@go-to-k/cdkd 0.276.4 → 0.276.6

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DagBuilder, A as red, At as resolveApp, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_URL_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerStreaming, D as cyan, Dt as synthesisStatusMessage, E as bold, Et as Synthesizer, F as ProviderRegistry, Ft as resolveStateBucketWithDefaultAndSource, G as normalizeAwsTagsToCfn, Gt as AssemblyReader, H as cfnRefValueFromPhysicalId, Ht as findLargeInlineResources, I as findActionableSilentDrops, It as resolveUseCdkBootstrapAssets, J as applyRoleArnIfSet, Jt as resolveBucketRegion, K as resolveExplicitPhysicalId, Kt as processStackMessages, L as CloudControlProvider, Lt as stateBucketExistenceConfirmed, M as IAMRoleProvider, Mt as resolveCaptureObservedState, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveSkipPrefix, O as gray, Ot as getDefaultStateBucketName, P as clearOnUpdateRemoval, Pt as resolveStateBucketWithDefault, Q as isRetryableTransientError, Qt as setAwsClients, R as slowCcOperationTimeoutMs, Rt as warnDeprecatedNoPrefixCliFlag, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as runDockerForeground, T as formatResourceLine, Tt as getDockerImageBySourceHash, U as refStateLookupFromResource, Ut as uploadCfnTemplate, V as IntrinsicFunctionResolver, Vt as MIGRATE_TMP_PREFIX, W as WAFv2WebACLProvider, Wt as expectedOwnerParam, X as describeTypeWithThrottleRetry, Xt as getAwsClients, Y as DiffCalculator, Yt as AwsClients, Z as withRetry, Zt as resetAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateAssetBucketName, a as DeploymentEventsStore, an as LocalMigrateError, at as AssetPublisher, b as unsupportedFinalSnapshotError, bn as normalizeAwsError, bt as formatDockerLoginError, c as replayFailedOperations, cn as MissingCdkCliError, ct as buildAssetRedirectMap, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ProvisioningError, dt as rewriteTemplateAssetReferences, en as CdkdError, et as TemplateParser, f as computeImplicitDeleteEdges, fn as ResourceTimeoutError, ft as AssetModeResolver, g as ccRoutedFinalSnapshotError, gt as parseBootstrapMarker, h as buildFinalSnapshotIdentifier, hn as StackTerminationProtectionError, ht as getBootstrapMarkerKey, i as DeploymentEventsReader, in as LocalInvokeBuildError$1, it as shouldRetainResource, j as yellow, jt as resolveAutoAssetStorage, k as green, kt as getLegacyStateBucketName, l as replayRollback, ln as NestedStackChildDirectDestroyError, lt as createAssetRedirectResolver, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackHasActiveImportsError, mt as ensureAssetStorage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as S3StateBackend, o as planFailedOps, on as LocalStartServiceError, ot as stringifyValue, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceUpdateNotSupportedError, pt as BOOTSTRAP_MARKER_PREFIX, q as assertRegionMatch, r as DeployEngine, rn as DeployCancelledError, rt as rebuildClientForBucketRegion, s as planRollback, st as WorkGraph, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as LockManager, u as withResourceDeadline, un as PartialFailureError, ut as loadPublishableAssetManifest, v as isFinalSnapshotError, vt as validateContainerRepoName, w as renderStatefulReason, wt as AssetManifestLoader, x as extractDeploymentEventError, xn as withErrorHandling, xt as getDockerCmd, y as refusesFinalSnapshot, yt as buildDockerImage, z as disableInstanceApiTermination, zt as CFN_TEMPLATE_BODY_LIMIT } from "./deploy-engine-us-U4a0a.js";
+import { $ as DagBuilder, A as red, At as resolveApp, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_URL_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerStreaming, D as cyan, Dt as synthesisStatusMessage, E as bold, Et as Synthesizer, F as ProviderRegistry, Ft as resolveStateBucketWithDefaultAndSource, G as normalizeAwsTagsToCfn, Gt as AssemblyReader, H as cfnRefValueFromPhysicalId, Ht as findLargeInlineResources, I as findActionableSilentDrops, It as resolveUseCdkBootstrapAssets, J as applyRoleArnIfSet, Jt as resolveBucketRegion, K as resolveExplicitPhysicalId, Kt as processStackMessages, L as CloudControlProvider, Lt