@go-to-k/cdkd 0.284.13 → 0.284.15

package/dist/{deploy-engine-4Eh5Qqlm.js → deploy-engine-BNujuzW5.js}

@@ -12850,6 +12850,25 @@ function buildUnknownIntrinsicError(key) {
 	const issueUrl = `https://github.com/go-to-k/cdkd/issues/new?title=${encodeURIComponent(title)}&labels=intrinsic-support`;
 	return /* @__PURE__ */ new Error(`Unsupported CloudFormation intrinsic function "${key}": cdkd does not support resolving it yet. Deploying this template would produce a broken value. Please request support by opening an issue: ${issueUrl}`);
 }
+/**
+* Does `value` carry a CloudFormation dynamic reference anywhere inside it?
+*
+* Used as the identity fast path of {@link
+* IntrinsicFunctionResolver.reresolveCrossStackValue}: a cross-stack value that
+* carries none is returned untouched, so every ordinary import keeps its
+* pre-#1934 behaviour with no walk, no AWS call and no allocation.
+*
+* The walk descends arrays and objects because `state.outputs` is typed
+* `Record<string, unknown>` and deliberately NOT coerced to string — a
+* list-valued `Fn::GetAtt` persists a JSON array — so a secret-bearing output
+* is not always a bare string.
+*/
+function carriesDynamicReference(value) {
+	if (typeof value === "string") return value.includes("{{resolve:");
+	if (Array.isArray(value)) return value.some(carriesDynamicReference);
+	if (value !== null && typeof value === "object") return Object.values(value).some(carriesDynamicReference);
+	return false;
+}
 let cachedAccountIdentity = null;
 /**
 * Cache for availability zones per region
@@ -13148,7 +13167,7 @@ function stringifyParameterForLog(paramDef, value) {
 	if (paramDef?.NoEcho === true) return "<redacted>";
 	return stringifyValue(value);
 }
-var IntrinsicFunctionResolver = class {
+var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	logger = getLogger().child("IntrinsicFunctionResolver");
 	resolverRegion;
 	/**
@@ -13208,6 +13227,55 @@ var IntrinsicFunctionResolver = class {
 	* another's identity, which is a worse bug than the one this cache serves.
 	*/
 	regionScopedClients = /* @__PURE__ */ new Map();
+	/**
+	* ServiceDiscovery clients keyed by the region {@link clientsForRegion}
+	* selected (`''` when it selected none). See {@link serviceDiscoveryClient}
+	* for why this one service is not read off an `AwsClients` bag, and why the
+	* PROMISE rather than the client is what is stored.
+	*/
+	serviceDiscoveryClients = /* @__PURE__ */ new Map();
+	/**
+	* Resolvers pinned to a PRODUCER stack's region, for re-resolving a
+	* cross-stack imported value that was persisted REDACTED (issue
+	* [#1934](https://github.com/go-to-k/cdkd/issues/1934)); see
+	* {@link reresolveCrossStackValue}.
+	*
+	* A whole resolver rather than a client bag, because what has to be
+	* region-scoped is not only the lookup but the VALUE CACHE behind it:
+	* {@link cachedDynamicReferences} is keyed by the expression alone and is
+	* sound only because one resolver stands for one stack in one region (issue
+	* #1933). Resolving a producer's expression inside THIS resolver would put a
+	* foreign region's answer under a key the consumer's own lookups read — the
+	* exact cross-region leak that field's instance scope closed. A separate
+	* resolver per producer region keeps that invariant by construction.
+	*
+	* WHAT THAT DOES *NOT* BUY, stated because an earlier revision of this note
+	* implied it did: a separate instance isolates only the state this class
+	* OWNS. The `{{resolve:...}}` SECRET VERDICT store lives in
+	* `secret-redaction.ts`, is process-global and is keyed by the expression
+	* string alone, so a guest's resolution would still pin a foreign region's
+	* verdict for every later reader. That half is closed at the WRITE instead —
+	* see {@link pinSecretVerdict} and {@link producerRegionGuest}, which also
+	* record why re-keying that store is not available from this lane.
