@go-to-k/cdkd 0.278.34 → 0.278.36

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as withRetry, $t as getAwsClients, A as red, At as synthesisStatusMessage, B as isTerminationProtectionPropagationError, Bt as stateBucketExistenceConfirmed, C as isStatefulRecreateTargetSync, Cn as normalizeAwsError, Ct as formatDockerLoginError, D as cyan, Dt as AssetManifestLoader, E as bold, Et as runDockerStreaming, F as ProviderRegistry, Ft as resolveCaptureObservedState, G as normalizeAwsTagsToCfn, Gt as findLargeInlineResources, H as cfnRefValueFromPhysicalId, Ht as CFN_TEMPLATE_BODY_LIMIT, I as findActionableSilentDrops, It as resolveSkipPrefix, J as readConfigString, Jt as AssemblyReader, K as resolveExplicitPhysicalId, Kt as uploadCfnTemplate, L as CloudControlProvider, Lt as resolveStateBucketWithDefault, M as IAMRoleProvider, Mt as getLegacyStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveApp, O as gray, Ot as getDockerImageBySourceHash, P as clearOnUpdateRemoval, Pt as resolveAutoAssetStorage, Q as describeTypeWithThrottleRetry, Qt as AwsClients, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefaultAndSource, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as buildDockerImage, T as formatResourceLine, Tt as runDockerForeground, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_URL_LIMIT, V as IntrinsicFunctionResolver, Vt as warnDeprecatedNoPrefixCliFlag, W as WAFv2WebACLProvider, Wt as MIGRATE_TMP_PREFIX, X as applyRoleArnIfSet, Y as requireConfigString, Yt as processStackMessages, Z as DiffCalculator, Zt as resolveBucketRegion, _ as createPreDeleteFinalSnapshot, _n as StackHasActiveImportsError, _t as ensureAssetStorage, a as DeploymentEventsStore, at as S3StateBackend, b as unsupportedFinalSnapshotError, bt as validateAssetBucketName, c as replayFailedOperations, cn as LocalMigrateError, ct as AssetPublisher, d as IMPLICIT_DELETE_DEPENDENCIES, dn as MissingCdkCliError, dt as buildAssetRedirectMap, en as resetAwsClients, et as isRetryableTransientError, f as computeImplicitDeleteEdges, fn as NestedStackChildDirectDestroyError, ft as createAssetRedirectResolver, g as ccRoutedFinalSnapshotError, gn as ResourceUpdateNotSupportedError, gt as BOOTSTRAP_MARKER_PREFIX, h as buildFinalSnapshotIdentifier, hn as ResourceTimeoutError, ht as AssetModeResolver, i as DeploymentEventsReader, it as LockManager, j as yellow, jt as getDefaultStateBucketName, k as green, kt as Synthesizer, l as replayRollback, ln as LocalStartServiceError, lt as stringifyValue, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ProvisioningError, mt as rewriteTemplateAssetReferences, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as DagBuilder, o as planFailedOps, on as DeployCancelledError, ot as rebuildClientForBucketRegion, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as PartialFailureError, pt as loadPublishableAssetManifest, q as assertRegionMatch, qt as expectedOwnerParam, r as DeployEngine, rn as CdkdError, rt as TemplateParser, s as planRollback, sn as LocalInvokeBuildError$1, st as shouldRetainResource, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as setAwsClients, tt as isThrottlingError, u as withResourceDeadline, ut as WorkGraph, v as isFinalSnapshotError, vn as StackTerminationProtectionError, vt as getBootstrapMarkerKey, w as renderStatefulReason, wn as withErrorHandling, wt as getDockerCmd, x as extractDeploymentEventError, xt as validateContainerRepoName, y as refusesFinalSnapshot, yt as parseBootstrapMarker, z as disableInstanceApiTermination, zt as resolveUseCdkBootstrapAssets } from "./deploy-engine-Dp2u4Ktr.js";