as stateBucketExistenceConfirmed, M as IAMRoleProvider, Mt as resolveCaptureObservedState, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveSkipPrefix, O as gray, Ot as getDefaultStateBucketName, P as clearOnUpdateRemoval, Pt as resolveStateBucketWithDefault, Q as isRetryableTransientError, Qt as setAwsClients, R as slowCcOperationTimeoutMs, Rt as warnDeprecatedNoPrefixCliFlag, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as runDockerForeground, T as formatResourceLine, Tt as getDockerImageBySourceHash, U as refStateLookupFromResource, Ut as uploadCfnTemplate, V as IntrinsicFunctionResolver, Vt as MIGRATE_TMP_PREFIX, W as WAFv2WebACLProvider, Wt as expectedOwnerParam, X as describeTypeWithThrottleRetry, Xt as getAwsClients, Y as DiffCalculator, Yt as AwsClients, Z as withRetry, Zt as resetAwsClients, _ as createPreDeleteFinalSnapshot, _t as validateAssetBucketName, a as DeploymentEventsStore, an as LocalMigrateError, at as AssetPublisher, b as unsupportedFinalSnapshotError, bn as normalizeAwsError, bt as formatDockerLoginError, c as replayFailedOperations, cn as MissingCdkCliError, ct as buildAssetRedirectMap, d as IMPLICIT_DELETE_DEPENDENCIES, dn as ProvisioningError, dt as rewriteTemplateAssetReferences, en as CdkdError, et as TemplateParser, f as computeImplicitDeleteEdges, fn as ResourceTimeoutError, ft as AssetModeResolver, g as ccRoutedFinalSnapshotError, gt as parseBootstrapMarker, h as buildFinalSnapshotIdentifier, hn as StackTerminationProtectionError, ht as getBootstrapMarkerKey, i as DeploymentEventsReader, in as LocalInvokeBuildError$1, it as shouldRetainResource, j as yellow, jt as resolveAutoAssetStorage, k as green, kt as getLegacyStateBucketName, l as replayRollback, ln as NestedStackChildDirectDestroyError, lt as createAssetRedirectResolver, m as PRE_DELETE_SNAPSHOT_TYPES, mn as StackHasActiveImportsError, mt as ensureAssetStorage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as S3StateBackend, o as planFailedOps, on as LocalStartServiceError, ot as stringifyValue, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceUpdateNotSupportedError, pt as BOOTSTRAP_MARKER_PREFIX, q as assertRegionMatch, r as DeployEngine, rn as DeployCancelledError, rt as rebuildClientForBucketRegion, s as planRollback, st as WorkGraph, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as LockManager, u as withResourceDeadline, un as PartialFailureError, ut as loadPublishableAssetManifest, v as isFinalSnapshotError, vt as validateContainerRepoName, w as renderStatefulReason, wt as AssetManifestLoader, x as extractDeploymentEventError, xn as withErrorHandling, xt as getDockerCmd, y as refusesFinalSnapshot, yt as buildDockerImage, z as disableInstanceApiTermination, zt as CFN_TEMPLATE_BODY_LIMIT } from "./deploy-engine-1kK9dZKt.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-xUGPo-HF.js";
+import { t as ASGProvider } from "./asg-provider-Br39eGQt.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -14168,8 +14168,8 @@ function buildDeleteParams(properties) {
 function toDate(value) {
 	if (value === void 0) return void 0;
 	if (value instanceof Date) return value;
-	const parsed = new Date(String(value));
-	if (Number.isNaN(parsed.getTime())) throw new Error(`Configuration.ExcludedTimeRanges contains an unparsable time value: ${String(value)}`);
+	const parsed = typeof value === "string" || typeof value === "number" ? new Date(value) : /* @__PURE__ */ new Date(NaN);
+	if (Number.isNaN(parsed.getTime())) throw new Error(`Configuration.ExcludedTimeRanges contains an unparsable time value: ${JSON.stringify(value)}`);
 	return parsed;
 }
 /**
@@ -21042,6 +21042,79 @@ const QUANTITY_ITEM_FIELDS = [
 	"Aliases"
 ];
 /**
+* `ViewerCertificate` members whose ACRONYM CASING differs between the CFn
+* resource schema and the CloudFront API (issue #1370). The CFn template
+* carries the left-hand spelling; the SDK model only knows the right-hand
+* one, so an unrenamed key silently never reaches AWS — a custom-domain
+* distribution then fails to create ("Your ViewerCertificate is missing one
+* of ACMCertificateArn, IAMCertificateId, or CloudFrontDefaultCertificate").
