO test,
+*    and no test could be written that it would fail. It earns its place by
+*    giving the caller a `string[]`, and by keeping this function honest if a
+*    future caller ever COERCES a member instead of comparing it. The
+*    nested-list case in the suite fences that hypothetical `String(member)`
+*    implementation -- i.e. the mistake, not this code.
+*/
+function readAllowedFirstAuthFactors(properties) {
+	const factors = (properties["Policies"]?.["SignInPolicy"])?.["AllowedFirstAuthFactors"];
+	if (!Array.isArray(factors)) return [];
+	return factors.filter((factor) => typeof factor === "string");
+}
+/**
+* The PRE-FLIGHT: the reason this user-pool configuration cannot be applied at
+* all, or `undefined` when nothing is known to refuse it.
+*
+* Two rules, both for combinations AWS rejects 100% of the time, and both
+* raised BEFORE the first AWS call on BOTH the create and the update path. The
+* ordering is what makes them worth refusing rather than warning about: on the
+* UPDATE path `UpdateUserPool` lands FIRST and `SetUserPoolMfaConfig` is
+* refused afterwards, so sending the request leaves a PARTIAL APPLY behind --
+* with the security-relevant half being the half that did NOT apply (the MFA
+* configuration), while the half that did is the one loosening authentication.
+* Nothing unwinds it, and a retry cannot succeed until the user reverse-engineers
+* an AWS-worded error about a field they did not think they were changing.
+*
+* Rule 1 (issue #1977) -- `MfaConfiguration` resolves to OFF while the request
+* carries an MFA factor block. MEASURED us-east-1 2026-08-19 (issue #1968):
+*
+*   {ON,  SoftwareTokenMfaConfiguration: {Enabled: true}}   -> ACCEPTED (control)
+*   {OFF, SoftwareTokenMfaConfiguration: {Enabled: true}}   -> rejected
+*   {OFF, SoftwareTokenMfaConfiguration: {Enabled: false}}  -> rejected
+*   {OFF, EmailMfaConfiguration: {Message, Subject}}        -> rejected
+*
+* all with `InvalidParameterException: Invalid MFA configuration given, can't
+* turn off MFA and configure an MFA together`. The `Enabled: false` arm settles
+* the KEY: a block that enables NOTHING is still refused, so the rule is about
+* the block's PRESENCE -- exactly what `hasAnyMfaFactorBlock` tests -- and
+* since that predicate is precisely the three factor sub-blocks, no accepted
+* case survives. (Bound on the Email arm: an OPTIONAL control with that block
+* failed with a DIFFERENT error, "Cannot set EmailMfaConfiguration when user
+* pool EmailConfiguration contains an EmailSendingAccount of COGNITO_DEFAULT",
+* so it has no isolated control of its own -- informative in itself, since it
+* shows the exclusion is evaluated BEFORE the email-sending-account check.)
+*
+* Rule 2 (issue #1975) -- the `SetUserPoolMfaConfig` request resolves
+* `MfaConfiguration` to ON while `Policies.SignInPolicy.AllowedFirstAuthFactors`
+* allows `EMAIL_OTP` or `SMS_OTP`. AWS refuses with `Only PASSWORD and WEB_AUTHN
+* (if configured) can be enabled as an auth factor if MFA is enabled`. MEASURED
+* us-east-1 2026-08-19, both members and both MFA modes:
+*
+*   {[PASSWORD, EMAIL_OTP], ON}       -> rejected
+*   {[PASSWORD, EMAIL_OTP], OPTIONAL} -> ACCEPTED
+*   {[PASSWORD, SMS_OTP],   ON}       -> rejected (pool WITH a valid SmsConfiguration)
+*   {[PASSWORD, SMS_OTP],   OPTIONAL} -> ACCEPTED
+*
+* So `=== 'ON'` is MEASURED-CORRECT rather than merely conservative: OPTIONAL is
+* ACCEPTED, and widening this to `!== 'OFF'` would REFUSE A WORKING DEPLOY. An
+* earlier revision of this comment called OPTIONAL unmeasured; it is not, and
+* the measurement is what settles the narrowing rather than a cost argument.
