@go-to-k/cdkd 0.267.19 → 0.268.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, $t as NestedStackChildDirectDestroyError, A as slowCcOperationTimeoutMs, At as CFN_TEMPLATE_BODY_LIMIT, B as applyRoleArnIfSet, Bt as AwsClients, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as expectedOwnerParam, G as DagBuilder, Gt as CdkdError, H as describeTypeWithThrottleRetry, Ht as resetAwsClients, I as WAFv2WebACLProvider, It as AssemblyReader, J as S3StateBackend, Jt as LocalInvokeBuildError$1, K as TemplateParser, L as normalizeAwsTagsToCfn, Lt as processStackMessages, M as isTerminationProtectionPropagationError, Mt as MIGRATE_TMP_PREFIX, N as IntrinsicFunctionResolver, Nt as findLargeInlineResources, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as uploadCfnTemplate, Q as stringifyValue, Qt as MissingCdkCliError, R as resolveExplicitPhysicalId, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as setAwsClients, V as DiffCalculator, Vt as getAwsClients, W as isRetryableTransientError, X as shouldRetainResource, Xt as LocalStartServiceError, Y as rebuildClientForBucketRegion, Yt as LocalMigrateError, Z as AssetPublisher, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as StackTerminationProtectionError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dn as withErrorHandling, dt as buildDockerImage, en as PartialFailureError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as StackHasActiveImportsError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_URL_LIMIT, k as CloudControlProvider, kt as warnDeprecatedNoPrefixCliFlag, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as ResourceTimeoutError, nt as loadPublishableAssetManifest, o as planFailedOps, ot as ensureAssetStorage, p as extractDeploymentEventError, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ResourceUpdateNotSupportedError, rt as rewriteTemplateAssetReferences, s as planRollback, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as ProvisioningError, tt as createAssetRedirectResolver, u as withResourceDeadline, un as normalizeAwsError, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch, zt as resolveBucketRegion } from "./deploy-engine-CZCV0ofI.js";
+import { $ as WorkGraph, $t as MissingCdkCliError, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalMigrateError, Y as rebuildClientForBucketRegion, Yt as LocalInvokeBuildError$1, Z as AssetPublisher, Zt as LocalStartServiceError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as StackHasActiveImportsError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dn as normalizeAwsError, dt as buildDockerImage, en as NestedStackChildDirectDestroyError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as withErrorHandling, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceUpdateNotSupportedError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as ProvisioningError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackTerminationProtectionError, ot as ensureAssetStorage, p as extractDeploymentEventError, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ResourceTimeoutError, rt as rewriteTemplateAssetReferences, s as planRollback, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as PartialFailureError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-B5cRuFij.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-C156B4uU.js";
+import { t as ASGProvider } from "./asg-provider-ZylgRJOY.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -17,7 +17,7 @@ import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, Cre
 import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
 import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, GetSecretValueCommand, RemoveRegionsFromReplicationCommand, ReplicateSecretToRegionsCommand, ResourceNotFoundException as ResourceNotFoundException$3, SecretsManagerClient, TagResourceCommand as TagResourceCommand$5, UntagResourceCommand as UntagResourceCommand$5, UpdateSecretCommand } from "@aws-sdk/client-secrets-manager";
 import { AddTagsToResourceCommand, DeleteParameterCommand, DescribeParametersCommand, GetParameterCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$2, ParameterNotFound, PutParameterCommand, RemoveTagsFromResourceCommand, SSMClient } from "@aws-sdk/client-ssm";
-import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand } from "@aws-sdk/client-cloudfront";
+import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, CreateOriginAccessControlCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, DeleteOriginAccessControlCommand, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, GetOriginAccessControlCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, NoSuchOriginAccessControl, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand, UpdateOriginAccessControlCommand } from "@aws-sdk/client-cloudfront";
 import { CloudWatchClient, DeleteAlarmsCommand, DescribeAlarmsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$4, PutMetricAlarmCommand, TagResourceCommand as TagResourceCommand$7, UntagResourceCommand as UntagResourceCommand$7 } from "@aws-sdk/client-cloudwatch";
 import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
@@ -19903,6 +19903,235 @@ var CloudFrontOAIProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/cloudfront-oac-provider.ts
+/**
+* SDK Provider for AWS::CloudFront::OriginAccessControl
+*
+* An Origin Access Control (OAC) is the modern replacement for an Origin
+* Access Identity and is what `S3BucketOrigin.withOriginAccessControl()`
+* synthesizes, so it appears in essentially every CloudFront + S3 CDK stack.