+	*
+	* Bounded like {@link regionScopedClients}: an entry exists only for a
+	* producer region that DIFFERS from this resolver's own, and at most one per
+	* such region. Same lifetime too — the resolver's own, with no teardown.
+	*/
+	producerRegionResolvers = /* @__PURE__ */ new Map();
+	/**
+	* True on a resolver built by {@link resolverForProducerRegion} to answer for
+	* ANOTHER stack's region — a read-only guest of this deploy.
+	*
+	* Its one consequence is {@link pinSecretVerdict}: a guest never writes the
+	* PROCESS-GLOBAL secret-verdict store, because a verdict keyed by the
+	* expression string alone would carry a foreign region's answer into the
+	* consumer's own next pass. Deliberately NOT on
+	* {@link IntrinsicFunctionResolverOptions} — no caller outside this class may
+	* declare itself a guest, and the flag is set by the one line that builds
+	* one.
+	*/
+	producerRegionGuest = false;
 	strictGetAtt;
 	cfnFallback;
 	/**
@@ -13474,6 +13542,56 @@ var IntrinsicFunctionResolver = class {
 		return scoped;
 	}
 	/**
+	* The ServiceDiscovery client for the `HostedZoneId` namespace lookup, in the
+	* region {@link clientsForRegion} selects (issue
+	* [#1994](https://github.com/go-to-k/cdkd/issues/1994)).
+	*
+	* It is BUILT here rather than read off the bag for one reason: `AwsClients`
+	* carries no `serviceDiscovery` member, and adding one would put a static
+	* `@aws-sdk/client-servicediscovery` import into a module every command
+	* loads. So the REGION DECISION is still `clientsForRegion`'s — including its
+	* ambient-reuse rule and its refusal of a region that is not client-safe —
+	* and only the construction is local: the chosen bag's
+	* {@link AwsClients.credentialConfig} carries `--profile` / explicit
+	* credentials across, and its {@link AwsClients.configuredRegion} is the
+	* region to pin. An UNCONFIGURED bag (no region was ever named, i.e. the
+	* no-argument constructor) pins nothing and lets the SDK's own chain
+	* resolve — the same arm-1 answer `clientsForRegion` gives, and strictly
+	* better than the `resolverRegion` this site used to read, which substitutes
+	* `AWS_REGION` and then a hard-coded `us-east-1`.
+	*
+	* The PROMISE is memoized, not the client: the dynamic import makes this
+	* async, so two callers arriving from different await depths can both be
+	* inside the seam and would each construct (and leak) their own client. That
+	* is defensive rather than measured — the unit case dispatching ten lookups
+	* together produces ONE client either way, because they serialize on
+	* `getAccountInfo`'s in-flight promise and reach here one at a time, which
+	* the case says out loud. A REJECTED import is evicted
+	* so a transient failure does not poison the rest of the deploy, mirroring
+	* `cfnExportsPromise`. Lifetime is the resolver's own, like
+	* {@link regionScopedClients} and {@link cfnClients}: at most one per region
+	* per resolver, versus the one-per-CALL this replaces.
+	*/
+	async serviceDiscoveryClient() {
+		const scoped = this.clientsForRegion(this.explicitRegion);
+		const region = scoped.configuredRegion;
+		const key = region ?? "";
+		const cached = this.serviceDiscoveryClients.get(key);
+		if (cached) return cached;
+		const building = (async () => {
+			const { ServiceDiscoveryClient } = await import("@aws-sdk/client-servicediscovery");
+			return new ServiceDiscoveryClient({
+				...scoped.credentialConfig ?? {},
+				...region ? { region } : {}
+			});
+		})();
+		this.serviceDiscoveryClients.set(key, building);
+		building.catch(() => {
+			if (this.serviceDiscoveryClients.get(key) === building) this.serviceDiscoveryClients.delete(key);
+		});
+		return building;
+	}
+	/**
 	* Resolve parameter values from template Parameters section
 	*
 	* Merges default values from template with user-provided parameter values.
