@go-to-k/cdkd 0.285.0 → 0.285.2

package/dist/{program-C0dW-OL8.js → program-fntegUX1.js}

@@ -1,8 +1,8 @@
-import { $ as maskerOrIdentity, $n as CFN_TEMPLATE_BODY_LIMIT, $t as maskSecretsInText, A as renderStatefulReason, An as describeAwsFailure, Ar as PartialFailureError, At as requireConfigString, B as exportAliasCollisionScrubWarning, Bn as Synthesizer, Br as normalizeAwsError, Bt as INTRINSIC_KEYS, C as isFinalSnapshotError, Cn as getBootstrapMarkerKey, Cr as DynamicReferenceRegionAmbiguousError, Ct as coerceCfnBoolean, D as extractDeploymentEventError, Dn as validateAssetBucketName, Dt as replayWarn, E as makeCanonicalizePropertiesFn, En as readBootstrapMarkerBody, Er as LocalStartServiceError, Et as readConfigString, F as green, Fn as partitionSensitiveEnv, Fr as StackTerminationProtectionError, Ft as s3BucketDualStackDomainName, G as IAMRoleProvider, Gn as resolveAutoAssetStorage, Gr as markNonRetryable, Gt as STATE_SOURCED_CROSS_GENERATION_RULES, H as secretBearingStateKeyWarning, Hn as getDefaultStateBucketName, Hr as isMarkedNonRetryable, Ht as withRetry, I as red, In as runDockerForeground, It as s3BucketRegionalDomainName, J as ProviderRegistry, Jn as resolveStateBucketWithDefault, Jt as createSecretMasker, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveCaptureObservedState, Kr as markRedactedCause, Kt as STATE_SOURCED_READBACK_RULES, L as yellow, Ln as runDockerStreaming, Lt as s3BucketWebsiteUrl, M as bold, Mn as dockerSpawnEnvWithSensitive, Mr as ResourceTimeoutError, Mt as producerRegionsFromState, N as cyan, Nn as formatDockerLoginError, Nr as ResourceUpdateNotSupportedError, Nt as s3BucketArn, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as validateContainerRepoName, Or as MissingCdkCliError, Ot as requireConfigArray, P as gray, Pn as getDockerCmd, Pr as StackHasActiveImportsError, Pt as s3BucketDomainName, Q as maskDeep, Qn as warnDeprecatedNoPrefixCliFlag, Qt as maskSecretsInError, R as collectDeclaredOutputNames, Rn as AssetManifestLoader, Rt as applyRoleArnIfSet, S as createPreDeleteFinalSnapshot, Sn as ensureAssetStorage, Sr as DeployCancelledError, St as assertRegionMatch, T as unsupportedFinalSnapshotError, Tn as parseBootstrapMarker, Tr as LocalMigrateError, Tt as configStringRefusal, U as stateKeySecretExposure, Un as getLegacyStateBucketName, Ur as isRetryableTransientError, Ut as DagBuilder, V as isExportAliasCollision, Vn as synthesisStatusMessage, Vr as withErrorHandling, Vt as describeTypeWithThrottleRetry, W as getCurrentResourceSecrets, Wn as resolveApp, Wr as isThrottlingError, Wt as TemplateParser, X as findSilentDropProperties, Xn as resolveUseCdkBootstrapAssets, Xt as errorCauseChain, Y as findActionableSilentDrops, Yn as resolveStateBucketWithDefaultAndSource, Yt as dynamicReferenceTokens, Z as createMaskedRetryLogger, Zn as stateBucketExistenceConfirmed, Zt as isSingleDynamicReferenceToken, _ as computeImplicitDeleteEdges, _n as escapeRegExp, _t as parameterTypeMayLoseSecretIdentity, a as DeploymentEventsStore, an as rebuildClientForBucketRegion, ar as expectedOwnerParam, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as BOOTSTRAP_MARKER_PREFIX, br as CrossAccountSecretRefusalError, bt as normalizeAwsTagsToCfn, c as replayFailedOperations, cn as importableOutputs, cr as derivePartitionAndUrlSuffix, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as stringifyValue, dt as IntrinsicFunctionResolver, en as redactSecretsForState, er as CFN_TEMPLATE_URL_LIMIT, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as WorkGraph, fr as resolveBucketRegion, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as rewriteTemplateAssetReferences, gr as setAwsClients, gt as isUnboundTemplateParameter, h as maskingRetryLogger, hn as loadPublishableAssetManifest, hr as resetAwsClients, ht as getAccountInfo, i as DeploymentEventsReader, in as S3StateBackend, ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, it as interruptWatchListenerCount, j as formatResourceLine, jn as buildDockerImage, jr as ProvisioningError, jt as classifyReplaySecretRegion, k as isStatefulRecreateTargetSync, kn as buildDenyExternalAccessPolicy, kr as NestedStackChildDirectDestroyError, kt as requireConfigObject, l as replayRollback, ln as shouldRetainResource, lr as AssemblyReader, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as createAssetRedirectResolver, mr as getAwsClients, mt as coerceParameterTypedValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as LockManager, nr as findLargeInlineResources, nt as beginCommandInterruptScope, o as planFailedOps, on as exportNamesCarriedFrom, or as PARTITION_TABLE, ot as startInterruptWatch, p as deleteSkipReason, pn as buildAssetRedirectMap, pr as AwsClients, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveSkipPrefix, qr as retryClassificationText, qt as TEMPLATE_SOURCED_RULES, r as DeployEngine, rn as displaySafe, rr as uploadCfnTemplate, rt as endCommandInterruptScope, s as planRollback, sn as importableOutputKeys, sr as canonicalizeRegion, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as scrubResourceRecord, tr as MIGRATE_TMP_PREFIX, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as AssetPublisher, ur as processStackMessages, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as stripControlChars, vr as CdkdError, vt as refStateLookupFromResource, w as refusesFinalSnapshot, wn as isCrossRegionRedirect, wr as LocalInvokeBuildError$1, wt as configBooleanRefusal, x as ccRoutedFinalSnapshotError, xn as assertAssetBucketRegion, xt as resolveExplicitPhysicalId, y as PRE_DELETE_SNAPSHOT_TYPES, yn as AssetModeResolver, yt as WAFv2WebACLProvider, z as collectPublishedOutputNames, zn as getDockerImageBySourceHash, zt as DiffCalculator } from "./deploy-engine-DWmYq7m1.js";
-import { a as runStackBuffered, c as PATTERN_B_NAME_PROPERTIES, d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, h as withSkipPrefix, l as PATTERN_B_RESOURCE_TYPES, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, r as reserveStdoutForPayload, s as PATTERN_B_NAME_OPTIONS } from "./logger-C9-E73FI.js";
+import { $ as maskerOrIdentity, $n as CFN_TEMPLATE_BODY_LIMIT, $t as maskSecretsInText, A as renderStatefulReason, An as describeAwsFailure, Ar as PartialFailureError, At as requireConfigString, B as exportAliasCollisionScrubWarning, Bn as Synthesizer, Br as normalizeAwsError, Bt as INTRINSIC_KEYS, C as isFinalSnapshotError, Cn as getBootstrapMarkerKey, Cr as DynamicReferenceRegionAmbiguousError, Ct as coerceCfnBoolean, D as extractDeploymentEventError, Dn as validateAssetBucketName, Dt as replayWarn, E as makeCanonicalizePropertiesFn, En as readBootstrapMarkerBody, Er as LocalStartServiceError, Et as readConfigString, F as green, Fn as partitionSensitiveEnv, Fr as StackTerminationProtectionError, Ft as s3BucketDualStackDomainName, G as IAMRoleProvider, Gn as resolveAutoAssetStorage, Gr as markNonRetryable, Gt as STATE_SOURCED_CROSS_GENERATION_RULES, H as secretBearingStateKeyWarning, Hn as getDefaultStateBucketName, Hr as isMarkedNonRetryable, Ht as withRetry, I as red, In as runDockerForeground, It as s3BucketRegionalDomainName, J as ProviderRegistry, Jn as resolveStateBucketWithDefault, Jt as createSecretMasker, K as collectInlinePolicyNamesManagedBySiblings, Kn as resolveCaptureObservedState, Kr as markRedactedCause, Kt as STATE_SOURCED_READBACK_RULES, L as yellow, Ln as runDockerStreaming, Lt as s3BucketWebsiteUrl, M as bold, Mn as dockerSpawnEnvWithSensitive, Mr as ResourceTimeoutError, Mt as producerRegionsFromState, N as cyan, Nn as formatDockerLoginError, Nr as ResourceUpdateNotSupportedError, Nt as s3BucketArn, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as validateContainerRepoName, Or as MissingCdkCliError, Ot as