+import { $ as describeTypeWithThrottleRetry, $t as AwsClients, A as red, At as Synthesizer, B as isTerminationProtectionPropagationError, Bt as resolveUseCdkBootstrapAssets, C as isStatefulRecreateTargetSync, Ct as buildDockerImage, D as cyan, Dt as runDockerStreaming, E as bold, Et as runDockerForeground, F as ProviderRegistry, Ft as resolveAutoAssetStorage, G as normalizeAwsTagsToCfn, Gt as MIGRATE_TMP_PREFIX, H as cfnRefValueFromPhysicalId, Ht as warnDeprecatedNoPrefixCliFlag, I as findActionableSilentDrops, It as resolveCaptureObservedState, J as readConfigString, Jt as expectedOwnerParam, K as resolveExplicitPhysicalId, Kt as findLargeInlineResources, L as CloudControlProvider, Lt as resolveSkipPrefix, M as IAMRoleProvider, Mt as getDefaultStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as getLegacyStateBucketName, O as gray, Ot as AssetManifestLoader, P as clearOnUpdateRemoval, Pt as resolveApp, Q as DiffCalculator, Qt as resolveBucketRegion, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefault, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateContainerRepoName, T as formatResourceLine, Tn as withErrorHandling, Tt as getDockerCmd, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_BODY_LIMIT, V as IntrinsicFunctionResolver, Vt as stateBucketExistenceConfirmed, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_URL_LIMIT, X as requireConfigString, Xt as processStackMessages, Y as requireConfigArray, Yt as AssemblyReader, Z as applyRoleArnIfSet, _ as createPreDeleteFinalSnapshot, _n as ResourceUpdateNotSupportedError, _t as BOOTSTRAP_MARKER_PREFIX, a as DeploymentEventsStore, at as LockManager, b as unsupportedFinalSnapshotError, bt as parseBootstrapMarker, c as replayFailedOperations, cn as LocalInvokeBuildError$1, ct as shouldRetainResource, d as IMPLICIT_DELETE_DEPENDENCIES, dt as WorkGraph, en as getAwsClients, et as withRetry, f as computeImplicitDeleteEdges, fn as MissingCdkCliError, ft as buildAssetRedirectMap, g as ccRoutedFinalSnapshotError, gn as ResourceTimeoutError, gt as AssetModeResolver, h as buildFinalSnapshotIdentifier, hn as ProvisioningError, ht as rewriteTemplateAssetReferences, i as DeploymentEventsReader, in as CdkdError, it as TemplateParser, j as yellow, jt as synthesisStatusMessage, k as green, kt as getDockerImageBySourceHash, l as replayRollback, ln as LocalMigrateError, lt as AssetPublisher, m as PRE_DELETE_SNAPSHOT_TYPES, mn as PartialFailureError, mt as loadPublishableAssetManifest, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as setAwsClients, nt as isThrottlingError, o as planFailedOps, ot as S3StateBackend, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as NestedStackChildDirectDestroyError, pt as createAssetRedirectResolver, q as assertRegionMatch, qt as uploadCfnTemplate, r as DeployEngine, rt as DagBuilder, s as planRollback, sn as DeployCancelledError, st as rebuildClientForBucketRegion, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resetAwsClients, tt as isRetryableTransientError, u as withResourceDeadline, un as LocalStartServiceError, ut as stringifyValue, v as isFinalSnapshotError, vn as StackHasActiveImportsError, vt as ensureAssetStorage, w as renderStatefulReason, wn as normalizeAwsError, wt as formatDockerLoginError, x as extractDeploymentEventError, xt as validateAssetBucketName, y as refusesFinalSnapshot, yn as StackTerminationProtectionError, yt as getBootstrapMarkerKey, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefaultAndSource } from "./deploy-engine-iHGY-Q_U.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-Cta08VYI.js";
+import { t as ASGProvider } from "./asg-provider-5hYG8VHd.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -66,7 +66,8 @@ import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as Creat