@@ -13884,8 +14002,7 @@ var IntrinsicFunctionResolver = class {
 			case "VpcId": return physicalId;
 			case "CidrBlock": return resource.attributes?.["CidrBlock"] || resource.properties?.["CidrBlock"];
 			case "Ipv6CidrBlocks": try {
-				const { EC2Client, DescribeVpcsCommand } = await import("@aws-sdk/client-ec2");
-				const ec2 = new EC2Client({ region: this.resolverRegion });
+				const ec2 = this.clientsForRegion(this.explicitRegion).ec2;
 				const maxAttempts = 15;
 				for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 					const associations = (await ec2.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0]?.Ipv6CidrBlockAssociationSet || [];
@@ -13984,8 +14101,8 @@ var IntrinsicFunctionResolver = class {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:namespace/${physicalId}`;
 			case "Id": return physicalId;
 			case "HostedZoneId": try {
-				const { ServiceDiscoveryClient, GetNamespaceCommand } = await import("@aws-sdk/client-servicediscovery");
-				return (await new ServiceDiscoveryClient({ region: this.resolverRegion }).send(new GetNamespaceCommand({ Id: physicalId }))).Namespace?.Properties?.DnsProperties?.HostedZoneId;
+				const { GetNamespaceCommand } = await import("@aws-sdk/client-servicediscovery");
+				return (await (await this.serviceDiscoveryClient()).send(new GetNamespaceCommand({ Id: physicalId }))).Namespace?.Properties?.DnsProperties?.HostedZoneId;
 			} catch (error) {
 				this.logger.warn(`Failed to fetch HostedZoneId for namespace ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 				return;
@@ -14542,6 +14659,174 @@ var IntrinsicFunctionResolver = class {
 		return result;
 	}
 	/**
+	* Re-resolve the dynamic references in a value read out of a PRODUCER
+	* stack's persisted outputs, before it is handed to the consumer (issue
+	* [#1934](https://github.com/go-to-k/cdkd/issues/1934)).
+	*
+	* Since PR #1899 a secret-bearing output is stored REDACTED: `state.outputs`
+	* and the exports index hold `{{resolve:secretsmanager:X:SecretString:pw}}`
+	* rather than the resolved value. A consumer resolving `Fn::ImportValue` /
+	* `Fn::GetStackOutput` got that string back VERBATIM and shipped the literal
+	* token to AWS as the property value — the GHSA-p5qg-v9gv-hc7w class one
+	* more time, and the same shape `resolveReplayProps` fixed for the rollback
+	* replay and #1914 fixed for `cdkd drift --revert`. Every place that reads a
+	* REDACTED bag and hands it onward has to re-resolve first; the cross-stack
+	* import edge was the one that was missed, because the redaction and the
+	* consumption live in different stacks and often different runs.
+	*
+	* `{{resolve:` re-resolution in {@link resolveValue} could not cover it: that
+	* arm fires for a leaf INPUT string, and an intrinsic's RETURN value is never
+	* fed back through it.
+	*
+	* WHICH REGION RESOLVES IT — the producer's, via {@link
+	* resolverForProducerRegion}. The expression was resolved BY the producer IN
+	* the producer's region, so that is the only region whose answer reproduces
+	* the value the producer exported; a Secrets Manager secret or an SSM
+	* parameter of the same NAME in two regions is two independent values (issue
+	* #1933). The index hit carries `entry.producerRegion` (a required field) and
+	* `Fn::GetStackOutput` carries the reference's own resolved `Region`, so both
+	* of those are recorded rather than inferred.