+*
+* WHY THE MESSAGE DOES NOT OFFER `WEB_AUTHN` AS THE ESCAPE HATCH, even though
+* AWS's own error text names it as accepted. MEASURED us-east-1 2026-08-20: a
+* pool allowing `WEB_AUTHN` as a first auth factor is REJECTED by
+* `SetUserPoolMfaConfig(ON, SoftwareTokenMfa)` --
+*
+*   InvalidParameterException: Cannot set WebAuthn factor configuration to
+*   SINGLE_FACTOR if MFA is required and WebAuthn is an allowed first auth factor
+*
+* -- with NO WebAuthn block at all, with `UserVerification: preferred`, and with
+* `required`. The only accepted shape is
+* `WebAuthnConfiguration.FactorConfiguration = MULTI_FACTOR_WITH_USER_VERIFICATION`,
+* and the PINNED SDK (`@aws-sdk/client-cognito-identity-provider` 3.1018.0)
+* does not carry that field -- `WebAuthnConfigurationType` is exactly
+* `{RelyingPartyId?, UserVerification?}` -- so cdkd cannot reach it today.
+* Telling the user to switch to `WEB_AUTHN` would therefore be advice that
+* cannot be followed, which is why the remedy names removing the factor or
+* lowering `MfaConfiguration` instead.
+*
+* That same measurement means `WEB_AUTHN` + ON reproduces this very
+* partial-apply shape while NOT being on the deny-list. Deliberately left
+* uncovered: the correct rule there is CONDITIONAL on
+* `WebAuthnConfiguration.FactorConfiguration`, which the pinned SDK cannot
+* express, so a flat deny-list entry would be an OVER-REFUSAL of the shape that
+* becomes valid the moment the SDK gains the field. Tracked as issue #2064.
+*
+* SCOPE LIMIT, deliberate and load-bearing: rule 2 fires only when a
+* `SetUserPoolMfaConfig` request is actually BUILT (`hasMfaConfigProps`), i.e.
+* the template declares `EnabledMfas` / an email-OTP message or subject /
+* WebAuthn. With NONE of those, `MfaConfiguration` rides on the SINGLE
+* `CreateUserPool` / `UpdateUserPool` call and no second call follows -- so
+* there is no two-call window and structurally NOTHING to partly apply, which
+* is the entire harm this pre-flight exists to prevent. Refusing there would
+* ALSO be an over-refusal on a shape AWS accepts: a pool created with
+* `AllowedFirstAuthFactors: [PASSWORD, EMAIL_OTP]` and no MFA configuration
+* call at all is ACCEPTED (measured, same session -- the pool came up fine and
+* only the later `SetUserPoolMfaConfig(ON)` failed). Such a template is left to
+* AWS, which answers it atomically.
+*
+* CLOUDFORMATION PARITY, settled by A/B rather than assumed -- both issues made
+* this an explicit precondition. CloudFormation hits the SAME rejections and
+* rolls the stack back:
+*
+*   {MfaConfiguration: OFF, EnabledMfas: [SOFTWARE_TOKEN_MFA]}
+*     -> ROLLBACK_COMPLETE, "Invalid MFA configuration given, can't turn off
+*        MFA and configure an MFA together"
+*   {MfaConfiguration: ON, EnabledMfas: [SOFTWARE_TOKEN_MFA],
+*    AllowedFirstAuthFactors: [PASSWORD, EMAIL_OTP]}  (ESSENTIALS tier)
+*     -> ROLLBACK_COMPLETE, "Only PASSWORD and WEB_AUTHN..."
+*
+* So refusing is PARITY-PRESERVING, not a divergence: cdkd refuses the same SET
+* of templates CloudFormation refuses, only EARLIER (before the first API call
+* instead of after a partial apply) and in cdkd's own wording. Nothing that
+* deploys under CloudFormation is blocked here.
+*
+* Both rules read the value cdkd would SEND rather than the raw template value,
+* from ONE `buildMfaConfigRequest` call, so the refusal and the request can
+* never disagree about what OFF / ON means for a given bag. The build runs with
+* NO logger, so the pre-flight is silent and `applyMfaConfig`'s own warnings
+* still fire exactly once.
+*
+* WHAT THIS CANNOT SEE, stated because the message says "refuses it before
+* sending anything" and that reads as a completeness claim: the pre-flight
+* inspects the TEMPLATE, never the live pool, so two template edits reach the
+* same partial apply without tripping it -- DELETING the `SignInPolicy` block
+* while setting `MfaConfiguration: ON`, and OMITTING `MfaConfiguration` while
+* adding `EMAIL_OTP` to a pool whose live MFA is already ON. Both need a
+* live-state guard and are tracked in #2051.