+*/
+const VIEWER_CERTIFICATE_CFN_TO_SDK = {
+	AcmCertificateArn: "ACMCertificateArn",
+	SslSupportMethod: "SSLSupportMethod",
+	IamCertificateId: "IAMCertificateId"
+};
+/**
+* Top-level `DistributionConfig` members with the same CFn-vs-SDK casing
+* divergence (issue #1370): the template's `IPV6Enabled` is `IsIPV6Enabled`
+* in the SDK model, so it was silently dropped (IPv6 ended up disabled).
+*/
+const TOP_LEVEL_CFN_TO_SDK = { IPV6Enabled: "IsIPV6Enabled" };
+/**
+* CloudFormation defaults applied when a top-level `DistributionConfig`
+* member present in the PREVIOUS template is REMOVED from the new one
+* (issue #1371). `UpdateDistribution` is a read-modify-write API taking the
+* complete config, so the update path merges the template over the live
+* config — but a member the user deleted from the template must reset to
+* its CloudFormation default (CFn semantics), not silently keep its live
+* value. Values are in SDK shape.
+*
+* Sources: the AWS::CloudFront::Distribution registry schema `default`
+* annotations (Comment / DefaultRootObject / HttpVersion / PriceClass /
+* Restrictions / ViewerCertificate / WebACLId — verified via
+* `cloudformation:DescribeType`, 2026-08-09); list members reset to the
+* empty `{ Quantity: 0, Items: [] }` wrapper (removing a list property
+* means "no items"); `Logging` to the API's documented off shape. Removed
+* members with NO entry here (e.g. `IsIPV6Enabled` / `Staging` — no
+* schema-documented default) keep their live value with a warning: a
+* visible conservative choice, never a silent guess.
+*/
+const REMOVAL_RESET_DEFAULTS = {
+	Aliases: {
+		Quantity: 0,
+		Items: []
+	},
+	CacheBehaviors: {
+		Quantity: 0,
+		Items: []
+	},
+	Comment: "",
+	CustomErrorResponses: {
+		Quantity: 0,
+		Items: []
+	},
+	DefaultRootObject: "",
+	HttpVersion: "http1.1",
+	Logging: {
+		Enabled: false,
+		IncludeCookies: false,
+		Bucket: "",
+		Prefix: ""
+	},
+	OriginGroups: {
+		Quantity: 0,
+		Items: []
+	},
+	PriceClass: "PriceClass_All",
+	Restrictions: { GeoRestriction: {
+		RestrictionType: "none",
+		Quantity: 0,
+		Items: []
+	} },
+	ViewerCertificate: { CloudFrontDefaultCertificate: true },
+	WebACLId: ""
+};
+/**
 * Nested fields inside each CacheBehavior / DefaultCacheBehavior that use
 * the Quantity + Items pattern.
 */
@@ -21107,8 +21180,18 @@ var CloudFrontDistributionProvider = class {
 	/**
 	* Update a CloudFront Distribution
 	*
-	* Gets the current config via GetDistributionConfigCommand, merges new properties,
-	* then calls UpdateDistributionCommand with the required IfMatch ETag.
+	* `UpdateDistribution` is a read-modify-write API that expects the COMPLETE
+	* configuration, while a CFn template legitimately omits every optional
+	* member the user did not set — sending the template verbatim fails on the
+	* first required-on-update member the template lacks ("WebACLId is missing
+	* for the resource", issue #1371). So the update merges per top-level
+	* member: `GetDistributionConfigCommand`'s current config is the base, the
+	* template is the authority for every member it carries, a member REMOVED
+	* since the previous template resets to its CloudFormation default
+	* (matching CFn's omission-resets semantics rather than silently keeping
+	* the live value), and `CallerReference` is always preserved from the
+	* current config. Then calls `UpdateDistributionCommand` with the required
+	* IfMatch ETag.
