@go-to-k/cdkd 0.291.2 → 0.291.4

package/dist/{program-DnmYd7BO.js → program-C5r-kmIQ.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as derivePartitionAndUrlSuffix, $n as safeStackName, $r as assertAssetBucketRegion, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as PartialFailureError, Ai as resolveAutoAssetStorage, An as malformedOutputsRefusalMessage, Ar as formatLockExpiry, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as normalizeAwsError, Bi as CFN_TEMPLATE_URL_LIMIT, Bn as refuseMalformedOrphansForDestroy, Br as isReadableBag, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as DynamicReferenceRegionAmbiguousError, Ci as AssetManifestLoader, Cn as isReadableResourceEntry, Cr as LockManager, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Di as getDefaultStateBucketName, Dn as malformedOrphanRecordsWarning, Dr as buildForceUnlockCommand, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as LocalStartServiceError, Ei as synthesisStatusMessage, En as malformedLocalOutputsWarning, Er as UNREPRODUCIBLE_LOCK_CLAUSE, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as StackTerminationProtectionError, Fi as resolveUseCdkBootstrapAssets, Fn as malformedResourcesWarning, Fr as hasReadableExportSet, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as isTransientServerError, Gi as injectiveKey, Gn as refuseMalformedResourcesForDestroy, Gr as stringifyValue, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as isMarkedNonRetryable, Hi as findLargeInlineResources, Hn as refuseMalformedOutputsForDestroy, Hr as orphansCarriedFrom, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as stateBucketExistenceConfirmed, In as malformedStateRefusalMessage, Ir as hasReasonlessBaselineRefusal, It as isNamelessDynamicReferenceError, J as bold, Ja as retryClassificationText, Ji as producerRecordKey, Jn as repairMalformedOutputsForReadOnly, Jr as createAssetRedirectResolver, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as markNonRetryable, Ki as injectiveKeyPrefix, Kn as refuseMalformedState, Kr as WorkGraph, Kt as coerceCfnInteger, L as planOrphanAdoption, La as SynthesisError, Li as warnDeprecatedNoPrefixCliFlag, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasUnverifiableParameterRefusal, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as ResourceTimeoutError, Mi as resolveSkipPrefix, Mn as malformedRenderedContainersWarning, Mr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as ResourceUpdateNotSupportedError, Ni as resolveStateBucketWithDefault, Nn as malformedResourceEntriesWarning, Nr as DEFAULT_STATE_PREFIX, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as MalformedProducerRecordRefusalError, Oi as getLegacyStateBucketName, On as malformedOrphansRefusalMessage, Or as buildLockContentionMessage, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as StackHasActiveImportsError, Pi as resolveStateBucketWithDefaultAndSource, Pn as malformedResourcePropertiesWarning, Pr as exportNamesCarriedFrom, Pt as getAccountInfo, Q as red, Qi as canonicalizeRegion, Qn as safeRegion, Qr as BOOTSTRAP_MARKER_PREFIX, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as ssmResolvedValueType, Rn as refuseMalformedNestedChildOutputs, Rr as importableOutputKeys, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as DeployCancelledError, Si as stripControlChars, Sn as hasReadableResources, Sr as scrubResourceRecord, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as LocalInvokeBuildError$1, Ti as Synthesizer, Tn as malformedExportSourceWarning, Tr as rebuildClientForBucketRegion, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ua as isRetryableTransientError, Ui as uploadCfnTemplate, Un as refuseMalformedResourceEntries, Ur as shouldRetainResource, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as withErrorHandling, Vi as MIGRATE_TMP_PREFIX, Vn as refuseMalformedOutputs, Vr as orphansAfterRollback, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as isThrottlingError, Wi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Wn as refuseMalformedResourcePropertiesForOrphan, Wr as AssetPublisher, Wt as assertRegionMatch, X as gray, Xa as safeStringify, Xi as expectedOwnerParam, Xn as repairMalformedResourcePropertiesForReadOnly, Xr as rewriteTemplateAssetReferences, Xt as readConfigString, Y as cyan, Ya as describeAwsFailure, Yi as decodeListingKey, Yn as repairMalformedResourceEntriesForReadOnly, Yr as loadPublishableAssetManifest, Yt as configStringRefusal, Z as green, Zi as PARTITION_TABLE, Zn as repairMalformedResourcesForReadOnly, Zr as AssetModeResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _i as partitionSensitiveEnv, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as maskSecretsInError, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as hasPlainPrototype, ai as validateAssetBucketName, an as s3BucketDomainName, ar as TemplateParser, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as CrossAccountSecretRefusalError, bi as runDockerStreaming, bn as hasReadableOrphans, br as recoverMaskedOutput, bt as startInterruptWatch, c as replayFailedOperations, ca as absoluteAssemblyPathEscape, ci as buildDockerImage, cn as s3BucketWebsiteUrl, cr as STATE_SOURCED_READBACK_RULES, ct as IAMRoleProvider, d as updatePartialMessage, di as describeDockerCapturedOutput, dn as applyCallerIdentityCredentials, dr as createSecretMasker, dt as ProviderRegistry, ea as AssemblyReader, ei as ensureAssetStorage, en as requireConfigString, er as findActionableSilentDrops, et as collectDeclaredOutputNames, f as updatePartialReason, fa as resolveBucketRegion, fi as describeDockerExecFailure, fn as callerEnvCredentials, fr as dynamicReferenceTokens, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as setAwsClients, gi as getDockerCmd, gn as STATE_RESOURCES_MALFORMED, gr as markSameGenerationBag, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as resetAwsClients, hi as formatDockerLoginError, hn as INTRINSIC_KEYS, hr as isSingleDynamicReferenceToken, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as hasOwnKey, ii as readBootstrapMarkerBody, in as s3BucketArn, ir as DagBuilder, it as secretBearing, j as isFinalSnapshotError, ja as ProvisioningError, ji as resolveCaptureObservedState, jn as malformedOutputsWarning, jr as shellQuote, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as NestedStackChildDirectDestroyError, ki as resolveApp, kn as malformedOrphansWarning, kr as forceQuitRecoveryClause, kt as IntrinsicFunctionResolver, l as replayRollback, la as renderAssemblyPathEscape, li as resolveDockerContextDirectory, ln as applyRoleArnIfSet, lr as TEMPLATE_SOURCED_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as getAwsClients, mi as dockerSpawnEnvWithSensitive, mn as DiffCalculator, mr as identityKeyFor, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as processStackMessages, ni as isCrossRegionRedirect, nn as producerRegionsFromState, nr as describeTypeWithThrottleRetry, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as nullPrototypeRecord, oi as validateContainerRepoName, on as s3BucketDualStackDomainName, or as STATE_SOURCED_BASELINE_RULES, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as AwsClients, pi as describeDockerFailure, pn as envCredentialsAreAssumedRole, pr as errorCauseChain, pt as createMaskedRetryLogger, q as formatResourceLine, qa as markRedactedCause, qi as producerCoordinateKey, qn as repairMalformedOrphansForReadOnly, qr as buildAssetRedirectMap, qt as configBooleanRefusal, r as DeployEngine, ra as defineOwnKey, ri as parseBootstrapMarker, rn as withSharedDrainBudget, rr as withRetry, rt as isExportAliasCollision, s as planRollback, sa as ownValue, si as buildDenyExternalAccessPolicy, sn as s3BucketRegionalDomainName, sr as STATE_SOURCED_CROSS_GENERATION_RULES, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as failedStageNote, ti as getBootstrapMarkerKey, tn as classifyReplaySecretRegion, tr as findSilentDropProperties, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveAssemblyPath, ui as warnManifestExecutable, un as AWS_CREDENTIAL_ENV_KEYS, ur as carriesSecretMask, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as CdkdError, vi as redactDockerArgvValues, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as maskSecretsInText, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as IntrinsicResolutionRefusalError, wi as getDockerImageBySourceHash, wn as malformedExportNamesWarning, wr as S3StateBackend, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as escapeRegExp, xn as hasReadableOutputs, xr as redactSecretsForState, xt as CloudControlProvider, y as keptWholeReasonText, yi as runDockerForeground, yn as displayLogicalId, yr as recordMaskOnlyValue, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as CFN_TEMPLATE_BODY_LIMIT, zn as refuseMalformedOrphans, zr as importableOutputs, zt as refStateLookupFromResource } from "./deploy-engine-C1w5fjW1.js";
+import { $ as yellow, $a as describeAwsFailure, $i as expectedOwnerParam, $n as repairMalformedResourcePropertiesForReadOnly, $r as rewriteTemplateAssetReferences, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as LocalStartServiceError, Ai as getDefaultStateBucketName, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as warnDeprecatedNoPrefixCliFlag, Bn as refuseMalformedOrphansForDestroy, Br as hasUnverifiableParameterRefusal, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ci as runDockerStreaming, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as DynamicReferenceRegionAmbiguousError, Di as getDockerImageBySourceHash, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as DeployCancelledError, Ei as AssetManifestLoader, En as malformedLocalOutputsWarning, Er as LockManager, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as ProvisioningError, Fi as resolveSkipPrefix, Fn as malformedResourcesWarning, Fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as withErrorHandling, Gi as findLargeInlineResources, Gn as refuseMalformedResourceEntries, Gr as orphansCarriedFrom, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Hi as CFN_TEMPLATE_BODY_LIMIT, Hn as refuseMalformedOutputs, Hr as importableOutputs, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as ResourceTimeoutError, Ii as resolveStateBucketWithDefault, In as malformedStateRefusalMessage, Ir as DEFAULT_STATE_PREFIX, It as isNamelessDynamicReferenceError, J as bold, Ja as isThrottlingError, Ji as injectiveKey, Jn as refuseMalformedResourcesForDestroy, Jr as stringifyValue, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as isMarkedNonRetryable, Ki as uploadCfnTemplate, Kn as refuseMalformedResourceEntriesForOrphan, Kr as shouldRetainResource, Kt as coerceCfnInteger, L as planOrphanAdoption, La as ResourceUpdateNotSupportedError, Li as resolveStateBucketWithDefaultAndSource, Ln as refuseDivergentRecordRegionForDestroy, Lr as exportNamesCarriedFrom, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as MalformedProducerRecordRefusalError, Mi as resolveApp, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as NestedStackChildDirectDestroyError, Ni as