@go-to-k/cdkd 0.238.5 → 0.239.0

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
 import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
-import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-_tADDg2k.js";
+import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-8lyaaElh.js";
 import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
 import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -61,8 +61,9 @@ import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand,
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$1, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$1, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$18, NotFoundException as NotFoundException$5, S3TablesClient, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16 } from "@aws-sdk/client-s3tables";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$18, NotFoundException as NotFoundException$5, S3TablesClient, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1885,7 +1886,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.238.5";
+	return "0.239.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -35162,6 +35163,277 @@ var CodeBuildProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/dlm-lifecycle-policy-provider.ts
+/**
+* SDK Provider for AWS::DLM::LifecyclePolicy (Data Lifecycle Manager).
+*
+* Why an SDK provider (issue #1040): the type is
+* `ProvisioningType: NON_PROVISIONABLE`, so cdkd's Cloud Control fallback
+* cannot handle it and pre-flight rejected it. The DLM API surface is small
+* and the CFn property shape maps 1:1 onto the SDK's PascalCase inputs; the
+* only conversion is the CFn `Tags` list <-> DLM tag-map.
+*
+* physicalId is the service-generated policy id (`policy-0123456789abcdef0`)
+* — matches CFn, where `Ref` returns the policy id (`Id` is the
+* primaryIdentifier). `Fn::GetAtt Arn` returns the policy ARN.
+*
+* API mapping:
+*   - create      -> CreateLifecyclePolicy (+ GetLifecyclePolicy for the Arn
+*                    attribute — the create response only carries PolicyId)
+*   - update      -> UpdateLifecyclePolicy for policy fields, plus explicit
+*                    TagResource / UntagResource for tag diffs (the update
+*                    API has no Tags parameter). Tag removal — including a
+*                    FULL `Tags` property removal — is handled explicitly
+*                    via UntagResource (the #981 ECR regression class).
+*   - delete      -> DeleteLifecyclePolicy (NotFound idempotent, guarded by
+*                    assertRegionMatch)
+*   - getAttribute-> GetLifecyclePolicy (`Arn` from Policy.PolicyArn)
+*
+* `DefaultPolicy` is create-only at the API level (UpdateLifecyclePolicy has
+* no such parameter; CFn documents it as "Update requires: Replacement"), so
+* a change is rejected with `ResourceUpdateNotSupportedError` and the deploy
+* engine's `--replace` fallback recreates the policy.
+*/
+var DLMLifecyclePolicyProvider = class {
+	client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("DLMLifecyclePolicyProvider");
+	handledProperties = new Map([["AWS::DLM::LifecyclePolicy", new Set([
+		"Description",
+		"ExecutionRoleArn",
+		"State",
+		"PolicyDetails",
+		"Tags",
+		"DefaultPolicy",
+		"CreateInterval",
+		"RetainInterval",
+		"CopyTags",
+		"ExtendDeletion",
+		"CrossRegionCopyTargets",
+		"Exclusions"
+	])]]);
+	getClient() {
+		if (!this.client) this.client = new DLMClient(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.client;
+	}
+	/**
+	* Convert the CFn `Tags` list (`[{ Key, Value }]`) to the DLM tag map
+	* (`Record<string, string>`). Returns `undefined` for an absent / empty
+	* list so callers can omit the field.
+	*/
+	cfnTagsToMap(tags) {
+		if (!Array.isArray(tags)) return void 0;
+		const map = {};
+		for (const t of tags) if (typeof t?.Key === "string" && t.Key.length > 0) map[t.Key] = typeof t.Value === "string" ? t.Value : "";
+		return Object.keys(map).length > 0 ? map : void 0;
+	}
+	/**
+	* Map the CFn property shape to the SDK input shape (shared by create and
+	* update — every field name is PascalCase-identical). `Tags` and
+	* `DefaultPolicy` are intentionally NOT included: create wires them
+	* separately (update has neither parameter).