+	*
+	* THE SCAN ARM IS THE EXCEPTION, and it is one this method inherits rather
+	* than introduces: a pre-v2 state record has no `region` field, so the scan
+	* reads it as `refRegion ?? this.resolverRegion` — the consumer's own region,
+	* itself defaulted through `AWS_REGION` and then `us-east-1`. Where that
+	* guess is wrong the re-resolution asks the wrong region and either misses
+	* the secret (a hard failure naming the lookup, since issue #1934's
+	* restructure surfaces it rather than degrading to `export not found`) or
+	* resolves a same-named secret in the consumer's region. What bounds it is
+	* that the guess is the SAME one the state READ just used, so this method
+	* cannot disagree with the record it was handed — a region-less record was
+	* already being read from that region or not found at all. The honest fix is
+	* a region on the record, which is what schema v2 did for every record
+	* written since.
+	*
+	* WHICH CREDENTIALS — the consumer's, which are the producer's too for every
+	* path that reaches here. `Fn::ImportValue` reads the account-scoped state
+	* bucket / exports index, so a producer it can see is in this account by
+	* construction, and the cross-ACCOUNT `Fn::GetStackOutput` path deliberately
+	* never calls this (see the refusal at its call site) rather than resolving a
+	* producer's expression under the consumer's identity — which would answer
+	* from a same-named secret in the WRONG account, the #1957 disclosure shape.
+	*
+	* The CONSUMER's `context` is passed through, which is what keeps the
+	* consumer's own state redacted: each resolved plaintext is recorded into its
+	* `recordedSecretValues`, so the deploy engine's save choke point rewrites it
+	* back to the expression on the way into `state.json`. It also means
+	* `skipDynamicReferences` is honoured, so the diff / no-op path keeps
+	* comparing expression-vs-expression instead of fetching a secret to print.
+	*
+	* Identity-returns a value carrying no `{{resolve:` at all, so an ordinary
+	* import is untouched.
+	*
+	* THE WALK BELOW IS A THIRD COPY, and that is recorded rather than fixed.
+	* `rollback-executor.ts`'s `resolveReplayProps` carries the same descent, and
+	* `drift.ts`'s `resolveStateSecretExpressions` the same idea. Extracting one
+	* helper is the right end state and is NOT this change's to make: the natural
+	* home is beside those callers, in files a parallel lane owns, and a
+	* cross-module extraction done from here would edit them. Two things a future
+	* extractor needs that a mechanical merge would drop: this copy rebuilds
+	* objects with `Object.create(null)` (the `__proto__` hazard below), and it
+	* takes the RESOLVER as a parameter because the region it must answer for is
+	* the producer's rather than the caller's — which is exactly what issue #2057
+	* says the other two copies get wrong.
+	*/
+	async reresolveCrossStackValue(value, producerRegion, context, origin) {
+		if (!carriesDynamicReference(value)) return value;
+		const resolver = this.resolverForProducerRegion(producerRegion);
+		const walk = async (v) => {
+			if (typeof v === "string") return v.includes("{{resolve:") ? await resolver.resolveDynamicReferences(v, context) : v;
+			if (Array.isArray(v)) {
+				const out = new Array(v.length);
+				for (let i = 0; i < v.length; i++) out[i] = await walk(v[i]);
+				return out;
+			}
+			if (v !== null && typeof v === "object") {
+				const out = Object.create(null);
+				for (const [k, val] of Object.entries(v)) out[k] = await walk(val);
+				return out;
+			}
+			return v;
+		};
+		this.logger.debug(`Re-resolving dynamic reference(s) in ${origin}`);
+		return await walk(value);
+	}
+	/**
+	* The resolver that must answer for a PRODUCER region — `this` when the
+	* producer shares this resolver's own region, otherwise the pinned sibling
+	* from {@link producerRegionResolvers}.
+	*
+	* The comparison is against {@link explicitRegion}, NOT {@link
+	* resolverRegion}: the latter substitutes `AWS_REGION` and then a hard-coded
+	* `us-east-1`, so comparing against it would answer "same region" on the
+	* strength of a guess and resolve the producer's expression against whatever
+	* the ambient clients happen to point at. When no region was named, a producer
+	* region that IS named still binds — "unknown means SCOPE, not skip", the same
+	* rule {@link clientsForRegion} applies, and the same one `Fn::GetAZs` already
+	* follows for its template-named region.