resolveAutoAssetStorage, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as IntrinsicResolutionRefusalError, Oi as Synthesizer, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as PartialFailureError, Pi as resolveCaptureObservedState, Pn as malformedResourcePropertiesWarning, Pr as shellQuote, Pt as getAccountInfo, Q as red, Qa as retryClassificationText, Qi as decodeListingKey, Qn as repairMalformedResourceEntriesForReadOnly, Qr as loadPublishableAssetManifest, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as StackHasActiveImportsError, Ri as resolveUseCdkBootstrapAssets, Rn as refuseMalformedNestedChildOutputs, Rr as hasReadableExportSet, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as CdkdError, Si as runDockerForeground, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ti as stripControlChars, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as CFN_TEMPLATE_URL_LIMIT, Un as refuseMalformedOutputsForDestroy, Ur as isReadableBag, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as SynthesisError, Vi as ssmResolvedValueType, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputKeys, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as normalizeAwsError, Wi as MIGRATE_TMP_PREFIX, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansAfterRollback, Wt as assertRegionMatch, X as gray, Xa as markNonRetryable, Xi as producerCoordinateKey, Xn as repairMalformedOrphansForReadOnly, Xr as buildAssetRedirectMap, Xt as readConfigString, Y as cyan, Ya as isTransientServerError, Yi as injectiveKeyPrefix, Yn as refuseMalformedState, Yr as WorkGraph, Yt as configStringRefusal, Z as green, Za as markRedactedCause, Zi as producerRecordKey, Zn as repairMalformedOutputsForReadOnly, Zr as createAssetRedirectResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as AwsClients, _i as dockerSpawnEnvWithSensitive, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as globMatches, ai as isCrossRegionRedirect, an as s3BucketDomainName, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as setAwsClients, bi as partitionSensitiveEnv, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as hasOwnKey, ci as validateAssetBucketName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as ownValue, di as buildDockerImage, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as PARTITION_TABLE, ei as AssetModeResolver, en as requireConfigString, eo as safeStringify, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as absoluteAssemblyPathEscape, fi as resolveDockerContextDirectory, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as resolveBucketRegion, gi as describeDockerFailure, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as describeDockerExecFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as failedStageNote, ii as getBootstrapMarkerKey, in as s3BucketArn, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ji as getLegacyStateBucketName, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as LocalInvokeBuildError$1, ki as synthesisStatusMessage, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as hasPlainPrototype, li as validateContainerRepoName, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as resolveAssemblyPath, mi as describeDockerCapturedOutput, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as derivePartitionAndUrlSuffix, ni as assertAssetBucketRegion, nn as producerRegionsFromState, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as processStackMessages, oi as parseBootstrapMarker, on as s3BucketDualStackDomainName, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as renderAssemblyPathEscape, pi as warnManifestExecutable, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as isRetryableTransientError, qi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, qn as refuseMalformedResourcePropertiesForOrphan, qr as AssetPublisher, qt as configBooleanRefusal, r as DeployEngine, ra as AssemblyReader, ri as ensureAssetStorage, rn as withSharedDrainBudget, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as defineOwnKey, si as readBootstrapMarkerBody, sn as s3BucketRegionalDomainName, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as canonicalizeRegion, ti as BOOTSTRAP_MARKER_PREFIX, tn as classifyReplaySecretRegion, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as nullPrototypeRecord, ui as buildDenyExternalAccessPolicy, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as getAwsClients, vi as formatDockerLoginError, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as CrossAccountSecretRefusalError, wi as escapeRegExp, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as redactDockerArgvValues, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, ya as resetAwsClients, yi as getDockerCmd, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as StackTerminationProtectionError, zi as stateBucketExistenceConfirmed, zn as refuseMalformedOrphans, zr as hasReasonlessBaselineRefusal, zt as refStateLookupFromResource } from "./deploy-engine-CpMT9Bmm.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-5OUR3VB2.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DPGr3o8N.js";
+import { t as getCdkdVersion } from "./version-ChuDKy_E.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-_vdcb9QG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -290,7 +290,7 @@ const STATE_KEY_MAX_CODE_POINTS = STACK_REF_MAX_CODE_POINTS + 64;
 * Parse context key=value pairs from CLI arguments into a Record
 */
 function parseContextOptions(contextArgs) {
-	const context = {};
+	const context = nullPrototypeRecord();
 	if (contextArgs) for (const arg of contextArgs) {
 		const eqIndex = arg.indexOf("=");
 		if (eqIndex > 0) context[arg.substring(0, eqIndex)] = arg.substring(eqIndex + 1);
@@ -2046,6 +2046,104 @@ function createBootstrapCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/cli/stack-matcher.ts
+/**
+* Match stacks against user-supplied name patterns.
+*
+* Patterns are evaluated against two fields:
+*
+* - `stackName` — the physical CloudFormation stack name (e.g. `MyStage-MyStack`)
+* - `displayName` — the hierarchical CDK path (e.g. `MyStage/MyStack`); falls
+*   back to `stackName` when the assembly does not carry one
+*
+* Routing is decided by whether the pattern contains `/`:
+*
+* - Pattern contains `/` → matched only against `displayName` (a `/` cannot
+*   appear in a CloudFormation stack name, so this is unambiguous)
+* - Pattern contains no `/` → matched only against `stackName`
+*
+* Wildcards (`*`) are supported in either case; every other character is
+* literal. Results are de-duplicated by
+* `stackName`, so a pattern that incidentally matches the same stack via both
+* fields is returned only once.
+*/
+function matchStacks(stacks, patterns) {
+	if (patterns.length === 0) return [];
+	const seen = /* @__PURE__ */ new Set();
+	const result = [];
+	for (const stack of stacks) if (patterns.some((pattern) => stackMatchesPattern(stack, pattern)) && !seen.has(stack.stackName)) {
+		seen.add(stack.stackName);
+		result.push(stack);
+	}
+	return result;
+}
+/**
+* Render a stack for diagnostic messages. When `displayName` differs from the
+* physical name, both are shown so the user can see which forms are valid as
+* patterns (e.g. `MyStage-Api (MyStage/Api)`).
+*
+* Both names come from the Cloud Assembly, and every one of this helper's
+* render sites interpolates the result into PROSE cdkd authors — `Available:
+* ...`, `Multiple stacks found: ...`, `Publishing assets for stack: ...`, the
+* last of which prints on a normal run rather than only on an error. So they
+* go through `displayIdent` ([#3277](https://github.com/go-to-k/cdkd/issues/3277)):
+* a `stackName` carrying `ESC [ 2 K` plus a carriage return ERASES cdkd's own
+* line and a newline forges a second one, and a value carrying quotes and
+* periods writes a cdkd-sounding clause.
+*
+* It is the identity on every legitimate `stackName` — a CloudFormation stack
+* name is `[A-Za-z0-9-]`, inside `PLAIN_IDENT`. It is NOT the identity on
+* every legitimate `displayName`: CDK sets that to the construct path, and
+* `constructs` rewrites only `/` in an id, so `new Stack(app, 'My Stack')` is
+* legal and prints `MyStack ("My Stack")`. Those quotes are not part of any
+* pattern, in a clause whose job is to say which forms ARE valid as patterns —
+* accepted, because the alternative is `displaySafe`, which passes the quotes
+* and spaces a crafted value needs, and the pattern still matches the RAW
+* name either way (`matchStacks` never sees this rendering).
+*
+* Sanitizing HERE rather than at the call sites is what keeps the rule whole:
+* the sites include `scrub.ts` and `destroy.ts`, which this change does not
+* touch, and a rule widened by hand is how the class survived being closed
+* twice already.
+*/
+function describeStack(stack) {
+	const name = displayIdent(stack.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+	if (stack.displayName && stack.displayName !== stack.stackName) return `${name} (${displayIdent(stack.displayName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })})`;
+	return name;
+}
+/**
+* The message a command raises when SELECTION came back empty — shared by
+* `deploy`, `diff`, `list` and `publish-assets`, which all built the identical
+* string by hand.
+*
+* `assembly` is required AND so is its `failedStages` member, which is the
+* point: a Stage that failed to load dropped every stack under it from
+* `available`, so "no stacks matching" names the wrong problem unless the
+* failure is reported with it (issue
+* [#3482](https://github.com/go-to-k/cdkd/issues/3482)). A REQUIRED member,
+* not an optional one — `{ failedStages?: ... }` accepts `{}`, so it fences
+* the argument while leaving the content unfenced, which is the wiring hole
+* this signature exists to close. `SynthesisResult.failedStages` is required
+* for the same reason, so passing the result satisfies it and an ad-hoc `{}`
+* does not.
+*
+* What it does NOT fence: a caller passing a STALE or empty list. That is
+* behaviour, not shape, and it is covered by a wiring test per command.
+*/
+function renderNoStackMatch(patterns, available, assembly) {
+	return (patterns.length > 0 ? `No stacks matching ${patterns.join(", ")} found in assembly. ` + (available.length > 0 ? `Available: ${available.map(describeStack).join(", ")}` : "The assembly has no stacks") : "No stacks found in assembly") + failedStageNote(patterns, assembly.failedStages);
+}
+/**
+* `*` matches any run of characters and every other character is literal —
+* `globMatches` owns that rule for this matcher and for the failed-Stage
+* attribution alike ([#3508](https://github.com/go-to-k/cdkd/issues/3508)).
+*/
+function stackMatchesPattern(stack, pattern) {
+	const target = pattern.includes("/") ? stack.displayName ?? stack.stackName : stack.stackName;
+	return globMatches(pattern, target);
+}
+
 //#endregion
 //#region src/utils/yaml.ts
 /**
@@ -2293,7 +2391,7 @@ function resolveVerboseTemplatePath(outputDir, stackName) {
 * (go-to-k/cdkd#3489): the guard has its own cases, but reverting the CALL
 * SITE left the suite green.