 import AdmZip from "adm-zip";
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$14, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23 } from "@aws-sdk/client-s3tables";
+import { ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3ControlClient, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23 } from "@aws-sdk/client-s3-control";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -9689,7 +9690,7 @@ var LambdaUrlProvider = class {
 		this.logger.debug(`Creating Lambda URL ${logicalId}`);
 		const targetFunctionArn = properties["TargetFunctionArn"];
 		if (!targetFunctionArn) throw new ProvisioningError(`TargetFunctionArn is required for Lambda URL ${logicalId}`, resourceType, logicalId);
-		const authType = properties["AuthType"] || "NONE";
+		const authType = requireConfigString(properties["AuthType"], "NONE", "AWS::Lambda::Url AuthType");
 		try {
 			const cors = properties["Cors"];
 			const createParams = {
@@ -9733,7 +9734,7 @@ var LambdaUrlProvider = class {
 		};
 		const updateParams = {
 			FunctionName: physicalId,
-			AuthType: properties["AuthType"] || "NONE"
+			AuthType: requireConfigString(properties["AuthType"], "NONE", "AWS::Lambda::Url AuthType")
 		};
 		const invokeMode = clearOnUpdateRemoval(properties["InvokeMode"], previousProperties["InvokeMode"], "BUFFERED");
 		if (invokeMode !== void 0) updateParams.InvokeMode = invokeMode;
@@ -12317,11 +12318,18 @@ var DynamoDBGlobalTableProvider = class {
 		if (billingMode === "PROVISIONED") createParams.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion);
 		const streamSpecInput = properties["StreamSpecification"];
 		const needsStream = replicas.some((r) => r["Region"] !== currentRegion) || replicas.length > 1;
-		if (streamSpecInput) createParams.StreamSpecification = {
-			StreamEnabled: true,
-			StreamViewType: streamSpecInput["StreamViewType"] ?? "NEW_AND_OLD_IMAGES"
-		};
-		else if (needsStream) {
+		if (streamSpecInput != null) {
+			let streamViewType;
+			try {
+				streamViewType = readConfigString(streamSpecInput, "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification");
+			} catch (error) {
+				throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			}
+			createParams.StreamSpecification = {
+				StreamEnabled: true,
+				StreamViewType: streamViewType
+			};
+		} else if (needsStream) {
 			this.logger.info(`Auto-enabling streams (NEW_AND_OLD_IMAGES) on ${logicalId} — required for cross-region replication`);
 			createParams.StreamSpecification = {
 				StreamEnabled: true,
@@ -12577,7 +12585,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (properties["StreamSpecification"] !== void 0 && !deepEqual$1(properties["StreamSpecification"], previousProperties["StreamSpecification"])) {
 				flatUpdate.StreamSpecification = {
 					StreamEnabled: true,
-					StreamViewType: properties["StreamSpecification"]["StreamViewType"]
+					StreamViewType: readConfigString(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification")
 				};
 				flatChanged = true;
 			}
@@ -21934,8 +21942,9 @@ var CloudFrontOAIProvider = class {
 	*/
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating CloudFront OAI ${logicalId}`);
-		const comment = properties["CloudFrontOriginAccessIdentityConfig"]?.["Comment"] ?? "";
+		const config = properties["CloudFrontOriginAccessIdentityConfig"];
 		try {
+			const comment = readConfigString(config, "Comment", "", "AWS::CloudFront::CloudFrontOriginAccessIdentity CloudFrontOriginAccessIdentityConfig");
 			const oai = (await this.cloudFrontClient.send(new CreateCloudFrontOriginAccessIdentityCommand({ CloudFrontOriginAccessIdentityConfig: {