+	*/
+	/**
+	* Pin (or retract) a `{{resolve:...}}` secret verdict in the PROCESS-GLOBAL
+	* store — unless this resolver is a producer-region GUEST, which writes
+	* nothing there.
+	*
+	* The guest suppression is the correction the review of issue #1934 forced,
+	* and the isolation note on {@link producerRegionResolvers} used to overstate
+	* what a per-region resolver bought. The value cache is per-instance, but the
+	* VERDICT store is not this class's — it lives in `secret-redaction.ts` and is
+	* keyed by the expression STRING alone, so a producer-region resolution would
+	* pin a FOREIGN region's answer for the whole process. The consequence is
+	* concrete, and it lands on the consumer's very next pass: `isKnownSecret`
+	* consults that store, and on the `skipDynamicReferences` (diff / no-op) path
+	* a `true` verdict SKIPS the lookup and leaves the expression unresolved — so
+	* a consumer-region parameter that is a plain `String`, and which state
+	* therefore holds RESOLVED, would be compared as an expression and report a
+	* spurious change on every run. That is issue #1901's perpetual-UPDATE class,
+	* arriving through a region boundary the store cannot see.
+	*
+	* KEYING THE STORE BY REGION IS THE BETTER FIX AND IS NOT AVAILABLE FROM
+	* HERE. `secret-redaction.ts` reads its own store internally with the BARE
+	* expression (`isKnownSecretExpression`, and the mixed-leaf public-reference
+	* test), so a region-qualified key would silently stop matching for the
+	* redaction path — losing the #1910 losing-member arm and changing the #1926
+	* empty-map verdict — and that file is owned by another lane in this run.
+	* Suppressing the WRITE is the half that is correct on its own: it removes
+	* the new cross-region reachability without changing the key, and the
+	* consumer's own resolver keeps pinning its own region's verdicts exactly as
+	* before.
+	*
+	* READS are deliberately NOT suppressed. A guest reading the consumer's
+	* verdict can only seed `isKnownSecret`, which for `ssm` is OVERWRITTEN by
+	* the fresh `GetParameter` response, and on the skip path it produces the
+	* unresolved expression the diff wants anyway. Only the write direction
+	* carried the defect.
+	*
+	* The cost of suppressing is one `GetParameter` per foreign expression per
+	* later pass, since the guest's OWN instance cache still carries the verdict
+	* alongside the value (issue #1933's design) and answers every repeat within
+	* the deploy.
+	*/
+	pinSecretVerdict(expression, secret) {
+		if (this.producerRegionGuest) return;
+		if (secret) recordedSecretExpressions.add(expression);
+		else recordedSecretExpressions.delete(expression);
+	}
+	resolverForProducerRegion(producerRegion) {
+		if (!producerRegion) return this;
+		const target = canonicalizeRegion(producerRegion);
+		if (target === canonicalizeRegion(this.explicitRegion)) return this;
+		const cached = this.producerRegionResolvers.get(target);
+		if (cached) return cached;
+		const scoped = new IntrinsicFunctionResolver(target, {
+			strictGetAtt: this.strictGetAtt,
+			cfnFallback: this.cfnFallback
+		});
+		scoped.producerRegionGuest = true;
+		this.producerRegionResolvers.set(target, scoped);
+		this.logger.debug(`Using a producer-region resolver for ${target}`);
+		return scoped;
+	}
+	/**
 	* Resolve Fn::ImportValue (cross-stack references)
 	*
 	* Searches all other stacks for an exported output with the given name.