 */
-async function synthCommand(options) {
+async function synthCommand(stackPatterns, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
 	reserveStdoutForPayload();
@@ -2319,7 +2417,11 @@ async function synthCommand(options) {
 		...options.profile && { profile: options.profile },
 		...Object.keys(context).length > 0 && { context }
 	};
-	const { stacks, assemblyDir } = await synthesizer.synthesize(synthOptions);
+	const result = await synthesizer.synthesize(synthOptions);
+	const { stacks: allStacks, assemblyDir } = result;
+	const selected = stackPatterns.length > 0 ? matchStacks(allStacks, stackPatterns) : allStacks;
+	if (selected.length === 0) throw new Error(renderNoStackMatch(stackPatterns, allStacks, result));
+	const stacks = selected;
 	processStackMessages(stacks, logger, {
 		strict: options.strict === true,
 		ignoreErrors: options.ignoreErrors === true
@@ -2327,8 +2429,9 @@ async function synthCommand(options) {
 	if (stacks.length === 1) {
 		const template = stacks[0].template;
 		process.stdout.write(toYaml(template));
-	}
-	logger.info(`\n${green("✓")} ${bold("Synthesis complete!")} Found ${stacks.length} stack(s):`);
+	} else logger.info(`Supply a stack id (${stacks.map(describeStack).join(", ")}) to display its template.`);
+	const found = stacks.length === allStacks.length ? `Found ${stacks.length} stack(s):` : `Found ${stacks.length} of ${allStacks.length} stack(s):`;
+	logger.info(`\n${green("✓")} ${bold("Synthesis complete!")} ${found}`);
 	for (const stack of stacks) {
 		const resourceCount = countDeployableResources(stack.template);
 		const outputCount = Object.keys(stack.template.Outputs ?? {}).length;
@@ -2348,7 +2451,7 @@ async function synthCommand(options) {
 * Create synth command
 */
 function createSynthCommand() {
-	const cmd = new Command("synth").description("Synthesize CDK app to CloudFormation template").action(withErrorHandling(synthCommand));
+	const cmd = new Command("synth").description("Synthesize CDK app to CloudFormation template").argument("[stacks...]", "Stack name(s) whose template to print. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*'). Every stack is synthesized either way -- the selection decides what reaches stdout.").action(withErrorHandling(synthCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -2359,99 +2462,6 @@ function createSynthCommand() {
 	return cmd;
 }
 
-//#endregion
-//#region src/cli/stack-matcher.ts
-/**
-* Match stacks against user-supplied name patterns.
-*
-* Patterns are evaluated against two fields:
-*
-* - `stackName` — the physical CloudFormation stack name (e.g. `MyStage-MyStack`)
-* - `displayName` — the hierarchical CDK path (e.g. `MyStage/MyStack`); falls
-*   back to `stackName` when the assembly does not carry one
-*
-* Routing is decided by whether the pattern contains `/`:
-*
-* - Pattern contains `/` → matched only against `displayName` (a `/` cannot
-*   appear in a CloudFormation stack name, so this is unambiguous)
-* - Pattern contains no `/` → matched only against `stackName`
-*
-* Wildcards (`*`) are supported in either case. Results are de-duplicated by
-* `stackName`, so a pattern that incidentally matches the same stack via both
-* fields is returned only once.
-*/
-function matchStacks(stacks, patterns) {
-	if (patterns.length === 0) return [];
-	const seen = /* @__PURE__ */ new Set();
-	const result = [];
-	for (const stack of stacks) if (patterns.some((pattern) => stackMatchesPattern(stack, pattern)) && !seen.has(stack.stackName)) {
-		seen.add(stack.stackName);
-		result.push(stack);
-	}
-	return result;
-}
-/**
-* Render a stack for diagnostic messages. When `displayName` differs from the
-* physical name, both are shown so the user can see which forms are valid as
-* patterns (e.g. `MyStage-Api (MyStage/Api)`).
-*
-* Both names come from the Cloud Assembly, and every one of this helper's
-* render sites interpolates the result into PROSE cdkd authors — `Available:
-* ...`, `Multiple stacks found: ...`, `Publishing assets for stack: ...`, the
-* last of which prints on a normal run rather than only on an error. So they
-* go through `displayIdent` ([#3277](https://github.com/go-to-k/cdkd/issues/3277)):
-* a `stackName` carrying `ESC [ 2 K` plus a carriage return ERASES cdkd's own
-* line and a newline forges a second one, and a value carrying quotes and
-* periods writes a cdkd-sounding clause.
-*
-* It is the identity on every legitimate `stackName` — a CloudFormation stack
-* name is `[A-Za-z0-9-]`, inside `PLAIN_IDENT`. It is NOT the identity on
-* every legitimate `displayName`: CDK sets that to the construct path, and
-* `constructs` rewrites only `/` in an id, so `new Stack(app, 'My Stack')` is
-* legal and prints `MyStack ("My Stack")`. Those quotes are not part of any
-* pattern, in a clause whose job is to say which forms ARE valid as patterns —
-* accepted, because the alternative is `displaySafe`, which passes the quotes
-* and spaces a crafted value needs, and the pattern still matches the RAW
-* name either way (`matchStacks` never sees this rendering).
-*
-* Sanitizing HERE rather than at the call sites is what keeps the rule whole:
-* the sites include `scrub.ts` and `destroy.ts`, which this change does not
-* touch, and a rule widened by hand is how the class survived being closed
-* twice already.
-*/
-function describeStack(stack) {
-	const name = displayIdent(stack.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
-	if (stack.displayName && stack.displayName !== stack.stackName) return `${name} (${displayIdent(stack.displayName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS })})`;
-	return name;
-}
-/**
-* The message a command raises when SELECTION came back empty — shared by
-* `deploy`, `diff`, `list` and `publish-assets`, which all built the identical
-* string by hand.
-*
-* `assembly` is required AND so is its `failedStages` member, which is the
-* point: a Stage that failed to load dropped every stack under it from
-* `available`, so "no stacks matching" names the wrong problem unless the
-* failure is reported with it (issue
-* [#3482](https://github.com/go-to-k/cdkd/issues/3482)). A REQUIRED member,
-* not an optional one — `{ failedStages?: ... }` accepts `{}`, so it fences
-* the argument while leaving the content unfenced, which is the wiring hole
-* this signature exists to close. `SynthesisResult.failedStages` is required
-* for the same reason, so passing the result satisfies it and an ad-hoc `{}`
-* does not.
-*
-* What it does NOT fence: a caller passing a STALE or empty list. That is
-* behaviour, not shape, and it is covered by a wiring test per command.
-*/
-function renderNoStackMatch(patterns, available, assembly) {
-	return (patterns.length > 0 ? `No stacks matching ${patterns.join(", ")} found in assembly. ` + (available.length > 0 ? `Available: ${available.map(describeStack).join(", ")}` : "The assembly has no stacks") : "No stacks found in assembly") + failedStageNote(patterns, assembly.failedStages);
-}
-function stackMatchesPattern(stack, pattern) {
-	const target = pattern.includes("/") ? stack.displayName ?? stack.stackName : stack.stackName;
-	if (pattern.includes("*")) return new RegExp("^" + pattern.replace(/\*/g, ".*") + "$").test(target);
-	return target === pattern;
-}
-
 //#endregion
 //#region src/cli/commands/list.ts
 /**
@@ -22349,17 +22359,21 @@ var DynamoDBGlobalTableProvider = class {
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
+		let wiringProperties = properties;
 		if (indexesOmitted) {
 			effectiveProperties = { ...effectiveProperties ?? properties };
 			delete effectiveProperties["GlobalSecondaryIndexes"];
-			const replicasForOmit = effectiveProperties["Replicas"];
-			if (Array.isArray(replicasForOmit)) effectiveProperties["Replicas"] = replicasForOmit.map((entry) => {
-				const replica = asRecord$1(entry);
-				if (!replica || replica["Region"] !== currentRegion) return entry;
-				const copy = { ...replica };
-				delete copy["GlobalSecondaryIndexes"];
-				return copy;
-			});
+			const recorded = withdrawReplicaIndexBlocks(effectiveProperties["Replicas"]);
+			if (recorded.changed) effectiveProperties["Replicas"] = recorded.replicas;
+			const wired = withdrawReplicaIndexBlocks(properties["Replicas"]);
+			if (wired.changed) {
+				wiringProperties = {
+					...properties,
+					Replicas: wired.replicas
+				};
+				const crossRegion = wired.withdrawnRegions.filter((region) => region !== currentRegion);
+				if (crossRegion.length > 0) warn(`DynamoDB GlobalTable ${logicalId}: omitting the GlobalSecondaryIndexes overrides of replica(s) ${crossRegion.join(", ")}: they name indexes this create does not build, so there is nothing for them to apply to`);
+			}
 			const keptKeyAttributes = collectDesiredKeyAttributeNames(properties, { indexListKeys: ["LocalSecondaryIndexes"] });
 			if (keptKeyAttributes.size > 0 && Array.isArray(attributeDefinitions)) {
 				const prunedAttributeDefinitions = attributeDefinitions.filter((definition) => {
@@ -22392,7 +22406,8 @@ var DynamoDBGlobalTableProvider = class {
 		if (billingMode !== "PROVISIONED" && Object.keys(createOnDemand).length > 0) createParams.OnDemandThroughput = createOnDemand;
 		const localReplicaTags = replicas.find((r) => r["Region"] === currentRegion)?.["Tags"];
 		if (localReplicaTags && localReplicaTags.length > 0) createParams.Tags = localReplicaTags;
-		for (const replica of replicas) {
+		const wiringReplicas = wiringProperties["Replicas"] ?? [];
+		for (const replica of wiringReplicas) {
 			const replicaRegion = replica["Region"];
 			if (!replicaRegion || replicaRegion === currentRegion) continue;
 			toSdkReplicaGlobalSecondaryIndexes(replica["GlobalSecondaryIndexes"], billingMode, diagnostics, maskSecrets);
@@ -22408,7 +22423,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		try {
 			const tableInfo = await this.waitForTableActive(tableName, logicalId);
-			for (const replica of replicas) {
+			for (const replica of wiringReplicas) {
 				const region = replica["Region"];
 				if (!region || region === currentRegion) continue;
 				await this.addReplica(tableName, replica, region, logicalId, billingMode, void 0, maskSecrets);
@@ -22433,7 +22448,7 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 			}
 			if (billingMode === "PROVISIONED") try {
-				await this.reconcileAutoScalingTargets(tableName, [], collectAutoScalingTargets(properties, currentRegion), currentRegion, void 0, maskSecrets);
+				await this.reconcileAutoScalingTargets(tableName, [], collectAutoScalingTargets(wiringProperties, currentRegion), currentRegion, void 0, maskSecrets);
 			} catch (autoScalingErr) {
 				warn(`Auto-scaling registration failed for ${tableName}: ${describeAwsFailure(autoScalingErr).detail}. The table was created successfully; re-run the deploy to register the scaling targets.`);
 			}
@@ -22555,13 +22570,55 @@ var DynamoDBGlobalTableProvider = class {
 		if (tableOverrides.OnDemandThroughputOverride) create.OnDemandThroughputOverride = tableOverrides.OnDemandThroughputOverride;
 		if (replica["TableClassOverride"]) create.TableClassOverride = replica["TableClassOverride"];
 		const replicaUpdates = [{ Create: create }];
-		await this.dynamoDBClient.send(new UpdateTableCommand({
-			TableName: tableName,
-			ReplicaUpdates: replicaUpdates
-		}));
+		for (let attempt = 1;; attempt++) try {
+			await this.dynamoDBClient.send(new UpdateTableCommand({
+				TableName: tableName,
+				ReplicaUpdates: replicaUpdates
+			}));
+			break;
+		} catch (error) {
+			if (attempt >= 3 || !isReplicaCopyExistsRefusal(error)) throw error;
+			if (!await this.waitForRegionalCopyReleased(tableName, region, maskSecrets)) throw error;
+			await new Promise((resolve) => setTimeout(resolve, REPLICA_COPY_RELEASE_POLL_MS));
+		}
 		await this.waitForReplicaActive(tableName, region, logicalId);
 	}
 	/**
+	* Poll the replica REGION for its same-named table until it is gone,
+	* answering `true` once it is (so the replica-add may be retried) and
+	* `false` for anything that is not a copy on its way out: a table in any
+	* status but `DELETING`, a probe error, or the cap running out. Only ever
+	* READS the region — the caller re-throws AWS's own refusal on `false`.