requireConfigArray, P as gray, Pn as getDockerCmd, Pr as StackHasActiveImportsError, Pt as s3BucketDomainName, Q as maskDeep, Qn as warnDeprecatedNoPrefixCliFlag, Qt as maskSecretsInError, R as collectDeclaredOutputNames, Rn as AssetManifestLoader, Rt as applyRoleArnIfSet, S as createPreDeleteFinalSnapshot, Sn as ensureAssetStorage, Sr as DeployCancelledError, St as assertRegionMatch, T as unsupportedFinalSnapshotError, Tn as parseBootstrapMarker, Tr as LocalMigrateError, Tt as configStringRefusal, U as stateKeySecretExposure, Un as getLegacyStateBucketName, Ur as isRetryableTransientError, Ut as DagBuilder, V as isExportAliasCollision, Vn as synthesisStatusMessage, Vr as withErrorHandling, Vt as describeTypeWithThrottleRetry, W as getCurrentResourceSecrets, Wn as resolveApp, Wr as isThrottlingError, Wt as TemplateParser, X as findSilentDropProperties, Xn as resolveUseCdkBootstrapAssets, Xt as errorCauseChain, Y as findActionableSilentDrops, Yn as resolveStateBucketWithDefaultAndSource, Yt as dynamicReferenceTokens, Z as createMaskedRetryLogger, Zn as stateBucketExistenceConfirmed, Zt as isSingleDynamicReferenceToken, _ as computeImplicitDeleteEdges, _n as escapeRegExp, _t as parameterTypeMayLoseSecretIdentity, a as DeploymentEventsStore, an as rebuildClientForBucketRegion, ar as expectedOwnerParam, at as isInterruptedWaitError, b as buildFinalSnapshotIdentifier, bn as BOOTSTRAP_MARKER_PREFIX, br as CrossAccountSecretRefusalError, bt as normalizeAwsTagsToCfn, c as replayFailedOperations, cn as importableOutputs, cr as derivePartitionAndUrlSuffix, ct as slowCcOperationTimeoutMs, d as updatePartialReason, dn as stringifyValue, dt as IntrinsicFunctionResolver, en as redactSecretsForState, er as CFN_TEMPLATE_URL_LIMIT, et as CUSTOM_RESOURCE_RESPONSE_PREFIX, f as UNSPECIFIED_SKIP_REASON, fn as WorkGraph, fr as resolveBucketRegion, ft as carriesDynamicReference, g as IMPLICIT_DELETE_DEPENDENCIES, gn as rewriteTemplateAssetReferences, gr as setAwsClients, gt as isUnboundTemplateParameter, h as maskingRetryLogger, hn as loadPublishableAssetManifest, hr as resetAwsClients, ht as getAccountInfo, i as DeploymentEventsReader, in as S3StateBackend, ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, it as interruptWatchListenerCount, j as formatResourceLine, jn as buildDockerImage, jr as ProvisioningError, jt as classifyReplaySecretRegion, k as isStatefulRecreateTargetSync, kn as buildDenyExternalAccessPolicy, kr as NestedStackChildDirectDestroyError, kt as requireConfigObject, l as replayRollback, ln as shouldRetainResource, lr as AssemblyReader, lt as disableInstanceApiTermination, m as withResourceDeadline, mn as createAssetRedirectResolver, mr as getAwsClients, mt as coerceParameterTypedValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as LockManager, nr as findLargeInlineResources, nt as beginCommandInterruptScope, o as planFailedOps, on as exportNamesCarriedFrom, or as PARTITION_TABLE, ot as startInterruptWatch, p as deleteSkipReason, pn as buildAssetRedirectMap, pr as AwsClients, pt as cfnRefValueFromPhysicalId, q as clearOnUpdateRemoval, qn as resolveSkipPrefix, qr as retryClassificationText, qt as TEMPLATE_SOURCED_RULES, r as DeployEngine, rn as displaySafe, rr as uploadCfnTemplate, rt as endCommandInterruptScope, s as planRollback, sn as importableOutputKeys, sr as canonicalizeRegion, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as scrubResourceRecord, tr as MIGRATE_TMP_PREFIX, tt as DEFAULT_STATE_PREFIX, u as updatePartialMessage, un as AssetPublisher, ur as processStackMessages, ut as isTerminationProtectionPropagationError, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as stripControlChars, vr as CdkdError, vt as refStateLookupFromResource, w as refusesFinalSnapshot, wn as isCrossRegionRedirect, wr as LocalInvokeBuildError$1, wt as configBooleanRefusal, x as ccRoutedFinalSnapshotError, xn as assertAssetBucketRegion, xt as resolveExplicitPhysicalId, y as PRE_DELETE_SNAPSHOT_TYPES, yn as AssetModeResolver, yt as WAFv2WebACLProvider, z as collectPublishedOutputNames, zn as getDockerImageBySourceHash, zt as DiffCalculator } from "./deploy-engine-Bci2hIDt.js";