@@ -14551,18 +14836,23 @@ var IntrinsicFunctionResolver = class {
 		if (typeof exportName !== "string") throw new Error(`Fn::ImportValue: export name must resolve to a string, got ${typeof exportName}`);
 		if (!context.stateBackend) throw new Error("Fn::ImportValue: state backend is required for cross-stack references");
 		this.logger.debug(`Resolving Fn::ImportValue: ${exportName}`);
-		if (context.exportIndex) try {
-			const entry = await context.exportIndex.lookup(exportName);
+		if (context.exportIndex) {
+			let entry;
+			try {
+				entry = await context.exportIndex.lookup(exportName);
+			} catch (err) {
+				this.logger.warn(`Exports index lookup failed for '${exportName}': ${err instanceof Error ? err.message : String(err)}; falling back to state.json scan`);
+				entry = void 0;
+			}
 			if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
 				this.recordImport(context, exportName, entry.producerStack, entry.producerRegion);
 				this.logger.info(`Resolved Fn::ImportValue: ${exportName} = ${JSON.stringify(entry.value)} (from index: ${entry.producerStack} / ${entry.producerRegion})`);
-				return entry.value;
+				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${exportName}' (producer ${entry.producerStack} / ${entry.producerRegion})`);
 			}
-		} catch (err) {
-			this.logger.warn(`Exports index lookup failed for '${exportName}': ${err instanceof Error ? err.message : String(err)}; falling back to state.json scan`);
 		}
 		const allStacks = await context.stateBackend.listStacks();
 		this.logger.debug(`Found ${allStacks.length} state record(s) to search for export: ${exportName}`);
+		let found;
 		for (const ref of allStacks) {
 			const { stackName: refStack, region: refRegion } = ref;
 			if (context.stackName && refStack === context.stackName) {
@@ -14592,13 +14882,19 @@ var IntrinsicFunctionResolver = class {
 						this.logger.debug(`Failed to patch exports index for '${exportName}': ${err instanceof Error ? err.message : String(err)}`);
 					});
 					this.recordImport(context, exportName, refStack, lookupRegion);
-					return value;
+					found = {
+						value,
+						refStack,
+						lookupRegion
+					};
+					break;
 				}
 			} catch (error) {
 				this.logger.warn(`Failed to read state for stack ${refStack}: ${error instanceof Error ? error.message : String(error)}`);
 				continue;
 			}
 		}
+		if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue '${exportName}' (producer ${found.refStack} / ${found.lookupRegion})`);
 		if (this.cfnFallback) {
 			const cfnExport = await this.lookupCfnExport(exportName);
 			if (cfnExport) {
@@ -14817,7 +15113,8 @@ var IntrinsicFunctionResolver = class {
 		const value = outputs[outputName];
 		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${stackName}, Region=${region}, OutputName=${outputName}${roleArn ? `, RoleArn=${roleArn}` : ""} -> ${JSON.stringify(value)}`);
 		if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
-		return value;
+		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::GetStackOutput: output '${outputName}' of stack '${stackName}' (${region}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
+		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${outputName}' (producer ${stackName} / ${region})`);
 	}
 	/**
 	* Push a resolved `Fn::GetStackOutput` into the consumer's
@@ -15091,8 +15388,8 @@ var IntrinsicFunctionResolver = class {
 			else if (service === "ssm") {
 				const decrypt = context?.skipDynamicReferences !== true;
 				const param = await this.resolveSSMReference(parts, decrypt);
-				if (param.type === "SecureString") recordedSecretExpressions.add(fullMatch);
-				else if (!param.secure) recordedSecretExpressions.delete(fullMatch);