+	* Interruptible, like every other bounded wait on this provider's paths.
+	*/
+	async waitForRegionalCopyReleased(tableName, region, maskSecrets) {
+		const client = this.getRegionalClient(region);
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB ${region} copy of ${tableName} to finish deleting`));
+		let announced = false;
+		try {
+			for (let poll = 0; poll < 180; poll++) {
+				if (watch.isInterrupted()) throw watch.onInterrupted();
+				let status;
+				try {
+					status = (await client.send(new DescribeTableCommand({ TableName: tableName }))).Table?.TableStatus;
+				} catch (probeError) {
+					if (probeError instanceof ResourceNotFoundException$1) return true;
+					this.logger.debug(maskSecrets(`Could not read the ${region} copy of ${tableName}: ${describeAwsFailure(probeError).detail}`));
+					return false;
+				}
+				if (status !== "DELETING") return false;
+				if (!announced) {
+					this.logger.info(maskSecrets(`The ${region} copy of ${tableName} is still being deleted; waiting for it before adding the replica`));
+					announced = true;
+				}
+				await new Promise((resolve) => setTimeout(resolve, REPLICA_COPY_RELEASE_POLL_MS));
+			}
+			return false;
+		} finally {
+			watch.dispose();
+		}
+	}
+	/**
 	* Update a DynamoDB Global Table in place.
 	*
 	* AWS-side state-machine constraint: `UpdateTable` does not accept
@@ -23173,7 +23230,7 @@ var DynamoDBGlobalTableProvider = class {
 		const oldEnabled = oldSettings !== void 0 && oldSettings !== null;
 		const newEnabled = newSettings !== void 0 && newSettings !== null;
 		if (!oldEnabled && !newEnabled) return;
-		const watch = startInterruptWatch(`DynamoDB auto-scaling for ${tableName}`);
+		const watch = startInterruptWatch(maskSecrets(`DynamoDB auto-scaling for ${tableName}`));
 		try {
 			if (newEnabled) {
 				const minCapacity = coerceCfnInteger(newSettings["MinCapacity"] ?? 0);
@@ -24526,6 +24583,65 @@ function collectAutoScalingTargets(properties, localRegion) {
 	return specs;
 }
 /**
+* How long `addReplica` waits out a same-named regional copy that is still
+* DELETING (issue #3569): polls x interval, ~15 minutes. A regional copy has
+* been measured to linger for minutes after it left the source table's
+* `Replicas[]`.
+*/
+const REPLICA_COPY_RELEASE_POLLS = 180;
+const REPLICA_COPY_RELEASE_POLL_MS = 5e3;
+/** Replica-add attempts in total, the first included. */
+const REPLICA_COPY_RELEASE_ATTEMPTS = 3;
+/**
+* AWS's refusal of a `ReplicaUpdates[].Create` whose region already holds a
+* table of that name. Keyed on the MESSAGE: the error class is a generic
+* `ValidationException`, shared with every other malformed replica request.
+*/
+function isReplicaCopyExistsRefusal(error) {
+	return error instanceof Error && /one or more replicas already existed as tables/i.test(error.message);
+}
+/**
+* `Replicas` with every entry's `GlobalSecondaryIndexes` key REMOVED — the
+* replay-CREATE GSI omit arm's prune of the per-replica index blocks (issue
+* #1741, second instance), which name indexes that create does not build.
+*
+* Copy-on-write: an entry that carries the key is copied without it, every
+* other entry (a non-object included — an unresolved intrinsic must reach AWS
+* as-is, not be rewritten) is passed through by reference, and the caller's
+* array is never mutated. The caller's bag IS `previousState.properties` on
+* this path. A non-array container is returned untouched with `changed: false`.
+*
+* `withdrawnRegions` lists the `Region` of each entry whose block was a
+* non-empty ARRAY, i.e. one `toSdkReplicaGlobalSecondaryIndexes` would have
+* turned into a real override on the wire; a malformed or empty block was
+* never sendable, so withdrawing it is not a loss worth announcing.
+*/
+function withdrawReplicaIndexBlocks(replicas) {
+	if (!Array.isArray(replicas)) return {
+		replicas,
+		changed: false,
+		withdrawnRegions: []
+	};
+	let changed = false;
+	const withdrawnRegions = [];
+	const out = replicas.map((entry) => {
+		const replica = asRecord$1(entry);
+		if (!replica || !Object.prototype.hasOwnProperty.call(replica, "GlobalSecondaryIndexes")) return entry;
+		changed = true;
+		const block = replica["GlobalSecondaryIndexes"];
+		const region = replica["Region"];
+		if (Array.isArray(block) && block.length > 0 && typeof region === "string") withdrawnRegions.push(region);
+		const copy = { ...replica };
+		delete copy["GlobalSecondaryIndexes"];
+		return copy;
+	});
+	return {
+		replicas: changed ? out : replicas,
+		changed,
+		withdrawnRegions
+	};
+}
+/**
 * Every attribute name some KEY SCHEMA in the desired template references:
 * the table's own `KeySchema`, each GSI's, and each LSI's. This is the set
 * the `AttributeDefinitions`-removal guard in `update()` tests membership
@@ -46196,11 +46312,29 @@ function isEmptyObjectPlaceholder(value) {
 * - `EMAIL_OTP`          -> `EmailMfaConfiguration` (carries the email-OTP
 *                           message/subject template — i.e. CFn's
 *                           `EmailAuthenticationMessage` / `Subject`)
+*
+* **The email-OTP model, stated once (issue #1924): the `EmailMfaConfiguration`
+* block's PRESENCE is the factor.** `EmailMfaConfigType` is exactly
+* `{Message?, Subject?}` -- unlike `SoftwareTokenMfaConfigType` it has no
+* `Enabled` member, so the API has no way to carry a message template without
+* enabling email OTP, nor to report one. That is read off the API's TYPE, not
+* measured: a live probe needs a DEVELOPER email sender (a COGNITO_DEFAULT pool
+* refuses the block outright), which the maintainer's account does not have.
+* Both sides honor that: `buildMfaConfigRequest` sends the block for `EMAIL_OTP` OR a bare
+* message/subject (announcing the second, since the template did not list the
+* factor), and `readCurrentState` reads a present block back as `EMAIL_OTP`.
 */
 const MFA_FACTOR_SMS = "SMS_MFA";
 const MFA_FACTOR_SOFTWARE_TOKEN = "SOFTWARE_TOKEN_MFA";
 const MFA_FACTOR_EMAIL_OTP = "EMAIL_OTP";
 /**
+* The one `WebAuthnConfiguration.FactorConfiguration` value AWS accepts beside
+* `MfaConfiguration: ON` when `WEB_AUTHN` is an allowed first auth factor
+* (issue #2064). Typed against the SDK enum so a rename upstream is a compile
+* error rather than a silently never-matching comparison.
+*/
+const WEB_AUTHN_MULTI_FACTOR = "MULTI_FACTOR_WITH_USER_VERIFICATION";
+/**
 * CFn path every `MfaConfiguration` shape refusal in this provider reports.
 * One constant so the three sites that READ the property -- `create`,
 * `update`, and `narrowMfaConfiguration` (the diff / effectiveProperties
@@ -46290,7 +46424,7 @@ function readEnabledMfas(properties) {
 * mirrors how CloudFormation/CDK sequence the two calls.
 */
 function hasMfaConfigProps(properties) {
-	return readEnabledMfas(properties).declaresFactor || !!properties["EmailAuthenticationMessage"] || !!properties["EmailAuthenticationSubject"] || !!properties["WebAuthnRelyingPartyID"] || !!properties["WebAuthnUserVerification"];
+	return readEnabledMfas(properties).declaresFactor || !!properties["EmailAuthenticationMessage"] || !!properties["EmailAuthenticationSubject"] || !!properties["WebAuthnRelyingPartyID"] || !!properties["WebAuthnUserVerification"] || !!properties["WebAuthnFactorConfiguration"];
 }
 /**
 * Build the `SetUserPoolMfaConfig` request from the CFn-level MFA properties,
@@ -46356,6 +46490,7 @@ function buildMfaConfigRequest(physicalId, properties, logger, declaredMfaConfig
 	const emailSubject = properties["EmailAuthenticationSubject"] || void 0;
 	const webAuthnRpId = properties["WebAuthnRelyingPartyID"] || void 0;
 	const webAuthnUserVerification = properties["WebAuthnUserVerification"] || void 0;
+	const webAuthnFactorConfiguration = properties["WebAuthnFactorConfiguration"] || void 0;
 	if (!hasMfaConfigProps(properties)) return void 0;
 	const request = { UserPoolId: physicalId };
 	const factors = new Set(enabledMfas ?? []);
@@ -46366,13 +46501,15 @@ function buildMfaConfigRequest(physicalId, properties, logger, declaredMfaConfig
 		...emailMessage !== void 0 ? { Message: emailMessage } : {},
 		...emailSubject !== void 0 ? { Subject: emailSubject } : {}
 	};
-	if (webAuthnRpId !== void 0 || webAuthnUserVerification !== void 0) request.WebAuthnConfiguration = {
+	if (webAuthnRpId !== void 0 || webAuthnUserVerification !== void 0 || webAuthnFactorConfiguration !== void 0) request.WebAuthnConfiguration = {
 		...webAuthnRpId !== void 0 ? { RelyingPartyId: webAuthnRpId } : {},
-		...webAuthnUserVerification !== void 0 ? { UserVerification: webAuthnUserVerification } : {}
+		...webAuthnUserVerification !== void 0 ? { UserVerification: webAuthnUserVerification } : {},
+		...webAuthnFactorConfiguration !== void 0 ? { FactorConfiguration: webAuthnFactorConfiguration } : {}
 	};
 	const enablesMfaFactor = declaresFactor || request.EmailMfaConfiguration !== void 0;
 	request.MfaConfiguration = declaredMfaConfiguration || (enablesMfaFactor ? "OPTIONAL" : "OFF");
 	if (enabledMfasBlank) warn(`UserPool ${physicalId}: EnabledMfas is an empty string, which declares no MFA factor and is treated as absent — a mangled Fn::Join or an empty String parameter collapses to this shape. Nothing is enabled from it and MfaConfiguration is ${request.MfaConfiguration}; declare the factor names as a list (e.g. ["${MFA_FACTOR_SOFTWARE_TOKEN}"]) if a factor was intended.`);
+	if (request.EmailMfaConfiguration !== void 0 && !factors.has(MFA_FACTOR_EMAIL_OTP) && !enabledMfasMalformed) warn(`UserPool ${physicalId}: EmailAuthenticationMessage / EmailAuthenticationSubject is sent in SetUserPoolMfaConfig's EmailMfaConfiguration block, which has no enable switch of its own -- sending it ENABLES the ${MFA_FACTOR_EMAIL_OTP} MFA factor although EnabledMfas does not list it, and a read-back reports EnabledMfas with ${MFA_FACTOR_EMAIL_OTP}. Add ${MFA_FACTOR_EMAIL_OTP} to EnabledMfas to declare it, or remove the message and subject if email OTP is not wanted.`);
 	const anyFactorBlock = hasAnyMfaFactorBlock(request);
 	const maskLeaves = (v) => maskDeep(v, maskSecrets);
 	const dropped = unrecognizedFactors.map((f) => JSON.stringify(maskLeaves(f)) ?? String(f));
@@ -46546,7 +46683,7 @@ const POLICIES_SUB_KEY_ANNOUNCEMENT = {
 * The PRE-FLIGHT: the reason this user-pool configuration cannot be applied at
 * all, or `undefined` when nothing is known to refuse it.