+import { a as runStackBuffered, c as PATTERN_B_NAME_PROPERTIES, d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, h as withSkipPrefix, l as PATTERN_B_RESOURCE_TYPES, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, r as reserveStdoutForPayload, s as PATTERN_B_NAME_OPTIONS } from "./logger-Dz3Le2Pw.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DdNVYNv2.js";
-import { t as ASGProvider } from "./asg-provider-Bfx30mgz.js";
+import { t as getCdkdVersion } from "./version-CPBCBoA5.js";
+import { t as ASGProvider } from "./asg-provider-DEG5QGu2.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1948,6 +1948,7 @@ function toLongRecord(stack, includeDeps) {
 async function listCommand(patterns, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
+	if (options.json) reserveStdoutForPayload();
 	warnIfDeprecatedRegion(options);
 	foldRegionOption(options);
 	await applyRoleArnIfSet({
@@ -18552,9 +18553,9 @@ var DynamoDBTableProvider = class {
 	* `observedProperties` baseline, a later AWS-side increase surfaces as drift
 	* on a property the user never declared and `--revert` would issue a
 	* decrease AWS rejects. `readCurrentState` therefore emits it only when the
-	* DESIRED bag declares it (the fix issue #1742 PROPOSES for the per-index
-	* sibling — still open and unlanded at the time of writing, so this is the
-	* first site to carry the shape), never as a blanket drop:
+	* DESIRED bag declares it (the same shape issue #1742 proposed for the
+	* per-index sibling, which landed in #1859 — this site carried it first),
+	* never as a blanket drop:
 	* `AWS::DynamoDB::Table` accepts an explicit `WarmThroughput` and a real
 	* change to one must stay visible. Known residual on that declared arm
 	* (issue #1768): AWS may GROW a declared value, which is reported as drift —
@@ -42408,6 +42409,48 @@ function readAllowedFirstAuthFactors(properties) {
 	return factors.filter((factor) => typeof factor === "string");
 }
 /**
+* The two sub-keys of the CFn `Policies` blob — exactly the members
+* `UserPoolPolicyType` declares, and exactly the keys `toSdkUserPoolPolicies`
+* forwards. Iterated by the #1979 removal announcement so a sub-key AWS adds
+* later joins BOTH the forwarding and the announcement in one edit here.
+*/
+const POLICIES_SUB_KEYS = ["PasswordPolicy", "SignInPolicy"];
+/**
+* Would this property bag put `Policies.<subKey>` on the wire?
+*
+* MIRRORS the wire's own two truthiness gates rather than re-deriving a
+* "present" notion of its own: `create()` / `update()` gate on
+* `if (properties['Policies'])` and `toSdkUserPoolPolicies` gates each sub-key
+* on `if (policies['SignInPolicy'])`. The #1979 removal announcement must fire
+* exactly when the wire STOPS carrying a sub-key it previously carried, so a
+* hand-written presence test here (`in`, `!== undefined`, a plain-object
+* guard) would disagree with the wire on `null` / `''` / `0` / `false` — the
+* config-shape.ts share-the-predicate rule, applied to a truthiness gate.
+* Agreement is pinned by a unit table that drives every value shape through
+* the PUBLIC `update()` and asserts warn-iff-not-sent.
+*/
+function sendsPoliciesSubKey(bag, subKey) {
+	const policies = bag["Policies"];
+	if (!policies) return false;
+	return Boolean(policies[subKey]);
+}
+/**
+* What the removal announcement tells the user about each sub-key: a short
+* label for the live value the pool keeps, and the AWS default the user must
+* DECLARE explicitly to get reset behavior (there is no removal path on the
+* wire, so an explicit declaration is the only way to change the live value).