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating CloudFront Distribution ${logicalId}: ${physicalId}`);
@@ -21117,10 +21200,8 @@ var CloudFrontDistributionProvider = class {
 			const etag = getConfigResponse.ETag;
 			const currentConfig = getConfigResponse.DistributionConfig;
 			const newDistributionConfig = properties["DistributionConfig"] ?? {};
-			const sdkConfig = this.convertToSdkFormat({
-				...newDistributionConfig,
-				CallerReference: currentConfig.CallerReference
-			});
+			const previousDistributionConfig = previousProperties["DistributionConfig"] ?? {};
+			const sdkConfig = this.mergeUpdateConfig(currentConfig, newDistributionConfig, previousDistributionConfig, logicalId);
 			await this.cloudFrontClient.send(new UpdateDistributionCommand({
 				Id: physicalId,
 				IfMatch: etag,
@@ -21276,6 +21357,21 @@ var CloudFrontDistributionProvider = class {
 		return ["DistributionConfig.CallerReference", "DistributionConfig.Logging.Bucket"];
 	}
 	/**
+	* Plain-string arrays that are semantically UNORDERED sets, per
+	* {@link ResourceProvider.getDriftUnorderedPaths}.
+	*
+	* `GeoRestriction.Locations` is a set of ISO country codes — the
+	* CloudFront API reference documents no ordering semantics and the
+	* service does not echo the submitted order back (observed live in the
+	* `s3-cloudfront` integ, 2026-08-09: a template `[JP, US]` allowlist
+	* read back as `[US, JP]`), so a positional compare fires guaranteed
+	* phantom drift on any multi-country restriction.
+	*/
+	getDriftUnorderedPaths(resourceType) {
+		if (resourceType !== "AWS::CloudFront::Distribution") return [];
+		return ["DistributionConfig.Restrictions.GeoRestriction.Locations"];
+	}
+	/**
 	* Get resource attribute (for Fn::GetAtt resolution)
 	*/
 	async getAttribute(physicalId, _resourceType, attributeName) {
@@ -21361,6 +21457,124 @@ var CloudFrontDistributionProvider = class {
 		}
 	}
 	/**
+	* Build the complete SDK-shape `DistributionConfig` for an update
+	* (issue #1371). Per top-level member:
+	*
+	* - present in the new template          -> template value (authority)
+	* - removed since the previous template  -> CloudFormation default
+	*   ({@link REMOVAL_RESET_DEFAULTS}); a member with no known default keeps
+	*   its live value with a WARN (visible, never a silent decision)
+	* - never templated                      -> live value from `currentConfig`
+	*   (the AWS-side default filled at create, or an out-of-band setting cdkd
+	*   never managed)
+	*
+	* One deliberate exception to the never-templated rule: `Comment` is
+	* always present in `templateSdk` ({@link convertToSdkFormat} injects
+	* `''` when absent — the SDK requires a non-null string), so an
+	* untemplated Comment resets to `''` rather than keeping the live value.
+	* That matches its CFn registry-schema default and the pre-merge
+	* behavior.
+	*
+	* `CallerReference` is always preserved from the current config (a
+	* create-time idempotency token the template never carries).
+	*/
+	mergeUpdateConfig(currentConfig, newDistributionConfig, previousDistributionConfig, logicalId) {
+		const templateSdk = this.convertToSdkFormat(newDistributionConfig);
+		const previousSdk = this.convertToSdkFormat(previousDistributionConfig);
+		const merged = { ...currentConfig };
+		for (const key of Object.keys(previousSdk)) {
+			if (key in templateSdk || key === "CallerReference") continue;
+			if (key in REMOVAL_RESET_DEFAULTS) merged[key] = structuredClone(REMOVAL_RESET_DEFAULTS[key]);
+			else {
+				const cfnKey = Object.entries(TOP_LEVEL_CFN_TO_SDK).find(([, sdkKey]) => sdkKey === key)?.[0] ?? key;
+				this.logger.warn(`CloudFront Distribution ${logicalId}: '${cfnKey}' was removed from the template but has no known CloudFormation default; keeping the live value. Set the property explicitly in the template to control it.`);
+			}
+		}
+		Object.assign(merged, templateSdk);
+		merged["CallerReference"] = currentConfig["CallerReference"];
+		this.completeRequiredUpdateFields(merged);
+		return merged;
+	}
+	/**
+	* Fill the sub-fields `UpdateDistribution` REQUIRES but a CFn template
+	* legitimately omits (issue #1371, second layer). The top-level merge
+	* makes the payload complete per member, but the template-authoritative
+	* `Origins` / `DefaultCacheBehavior` / `CacheBehaviors` members carry the
+	* template's SPARSE sub-shapes, and the API — which accepts them sparse
+	* on CREATE — rejects an update with per-field errors ("The
+	* 'OriginCustomHeaders' field is missing", "OriginReadTimeout is required
+	* for updates", "The parameter SmoothStreaming flag is missing", ...).