 *
-* Two rules, both for combinations AWS rejects 100% of the time, and both
+* Three rules, all for combinations AWS rejects 100% of the time, and all
 * raised BEFORE the first AWS call on BOTH the create and the update path. The
 * ordering is what makes them worth refusing rather than warning about: on the
 * UPDATE path `UpdateUserPool` lands FIRST and `SetUserPoolMfaConfig` is
@@ -46601,20 +46738,33 @@ const POLICIES_SUB_KEY_ANNOUNCEMENT = {
 *
 * -- with NO WebAuthn block at all, with `UserVerification: preferred`, and with
 * `required`. The only accepted shape is
-* `WebAuthnConfiguration.FactorConfiguration = MULTI_FACTOR_WITH_USER_VERIFICATION`,
-* and the PINNED SDK (`@aws-sdk/client-cognito-identity-provider` 3.1018.0)
-* does not carry that field -- `WebAuthnConfigurationType` is exactly
-* `{RelyingPartyId?, UserVerification?}` -- so cdkd cannot reach it today.
-* Telling the user to switch to `WEB_AUTHN` would therefore be advice that
-* cannot be followed, which is why the remedy names removing the factor or
-* lowering `MfaConfiguration` instead.
-*
-* That same measurement means `WEB_AUTHN` + ON reproduces this very
-* partial-apply shape while NOT being on the deny-list. Deliberately left
-* uncovered: the correct rule there is CONDITIONAL on
-* `WebAuthnConfiguration.FactorConfiguration`, which the pinned SDK cannot
-* express, so a flat deny-list entry would be an OVER-REFUSAL of the shape that
-* becomes valid the moment the SDK gains the field. Tracked as issue #2064.
+* `WebAuthnConfiguration.FactorConfiguration = MULTI_FACTOR_WITH_USER_VERIFICATION`
+* (the CFn `WebAuthnFactorConfiguration`), so switching to `WEB_AUTHN` is a
+* two-property edit with its own rule -- rule 3 -- and the remedy names the
+* one-property fix instead.
+*
+* Rule 3 (issue #2064) -- the request resolves `MfaConfiguration` to ON while
+* the allowed first auth factors include `WEB_AUTHN` and the request does not
+* carry `FactorConfiguration: MULTI_FACTOR_WITH_USER_VERIFICATION`. It cannot
+* be a deny-list entry: the SAME factor is legal or illegal by that one field.
+* MEASURED us-east-1 2026-09-23, on a pool allowing `[PASSWORD, WEB_AUTHN]`:
+*
+*   {ON,  SoftwareToken, FactorConfiguration: MULTI}                   -> ACCEPTED
+*   {ON,  SoftwareToken, FactorConfiguration: MULTI, UV: preferred}    -> ACCEPTED
+*   {OFF, FactorConfiguration: MULTI}                                  -> ACCEPTED
+*   {ON,  SoftwareToken, FactorConfiguration: SINGLE_FACTOR}           -> rejected
+*   {ON,  SoftwareToken, no WebAuthn block}, live value MULTI          -> rejected
+*
+* all rejections reading "Cannot set WebAuthn factor configuration to
+* SINGLE_FACTOR if MFA is required and WebAuthn is an allowed first auth
+* factor". The last line is what licenses reading the REQUEST rather than the
+* pool: `SetUserPoolMfaConfig` is a full replace here too, so an omitted block
+* is SINGLE_FACTOR whatever the pool held. It is the #1975 partial apply
+* exactly -- measured from both an OFF and an OPTIONAL pool, `UpdateUserPool`
+* adding `WEB_AUTHN` LANDED and the `SetUserPoolMfaConfig(ON)` after it was
+* rejected. (From a pool already at ON, `UpdateUserPool` itself refuses to add
+* `WEB_AUTHN` -- "WEB_AUTHN cannot be used as an auth factor when MFA is
+* enabled if not configured for MFA" -- atomically.)
 *
 * SCOPE LIMIT, deliberate and load-bearing: rule 2 fires only when a
 * `SetUserPoolMfaConfig` request is actually BUILT (`hasMfaConfigProps`), i.e.
@@ -46651,13 +46801,27 @@ const POLICIES_SUB_KEY_ANNOUNCEMENT = {
 * NO logger, so the pre-flight is silent and `applyMfaConfig`'s own warnings
 * still fire exactly once.
 *
-* WHAT THIS CANNOT SEE, stated because the message says "refuses it before
-* sending anything" and that reads as a completeness claim: the pre-flight
-* inspects the TEMPLATE, never the live pool, so two template edits reach the
-* same partial apply without tripping it -- DELETING the `SignInPolicy` block
-* while setting `MfaConfiguration: ON`, and OMITTING `MfaConfiguration` while
-* adding `EMAIL_OTP` to a pool whose live MFA is already ON. Both need a
-* live-state guard and are tracked in #2051.
+* WHICH FACTOR LIST rules 2 and 3 read (issue #2051): the one the pool will
+* hold when `SetUserPoolMfaConfig` runs. When the template SENDS
+* `Policies.SignInPolicy.AllowedFirstAuthFactors` as a list that is the
+* template's list; when it does not, it is the LIVE list, because an omitted
+* sub-key -- or a sent `SignInPolicy` without the member -- is PRESERVED by
+* `UpdateUserPool` (the ledger at `readLiveMfaConfiguration`;
+* `sendsFirstAuthFactorList`). `update()` supplies that live
+* list as `liveFirstAuthFactors`, read only when a rule could fire on it; on
+* create, and when the read fails, it is absent and only the template is
+* judged -- AWS's own default `[PASSWORD]` cannot trip either rule. MEASURED
+* us-east-1 2026-09-23: a pool at `[PASSWORD, EMAIL_OTP]` + OPTIONAL took an
+* `UpdateUserPool` omitting `Policies` (its `AutoVerifiedAttributes` canary
+* landed, the factor list survived), then `SetUserPoolMfaConfig(ON)` was
+* rejected -- the partial apply of DELETING `SignInPolicy` while setting ON.
+*
+* The OTHER #2051 path -- omitting `MfaConfiguration` while adding `EMAIL_OTP`
+* to a pool whose live MFA is ON -- is NOT a partial apply and is not guarded:
+* MEASURED the same day, `UpdateUserPool` itself rejects the added factor
+* ("Only PASSWORD and WEB_AUTHN (if configured) can be enabled as an auth
+* factor if MFA is enabled") and its co-sent `AutoVerifiedAttributes` did NOT
+* land, so AWS answers it atomically before any second call.
 *
 * Deliberately UNCONDITIONAL -- no `CreateContext.replayingState` downgrade.
 * `.claude/rules/providers.md` says a create-path pre-flight refusal MUST
@@ -46665,16 +46829,23 @@ const POLICIES_SUB_KEY_ANNOUNCEMENT = {
 * oversight, and the rule's own reasoning is what licenses it: the downgrade
 * exists because a refusal against a STATE record leaves a resource
 * un-rollbackable with no template-side remedy. That presupposes the replay
-* could otherwise SUCCEED. Here it cannot -- both combinations are rejected by
+* could otherwise SUCCEED. Here it cannot -- every combination is rejected by
 * AWS 100% of the time (measured above, and CloudFormation rolls back on the
 * same templates), so downgrading would trade a clear cdkd-worded refusal for
 * the identical failure arriving later from AWS, on the create path with a
-* pool to roll back and on the update path with a partial apply. A state record
-* additionally cannot legitimately HOLD either combination: state is written
-* only after a SUCCESSFUL apply, and neither can be applied. Revisit this if
-* AWS ever starts accepting one of them.
-*/
-function describeUnsupportedMfaCombination(properties, declaredMfaConfiguration) {
+* pool to roll back and on the update path with a partial apply. Revisit this
+* if AWS ever starts accepting one of them.
+*
+* That argument is about the REPLAY failing either way, not about state being
+* unable to hold the combination -- the live-list arm can meet a perfectly
+* legitimate record. Example: a record at `ON` with no `SignInPolicy`, then a
+* failed deploy that lowered MFA and added `EMAIL_OTP`; the rollback replays
+* the `ON` record against a live `EMAIL_OTP` and is refused. It would have been
+* rejected by AWS all the same, and in both cases the pool keeps the MFA value
+* the failed deploy left -- a rollback cannot restore `ON` until the live
+* factor list allows it, which the refusal text names.