+	*/
+	toSdkFields(properties) {
+		return {
+			...properties["ExecutionRoleArn"] !== void 0 && { ExecutionRoleArn: properties["ExecutionRoleArn"] },
+			...properties["Description"] !== void 0 && { Description: properties["Description"] },
+			...properties["State"] !== void 0 && { State: properties["State"] },
+			...properties["PolicyDetails"] !== void 0 && { PolicyDetails: properties["PolicyDetails"] },
+			...properties["CreateInterval"] !== void 0 && { CreateInterval: properties["CreateInterval"] },
+			...properties["RetainInterval"] !== void 0 && { RetainInterval: properties["RetainInterval"] },
+			...properties["CopyTags"] !== void 0 && { CopyTags: properties["CopyTags"] },
+			...properties["ExtendDeletion"] !== void 0 && { ExtendDeletion: properties["ExtendDeletion"] },
+			...properties["CrossRegionCopyTargets"] !== void 0 && { CrossRegionCopyTargets: properties["CrossRegionCopyTargets"] },
+			...properties["Exclusions"] !== void 0 && { Exclusions: properties["Exclusions"] }
+		};
+	}
+	/** Fetch the policy ARN (`Fn::GetAtt Arn`) for a policy id. */
+	async fetchPolicyArn(policyId) {
+		return (await this.getClient().send(new GetLifecyclePolicyCommand$1({ PolicyId: policyId }))).Policy?.PolicyArn ?? "";
+	}
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating DLM Lifecycle Policy ${logicalId}`);
+		try {
+			const tags = this.cfnTagsToMap(properties["Tags"]);
+			const input = {
+				...this.toSdkFields(properties),
+				...properties["DefaultPolicy"] !== void 0 && { DefaultPolicy: properties["DefaultPolicy"] },
+				...tags && { Tags: tags }
+			};
+			const response = await this.getClient().send(new CreateLifecyclePolicyCommand(input));
+			if (!response.PolicyId) throw new Error("CreateLifecyclePolicy did not return a PolicyId");
+			let arn = "";
+			try {
+				arn = await this.fetchPolicyArn(response.PolicyId);
+			} catch (err) {
+				this.logger.warn(`Created DLM Lifecycle Policy ${response.PolicyId} but could not fetch its ARN: ${err instanceof Error ? err.message : String(err)}`);
+			}
+			this.logger.debug(`Successfully created DLM Lifecycle Policy ${logicalId}: ${response.PolicyId}`);
+			return {
+				physicalId: response.PolicyId,
+				attributes: arn ? { Arn: arn } : {}
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		if (JSON.stringify(properties["DefaultPolicy"]) !== JSON.stringify(previousProperties["DefaultPolicy"])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `DefaultPolicy cannot be changed in place; re-run with \`cdkd deploy --replace ${logicalId}\` to recreate the policy`);
+		this.logger.debug(`Updating DLM Lifecycle Policy ${logicalId} (${physicalId})`);
+		try {
+			await this.getClient().send(new UpdateLifecyclePolicyCommand({
+				PolicyId: physicalId,
+				...this.toSdkFields(properties)
+			}));
+			const newTags = this.cfnTagsToMap(properties["Tags"]) ?? {};
+			const oldTags = this.cfnTagsToMap(previousProperties["Tags"]) ?? {};
+			const arn = await this.fetchPolicyArn(physicalId);
+			const tagsChanged = JSON.stringify(newTags) !== JSON.stringify(oldTags);
+			if (tagsChanged && !arn) this.logger.warn(`Skipping tag update for DLM Lifecycle Policy ${physicalId}: GetLifecyclePolicy returned no PolicyArn`);
+			if (tagsChanged && arn) {
+				const removedKeys = Object.keys(oldTags).filter((k) => !(k in newTags));
+				if (removedKeys.length > 0) {
+					await this.getClient().send(new UntagResourceCommand$15({
+						ResourceArn: arn,
+						TagKeys: removedKeys
+					}));
+					this.logger.debug(`Removed ${removedKeys.length} tag(s) from DLM Lifecycle Policy ${physicalId}`);
+				}
+				const tagsToAdd = {};
+				for (const [k, v] of Object.entries(newTags)) if (oldTags[k] !== v) tagsToAdd[k] = v;
+				if (Object.keys(tagsToAdd).length > 0) {
+					await this.getClient().send(new TagResourceCommand$15({
+						ResourceArn: arn,
+						Tags: tagsToAdd
+					}));
+					this.logger.debug(`Added/updated ${Object.keys(tagsToAdd).length} tag(s) on DLM Lifecycle Policy ${physicalId}`);
+				}
+			}
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: arn ? { Arn: arn } : {}
+			};
+		} catch (error) {
+			if (error instanceof ResourceUpdateNotSupportedError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(`Deleting DLM Lifecycle Policy ${logicalId}: ${physicalId}`);
+		try {
+			await this.getClient().send(new DeleteLifecyclePolicyCommand$1({ PolicyId: physicalId }));
+			this.logger.debug(`Successfully deleted DLM Lifecycle Policy ${logicalId}`);
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$12) {
+				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`DLM Lifecycle Policy ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Attribute fallback. `Arn` is cached in state at create/update time, so
+	* this only fires for imported/degraded records.