+*/
+const POLICIES_SUB_KEY_ANNOUNCEMENT = {
+	PasswordPolicy: {
+		label: "password policy",
+		reset: "the AWS default is MinimumLength: 8 with every character-class requirement enabled and TemporaryPasswordValidityDays: 7"
+	},
+	SignInPolicy: {
+		label: "sign-in policy",
+		reset: "the AWS default is AllowedFirstAuthFactors: [PASSWORD]"
+	}
+};
+/**
 * The PRE-FLIGHT: the reason this user-pool configuration cannot be applied at
 * all, or `undefined` when nothing is known to refuse it.
 *
@@ -42746,17 +42789,47 @@ var CognitoUserPoolProvider = class {
 	* `readLiveMfaConfiguration`'s docstring, which carries the one ledger of
 	* which fields were measured to reset and which were not.
 	*
-	* **Consequence of that measurement, NOT fixed here: there is no removal
-	* path.** This builder forwards only what the template DECLARES, so deleting
-	* `SignInPolicy` from a template sends nothing for it -- and nothing sent
-	* means nothing changed. A user tightening their auth by removing a
-	* passwordless first-auth factor therefore leaves it live on the pool
-	* indefinitely, and `readCurrentState` keeps reporting a drift that
-	* `cdkd drift --revert` cannot clear, since the revert routes through this
-	* same builder. Clearing it needs an explicit reset value on the wire, which
-	* is a behavior change with its own integ and is out of this lane's scope.
-	* Whether CloudFormation removes it on the same template edit is UNMEASURED
-	* -- do not assume parity in either direction.
+	* **Consequence of that measurement: there is no removal path, and that is
+	* PARITY, not a gap to close with a reset** (issue #1979). This builder
+	* forwards only what the template DECLARES, so deleting `SignInPolicy` from
+	* a template sends nothing for it -- and nothing sent means nothing changed.
+	* Whether that no-op should become an explicit reset was settled by a real
+	* CloudFormation A/B rather than assumed. MEASURED us-east-1 2026-09-02
+	* (issue #1979), on a CFn stack whose pool declared
+	* `PasswordPolicy: {MinimumLength: 12, RequireSymbols: false}` +
+	* `SignInPolicy: {AllowedFirstAuthFactors: [PASSWORD, EMAIL_OTP]}`
+	* (ESSENTIALS tier), three template edits, each reaching UPDATE_COMPLETE:
+	*
+	* - removing the `SignInPolicy` sub-key alone left the live value at
+	*   `[PASSWORD, EMAIL_OTP]`;
+	* - removing the `PasswordPolicy` sub-key alone left the live value at
+	*   `MinimumLength: 12` / `RequireSymbols: false` -- NOT reset to the
+	*   documented defaults (8, every requirement on);
+	* - removing the whole `Policies` container left BOTH sub-keys intact.
+	*
+	* So CloudFormation performs the SAME silent no-op, and a cdkd-side reset
+	* would be a DIVERGENCE from its stated template compatibility, not parity.
+	* What was wrong was only the SILENCE: `update()` announces the
+	* inexpressible removal via `warnOnUnremovablePoliciesSubKeys`, naming the
+	* sub-key, saying the live value is unchanged, and pointing at the
+	* explicit-declaration remedy. It fires on `cdkd deploy`; the other three
+	* `update()` call sites reach it only under conditions each of which is
+	* spelled out at that method, because the obvious reading of two of them is
+	* wrong.
+	*
+	* **The announcement is the ONLY signal, which is why silence was the whole
+	* defect.** The issue predicted that the removal would also leave a
+	* permanent `cdkd drift` difference; MEASURED us-east-1 2026-09-02 on a live
+	* pool (stack `Cdkd1979LiveVerify`), it does not, and the prediction is
+	* withdrawn here rather than repeated. `update()` refreshes
+	* `observedProperties` from the POST-update `readCurrentState`, so the
+	* retained sub-key lands in the drift BASELINE (`observedProperties ??
+	* properties`, `drift.ts`) as well as on the pool: the announcing deploy
+	* converges, the next identical deploy is an honest NO_CHANGE, and both
+	* `cdkd drift` and `cdkd diff` report nothing. Nothing downstream of the
+	* deploy tells the operator that the tightening did not land -- so the warn
+	* is not a supplement to a visible drift, it is the only place the fact
+	* appears at all.