+*/
+function describeUnsupportedMfaCombination(properties, declaredMfaConfiguration, liveFirstAuthFactors) {
 	const request = buildMfaConfigRequest("", properties, void 0, declaredMfaConfiguration);
 	if (request && request.MfaConfiguration === "OFF" && hasAnyMfaFactorBlock(request)) {
 		const blocks = [
@@ -46684,11 +46855,74 @@ function describeUnsupportedMfaCombination(properties, declaredMfaConfiguration)
 		];
 		return `${MFA_CONFIGURATION_PATH} is OFF while an MFA factor is configured (SetUserPoolMfaConfig would carry ${blocks.join(", ")}, built from EnabledMfas / EmailAuthenticationMessage / EmailAuthenticationSubject). AWS rejects that combination ("Invalid MFA configuration given, can't turn off MFA and configure an MFA together"), so cdkd refuses it before sending anything rather than leaving a partly-applied update behind. Set MfaConfiguration to ON or OPTIONAL (or remove it) to enable the declared factor. (If MFA is genuinely not wanted, remove EnabledMfas / EmailAuthenticationMessage / EmailAuthenticationSubject instead.)`;
 	}
-	if (request && request.MfaConfiguration === "ON") {
-		const denied = MFA_INCOMPATIBLE_FIRST_AUTH_FACTORS;
-		const offending = readAllowedFirstAuthFactors(properties).filter((factor) => denied.includes(factor));
-		if (offending.length > 0) return `${MFA_CONFIGURATION_PATH} is ON while Policies.SignInPolicy.AllowedFirstAuthFactors allows ${offending.join(", ")}. AWS rejects that combination ("Only PASSWORD and WEB_AUTHN (if configured) can be enabled as an auth factor if MFA is enabled"), and on an update the sign-in policy has already been applied by the time it does, so cdkd refuses it before sending anything rather than leaving a partly-applied update behind. Remove ${offending.join(", ")} from Policies.SignInPolicy.AllowedFirstAuthFactors, leaving PASSWORD. (Setting MfaConfiguration to OPTIONAL or OFF also clears the conflict, but weakens MFA.)`;
-	}
+	if (!request || request.MfaConfiguration !== "ON") return void 0;
+	const fromTemplate = sendsFirstAuthFactorList(properties);
+	const factors = fromTemplate ? readAllowedFirstAuthFactors(properties) : liveFirstAuthFactors ?? [];
+	const where = fromTemplate ? `Policies.SignInPolicy.AllowedFirstAuthFactors allows` : `the pool's LIVE Policies.SignInPolicy.AllowedFirstAuthFactors allows`;
+	const liveNote = fromTemplate ? "" : " (this template does not declare Policies.SignInPolicy.AllowedFirstAuthFactors, and UpdateUserPool PRESERVES an omitted sub-key, so the live list is what SetUserPoolMfaConfig meets)";
+	const partialApply = "and on an update the rest of the change has already been applied by the time it does, so cdkd refuses it before sending anything rather than leaving a partly-applied update behind.";
+	const denied = MFA_INCOMPATIBLE_FIRST_AUTH_FACTORS;
+	const offending = factors.filter((factor) => denied.includes(factor));
+	if (offending.length > 0) return fromTemplate ? `${MFA_CONFIGURATION_PATH} is ON while Policies.SignInPolicy.AllowedFirstAuthFactors allows ${offending.join(", ")}. AWS rejects that combination ("Only PASSWORD and WEB_AUTHN (if configured) can be enabled as an auth factor if MFA is enabled"), and on an update the sign-in policy has already been applied by the time it does, so cdkd refuses it before sending anything rather than leaving a partly-applied update behind. Remove ${offending.join(", ")} from Policies.SignInPolicy.AllowedFirstAuthFactors, leaving PASSWORD. (Setting MfaConfiguration to OPTIONAL or OFF also clears the conflict, but weakens MFA.)` : `${MFA_CONFIGURATION_PATH} is ON while ${where} ${offending.join(", ")}${liveNote}. AWS rejects that combination ("Only PASSWORD and WEB_AUTHN (if configured) can be enabled as an auth factor if MFA is enabled"), ${partialApply} Declare Policies.SignInPolicy with AllowedFirstAuthFactors that leave out ${offending.join(", ")} (for example [PASSWORD]) -- removing the block cannot remove a factor. (Setting MfaConfiguration to OPTIONAL or OFF also clears the conflict, but weakens MFA.)`;
+	if (factors.includes("WEB_AUTHN") && request.WebAuthnConfiguration?.FactorConfiguration !== WEB_AUTHN_MULTI_FACTOR) return `${MFA_CONFIGURATION_PATH} is ON while ${where} WEB_AUTHN${liveNote} and WebAuthnFactorConfiguration is not ${WEB_AUTHN_MULTI_FACTOR}. AWS rejects that combination ("Cannot set WebAuthn factor configuration to SINGLE_FACTOR if MFA is required and WebAuthn is an allowed first auth factor"), ${partialApply} Set WebAuthnFactorConfiguration to ${WEB_AUTHN_MULTI_FACTOR}, which is the only value AWS accepts beside MFA ON, or ${fromTemplate ? "remove WEB_AUTHN from Policies.SignInPolicy.AllowedFirstAuthFactors" : "declare Policies.SignInPolicy with AllowedFirstAuthFactors that leave out WEB_AUTHN"}. (Setting MfaConfiguration to OPTIONAL also clears the conflict, but weakens MFA.)`;
+}
+/**
+* Does this bag put `Policies.SignInPolicy.AllowedFirstAuthFactors` on the
+* wire as a LIST? Only then does the pool's list change. MEASURED us-east-1
+* 2026-09-23: an `UpdateUserPool` carrying `SignInPolicy: {}` landed (its
+* `AutoVerifiedAttributes` canary applied) and left a live
+* `[PASSWORD, EMAIL_OTP]` intact -- so a SENT sub-key without the member is,
+* for the factor list, the same as an omitted one. The sub-key gate is the
+* wire's own (`sendsPoliciesSubKey`); the member gate mirrors
+* `readAllowedFirstAuthFactors`, which reads a non-list as nothing. A declared
+* non-list takes the live arm, the side that can refuse (what AWS does with
+* that shape is unmeasured). An EMPTY list counts as sent and judges nothing, which is safe:
+* MEASURED the same day, `UpdateUserPool` rejects `AllowedFirstAuthFactors: []`
+* ("Member must have length greater than or equal to 1") atomically -- its
+* co-sent `AutoVerifiedAttributes` did not land.
+*/
+function sendsFirstAuthFactorList(properties) {
+	if (!sendsPoliciesSubKey(properties, "SignInPolicy")) return false;
+	const signInPolicy = properties["Policies"]["SignInPolicy"];
+	return Array.isArray(signInPolicy["AllowedFirstAuthFactors"]);
+}
+/**
+* Does the pre-flight need the pool's LIVE first-auth-factor list (issue
+* #2051)? Only when rules 2 / 3 can evaluate -- a `SetUserPoolMfaConfig`
+* request resolving to ON -- AND the template does not send
+* `Policies.SignInPolicy`, so the live list is what that call will meet. Every
+* other update spends no extra read.
+*/
+function mfaPreflightNeedsLiveSignInPolicy(properties, declaredMfaConfiguration) {
+	return buildMfaConfigRequest("", properties, void 0, declaredMfaConfiguration)?.MfaConfiguration === "ON" && !sendsFirstAuthFactorList(properties);
+}
+/**
+* Could this update need `SetUserPoolMfaConfig` BEFORE `UpdateUserPool`
+* (issue #3562)? True only for the shape that FAILS in cdkd's usual order and
+* DEPLOYS under CloudFormation: the request keeps MFA `ON`, carries
+* `FactorConfiguration: MULTI_FACTOR_WITH_USER_VERIFICATION`, and the
+* template's factor list includes `WEB_AUTHN`. Whether the order actually
+* flips is then decided by the pool's LIVE MFA state
+* (`readMfaFirstPrior`) -- this only decides whether that read is worth making.
+*
+* MEASURED us-east-1 2026-09-23, from a pool at `ON` + SINGLE_FACTOR +
+* `[PASSWORD]`:
+*
+*   UpdateUserPool adding WEB_AUTHN first -> REJECTED ("WEB_AUTHN cannot be
+*     used as an auth factor when MFA is enabled if not configured for MFA")
+*   SetUserPoolMfaConfig(ON, MULTI) first, then UpdateUserPool -> both ACCEPTED
+*   CloudFormation, the same template edit -> UPDATE_COMPLETE
+*
+* The OTHER order-dependent edit the issue measured -- lowering MFA from `ON`
+* while ADDING `EMAIL_OTP` / `SMS_OTP` -- deliberately keeps cdkd's order:
+* CloudFormation ROLLS BACK that edit (same day, UPDATE_ROLLBACK_COMPLETE with
+* the same AWS message), so succeeding there would hide from a cdkd user a
+* failure their production CloudFormation deploy will hit. cdkd's own
+* rejection is atomic (`UpdateUserPool` refuses before anything lands).
+*/
+function mfaMayNeedToPrecedeUpdateUserPool(properties, declaredMfaConfiguration) {
+	const request = buildMfaConfigRequest("", properties, void 0, declaredMfaConfiguration);
+	return request?.MfaConfiguration === "ON" && request.WebAuthnConfiguration?.FactorConfiguration === WEB_AUTHN_MULTI_FACTOR && readAllowedFirstAuthFactors(properties).includes("WEB_AUTHN");
 }
 /**
 * Replace a DECLARED-but-unusable `MfaConfiguration` with the value cdkd
@@ -46772,9 +47006,10 @@ var CognitoUserPoolProvider = class {
 		"EmailAuthenticationMessage",
 		"EmailAuthenticationSubject",
 		"WebAuthnRelyingPartyID",
-		"WebAuthnUserVerification"
+		"WebAuthnUserVerification",
+		"WebAuthnFactorConfiguration"
 	])]]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Map([["WebAuthnFactorConfiguration", "No wire path in the PINNED SDK (@aws-sdk/client-cognito-identity-provider 3.1018.0): WebAuthnConfigurationType is {RelyingPartyId?, UserVerification?} and no CreateUserPool/UpdateUserPool field accepts SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION. This is an SDK-VERSION limit, NOT an API one -- the live API does honour FactorConfiguration (measured us-east-1 2026-08-20: SetUserPoolMfaConfig(ON) on a pool allowing WEB_AUTHN as a first auth factor is rejected with \"Cannot set WebAuthn factor configuration to SINGLE_FACTOR if MFA is required and WebAuthn is an allowed first auth factor\", i.e. the service reads a field the SDK cannot send). RE-EVALUATE THIS ENTRY ON AN SDK BUMP: if WebAuthnConfigurationType gains FactorConfiguration, the property becomes handleable and this entry must go"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map();
 	/**
 	* Warn when `MfaConfiguration` is declared as a BLANK string (issue #1925
 	* item 2, review round 2).
@@ -46817,8 +47052,8 @@ var CognitoUserPoolProvider = class {
 	* physical id on update, matching what each path passes to its other
 	* `ProvisioningError`s.