+	*
+	* The set below is the EMPIRICALLY REQUIRED list (probed live against
+	* UpdateDistribution, 2026-08-09) plus its symmetric CFn-default
+	* companions (`FunctionAssociations` / `TrustedSigners` /
+	* `TrustedKeyGroups` — same association/signer family, filled with the
+	* same disabled/empty CFn defaults CloudFormation submits for an
+	* omitted property). Values a template DOES carry always win — every
+	* fill is absent-only. Legacy `ForwardedValues`-mode TTLs are
+	* deliberately NOT filled (they are forbidden alongside `CachePolicyId`,
+	* so a wrong guess would break the modern mode; a legacy template that
+	* needs them fails loudly and can be added here).
+	*/
+	completeRequiredUpdateFields(config) {
+		const origins = config["Origins"];
+		if (origins && Array.isArray(origins["Items"])) origins["Items"] = origins["Items"].map((origin) => {
+			const o = { ...origin };
+			if (o["OriginPath"] === void 0) o["OriginPath"] = "";
+			if (o["CustomHeaders"] === void 0) o["CustomHeaders"] = {
+				Quantity: 0,
+				Items: []
+			};
+			if (o["CustomOriginConfig"] && typeof o["CustomOriginConfig"] === "object") {
+				const c = { ...o["CustomOriginConfig"] };
+				if (c["OriginReadTimeout"] === void 0) c["OriginReadTimeout"] = 30;
+				if (c["OriginKeepaliveTimeout"] === void 0) c["OriginKeepaliveTimeout"] = 5;
+				o["CustomOriginConfig"] = c;
+			}
+			return o;
+		});
+		const fillBehavior = (behavior) => {
+			const b = { ...behavior };
+			if (b["SmoothStreaming"] === void 0) b["SmoothStreaming"] = false;
+			if (b["FieldLevelEncryptionId"] === void 0) b["FieldLevelEncryptionId"] = "";
+			if (b["LambdaFunctionAssociations"] === void 0) b["LambdaFunctionAssociations"] = {
+				Quantity: 0,
+				Items: []
+			};
+			if (b["FunctionAssociations"] === void 0) b["FunctionAssociations"] = {
+				Quantity: 0,
+				Items: []
+			};
+			if (b["TrustedSigners"] === void 0) b["TrustedSigners"] = {
+				Enabled: false,
+				Quantity: 0
+			};
+			if (b["TrustedKeyGroups"] === void 0) b["TrustedKeyGroups"] = {
+				Enabled: false,
+				Quantity: 0
+			};
+			if (b["AllowedMethods"] === void 0) b["AllowedMethods"] = {
+				Quantity: 2,
+				Items: ["GET", "HEAD"],
+				CachedMethods: {
+					Quantity: 2,
+					Items: ["GET", "HEAD"]
+				}
+			};
+			else if (b["AllowedMethods"] && typeof b["AllowedMethods"] === "object" && b["AllowedMethods"]["CachedMethods"] === void 0) b["AllowedMethods"] = {
+				...b["AllowedMethods"],
+				CachedMethods: {
+					Quantity: 2,
+					Items: ["GET", "HEAD"]
+				}
+			};
+			return b;
+		};
+		if (config["DefaultCacheBehavior"] && typeof config["DefaultCacheBehavior"] === "object") config["DefaultCacheBehavior"] = fillBehavior(config["DefaultCacheBehavior"]);
+		const cacheBehaviors = config["CacheBehaviors"];
+		if (cacheBehaviors && Array.isArray(cacheBehaviors["Items"])) cacheBehaviors["Items"] = cacheBehaviors["Items"].map((cb) => fillBehavior(cb));
+	}
+	/**
 	* Convert CDK/CloudFormation DistributionConfig format to SDK format.