 	*/
 	toSdkUserPoolPolicies(policies) {
 		const result = {};
@@ -42938,7 +43011,10 @@ var CognitoUserPoolProvider = class {
 	*   container sent without `PasswordPolicy` left `PasswordPolicy` intact,
 	*   and omitting the container outright left both. Forwarding is still
 	*   REQUIRED to APPLY a changed sub-key — preservation is not application —
-	*   and no omission can express a REMOVAL.
+	*   and no omission can express a REMOVAL. CloudFormation measured the same
+	*   way on all three removal edits (2026-09-02, issue #1979; transcript at
+	*   `toSdkUserPoolPolicies`), so the update path ANNOUNCES the removal via
+	*   `warnOnUnremovablePoliciesSubKeys` instead of resetting.
 	*
 	* `SetUserPoolMfaConfig` — a DIFFERENT API with a DIFFERENT rule, kept in
 	* its own section so neither list is read as evidence for the other:
@@ -43004,6 +43080,76 @@ var CognitoUserPoolProvider = class {
 		}
 	}
 	/**
+	* Announce a `Policies` sub-key removal the wire cannot express (issue
+	* #1979). Fires once per removed sub-key when the previous side would have
+	* put it on the wire and the desired side no longer does — the same
+	* truthiness gates the forwarding itself uses (`sendsPoliciesSubKey`).
+	*
+	* WARN, not a reset, and not silence. `UpdateUserPool` preserves an omitted
+	* sub-key (measured 2026-08-19, issue #1968) and CloudFormation performs the
+	* SAME no-op on the identical template edit (measured 2026-09-02, issue
+	* #1979; both transcripts at `toSdkUserPoolPolicies`) — so sending a reset
+	* would diverge from cdkd's stated template compatibility, while silence
+	* leaves an operator believing a TIGHTENING landed (the motivating shape:
+	* deleting `SignInPolicy` to revoke a passwordless first-auth factor
+	* deploys green while AWS keeps allowing it). The announcement names the
+	* sub-key, states that the live value is unchanged, and gives the only
+	* remedy that exists on the wire: declaring the sub-key explicitly with the
+	* intended (e.g. default) configuration.
+	*
+	* Reached by four `update()` call sites, and each one needs its own reading
+	* of what "previous" MEANS there:
+	*
+	* - **`cdkd deploy`** (previous = the last-deployed template's record) warns
+	*   on the deploy that carries the removal. Later deploys compare template ==
+	*   record and are honest NO_CHANGEs, matching CloudFormation's own converged
+	*   stack (measured live, transcript at `toSdkUserPoolPolicies`).
+	* - **`cdkd drift --revert`** (previous = the full live readback) is NARROWER
+	*   than it looks, and the obvious reading of it is backwards. The revert's
+	*   DESIRED side is not the drift baseline: `buildRevertNewProperties`
+	*   (`drift.ts`) starts from `{ ...awsProperties }` and overwrites only the
+	*   top-level keys that actually DRIFTED, so an undrifted `Policies` carries
+	*   the LIVE blob and no removal is visible at all. And on a record with no
+	*   `observedProperties` — the case that looks most reachable — the revert
+	*   sets `preserveUntemplated`, whose `mergeUntemplatedValue` merges AWS's
+	*   untemplated sub-keys straight back in, so the sub-key is present on the
+	*   desired side and this warning does not fire -- unless the baseline's own
+	*   `Policies` is not a plain record (a `null`, a string, an unresolved
+	*   intrinsic), the one shape that merge declines: it returns the baseline
+	*   whole and drops the live sub-keys with it. What else reaches it is the
+	*   opposite shape: a record WITH `observedProperties`, plus a sub-key added
+	*   out-of-band after that capture, so `Policies` drifts and the baseline
+	*   written over it lacks the sub-key. The warning is then exactly right —
+	*   the revert cannot take that sub-key back off the pool.
+	* - **The rollback executor's `revert` arm** (previous = the newer state
+	*   record) warns when rolling back to a record that lacked the sub-key; the
+	*   rollback cannot restore that absence either.