 				CallerReference: logicalId,
 				Comment: comment
@@ -21970,8 +21979,9 @@ var CloudFrontOAIProvider = class {
 	*/
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
 		this.logger.debug(`Updating CloudFront OAI ${logicalId}: ${physicalId}`);
-		const comment = properties["CloudFrontOriginAccessIdentityConfig"]?.["Comment"] ?? "";
+		const config = properties["CloudFrontOriginAccessIdentityConfig"];
 		try {
+			const comment = readConfigString(config, "Comment", "", "AWS::CloudFront::CloudFrontOriginAccessIdentity CloudFrontOriginAccessIdentityConfig");
 			const getResponse = await this.cloudFrontClient.send(new GetCloudFrontOriginAccessIdentityCommand({ Id: physicalId }));
 			const etag = getResponse.ETag;
 			if (!etag) throw new Error("GetCloudFrontOriginAccessIdentity did not return ETag");
@@ -25035,7 +25045,12 @@ var ECSProvider = class {
 		const newServiceName = properties["ServiceName"];
 		const oldServiceName = previousProperties["ServiceName"];
 		if (newServiceName && oldServiceName && newServiceName !== oldServiceName) throw new ProvisioningError(`Cannot update ServiceName for ECS service ${logicalId} (immutable property, requires replacement)`, resourceType, logicalId, physicalId);
-		const deploymentControllerType = properties["DeploymentController"]?.["Type"] ?? "ECS";
+		let deploymentControllerType;
+		try {
+			deploymentControllerType = readConfigString(properties["DeploymentController"], "Type", "ECS", "AWS::ECS::Service DeploymentController");
+		} catch (error) {
+			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+		}
 		const isEcsController = deploymentControllerType === "ECS";
 		const loadBalancersChanged = JSON.stringify(previousProperties["LoadBalancers"] ?? null) !== JSON.stringify(properties["LoadBalancers"] ?? null);
 		const serviceRegistriesChanged = JSON.stringify(previousProperties["ServiceRegistries"] ?? null) !== JSON.stringify(properties["ServiceRegistries"] ?? null);
@@ -29919,13 +29934,14 @@ var Route53Provider = class {
 		if (!name) throw new ProvisioningError(`Name is required for hosted zone ${logicalId}`, resourceType, logicalId);
 		try {
 			const hostedZoneConfig = properties["HostedZoneConfig"];
+			const createComment = readConfigString(hostedZoneConfig, "Comment", "", "AWS::Route53::HostedZone HostedZoneConfig");
 			const vpcs = properties["VPCs"];
 			const firstVpc = vpcs && vpcs.length > 0 ? vpcs[0] : void 0;
 			const response = await this.getClient().send(new CreateHostedZoneCommand({
 				Name: name,
 				CallerReference: `${logicalId}-${Date.now()}`,
-				...hostedZoneConfig && hostedZoneConfig["Comment"] ? { HostedZoneConfig: {
-					Comment: hostedZoneConfig["Comment"],
+				...createComment !== "" ? { HostedZoneConfig: {
+					Comment: createComment,
 					...firstVpc ? { PrivateZone: true } : {}
 				} } : firstVpc ? { HostedZoneConfig: { PrivateZone: true } } : {},
 				...firstVpc ? { VPC: {
@@ -29983,7 +29999,8 @@ var Route53Provider = class {
 	async updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Route 53 hosted zone ${logicalId}: ${physicalId}`);
 		try {
-			const comment = properties["HostedZoneConfig"]?.["Comment"] ?? "";
+			const hostedZoneConfig = properties["HostedZoneConfig"];
+			const comment = readConfigString(hostedZoneConfig, "Comment", "", "AWS::Route53::HostedZone HostedZoneConfig");
 			await this.getClient().send(new UpdateHostedZoneCommentCommand({
 				Id: physicalId,
 				Comment: comment
@@ -42382,8 +42399,8 @@ var CodeBuildProvider = class {
 	* object literal returned against a declared type IS excess-property checked,
 	* which turns each member name into a compile-time fact (issue #1386).