+* Before this provider it was the only resource in such a stack without an
+* SDK Provider and therefore routed through the Cloud Control API, paying
+* ProgressEvent polling (measured ~2.3s on the deploy critical path) for a
+* `CreateOriginAccessControl` call that returns synchronously. Because the
+* Distribution references the OAC, that latency delayed everything downstream.
+*
+* All four CloudFront OAC APIs are synchronous; `Update`/`Delete` additionally
+* require the resource's current `ETag` as `IfMatch`, fetched with
+* `GetOriginAccessControl`.
+*/
+var CloudFrontOACProvider = class {
+	cloudFrontClient;
+	logger = getLogger().child("CloudFrontOACProvider");
+	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudFront::OriginAccessControl", /* @__PURE__ */ new Set(["OriginAccessControlConfig"])]]);
+	constructor() {
+		const awsClients = getAwsClients();
+		this.cloudFrontClient = awsClients.cloudFront;
+	}
+	/**
+	* Create a CloudFront Origin Access Control.
+	*
+	* `CreateOriginAccessControl` is synchronous — the response already carries
+	* the generated `Id`, so there is nothing to poll or wait for.
+	*/
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating CloudFront Origin Access Control ${logicalId}`);
+		try {
+			const oacId = (await this.cloudFrontClient.send(new CreateOriginAccessControlCommand({ OriginAccessControlConfig: this.toSdkConfig(properties["OriginAccessControlConfig"], logicalId, resourceType) }))).OriginAccessControl?.Id;
+			if (!oacId) throw new Error("CreateOriginAccessControl returned no OriginAccessControl.Id");
+			this.logger.debug(`Created CloudFront Origin Access Control: ${oacId}`);
+			return {
+				physicalId: oacId,
+				attributes: { Id: oacId }
+			};
+		} catch (error) {
+			if (error instanceof CdkdError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create CloudFront Origin Access Control ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update a CloudFront Origin Access Control.
+	*
+	* `UpdateOriginAccessControl` overwrites the whole
+	* `OriginAccessControlConfig` and requires the resource's current `ETag` as
+	* `IfMatch`, so the update is a `Get` (for the ETag) followed by the
+	* `Update` itself. Every field of the config is mutable in place — an OAC
+	* is never replaced by a property change.
+	*/
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+		this.logger.debug(`Updating CloudFront Origin Access Control ${logicalId}: ${physicalId}`);
+		try {
+			const etag = (await this.cloudFrontClient.send(new GetOriginAccessControlCommand({ Id: physicalId }))).ETag;
+			if (!etag) throw new Error("GetOriginAccessControl did not return ETag");
+			await this.cloudFrontClient.send(new UpdateOriginAccessControlCommand({
+				Id: physicalId,
+				IfMatch: etag,
+				OriginAccessControlConfig: this.toSdkConfig(properties["OriginAccessControlConfig"], logicalId, resourceType, physicalId)
+			}));
+			this.logger.debug(`Successfully updated CloudFront Origin Access Control ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: { Id: physicalId }
+			};
+		} catch (error) {
+			if (error instanceof CdkdError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update CloudFront Origin Access Control ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Delete a CloudFront Origin Access Control.
+	*
+	* `DeleteOriginAccessControl` requires the current `ETag` as `IfMatch`, so
+	* the delete is a `Get` followed by the `Delete`. A `NoSuchOriginAccessControl`
+	* from EITHER call is treated as idempotent success, but only after
+	* `assertRegionMatch()` confirms the client is pointed at the region the
+	* resource was created in (a region mismatch would otherwise silently
+	* "succeed" while leaving the real resource behind).