+				if (param.type === "SecureString") this.pinSecretVerdict(fullMatch, true);
+				else if (!param.secure) this.pinSecretVerdict(fullMatch, false);
 				else cacheable = false;
 				isSecret = param.secure;
 				if (param.secure) {
@@ -15109,7 +15406,7 @@ var IntrinsicFunctionResolver = class {
 			});
 			if (isSecret && resolved) {
 				context?.recordedSecretValues?.set(resolved, fullMatch);
-				if (service === "secretsmanager") recordedSecretExpressions.add(fullMatch);
+				if (service === "secretsmanager") this.pinSecretVerdict(fullMatch, true);
 			}
 			result = result.replace(fullMatch, () => resolved);
 		}
@@ -16206,7 +16503,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-H-Dl8qng.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BZwQzb8e.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -18884,7 +19181,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		silentDrop: /* @__PURE__ */ new Map([
 			["IssuerConfiguration", "not yet implemented by cdkd"],
 			["KeyConfiguration", "not yet implemented by cdkd"],
-			["WebAuthnFactorConfiguration", "No SDK wire path: @aws-sdk/client-cognito-identity-provider has no field accepting SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION (not on CreateUserPool/UpdateUserPool, nor SetUserPoolMfaConfig.WebAuthnConfiguration which only carries RelyingPartyId/UserVerification); CC-API-registry-only property"]
+			["WebAuthnFactorConfiguration", "No wire path in the PINNED SDK (@aws-sdk/client-cognito-identity-provider 3.1018.0): WebAuthnConfigurationType is {RelyingPartyId?, UserVerification?} and no CreateUserPool/UpdateUserPool field accepts SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION. This is an SDK-VERSION limit, NOT an API one -- the live API does honour FactorConfiguration (measured us-east-1 2026-08-20: SetUserPoolMfaConfig(ON) on a pool allowing WEB_AUTHN as a first auth factor is rejected with \"Cannot set WebAuthn factor configuration to SINGLE_FACTOR if MFA is required and WebAuthn is an allowed first auth factor\", i.e. the service reads a field the SDK cannot send). RE-EVALUATE THIS ENTRY ON AN SDK BUMP: if WebAuthnConfigurationType gains FactorConfiguration, the property becomes handleable and this entry must go"]
 		])
 	}],
 	["AWS::DLM::LifecyclePolicy", {
@@ -24304,7 +24601,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.13";
+	return "0.284.15";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -26844,4 +27141,4 @@ var DeployEngine = class {
 
 //#endregion
 export { isTerminationProtectionPropagationError as $, ResourceUpdateNotSupportedError as $n, validateAssetBucketName as $t, renderStatefulReason as A, derivePartitionAndUrlSuffix as An, INTRINSIC_KEYS as At, exportAliasCollisionScrubWarning as B, CdkdError as Bn, stringifyValue as Bt, isFinalSnapshotError as C, CFN_TEMPLATE_URL_LIMIT as Cn, s3BucketArn as Ct, extractDeploymentEventError as D, expectedOwnerParam as Dn, s3BucketWebsiteUrl as Dt, makeCanonicalizePropertiesFn as E, uploadCfnTemplate as En, s3BucketRegionalDomainName as Et, green as F, AwsClients as Fn, LockManager as Ft, collectInlinePolicyNamesManagedBySiblings as G, LocalMigrateError as Gn, rewriteTemplateAssetReferences as Gt, secretBearingStateKeyWarning as H, DependencyError as Hn, buildAssetRedirectMap as Ht, red as I, getAwsClients as In, S3StateBackend as It, findActionableSilentDrops as J, MissingCdkCliError as Jn, AssetModeResolver as Jt, clearOnUpdateRemoval as K, LocalStartServiceError as Kn, escapeRegExp$1 as Kt, yellow as L, resetAwsClients as Ln, rebuildClientForBucketRegion as Lt, bold as M, processStackMessages as Mn, withRetry as Mt, cyan as N, clearBucketRegionCache as Nn, DagBuilder as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, PARTITION_TABLE