 	*
 	* The main transformation is adding Quantity fields where the SDK expects
@@ -21370,21 +21584,49 @@ var CloudFrontDistributionProvider = class {
 	convertToSdkFormat(config) {
 		const result = { ...config };
 		if (result["Comment"] === null || result["Comment"] === void 0) result["Comment"] = "";
+		for (const [cfnKey, sdkKey] of Object.entries(TOP_LEVEL_CFN_TO_SDK)) if (result[cfnKey] !== void 0) {
+			result[sdkKey] = result[cfnKey];
+			delete result[cfnKey];
+		}
+		if (result["ViewerCertificate"] && typeof result["ViewerCertificate"] === "object") {
+			const viewerCertificate = { ...result["ViewerCertificate"] };
+			for (const [cfnKey, sdkKey] of Object.entries(VIEWER_CERTIFICATE_CFN_TO_SDK)) if (viewerCertificate[cfnKey] !== void 0) {
+				viewerCertificate[sdkKey] = viewerCertificate[cfnKey];
+				delete viewerCertificate[cfnKey];
+			}
+			result["ViewerCertificate"] = viewerCertificate;
+		}
+		if (result["Restrictions"] && typeof result["Restrictions"] === "object") {
+			const restrictions = { ...result["Restrictions"] };
+			if (restrictions["GeoRestriction"] && typeof restrictions["GeoRestriction"] === "object") {
+				const geo = { ...restrictions["GeoRestriction"] };
+				if (Array.isArray(geo["Locations"])) {
+					geo["Items"] = geo["Locations"];
+					delete geo["Locations"];
+				}
+				if (geo["Quantity"] === void 0) geo["Quantity"] = Array.isArray(geo["Items"]) ? geo["Items"].length : 0;
+				restrictions["GeoRestriction"] = geo;
+			}
+			result["Restrictions"] = restrictions;
+		}
 		if (result["Logging"] && typeof result["Logging"] === "object") {
-			const logging = result["Logging"];
+			const logging = { ...result["Logging"] };
 			if (logging["IncludeCookies"] === void 0) logging["IncludeCookies"] = false;
 			if (logging["Enabled"] === void 0) logging["Enabled"] = true;
 			if (logging["Prefix"] === void 0) logging["Prefix"] = "";
+			result["Logging"] = logging;
 		}
 		for (const field of QUANTITY_ITEM_FIELDS) if (result[field] !== void 0) result[field] = this.wrapWithQuantity(result[field]);
 		if (result["DefaultCacheBehavior"] && typeof result["DefaultCacheBehavior"] === "object") result["DefaultCacheBehavior"] = this.convertCacheBehavior(result["DefaultCacheBehavior"]);
 		if (result["CacheBehaviors"] && typeof result["CacheBehaviors"] === "object") {
-			const cacheBehaviors = result["CacheBehaviors"];
+			const cacheBehaviors = { ...result["CacheBehaviors"] };
 			if (Array.isArray(cacheBehaviors["Items"])) cacheBehaviors["Items"] = cacheBehaviors["Items"].map((cb) => this.convertCacheBehavior(cb));
+			result["CacheBehaviors"] = cacheBehaviors;
 		}
 		if (result["Origins"] && typeof result["Origins"] === "object") {
-			const origins = result["Origins"];
+			const origins = { ...result["Origins"] };
 			if (Array.isArray(origins["Items"])) origins["Items"] = origins["Items"].map((origin) => this.convertOrigin(origin));
+			result["Origins"] = origins;
 		}
 		return result;
 	}
@@ -21415,6 +21657,31 @@ var CloudFrontDistributionProvider = class {
 	convertToCfnFormat(config) {
 		const result = { ...config };
 		delete result["CallerReference"];
+		for (const [cfnKey, sdkKey] of Object.entries(TOP_LEVEL_CFN_TO_SDK)) if (result[sdkKey] !== void 0) {
+			result[cfnKey] = result[sdkKey];
+			delete result[sdkKey];
+		}
+		if (result["ViewerCertificate"] && typeof result["ViewerCertificate"] === "object") {
+			const viewerCertificate = { ...result["ViewerCertificate"] };
+			for (const [cfnKey, sdkKey] of Object.entries(VIEWER_CERTIFICATE_CFN_TO_SDK)) if (viewerCertificate[sdkKey] !== void 0) {