+	* - **The rollback executor's `revert-failed-update` arm** passes
+	*   `attemptedProps` as the previous side, which is
+	*   `op.attemptedProperties ?? current.properties` — so a journal segment
+	*   that recorded no attempted properties degrades to the newer state record
+	*   and behaves exactly as the `revert` arm above. With a real attempted bag
+	*   it is the bag of an update that FAILED: if `UpdateUserPool` itself was
+	*   rejected, the attempted sub-key may never have reached AWS, and the
+	*   announcement then names a removal that had nothing to remove. Its literal
+	*   claim (the pool keeps whatever policy it currently has) stays true, and
+	*   the arm is not gated because a failure
+	*   AFTER a successful `UpdateUserPool` is the same-shaped case where the
+	*   sub-key DID land and the warning is fully earned; the two are not
+	*   distinguishable from `attemptedProps` alone.
+	*
+	* The message interpolates NO property values (sub-key names and the
+	* physical id only), so it needs no `maskSecrets` routing.
+	*/
+	warnOnUnremovablePoliciesSubKeys(physicalId, properties, previousProperties) {
+		for (const subKey of POLICIES_SUB_KEYS) {
+			if (!sendsPoliciesSubKey(previousProperties, subKey)) continue;
+			if (sendsPoliciesSubKey(properties, subKey)) continue;
+			const { label, reset } = POLICIES_SUB_KEY_ANNOUNCEMENT[subKey];
+			this.logger.warn(`UserPool ${physicalId}: the desired configuration no longer declares Policies.${subKey}, and no UpdateUserPool input can express that removal — omitting the sub-key PRESERVES the live value (measured us-east-1 2026-08-19, issue #1968), so the pool keeps its current ${label}. CloudFormation is the same no-op on the identical template edit (measured us-east-1 2026-09-02, issue #1979), so cdkd deliberately sends no reset. To change the live value, declare Policies.${subKey} explicitly with the intended configuration (${reset}).`);
+		}
+	}
+	/**
 	* Update a Cognito User Pool
 	*
 	* Note: PoolName (UserPoolName) is immutable and cannot be changed after
@@ -43028,6 +43174,7 @@ var CognitoUserPoolProvider = class {
 		this.warnOnBlankMfaConfiguration(properties["MfaConfiguration"]);
 		this.assertMfaCombinationApplicable(logicalId, resourceType, physicalId, properties, mfaConfiguration);
 		const liveMfa = mfaConfiguration === "" && hasMfaConfigProps(properties) ? await this.readLiveMfaConfiguration(physicalId) : void 0;
+		this.warnOnUnremovablePoliciesSubKeys(physicalId, properties, previousProperties);
 		try {
 			const updateParams = { UserPoolId: physicalId };
 			if (properties["Policies"]) {
@@ -73575,6 +73722,7 @@ function sortRefs(refs) {
 async function stateListCommand(options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
+	if (options.json) reserveStdoutForPayload();
 	const setup = await setupStateBackend(options);
 	try {
 		const refs = sortRefs(await setup.stateBackend.listStacks());
@@ -73705,6 +73853,7 @@ function createStateListCommand() {
 async function stateResourcesCommand(stackName, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
+	if (options.json) reserveStdoutForPayload();
 	const setup = await setupStateBackend(options);
 	try {
 		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
@@ -73832,6 +73981,7 @@ function createStateResourcesCommand() {
 async function stateShowCommand(stackName, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
+	if (options.json) reserveStdoutForPayload();
 	const setup = await setupStateBackend(options);
 	try {
 		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
@@ -74471,6 +74621,7 @@ async function listAssetStorageMarkers(s3, bucket) {
 async function stateInfoCommand(options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
+	if (options.json) reserveStdoutForPayload();
 	foldRegionOption(options);
 	await applyRoleArnIfSet({
 		roleArn: options.roleArn,
@@ -75262,9 +75413,10 @@ function createRollbackCommand() {
 async function eventsCommand(stackName, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
+	const asJson = options.json === true;
+	if (asJson) reserveStdoutForPayload();
 	warnIfDeprecatedRegion(options);
 	foldRegionOption(options);
-	const asJson = options.json === true;
 	const awsClients = new AwsClients({
 		...options.region && { region: options.region },
 		...options.profile && { profile: options.profile }
@@ -88749,4 +88901,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-C0dW-OL8.js.map
+//# sourceMappingURL=program-fntegUX1.js.map