 	*/
-	assertMfaCombinationApplicable(logicalId, resourceType, target, properties, declaredMfaConfiguration) {
-		const reason = describeUnsupportedMfaCombination(properties, declaredMfaConfiguration);
+	assertMfaCombinationApplicable(logicalId, resourceType, target, properties, declaredMfaConfiguration, liveFirstAuthFactors) {
+		const reason = describeUnsupportedMfaCombination(properties, declaredMfaConfiguration, liveFirstAuthFactors);
 		if (reason === void 0) return;
 		throw new ProvisioningError(reason, resourceType, logicalId, target);
 	}
@@ -47100,6 +47335,14 @@ var CognitoUserPoolProvider = class {
 	*
 	* - `AutoVerifiedAttributes` — DOES reset when omitted (2026-08-18).
 	* - `MfaConfiguration` — does NOT reset when omitted (2026-08-18, above).
+	* - `DeletionProtection` — does NOT reset when omitted (2026-09-23, issue
+	*   #2675): a pool created `ACTIVE` stayed `ACTIVE` through an
+	*   `UpdateUserPool` omitting it, whose co-sent `AutoVerifiedAttributes`
+	*   change landed (the call ran), and an explicit `INACTIVE` then applied
+	*   (the field is writable on this call rather than ignored).
+	* - `WebAuthnConfiguration.FactorConfiguration` (a `SetUserPoolMfaConfig`
+	*   field) — does NOT reset through an `UpdateUserPool` that omits every MFA
+	*   member (2026-09-23, issue #2064).
 	* - `Policies` — neither sub-key resets, measured in BOTH directions
 	*   (2026-08-19, issue #1968; details at `toSdkUserPoolPolicies`): a
 	*   container sent without `SignInPolicy` left `SignInPolicy` intact, a
@@ -47120,6 +47363,9 @@ var CognitoUserPoolProvider = class {
 	*   rejected the same way (2026-08-19, issue #1968; the transcript lives at
 	*   `describeUnsupportedMfaCombination`, which since issue #1977 REFUSES that
 	*   combination before any call rather than warning about it).
+	* - `WebAuthnConfiguration.FactorConfiguration` — an omitted block is read as
+	*   SINGLE_FACTOR even on a pool holding MULTI_FACTOR_WITH_USER_VERIFICATION
+	*   (2026-09-23, issue #2064; transcript at `describeUnsupportedMfaCombination`).
 	*
 	* Nothing here licenses a claim about a field on neither list, or about one
 	* API from the other's section. Measure it.
@@ -47158,6 +47404,79 @@ var CognitoUserPoolProvider = class {
 		}
 	}
 	/**
+	* The pool's live `Policies.SignInPolicy.AllowedFirstAuthFactors`, for the
+	* pre-flight (issue #2051), or `undefined` when it cannot be read.
+	*
+	* FAILS OPEN: an unreadable pool is judged on the template alone, which is
+	* the pre-#2051 behavior -- AWS then answers with its own rejection. Refusing
+	* on a failed read would block deploys over a question cdkd never answered.
+	* `update()` already needs `cognito-idp:DescribeUserPool` (its post-update
+	* attribute read), so this adds no permission. An ABSENT list (a pool with
+	* no sign-in policy) is AWS's default `[PASSWORD]`, which trips no rule, so
+	* it reads as empty.
+	*/
+	async readLiveAllowedFirstAuthFactors(physicalId) {
+		try {
+			const factors = (await this.retryOnTransientControlPlane(() => this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId })), `DescribeUserPool(${physicalId}) before the MFA pre-flight`)).UserPool?.Policies?.SignInPolicy?.AllowedFirstAuthFactors;
+			return Array.isArray(factors) ? factors : [];
+		} catch (error) {
+			this.logger.debug(`DescribeUserPool failed for UserPool ${physicalId} before the MFA pre-flight (${error instanceof Error ? error.name : typeof error}): ${describeAwsFailure(error).detail}`);
+			return;
+		}
+	}
+	/**
+	* The pool's FULL live MFA configuration when `SetUserPoolMfaConfig` has to
+	* go FIRST (issue #3562), or `undefined` to keep the usual order.
+	*
+	* MFA-first is needed exactly when the live pool is at `ON` without
+	* `MULTI_FACTOR_WITH_USER_VERIFICATION`: `UpdateUserPool` then refuses to add
+	* `WEB_AUTHN` until the factor configuration has changed. Anything else --
+	* live `OFF` / `OPTIONAL`, live `MULTI` already, or a read that FAILED --
+	* keeps `UpdateUserPool` first, which is the pre-#3562 behaviour and at worst
+	* the atomic rejection it always was. The returned response is also what
+	* `restoreMfaConfig` replays if `UpdateUserPool` fails after the MFA call
+	* landed.
+	*/
+	async readMfaFirstPrior(physicalId) {
+		try {
+			const live = await this.retryOnTransientControlPlane(() => this.getClient().send(new GetUserPoolMfaConfigCommand({ UserPoolId: physicalId })), `GetUserPoolMfaConfig(${physicalId}) for the call order`);
+			return live.MfaConfiguration === "ON" && live.WebAuthnConfiguration?.FactorConfiguration !== WEB_AUTHN_MULTI_FACTOR ? live : void 0;
+		} catch (error) {
+			this.logger.debug(`GetUserPoolMfaConfig failed for UserPool ${physicalId} while choosing the call order (${error instanceof Error ? error.name : typeof error}): ${describeAwsFailure(error).detail}`);
+			return;
+		}
+	}
+	/**
+	* Put back the MFA configuration `readMfaFirstPrior` read, after
+	* `UpdateUserPool` failed behind an MFA-first `SetUserPoolMfaConfig` (issue
+	* #3562). Without this the reversed order leaves the #1975 partial apply
+	* mirrored: the MFA change landed, the rest did not. MEASURED us-east-1
+	* 2026-09-23: replaying the earlier `GetUserPoolMfaConfig` members through
+	* `SetUserPoolMfaConfig` restored the pool exactly, after a MULTI change had
+	* landed and the `UpdateUserPool` behind it was rejected.
+	*
+	* Best effort: the caller re-throws the ORIGINAL error either way, and a
+	* failed restore is announced (error CLASS at warn, detail at debug) rather
+	* than replacing it.
+	*/
+	async restoreMfaConfig(physicalId, prior) {
+		const request = {
+			UserPoolId: physicalId,
+			...prior.MfaConfiguration !== void 0 && { MfaConfiguration: prior.MfaConfiguration },
+			...prior.SmsMfaConfiguration !== void 0 && { SmsMfaConfiguration: prior.SmsMfaConfiguration },
+			...prior.SoftwareTokenMfaConfiguration !== void 0 && { SoftwareTokenMfaConfiguration: prior.SoftwareTokenMfaConfiguration },
+			...prior.EmailMfaConfiguration !== void 0 && { EmailMfaConfiguration: prior.EmailMfaConfiguration },
+			...prior.WebAuthnConfiguration !== void 0 && { WebAuthnConfiguration: prior.WebAuthnConfiguration }
+		};
+		try {
+			await this.retryOnTransientControlPlane(() => this.getClient().send(new SetUserPoolMfaConfigCommand(request)), `SetUserPoolMfaConfig(${physicalId}) restore`);
+			this.logger.debug(`Restored the previous MFA configuration on UserPool ${physicalId}`);
+		} catch (restoreError) {
+			this.logger.warn(`UserPool ${physicalId}: UpdateUserPool failed after SetUserPoolMfaConfig had already applied the new MFA configuration, and restoring the previous one also failed (${restoreError instanceof Error ? restoreError.name : typeof restoreError}). The pool may now carry the NEW MFA configuration with its OLD sign-in policy; re-run the deploy, or check it with aws cognito-idp get-user-pool-mfa-config --user-pool-id ${physicalId}.`);
+			this.logger.debug(`MFA restore failure detail for UserPool ${physicalId}: ${describeAwsFailure(restoreError).detail}`);
+		}
+	}
+	/**
 	* Retry a Cognito control-plane call on transient "settling" errors. A
 	* SetUserPoolMfaConfig issued immediately after CreateUserPool (or another
 	* control-plane write) can briefly hit `ConcurrentModificationException` /
@@ -47271,9 +47590,11 @@ var CognitoUserPoolProvider = class {
 		this.logger.debug(`Updating Cognito User Pool ${logicalId}: ${physicalId}`);
 		const mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], { onUnusable: (message) => this.logger.warn(message) });
 		this.warnOnBlankMfaConfiguration(properties["MfaConfiguration"]);
-		this.assertMfaCombinationApplicable(logicalId, resourceType, physicalId, properties, mfaConfiguration);
+		const liveFirstAuthFactors = mfaPreflightNeedsLiveSignInPolicy(properties, mfaConfiguration) ? await this.readLiveAllowedFirstAuthFactors(physicalId) : void 0;
+		this.assertMfaCombinationApplicable(logicalId, resourceType, physicalId, properties, mfaConfiguration, liveFirstAuthFactors);
 		const liveMfa = mfaConfiguration === "" && hasMfaConfigProps(properties) ? await this.readLiveMfaConfiguration(physicalId) : void 0;
 		this.warnOnUnremovablePoliciesSubKeys(physicalId, properties, previousProperties);
+		const mfaFirstPrior = mfaMayNeedToPrecedeUpdateUserPool(properties, mfaConfiguration) ? await this.readMfaFirstPrior(physicalId) : void 0;
 		try {
 			const updateParams = { UserPoolId: physicalId };
 			if (properties["Policies"]) {
@@ -47298,14 +47619,23 @@ var CognitoUserPoolProvider = class {
 			if (properties["SmsAuthenticationMessage"] !== void 0) updateParams.SmsAuthenticationMessage = properties["SmsAuthenticationMessage"];
 			if (properties["SmsVerificationMessage"] !== void 0) updateParams.SmsVerificationMessage = properties["SmsVerificationMessage"];
 			if (properties["UserPoolTier"]) updateParams.UserPoolTier = properties["UserPoolTier"];
-			await this.getClient().send(new UpdateUserPoolCommand(updateParams));
-			await this.reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, properties["Schema"], previousProperties["Schema"], (properties["DeletionProtection"] ? properties["DeletionProtection"] : previousProperties["DeletionProtection"]) === "ACTIVE");
-			await this.applyMfaConfig(physicalId, properties, mfaConfiguration, {
+			const mfaOptions = {
 				...liveMfa?.value !== void 0 ? { liveMfaConfiguration: liveMfa.value } : {},
 				...liveMfa?.failed === true ? { liveReadFailed: true } : {},
 				declaredKind: classifyDeclaredMfaConfiguration(properties["MfaConfiguration"]),
 				...context?.maskSecrets && { maskSecrets: context.maskSecrets }
-			});
+			};
+			if (mfaFirstPrior) {
+				await this.applyMfaConfig(physicalId, properties, mfaConfiguration, mfaOptions);
+				try {
+					await this.getClient().send(new UpdateUserPoolCommand(updateParams));
+				} catch (updateError) {
+					await this.restoreMfaConfig(physicalId, mfaFirstPrior);
+					throw updateError;
+				}
+			} else await this.getClient().send(new UpdateUserPoolCommand(updateParams));
+			await this.reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, properties["Schema"], previousProperties["Schema"], (properties["DeletionProtection"] ? properties["DeletionProtection"] : previousProperties["DeletionProtection"]) === "ACTIVE");
+			if (!mfaFirstPrior) await this.applyMfaConfig(physicalId, properties, mfaConfiguration, mfaOptions);
 			this.logger.debug(`Successfully updated Cognito User Pool ${logicalId}`);
 			const userPool = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool;
 			const region = await this.getClient().config.region();
@@ -47375,7 +47705,7 @@ var CognitoUserPoolProvider = class {
 					before: "aws cognito-idp update-user-pool --user-pool-id",
 					identifier: physicalId,
 					after: "--deletion-protection INACTIVE",
-					caveat: "Note UpdateUserPool's behaviour on an omitted member differs per field, and is unmeasured for DeletionProtection, so send your complete pool configuration alongside that flag rather than the flag alone."