+	*/
+	async getAttribute(physicalId, resourceType, attributeName) {
+		if (attributeName === "Id" || attributeName === "PolicyId") return physicalId;
+		if (attributeName !== "Arn") throw new ProvisioningError(`Unknown attribute ${attributeName} for ${resourceType}`, resourceType, physicalId);
+		try {
+			return await this.fetchPolicyArn(physicalId);
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to resolve Arn for DLM Lifecycle Policy ${physicalId}: ${cause?.message ?? String(error)}`, resourceType, physicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Drift read-back. Surfaces `Description`, `State`, `ExecutionRoleArn`,
+	* and `Tags` (DLM tag map -> CFn list via `normalizeAwsTagsToCfn`).
+	*
+	* `PolicyDetails` is intentionally NOT surfaced (see
+	* `getDriftUnknownPaths`): the service normalizes the stored details —
+	* filling `PolicyType` / `ResourceTypes` / per-schedule defaults the
+	* template omitted — and the drift comparator's positional array equality
+	* would flag those AWS-added defaults as phantom drift on every clean run.
+	* The default-policy shorthand fields (`CreateInterval` / `RetainInterval`
+	* / `CopyTags` / `ExtendDeletion` / `CrossRegionCopyTargets` /
+	* `Exclusions`) are folded into the normalized `PolicyDetails` by the
+	* service (GetLifecyclePolicy does not return them at the top level), so
+	* they are excluded for the same reason.
+	*
+	* Returns `undefined` when the policy is gone (ResourceNotFoundException).
+	*/
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		try {
+			const policy = (await this.getClient().send(new GetLifecyclePolicyCommand$1({ PolicyId: physicalId }))).Policy;
+			if (!policy) return void 0;
+			return {
+				...policy.Description !== void 0 && { Description: policy.Description },
+				...policy.State !== void 0 && { State: policy.State },
+				...policy.ExecutionRoleArn !== void 0 && { ExecutionRoleArn: policy.ExecutionRoleArn },
+				Tags: normalizeAwsTagsToCfn(policy.Tags)
+			};
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$12) return;
+			throw error;
+		}
+	}
+	/**
+	* State property paths the provider deliberately does not read back from
+	* AWS — see `readCurrentState` for the rationale.
+	*/
+	getDriftUnknownPaths(_resourceType) {
+		return [
+			"PolicyDetails",
+			"CreateInterval",
+			"RetainInterval",
+			"CopyTags",
+			"ExtendDeletion",
+			"CrossRegionCopyTargets",
+			"Exclusions",
+			"DefaultPolicy"
+		];
+	}
+	/**
+	* Adopt an existing lifecycle policy into cdkd state.
+	*
+	* Lookup order:
+	*  1. `--resource` override (`knownPhysicalId`) -> verify via
+	*     GetLifecyclePolicy. There is no template name property — the policy
+	*     id is service-generated — so no name fallback applies.
+	*  2. Tag-based lookup: GetLifecyclePolicies returns every policy summary
+	*     WITH its tag map in a single unpaginated call, so the `aws:cdk:path`
+	*     match needs no per-policy follow-up.