+*
+* Deliberately UNCONDITIONAL -- no `CreateContext.replayingState` downgrade.
+* `.claude/rules/providers.md` says a create-path pre-flight refusal MUST
+* downgrade on a replay, so this is a STATED EXCEPTION rather than an
+* oversight, and the rule's own reasoning is what licenses it: the downgrade
+* exists because a refusal against a STATE record leaves a resource
+* un-rollbackable with no template-side remedy. That presupposes the replay
+* could otherwise SUCCEED. Here it cannot -- both combinations are rejected by
+* AWS 100% of the time (measured above, and CloudFormation rolls back on the
+* same templates), so downgrading would trade a clear cdkd-worded refusal for
+* the identical failure arriving later from AWS, on the create path with a
+* pool to roll back and on the update path with a partial apply. A state record
+* additionally cannot legitimately HOLD either combination: state is written
+* only after a SUCCESSFUL apply, and neither can be applied. Revisit this if
+* AWS ever starts accepting one of them.
+*/
+function describeUnsupportedMfaCombination(properties, declaredMfaConfiguration) {
+	const request = buildMfaConfigRequest("", properties, void 0, declaredMfaConfiguration);
+	if (request && request.MfaConfiguration === "OFF" && hasAnyMfaFactorBlock(request)) {
+		const blocks = [
+			...request.SmsMfaConfiguration !== void 0 ? ["SmsMfaConfiguration"] : [],
+			...request.SoftwareTokenMfaConfiguration !== void 0 ? ["SoftwareTokenMfaConfiguration"] : [],
+			...request.EmailMfaConfiguration !== void 0 ? ["EmailMfaConfiguration"] : []
+		];
+		return `${MFA_CONFIGURATION_PATH} is OFF while an MFA factor is configured (SetUserPoolMfaConfig would carry ${blocks.join(", ")}, built from EnabledMfas / EmailAuthenticationMessage / EmailAuthenticationSubject). AWS rejects that combination ("Invalid MFA configuration given, can't turn off MFA and configure an MFA together"), so cdkd refuses it before sending anything rather than leaving a partly-applied update behind. Set MfaConfiguration to ON or OPTIONAL (or remove it) to enable the declared factor. (If MFA is genuinely not wanted, remove EnabledMfas / EmailAuthenticationMessage / EmailAuthenticationSubject instead.)`;
+	}
+	if (request && request.MfaConfiguration === "ON") {
+		const denied = MFA_INCOMPATIBLE_FIRST_AUTH_FACTORS;
+		const offending = readAllowedFirstAuthFactors(properties).filter((factor) => denied.includes(factor));
+		if (offending.length > 0) return `${MFA_CONFIGURATION_PATH} is ON while Policies.SignInPolicy.AllowedFirstAuthFactors allows ${offending.join(", ")}. AWS rejects that combination ("Only PASSWORD and WEB_AUTHN (if configured) can be enabled as an auth factor if MFA is enabled"), and on an update the sign-in policy has already been applied by the time it does, so cdkd refuses it before sending anything rather than leaving a partly-applied update behind. Remove ${offending.join(", ")} from Policies.SignInPolicy.AllowedFirstAuthFactors, leaving PASSWORD. (Setting MfaConfiguration to OPTIONAL or OFF also clears the conflict, but weakens MFA.)`;
+	}
+}
+/**
 * Replace a DECLARED-but-unusable `MfaConfiguration` with the value cdkd
 * actually sends, or drop the key when nothing is sent. Returns the input
 * object unchanged when nothing applies, so the common case compares
@@ -40158,7 +40399,7 @@ var CognitoUserPoolProvider = class {
 		"WebAuthnRelyingPartyID",
 		"WebAuthnUserVerification"
 	])]]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Map([["WebAuthnFactorConfiguration", "No SDK wire path: @aws-sdk/client-cognito-identity-provider has no field accepting SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION (not on CreateUserPool/UpdateUserPool, nor SetUserPoolMfaConfig.WebAuthnConfiguration which only carries RelyingPartyId/UserVerification); CC-API-registry-only property"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Map([["WebAuthnFactorConfiguration", "No wire path in the PINNED SDK (@aws-sdk/client-cognito-identity-provider 3.1018.0): WebAuthnConfigurationType is {RelyingPartyId?, UserVerification?} and no CreateUserPool/UpdateUserPool field accepts SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION. This is an SDK-VERSION limit, NOT an API one -- the live API does honour FactorConfiguration (measured us-east-1 2026-08-20: SetUserPoolMfaConfig(ON) on a pool allowing WEB_AUTHN as a first auth factor is rejected with \"Cannot set WebAuthn factor configuration to SINGLE_FACTOR if MFA is required and WebAuthn is an allowed first auth factor\", i.e. the service reads a field the SDK cannot send). RE-EVALUATE THIS ENTRY ON AN SDK BUMP: if WebAuthnConfigurationType gains FactorConfiguration, the property becomes handleable and this entry must go"]])]]);
 	/**
 	* Warn when `MfaConfiguration` is declared as a BLANK string (issue #1925
 	* item 2, review round 2).