 	*/
-	mapSource(source) {
-		if (!source) return { type: "NO_SOURCE" };
+	mapSource(source, containerPath) {
+		if (source == null) return { type: "NO_SOURCE" };
 		let buildspec;
 		if (source["BuildSpec"] !== void 0) {
 			const bs = source["BuildSpec"];
@@ -42393,7 +42410,7 @@ var CodeBuildProvider = class {
 		const cfnGitSubmodules = source["GitSubmodulesConfig"];
 		const cfnBuildStatus = source["BuildStatusConfig"];
 		return {
-			type: source["Type"] ?? "NO_SOURCE",
+			type: readConfigString(source, "Type", "NO_SOURCE", containerPath),
 			buildspec,
 			location: source["Location"],
 			gitCloneDepth: source["GitCloneDepth"],
@@ -42411,10 +42428,10 @@ var CodeBuildProvider = class {
 			} : void 0
 		};
 	}
-	mapArtifacts(artifacts) {
-		if (!artifacts) return { type: "NO_ARTIFACTS" };
+	mapArtifacts(artifacts, containerPath) {
+		if (artifacts == null) return { type: "NO_ARTIFACTS" };
 		return {
-			type: artifacts["Type"] ?? "NO_ARTIFACTS",
+			type: readConfigString(artifacts, "Type", "NO_ARTIFACTS", containerPath),
 			location: artifacts["Location"],
 			path: artifacts["Path"],
 			name: artifacts["Name"],
@@ -42472,9 +42489,9 @@ var CodeBuildProvider = class {
 			};
 		}
 		const cfnSecondarySources = properties["SecondarySources"];
-		const secondarySources = cfnSecondarySources ? cfnSecondarySources.map((s) => this.mapSource(s)) : void 0;
+		const secondarySources = cfnSecondarySources == null ? void 0 : requireConfigArray(cfnSecondarySources, "AWS::CodeBuild::Project SecondarySources").map((s) => this.mapSource(s, "AWS::CodeBuild::Project SecondarySources[]"));
 		const cfnSecondaryArtifacts = properties["SecondaryArtifacts"];
-		const secondaryArtifacts = cfnSecondaryArtifacts ? cfnSecondaryArtifacts.map((a) => this.mapArtifacts(a)) : void 0;
+		const secondaryArtifacts = cfnSecondaryArtifacts == null ? void 0 : requireConfigArray(cfnSecondaryArtifacts, "AWS::CodeBuild::Project SecondaryArtifacts").map((a) => this.mapArtifacts(a, "AWS::CodeBuild::Project SecondaryArtifacts[]"));
 		const cfnSecondarySourceVersions = properties["SecondarySourceVersions"];
 		const secondarySourceVersions = cfnSecondarySourceVersions ? cfnSecondarySourceVersions.map((sv) => ({
 			sourceIdentifier: sv["SourceIdentifier"],
@@ -42505,10 +42522,10 @@ var CodeBuildProvider = class {
 		}
 		return {
 			name,
-			source: this.mapSource(source),
+			source: this.mapSource(source, "AWS::CodeBuild::Project Source"),
 			environment: {
-				type: environment?.["Type"] ?? "LINUX_CONTAINER",
-				computeType: environment?.["ComputeType"] ?? "BUILD_GENERAL1_SMALL",
+				type: readConfigString(environment, "Type", "LINUX_CONTAINER", "AWS::CodeBuild::Project Environment"),
+				computeType: readConfigString(environment, "ComputeType", "BUILD_GENERAL1_SMALL", "AWS::CodeBuild::Project Environment"),
 				image: environment?.["Image"],
 				environmentVariables: envVars ? envVars.map((v) => ({
 					name: v.Name,
@@ -42529,7 +42546,7 @@ var CodeBuildProvider = class {
 				} : void 0
 			},
 			serviceRole,
-			artifacts: this.mapArtifacts(artifacts),
+			artifacts: this.mapArtifacts(artifacts, "AWS::CodeBuild::Project Artifacts"),
 			tags: tags ? tags.map((t) => ({