+	*/
+	async import(input) {
+		if (input.knownPhysicalId) try {
+			const response = await this.getClient().send(new GetLifecyclePolicyCommand$1({ PolicyId: input.knownPhysicalId }));
+			return response.Policy?.PolicyId ? {
+				physicalId: input.knownPhysicalId,
+				attributes: { Arn: response.Policy.PolicyArn ?? "" }
+			} : null;
+		} catch (err) {
+			if (err instanceof ResourceNotFoundException$12) return null;
+			throw err;
+		}
+		if (!input.cdkPath) return null;
+		const list = await this.getClient().send(new GetLifecyclePoliciesCommand({}));
+		for (const policy of list.Policies ?? []) {
+			if (!policy.PolicyId) continue;
+			if (policy.Tags?.["aws:cdk:path"] === input.cdkPath) return {
+				physicalId: policy.PolicyId,
+				attributes: {}
+			};
+		}
+		return null;
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/s3-vectors-provider.ts
 /**
@@ -35235,11 +35507,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${physicalId}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$15({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$16({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$15({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$16({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -36230,7 +36502,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$16({
+			await this.getClient().send(new UntagResourceCommand$17({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -36239,7 +36511,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$16({
+			await this.getClient().send(new TagResourceCommand$17({
 				resourceArn,
 				tags: upserts
 			}));
@@ -36271,7 +36543,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$16({
+			await this.getClient().send(new UntagResourceCommand$17({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -36280,7 +36552,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$16({
+			await this.getClient().send(new TagResourceCommand$17({
 				resourceArn,
 				tags: upserts
 			}));
@@ -37927,6 +38199,7 @@ function registerAllProviders(registry) {
 	registry.register("AWS::KinesisFirehose::DeliveryStream", new FirehoseProvider());
 	registry.register("AWS::CloudTrail::Trail", new CloudTrailProvider());
 	registry.register("AWS::CodeBuild::Project", new CodeBuildProvider());
+	registry.register("AWS::DLM::LifecyclePolicy", new DLMLifecyclePolicyProvider());
 	registry.register("AWS::S3Vectors::VectorBucket", new S3VectorsProvider());
 	registry.register("AWS::ECR::Repository", new ECRProvider());
 	registry.register("AWS::AutoScaling::AutoScalingGroup", new ASGProvider());
@@ -46316,12 +46589,18 @@ function formatBucketSource(source) {
 * not-yet-bootstrapped bucket. (Bucket existence is verified separately
 * via {@link setupStateBackend}, so getting here implies the bucket is
 * reachable; `GetBucketLocation` failing is most often a permissions gap.)
+*
+* Takes the (region-corrected) S3 client directly — see the issue #1054 note
+* in {@link stateInfoCommand}. Before that fix this call was made with the
+* ambient-region client, so a cross-region state bucket silently degraded to
+* `undefined` ("Region: unknown") here; with the corrected client it now
+* succeeds and reports the bucket's actual region.
 */
-async function detectBucketRegion(awsClients, bucket) {
+async function detectBucketRegion(s3, bucket) {
 	try {
-		const constraint = (await awsClients.s3.send(new GetBucketLocationCommand({
+		const constraint = (await s3.send(new GetBucketLocationCommand({
 			Bucket: bucket,
-			...await expectedOwnerParam(awsClients.s3)
+			...await expectedOwnerParam(s3)
 		}))).LocationConstraint;
 		if (!constraint) return "us-east-1";
 		if (constraint === "EU") return "eu-west-1";
@@ -46342,12 +46621,12 @@ async function detectBucketRegion(awsClients, bucket) {
 * Returns the full set of state-file keys; the count is the unique-stacks
 * tally we want for the `Stacks:` line.
 */
-async function listStateFileKeys(awsClients, bucket, prefix) {
+async function listStateFileKeys(s3, bucket, prefix) {
 	const keys = [];
 	let continuationToken;
 	const searchPrefix = `${prefix}/`;
 	do {
-		const resp = await awsClients.s3.send(new ListObjectsV2Command({
+		const resp = await s3.send(new ListObjectsV2Command({
 			Bucket: bucket,
 			Prefix: searchPrefix,
 			...continuationToken && { ContinuationToken: continuationToken }
@@ -46365,13 +46644,13 @@ async function listStateFileKeys(awsClients, bucket, prefix) {
 * Returns `'unknown'` when no state files exist or parsing fails — we don't
 * want a cosmetic command to crash on an unexpected payload.