+	*/
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(`Deleting CloudFront Origin Access Control ${logicalId}: ${physicalId}`);
+		try {
+			let etag;
+			try {
+				etag = (await this.cloudFrontClient.send(new GetOriginAccessControlCommand({ Id: physicalId }))).ETag;
+			} catch (error) {
+				if (error instanceof NoSuchOriginAccessControl) {
+					await this.assertDeleteRegion(resourceType, logicalId, physicalId, context);
+					this.logger.debug(`Origin Access Control ${physicalId} does not exist, skipping deletion`);
+					return;
+				}
+				throw error;
+			}
+			await this.cloudFrontClient.send(new DeleteOriginAccessControlCommand({
+				Id: physicalId,
+				IfMatch: etag
+			}));
+			this.logger.debug(`Successfully deleted CloudFront Origin Access Control ${logicalId}`);
+		} catch (error) {
+			if (error instanceof NoSuchOriginAccessControl) {
+				await this.assertDeleteRegion(resourceType, logicalId, physicalId, context);
+				this.logger.debug(`Origin Access Control ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			if (error instanceof CdkdError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete CloudFront Origin Access Control ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Get resource attribute (for Fn::GetAtt resolution).
+	*
+	* `Id` is the type's only read-only attribute in the CFn schema, and it IS
+	* the physical id, so no AWS call is needed.
+	*/
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "Id") return physicalId;
+		throw new Error(`Unsupported attribute: ${attributeName} for AWS::CloudFront::OriginAccessControl`);
+	}
+	/**
+	* Read the AWS-current OAC configuration in CFn-property shape.
+	*
+	* The CFn `OriginAccessControlConfig` field names and the SDK's are
+	* identical, so the reverse mapping is a straight per-field copy.
+	*
+	* Every field is emitted unconditionally, with `?? ''` standing in for an
+	* AWS response that omits it (docs/provider-development.md § 3b): the
+	* optional `Description` is user-controllable and mutable, so dropping the
+	* key when AWS returns nothing would leave it out of `observedProperties`
+	* on a stack that never templated it — and the drift comparator's
+	* keys-from-state walk would then never notice a console-side edit. The
+	* `properties` fallback baseline is unaffected, since that walk only
+	* descends into keys the template itself carries.
+	*
+	* Returns `undefined` when the OAC is gone (`NoSuchOriginAccessControl`).
+	*/
+	async readCurrentState(physicalId, _logicalId, resourceType) {
+		if (resourceType !== "AWS::CloudFront::OriginAccessControl") return void 0;
+		try {
+			const config = (await this.cloudFrontClient.send(new GetOriginAccessControlCommand({ Id: physicalId }))).OriginAccessControl?.OriginAccessControlConfig;
+			if (!config) return void 0;
+			return { OriginAccessControlConfig: {
+				Name: config.Name ?? "",
+				Description: config.Description ?? "",
+				OriginAccessControlOriginType: config.OriginAccessControlOriginType ?? "",
+				SigningBehavior: config.SigningBehavior ?? "",
+				SigningProtocol: config.SigningProtocol ?? ""
+			} };
+		} catch (error) {
+			if (error instanceof NoSuchOriginAccessControl) return void 0;
+			throw error;
+		}
+	}
+	/**
+	* Adopt an existing CloudFront Origin Access Control into cdkd state.
+	*
+	* **Explicit override only.** An OAC carries no tags (CloudFront's tagging
+	* APIs cover distributions / streaming distributions, not OACs) and has no
+	* template-supplied physical name — the physical id is the AWS-generated
+	* `E...` id, while the config's `Name` is a display field that AWS does not
+	* accept as a lookup key. Users adopting an existing OAC pass
+	* `--resource <logicalId>=<oacId>`; the id is verified with a single
+	* `GetOriginAccessControl` so a typo reports not-found instead of poisoning
+	* state.