 				key: t.Key,
 				value: t.Value
@@ -43894,9 +43911,11 @@ var S3DirectoryBucketProvider = class {
 	handledProperties = /* @__PURE__ */ new Map([["AWS::S3Express::DirectoryBucket", /* @__PURE__ */ new Set([
 		"DataRedundancy",
 		"LocationName",
-		"BucketName"
+		"BucketName",
+		"Tags"
 	])]]);
 	ec2Client;
+	s3ControlClient;
 	providerRegion = process.env["AWS_REGION"];
 	constructor() {
 		const awsClients = getAwsClients();
@@ -43908,6 +43927,17 @@ var S3DirectoryBucketProvider = class {
 		return this.ec2Client;
 	}
 	/**
+	* Directory-bucket tags live on the S3 control plane: `PutBucketTagging`
+	* is documented "not supported for directory buckets", and the tag CRUD
+	* after create is S3 Control's `TagResource` / `UntagResource` /
+	* `ListTagsForResource` (requiring the `s3express:TagResource` /
+	* `s3express:UntagResource` / `s3express:ListTagsForResource` permissions).
+	*/
+	getS3ControlClient() {
+		if (!this.s3ControlClient) this.s3ControlClient = new S3ControlClient(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.s3ControlClient;
+	}
+	/**
 	* Convert AZ name (us-east-1a) to AZ ID (use1-az1) via EC2 DescribeAvailabilityZones
 	*/
 	async getAzId(azName) {
@@ -43938,7 +43968,16 @@ var S3DirectoryBucketProvider = class {
 	* Build attributes for a directory bucket
 	*/
 	async buildAttributes(bucketName) {
-		return { Arn: `arn:aws:s3express:${await this.getRegion()}:${await this.getAccountId()}:bucket/${bucketName}` };
+		return { Arn: await this.buildBucketArn(bucketName) };
+	}
+	/**
+	* Directory bucket ARN: `arn:aws:s3express:{region}:{account}:bucket/{name}`.
+	* Also the `ResourceArn` for the S3 Control tag operations. Callers that
+	* already resolved the account (for the S3 Control `AccountId` parameter)
+	* pass it in so the STS lookup runs once per operation.
+	*/
+	async buildBucketArn(bucketName, accountId) {
+		return `arn:aws:s3express:${await this.getRegion()}:${accountId ?? await this.getAccountId()}:bucket/${bucketName}`;
 	}
 	/**
 	* Create an S3 Express Directory Bucket
@@ -43953,6 +43992,8 @@ var S3DirectoryBucketProvider = class {
 			maxLength: 64,
 			lowercase: true
 		})}--${azId}--x-s3`;
+		const tags = properties["Tags"];
+		const includeTags = tags != null && !(Array.isArray(tags) && tags.length === 0);
 		try {
 			await this.s3Client.send(new CreateBucketCommand({
 				Bucket: bucketName,
@@ -43964,7 +44005,8 @@ var S3DirectoryBucketProvider = class {
 					Location: {
 						Name: azId,
 						Type: "AvailabilityZone"
-					}
+					},
+					...includeTags ? { Tags: tags } : {}
 				}
 			}));
 			this.logger.debug(`Created S3 Express Directory Bucket: ${bucketName}`);
@@ -43981,28 +44023,60 @@ var S3DirectoryBucketProvider = class {
 	/**
 	* Update an S3 Express Directory Bucket
 	*
-	* Most properties are immutable, so this is a no-op.
+	* `BucketName` / `DataRedundancy` / `LocationName` are create-only (the
+	* registry-schema fallback classifies changes to them as replacement), so
+	* the only in-place mutable property is `Tags` — applied via S3 Control's
+	* `TagResource` / `UntagResource` (the directory-bucket tag CRUD; the
+	* bucket-level `PutBucketTagging` is not supported for directory buckets).