@@ -40187,6 +40428,26 @@ var CognitoUserPoolProvider = class {
 		this.logger.warn("AWS::Cognito::UserPool MfaConfiguration is an empty string, which declares no MFA mode and is treated as absent -- a collapsed Fn::Join or an empty String parameter produces this shape. The pool deploys with the default MFA configuration instead; declare ON / OPTIONAL / OFF explicitly, or omit the property, to say which was meant.");
 	}
 	/**
+	* Raise {@link describeUnsupportedMfaCombination}'s verdict as a typed
+	* refusal, or return silently when there is nothing to refuse.
+	*
+	* A `ProvisioningError` so both call sites behave the way each already does
+	* with the sibling `MfaConfiguration` shape refusal: on the create path it
+	* surfaces as the provider's own error rather than an AWS one, and on the
+	* update path `update()`'s catch re-throws an already-wrapped
+	* `ProvisioningError` unchanged, so it is not double-wrapped. Both call sites
+	* are OUTSIDE their method's try, so the throw travels untouched either way.
+	*
+	* `target` is the pool NAME on create (there is no physical id yet) and the
+	* physical id on update, matching what each path passes to its other
+	* `ProvisioningError`s.
+	*/
+	assertMfaCombinationApplicable(logicalId, resourceType, target, properties, declaredMfaConfiguration) {
+		const reason = describeUnsupportedMfaCombination(properties, declaredMfaConfiguration);
+		if (reason === void 0) return;
+		throw new ProvisioningError(reason, resourceType, logicalId, target);
+	}
+	/**
 	* The DIFF-side half of the `MfaConfiguration` substitution record.
 	*
 	* Applied by `DiffCalculator` to BOTH comparison sides, so a template that
@@ -40276,6 +40537,7 @@ var CognitoUserPoolProvider = class {
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, poolName, error instanceof Error ? error : void 0);
 		}
+		this.assertMfaCombinationApplicable(logicalId, resourceType, poolName, properties, mfaConfiguration);
 		let createdUserPoolId;
 		try {
 			const createParams = { PoolName: poolName };
@@ -40445,7 +40707,8 @@ var CognitoUserPoolProvider = class {
 	*   sub-block in the request AWS REJECTS the call; with none it accepts and
 	*   resets the pool to MFA-disabled. An EXPLICIT OFF beside a block is
 	*   rejected the same way (2026-08-19, issue #1968; the transcript lives at
-	*   the pinned-OFF warning in `buildMfaConfigRequest`).
+	*   `describeUnsupportedMfaCombination`, which since issue #1977 REFUSES that
+	*   combination before any call rather than warning about it).
 	*
 	* Nothing here licenses a claim about a field on neither list, or about one
 	* API from the other's section. Measure it.
@@ -40523,6 +40786,7 @@ var CognitoUserPoolProvider = class {
 		this.logger.debug(`Updating Cognito User Pool ${logicalId}: ${physicalId}`);
 		const mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], { onUnusable: (message) => this.logger.warn(message) });
 		this.warnOnBlankMfaConfiguration(properties["MfaConfiguration"]);
+		this.assertMfaCombinationApplicable(logicalId, resourceType, physicalId, properties, mfaConfiguration);
 		const liveMfa = mfaConfiguration === "" && hasMfaConfigProps(properties) ? await this.readLiveMfaConfiguration(physicalId) : void 0;
 		try {
 			const updateParams = { UserPoolId: physicalId };
@@ -82898,7 +83162,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.13");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.14");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;