+				viewerCertificate[cfnKey] = viewerCertificate[sdkKey];
+				delete viewerCertificate[sdkKey];
+			}
+			result["ViewerCertificate"] = viewerCertificate;
+		}
+		if (result["Restrictions"] && typeof result["Restrictions"] === "object") {
+			const restrictions = { ...result["Restrictions"] };
+			if (restrictions["GeoRestriction"] && typeof restrictions["GeoRestriction"] === "object") {
+				const geo = { ...restrictions["GeoRestriction"] };
+				if (Array.isArray(geo["Items"])) {
+					geo["Locations"] = geo["Items"];
+					delete geo["Items"];
+				}
+				delete geo["Quantity"];
+				restrictions["GeoRestriction"] = geo;
+			}
+			result["Restrictions"] = restrictions;
+		}
 		for (const field of QUANTITY_ITEM_FIELDS) if (result[field] !== void 0) result[field] = this.unwrapQuantity(result[field]);
 		if (result["DefaultCacheBehavior"] && typeof result["DefaultCacheBehavior"] === "object") result["DefaultCacheBehavior"] = this.revertCacheBehavior(result["DefaultCacheBehavior"]);
 		if (Array.isArray(result["CacheBehaviors"])) result["CacheBehaviors"] = result["CacheBehaviors"].map((cb) => this.revertCacheBehavior(cb));
@@ -21462,7 +21729,10 @@ var CloudFrontDistributionProvider = class {
 		if (result["CustomHeaders"] !== void 0) result["CustomHeaders"] = this.unwrapQuantity(result["CustomHeaders"]);
 		if (result["CustomOriginConfig"] && typeof result["CustomOriginConfig"] === "object") {
 			const customOriginConfig = { ...result["CustomOriginConfig"] };
-			if (customOriginConfig["OriginSslProtocols"] !== void 0) customOriginConfig["OriginSslProtocols"] = this.unwrapQuantity(customOriginConfig["OriginSslProtocols"]);
+			if (customOriginConfig["OriginSslProtocols"] !== void 0) {
+				customOriginConfig["OriginSSLProtocols"] = this.unwrapQuantity(customOriginConfig["OriginSslProtocols"]);
+				delete customOriginConfig["OriginSslProtocols"];
+			}
 			result["CustomOriginConfig"] = customOriginConfig;
 		}
 		return result;
@@ -21518,6 +21788,15 @@ var CloudFrontDistributionProvider = class {
 			const parts = fieldPath.split(".");
 			this.applyQuantityAtPath(result, parts);
 		}
+		if (result["CachedMethods"] !== void 0) {
+			const allowedMethods = result["AllowedMethods"] && typeof result["AllowedMethods"] === "object" ? { ...result["AllowedMethods"] } : {
+				Quantity: 2,
+				Items: ["GET", "HEAD"]
+			};
+			allowedMethods["CachedMethods"] = result["CachedMethods"];
+			result["AllowedMethods"] = allowedMethods;
+			delete result["CachedMethods"];
+		}
 		return result;
 	}
 	/**
@@ -21529,6 +21808,10 @@ var CloudFrontDistributionProvider = class {
 		if (result["CustomHeaders"] !== void 0) result["CustomHeaders"] = this.wrapWithQuantity(result["CustomHeaders"]);
 		if (result["CustomOriginConfig"] && typeof result["CustomOriginConfig"] === "object") {
 			const customOriginConfig = { ...result["CustomOriginConfig"] };
+			if (customOriginConfig["OriginSSLProtocols"] !== void 0) {
+				customOriginConfig["OriginSslProtocols"] = customOriginConfig["OriginSSLProtocols"];
+				delete customOriginConfig["OriginSSLProtocols"];
+			}
 			if (customOriginConfig["OriginSslProtocols"] !== void 0) customOriginConfig["OriginSslProtocols"] = this.wrapWithQuantity(customOriginConfig["OriginSslProtocols"]);
 			if (customOriginConfig["HTTPPort"] === null || customOriginConfig["HTTPPort"] === void 0) customOriginConfig["HTTPPort"] = 80;
 			if (customOriginConfig["HTTPSPort"] === null || customOriginConfig["HTTPSPort"] === void 0) customOriginConfig["HTTPSPort"] = 443;