+					caveat: "Note UpdateUserPool resets some members a call omits (AutoVerifiedAttributes among them), so send your complete pool configuration alongside that flag rather than the flag alone."
 				}
 			}) : `AWS::Cognito::UserPool is a stateful type, so re-run with ${replaceFlags} to recreate it (this deletes all users in the pool).`;
 			throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `the Schema change (${immutableChanges.join("; ")}) is immutable on AWS — AWS can only ADD custom attributes in place, so removing or modifying an attribute requires recreating the pool. ${remedy}`);
@@ -47515,6 +47845,7 @@ var CognitoUserPoolProvider = class {
 			result["EmailAuthenticationSubject"] = mfa.EmailMfaConfiguration?.Subject ?? "";
 			result["WebAuthnRelyingPartyID"] = mfa.WebAuthnConfiguration?.RelyingPartyId ?? "";
 			result["WebAuthnUserVerification"] = mfa.WebAuthnConfiguration?.UserVerification ?? "";
+			result["WebAuthnFactorConfiguration"] = mfa.WebAuthnConfiguration?.FactorConfiguration ?? "";
 		} catch (mfaErr) {
 			this.logger.debug(`GetUserPoolMfaConfig failed for ${physicalId}, skipping MFA-derived drift keys: ${describeAwsFailure(mfaErr).detail}`);
 		}
@@ -85040,6 +85371,36 @@ function resolveCdkPathToLogicalIds(input, index) {
 //#endregion
 //#region src/analyzer/orphan-rewriter.ts
 /**
+* Why a reference to an orphaned record that is NOT a readable resource record
+* is left in place rather than resolved (go-to-k/cdkd#3350).
+*
+* `cdkd orphan` may drop such a record — refusing to would close the way out of
+* it — but it must not resolve THROUGH one. Measured before this guard: a
+* string or number record made a sibling's `{"Ref": O}` resolve to `undefined`,
+* which the save then dropped from the JSON, and its `Fn::Sub` `${O}` became
+* the literal `x-undefined`. Reported as unresolvable instead, so a plain run
+* aborts naming the site and `--force` leaves the intrinsic untouched — there
+* is no cached value to fall back to either, since the cache lives inside the
+* record that cannot be read.
+*/
+const UNREADABLE_ORPHAN_RECORD_REASON = "the orphaned resource's state record is not a readable resource record (not an object, no resource type, or no physical id), so nothing in it can be substituted";
+/**
+* Whether the fetcher may read an orphaned record at all: the ENTRY class's
+* predicate PLUS a non-empty string `physicalId`. The entry predicate stops at
+* `resourceType` on purpose (its own note), but every LIVE value this fetcher
+* produces is derived from the physical id — `{"resourceType": "T"}` alone
+* made `{"Ref": O}` resolve to `undefined` and `Fn::Sub` to `x-undefined`
+* exactly as a string record did, and a type whose `Ref` recovery reads the id
+* threw a bare `TypeError` (review of go-to-k/cdkd#3568). The `--force` cache
+* is skipped for such a record too, deliberately: a record with no identity is
+* not one whose cached values can be trusted to describe a live resource.
+*/
+function isResolvableOrphanRecord(entry) {
+	if (!isReadableResourceEntry(entry)) return false;
+	const physicalId = entry.physicalId;
+	return typeof physicalId === "string" && physicalId !== "";
+}
+/**
 * Live-fetch helper. Wraps `provider.getAttribute(...)` for one orphan
 * resource and memoizes results so multiple references to the same
 * `(orphan, attr)` pair only hit AWS once.
@@ -85110,8 +85471,12 @@ var AttributeFetcher = class {
 	* already does with a masked cached attribute; the two arms now agree.
 	*/
 	ref(orphanLogicalId) {
+		if (!Object.hasOwn(this.orphans, orphanLogicalId)) throw new Error(`Internal: Ref to '${orphanLogicalId}' has no orphan entry — should have been filtered out`);
 		const o = this.orphans[orphanLogicalId];
-		if (!o) throw new Error(`Internal: Ref to '${orphanLogicalId}' has no orphan entry — should have been filtered out`);
+		if (!isResolvableOrphanRecord(o)) return {
+			ok: false,
+			reason: UNREADABLE_ORPHAN_RECORD_REASON
+		};
 		let maskedKey;
 		const value = cfnRefValueFromPhysicalId(o.resourceType, o.physicalId, refStateLookupFromResource(o, (key) => {
 			maskedKey = key;
@@ -85150,11 +85515,15 @@ var AttributeFetcher = class {
 			ok: true,
 			value: this.cache.get(cacheKey)
 		};
-		const orphan = this.orphans[orphanLogicalId];
-		if (!orphan) return {
+		if (!Object.hasOwn(this.orphans, orphanLogicalId)) return {
 			ok: false,
 			reason: `Internal: GetAtt to '${orphanLogicalId}' has no orphan entry`
 		};
+		const orphan = this.orphans[orphanLogicalId];
+		if (!isResolvableOrphanRecord(orphan)) return {
+			ok: false,
+			reason: UNREADABLE_ORPHAN_RECORD_REASON
+		};
 		let provider;
 		try {
 			provider = this.providerRegistry.getProviderFor({
@@ -85191,7 +85560,15 @@ var AttributeFetcher = class {
 			reason
 		};
 		const orphan = this.orphans[orphanLogicalId];
-		const stored = orphan.attributes?.[attribute];
+		const bag = orphan.attributes;
+		if (bag !== void 0 && !isReadableBag(bag)) {
+			this.logger.warn(`--force: state.attributes of '${displaySafe(orphanLogicalId, { asciiOnly: true })}' is not a readable map, so it is not consulted for '${displaySafe(attribute, { asciiOnly: true })}'; leaving the original intrinsic in place.`);
+			return {
+				ok: false,
+				reason: `${reason}; the state.attributes cache is not a readable map`
+			};
+		}
+		const stored = bag !== void 0 && Object.hasOwn(bag, attribute) ? bag[attribute] : void 0;
 		const cached = isImpossibleEmptyStoredAttribute(orphan.resourceType, attribute, stored) ? void 0 : stored;
 		if (cached === void 0) {
 			this.logger.warn(`--force: state.attributes also lacks '${orphanLogicalId}.${attribute}'; leaving the original intrinsic in place.`);
@@ -85251,11 +85628,10 @@ var AttributeFetcher = class {
 */
 async function rewriteResourceReferences(state, orphanLogicalIds, providerRegistry, options = {}) {
 	const orphanSet = new Set(orphanLogicalIds);
-	const orphans = {};
+	const orphans = Object.create(null);
 	for (const id of orphanLogicalIds) {
-		const r = state.resources[id];
-		if (!r) throw new Error(`rewriteResourceReferences: orphan '${id}' not found in state.resources`);
-		orphans[id] = r;
+		if (!Object.hasOwn(state.resources, id)) throw new Error(`rewriteResourceReferences: orphan '${id}' not found in state.resources`);
+		orphans[id] = state.resources[id];
 	}
 	const fetcher = new AttributeFetcher(orphans, providerRegistry, options);
 	const rewrites = [];
@@ -85699,10 +86075,13 @@ async function orphanCommand(pathArgs, options) {
 			const stateData = await stateBackend.getState(stackInfo.stackName, targetRegion);
 			if (!stateData) throw new Error(`No state found for stack '${displaySafe(stackInfo.stackName)}' (${displaySafe(targetRegion, { asciiOnly: true })}). Nothing to orphan. (Did the stack get deployed?)`);
 			const { state, etag, migrationPending } = stateData;
-			refuseMalformedState(state, stackInfo.stackName, targetRegion);
-			refuseMalformedOutputs(state, stackInfo.stackName, targetRegion);
+			refuseMalformedState(state, stackInfo.stackName, recordRegion, recovery);
+			refuseMalformedOutputs(state, stackInfo.stackName, recordRegion, recovery);
+			refuseMalformedResourceEntriesForOrphan(state, orphanLogicalIds, stackInfo.stackName, recordRegion, recovery);
 			refuseMalformedResourcePropertiesForOrphan(state, orphanLogicalIds, stackInfo.stackName, recordRegion, recovery);
-			const missing = orphanLogicalIds.filter((id) => !(id in state.resources));
+			refuseMalformedResourceAttributesForOrphan(state, orphanLogicalIds, stackInfo.stackName, recordRegion, recovery);
+			refuseMalformedOrphansForOrphan(state, stackInfo.stackName, recordRegion, recovery);
+			const missing = orphanLogicalIds.filter((id) => !Object.hasOwn(state.resources, id));
 			if (missing.length > 0) {
 				const have = displayIdentList(Object.keys(state.resources), ", ");
 				throw new Error(`Resource(s) not in state for stack '${displaySafe(stackInfo.stackName)}' (${displaySafe(targetRegion, { asciiOnly: true })}): ${displayIdentList(missing, ", ")}.\nAvailable logical IDs: ${have}`);
@@ -97764,4 +98143,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-DnmYd7BO.js.map
+//# sourceMappingURL=program-C5r-kmIQ.js.map