as On, applyRoleArnIfSet as Ot, gray as P, resolveBucketRegion as Pn, TemplateParser as Pt, disableInstanceApiTermination as Q, ResourceTimeoutError as Qn, parseBootstrapMarker as Qt, collectDeclaredOutputNames as R, setAwsClients as Rn, shouldRetainResource as Rt, createPreDeleteFinalSnapshot as S, CFN_TEMPLATE_BODY_LIMIT as Sn, scrubResourceRecord as St, unsupportedFinalSnapshotError as T, findLargeInlineResources as Tn, s3BucketDualStackDomainName as Tt, stateKeySecretExposure as U, DeployCancelledError as Un, createAssetRedirectResolver as Ut, isExportAliasCollision as V, ConfigError as Vn, WorkGraph as Vt, IAMRoleProvider as W, LocalInvokeBuildError as Wn, loadPublishableAssetManifest as Wt, CloudControlProvider as X, PartialFailureError as Xn, ensureAssetStorage as Xt, findSilentDropProperties as Y, NestedStackChildDirectDestroyError as Yn, BOOTSTRAP_MARKER_PREFIX as Yt, slowCcOperationTimeoutMs as Z, ProvisioningError as Zn, getBootstrapMarkerKey as Zt, computeImplicitDeleteEdges as _, resolveStateBucketWithDefault as _n, STATE_SOURCED_READBACK_RULES as _t, DeploymentEventsStore as a, runDockerForeground as an, isCdkdError as ar, normalizeAwsTagsToCfn as at, buildFinalSnapshotIdentifier as b, stateBucketExistenceConfirmed as bn, maskSecretsInText as bt, replayFailedOperations as c, getDockerImageBySourceHash as cn, isMarkedNonRetryable as cr, coerceCfnBoolean as ct, updatePartialReason as d, getDefaultStateBucketName as dn, markNonRetryable as dr, readConfigString as dt, validateContainerRepoName as en, StackHasActiveImportsError as er, IntrinsicFunctionResolver as et, UNSPECIFIED_SKIP_REASON as f, getLegacyStateBucketName as fn, __exportAll as fr, replayWarn as ft, IMPLICIT_DELETE_DEPENDENCIES as g, resolveSkipPrefix as gn, STATE_SOURCED_CROSS_GENERATION_RULES as gt, maskingRetryLogger as h, resolveCaptureObservedState as hn, requireConfigString as ht, DeploymentEventsReader as i, getDockerCmd as in, formatError as ir, WAFv2WebACLProvider as it, formatResourceLine as j, AssemblyReader as jn, describeTypeWithThrottleRetry as jt, isStatefulRecreateTargetSync as k, canonicalizeRegion as kn, DiffCalculator as kt, replayRollback as l, Synthesizer as ln, isRetryableTransientError as lr, configBooleanRefusal as lt, withResourceDeadline as m, resolveAutoAssetStorage as mn, requireConfigObject as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, buildDockerImage as nn, StateError as nr, getAccountInfo as nt, planFailedOps as o, runDockerStreaming as on, normalizeAwsError as or, resolveExplicitPhysicalId as ot, deleteSkipReason as p, resolveApp as pn, requireConfigArray as pt, ProviderRegistry as q, LockError as qn, stripControlChars as qt, DeployEngine as r, formatDockerLoginError as rn, SynthesisError as rr, refStateLookupFromResource as rt, planRollback as s, AssetManifestLoader as sn, withErrorHandling as sr, assertRegionMatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, buildDenyExternalAccessPolicy as tn, StackTerminationProtectionError as tr, cfnRefValueFromPhysicalId as tt, updatePartialMessage as u, synthesisStatusMessage as un, isThrottlingError as ur, configStringRefusal as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, resolveStateBucketWithDefaultAndSource as vn, TEMPLATE_SOURCED_RULES as vt, refusesFinalSnapshot as w, MIGRATE_TMP_PREFIX as wn, s3BucketDomainName as wt, ccRoutedFinalSnapshotError as x, warnDeprecatedNoPrefixCliFlag as xn, redactSecretsForState as xt, PRE_DELETE_SNAPSHOT_TYPES as y, resolveUseCdkBootstrapAssets as yn, createSecretMasker as yt, collectPublishedOutputNames as z, AssetError as zn, AssetPublisher as zt };
-//# sourceMappingURL=deploy-engine-4Eh5Qqlm.js.map
+//# sourceMappingURL=deploy-engine-BNujuzW5.js.map