 */
-async function readSchemaVersion(awsClients, bucket, keys) {
+async function readSchemaVersion(s3, bucket, keys) {
 	if (keys.length === 0) return "unknown";
 	try {
-		const resp = await awsClients.s3.send(new GetObjectCommand({
+		const resp = await s3.send(new GetObjectCommand({
 			Bucket: bucket,
 			Key: keys[0],
-			...await expectedOwnerParam(awsClients.s3)
+			...await expectedOwnerParam(s3)
 		}));
 		if (!resp.Body) return "unknown";
 		const body = await resp.Body.transformToString();
@@ -46387,13 +46666,13 @@ async function readSchemaVersion(awsClients, bucket, keys) {
 * cosmetic command and should not crash on an unexpected payload (deploy
 * hard-errors on the same marker instead).
 */
-async function listAssetStorageMarkers(awsClients, bucket) {
+async function listAssetStorageMarkers(s3, bucket) {
 	const logger = getLogger();
 	const entries = [];
 	let continuationToken;
 	const keys = [];
 	do {
-		const resp = await awsClients.s3.send(new ListObjectsV2Command({
+		const resp = await s3.send(new ListObjectsV2Command({
 			Bucket: bucket,
 			Prefix: BOOTSTRAP_MARKER_PREFIX,
 			...continuationToken && { ContinuationToken: continuationToken }
@@ -46404,10 +46683,10 @@ async function listAssetStorageMarkers(awsClients, bucket) {
 	for (const key of keys) {
 		const region = key.slice(BOOTSTRAP_MARKER_PREFIX.length, -5);
 		try {
-			const marker = parseBootstrapMarker(await (await awsClients.s3.send(new GetObjectCommand({
+			const marker = parseBootstrapMarker(await (await s3.send(new GetObjectCommand({
 				Bucket: bucket,
 				Key: key,
-				...await expectedOwnerParam(awsClients.s3)
+				...await expectedOwnerParam(s3)
 			}))).Body?.transformToString() ?? "", key);
 			entries.push({
 				region,
@@ -46451,6 +46730,7 @@ async function stateInfoCommand(options) {
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
+	let regionCorrectedS3 = null;
 	try {
 		const region = options.region || process.env["AWS_REGION"] || "us-east-1";
 		const resolved = await resolveStateBucketWithDefaultAndSource(options.stateBucket, region);
@@ -46460,10 +46740,18 @@ async function stateInfoCommand(options) {
 			bucket,
 			prefix
 		}).verifyBucketExists();
-		const detectedRegion = await detectBucketRegion(awsClients, bucket);
-		const stateFileKeys = await listStateFileKeys(awsClients, bucket, prefix);
-		const schemaVersion = await readSchemaVersion(awsClients, bucket, stateFileKeys);
-		const assetStorage = await listAssetStorageMarkers(awsClients, bucket);
+		regionCorrectedS3 = await rebuildClientForBucketRegion(awsClients.s3, bucket, {
+			reuseClientCredentials: true,
+			tolerateNonStandardClient: true,
+			onRebuild: ({ bucketRegion, currentRegion }) => {
+				logger.debug(`State bucket '${bucket}' is in '${bucketRegion}' (state-info client was '${String(currentRegion)}'); building a region-corrected S3 client for info reads.`);
+			}
+		});
+		const infoS3 = regionCorrectedS3 ?? awsClients.s3;
+		const detectedRegion = await detectBucketRegion(infoS3, bucket);
+		const stateFileKeys = await listStateFileKeys(infoS3, bucket, prefix);
+		const schemaVersion = await readSchemaVersion(infoS3, bucket, stateFileKeys);
+		const assetStorage = await listAssetStorageMarkers(infoS3, bucket);
 		if (options.json) {
 			const json = {
 				bucket,
@@ -46491,6 +46779,7 @@ async function stateInfoCommand(options) {
 		}
 		process.stdout.write(`${lines.join("\n")}\n`);
 	} finally {
+		regionCorrectedS3?.destroy();
 		awsClients.destroy();
 	}
 }
@@ -57183,7 +57472,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.238.5");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.239.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());