+	*/
+	async import(input) {
+		if (!input.knownPhysicalId) return null;
+		try {
+			await this.cloudFrontClient.send(new GetOriginAccessControlCommand({ Id: input.knownPhysicalId }));
+			return {
+				physicalId: input.knownPhysicalId,
+				attributes: { Id: input.knownPhysicalId }
+			};
+		} catch (error) {
+			if (error instanceof NoSuchOriginAccessControl) return null;
+			throw error;
+		}
+	}
+	/**
+	* Map the CFn `OriginAccessControlConfig` property onto the SDK's
+	* `OriginAccessControlConfig` shape.
+	*
+	* The two shapes use identical field names, so this is a field-by-field
+	* copy that exists to (a) fail loudly when a required field is missing
+	* rather than letting the SDK reject with an opaque serialization error,
+	* and (b) keep unknown extra keys out of the request.
+	*/
+	toSdkConfig(value, logicalId, resourceType, physicalId) {
+		const config = value ?? {};
+		const name = config["Name"];
+		const originType = config["OriginAccessControlOriginType"];
+		const signingBehavior = config["SigningBehavior"];
+		const signingProtocol = config["SigningProtocol"];
+		const missing = [
+			typeof name === "string" && name.length > 0 ? void 0 : "Name",
+			typeof originType === "string" ? void 0 : "OriginAccessControlOriginType",
+			typeof signingBehavior === "string" ? void 0 : "SigningBehavior",
+			typeof signingProtocol === "string" ? void 0 : "SigningProtocol"
+		].filter((field) => field !== void 0);
+		if (missing.length > 0) throw new ProvisioningError(`CloudFront Origin Access Control ${logicalId}: OriginAccessControlConfig is missing required field(s): ${missing.join(", ")}`, resourceType, logicalId, physicalId);
+		const description = config["Description"];
+		return {
+			Name: name,
+			OriginAccessControlOriginType: originType,
+			SigningBehavior: signingBehavior,
+			SigningProtocol: signingProtocol,
+			...typeof description === "string" ? { Description: description } : {}
+		};
+	}
+	/**
+	* Shared region guard for the two delete-path not-found branches: a
+	* `*NotFound` may only be treated as idempotent success when the client's
+	* region matches the region the resource was recorded in.
+	*/
+	async assertDeleteRegion(resourceType, logicalId, physicalId, context) {
+		assertRegionMatch(await this.cloudFrontClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/cloudfront-distribution-provider.ts
 /**
@@ -42505,6 +42734,7 @@ function registerAllProviders(registry) {
 	registry.register("AWS::ApiGatewayV2::Route", apigwV2Provider);
 	registry.register("AWS::ApiGatewayV2::Authorizer", apigwV2Provider);
 	registry.register("AWS::CloudFront::CloudFrontOriginAccessIdentity", new CloudFrontOAIProvider());
+	registry.register("AWS::CloudFront::OriginAccessControl", new CloudFrontOACProvider());
 	registry.register("AWS::CloudFront::Distribution", new CloudFrontDistributionProvider());
 	registry.register("AWS::StepFunctions::StateMachine", new StepFunctionsProvider());
 	const ecsProvider = new ECSProvider();
@@ -42764,7 +42994,8 @@ async function deployCommand(stacks, options) {
 	});
 	setAwsClients(awsClients);
 	const statePrepPromise = (async () => {
-		const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+		const resolvedStateBucket = await resolveStateBucketWithDefaultAndSource(options.stateBucket, region);
+		const stateBucket = resolvedStateBucket.bucket;
 		const preflightStateBackend = new S3StateBackend(awsClients.s3, {
 			bucket: stateBucket,
 			prefix: options.statePrefix
@@ -42772,7 +43003,7 @@ async function deployCommand(stacks, options) {
 			region,
 			...options.profile && { profile: options.profile }
 		});
-		await preflightStateBackend.verifyBucketExists();
+		await preflightStateBackend.verifyBucketExists({ existenceAlreadyProbed: stateBucketExistenceConfirmed(resolvedStateBucket) });
 		return {
 			stateBucket,
 			preflightStateBackend,
@@ -62382,7 +62613,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.267.19");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.268.0");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;