@@ -51382,11 +51665,11 @@ async function rollbackCommand(stackArg, options) {
 				if (segment.failedOperations && segment.failedOperations.length > 0) if (options.revertFailed) {
 					const failedPlan = planFailedOps(segment.failedOperations, planStateView);
 					for (const item of failedPlan) logger.info(failedActionLabel(item, options.skipFinalSnapshot === true));
-					applyFailedPlanToPreview(failedPlan, planStateView);
+					applyFailedPlanToPreview(failedPlan, planStateView, options.skipFinalSnapshot === true);
 				} else for (const fop of segment.failedOperations) logger.info(`  - (left as-is) ${fop.logicalId} (${fop.resourceType}) — its ${fop.changeType} FAILED mid-deploy; pass --revert-failed to attempt reverting it`);
 				const plan = planRollback(segment.operations, planStateView, orphanLogicalIds);
 				for (const item of plan) logger.info(actionLabel(item, options.skipFinalSnapshot === true));
-				applyPlanToPreview(plan, planStateView);
+				applyPlanToPreview(plan, planStateView, options.skipFinalSnapshot === true);
 			}
 			logger.info("");
 			if (!skipConfirmation) {
@@ -51520,16 +51803,30 @@ async function rollbackCommand(stackArg, options) {
 	}
 }
 /**
+* Will the replay REFUSE this planned Snapshot delete instead of performing
+* it (issue #1368)? The preview must not unwind a record for an op that
+* never runs — the same question {@link snapshotNote} answers for the label,
+* asked with the same predicate and the same route, so the label and the
+* previewed state cannot disagree.
+*/
+function planItemWillBeRefused(resourceType, effectiveProvisionedBy, skipFinalSnapshot) {
+	if (skipFinalSnapshot) return false;
+	return refusesFinalSnapshot(resourceType, effectiveProvisionedBy);
+}
+/**
 * Apply a planned segment's effect to the plan-preview state so the NEXT
 * (older) segment's plan is classified against already-unwound state.
 * Mirrors what `replayRollback` mutates, without touching AWS.
 */
-function applyPlanToPreview(plan, previewState) {
+function applyPlanToPreview(plan, previewState, skipFinalSnapshot) {
 	for (const item of plan) {
 		const { op, action } = item;
 		switch (action) {
-			case "delete":
 			case "delete-with-final-snapshot":
+				if (planItemWillBeRefused(op.resourceType, item.effectiveProvisionedBy, skipFinalSnapshot)) break;
+				if (op.changeType === "CREATE") delete previewState[op.logicalId];
+				break;
+			case "delete":
 			case "orphan-retain":
 			case "orphan-flag":
 				if (op.changeType === "CREATE") delete previewState[op.logicalId];
@@ -51547,12 +51844,15 @@ function applyPlanToPreview(plan, previewState) {
 * Apply a planned FAILED-op revert's effect to the plan-preview state
 * (issue #1198). Mirrors `replayFailedOperations` without touching AWS.
 */
-function applyFailedPlanToPreview(plan, previewState) {
+function applyFailedPlanToPreview(plan, previewState, skipFinalSnapshot) {
 	for (const item of plan) {
 		const { op, action } = item;
 		switch (action) {
-			case "delete-failed-create":
 			case "delete-failed-create-with-final-snapshot":
+				if (planItemWillBeRefused(op.resourceType, item.effectiveProvisionedBy, skipFinalSnapshot)) break;
+				delete previewState[op.logicalId];
+				break;
+			case "delete-failed-create":
 			case "orphan-failed-create-retain":
 				delete previewState[op.logicalId];
 				break;
@@ -63752,7 +64052,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.276.4");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.276.6");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;