+	* `TagResource` is additive-only, so a tag dropped from the template
+	* (partial removal) — or the entire `Tags` property removed (full removal,
+	* `newTags === undefined`) — would survive on AWS unless the removed keys
+	* are explicitly `UntagResource`d.
 	*/
-	update(logicalId, physicalId, _resourceType, _properties, _previousProperties) {
-		this.logger.debug(`Update for S3 Express Directory Bucket ${logicalId} is a no-op (immutable properties)`);
-		return Promise.resolve({
-			physicalId,
-			wasReplaced: false
-		});
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		try {
+			const newTags = properties["Tags"];
+			const oldTags = previousProperties["Tags"];
+			const malformedNewTags = newTags != null && !Array.isArray(newTags);
+			const newKeys = new Set((Array.isArray(newTags) ? newTags : []).map((t) => t.Key).filter((k) => !!k));
+			const removedKeys = malformedNewTags ? [] : (Array.isArray(oldTags) ? oldTags : []).map((t) => t.Key).filter((k) => !!k && !newKeys.has(k));
+			const tagsToApply = malformedNewTags || Array.isArray(newTags) && newTags.length > 0 ? newTags : void 0;
+			if (JSON.stringify(newTags) !== JSON.stringify(oldTags) && (removedKeys.length > 0 || tagsToApply !== void 0)) {
+				const accountId = await this.getAccountId();
+				const resourceArn = await this.buildBucketArn(physicalId, accountId);
+				if (removedKeys.length > 0) await this.getS3ControlClient().send(new UntagResourceCommand$23({
+					AccountId: accountId,
+					ResourceArn: resourceArn,
+					TagKeys: removedKeys
+				}));
+				if (tagsToApply) await this.getS3ControlClient().send(new TagResourceCommand$23({
+					AccountId: accountId,
+					ResourceArn: resourceArn,
+					Tags: tagsToApply
+				}));
+				this.logger.debug(`Updated tags for S3 Express Directory Bucket ${physicalId}`);
+			} else this.logger.debug(`Update for S3 Express Directory Bucket ${logicalId} is a no-op (no tag changes; other properties are immutable)`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update S3 Express Directory Bucket ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
 	}
 	/**
 	* Delete an S3 Express Directory Bucket
 	*
 	* CloudFormation-parity data guard (issue #1344, sibling of #1340): a
 	* non-empty directory bucket is only auto-emptied when the user opted in —
-	* the `aws-cdk:auto-delete-objects` tag on the bucket (settable only via
-	* `--allow-unsupported-properties` today, since `Tags` is not yet a
-	* handled property for this type) or the deploy engine's
-	* `--force-stateful-recreation` consent on a replacement delete
-	* (`DeleteContext.forceDataDelete`). Otherwise the not-empty error
-	* surfaces exactly like CloudFormation's DELETE_FAILED (live-A/B-verified
-	* 2026-08-03: CFn fails a non-empty DirectoryBucket delete with "The
-	* bucket you tried to delete is not empty", 409).
+	* the `aws-cdk:auto-delete-objects` tag on the bucket (a first-class
+	* template `Tags` entry now that `Tags` is a handled property, issue #609)
+	* or the deploy engine's `--force-stateful-recreation` consent on a
+	* replacement delete (`DeleteContext.forceDataDelete`). Otherwise the
+	* not-empty error surfaces exactly like CloudFormation's DELETE_FAILED
+	* (live-A/B-verified 2026-08-03: CFn fails a non-empty DirectoryBucket
+	* delete with "The bucket you tried to delete is not empty", 409).
 	*
 	* Directory buckets do not support versioning, so the opted-in auto-empty
 	* only needs to delete current objects.
@@ -44011,15 +44085,8 @@ var S3DirectoryBucketProvider = class {
 		this.logger.debug(`Deleting S3 Express Directory Bucket ${logicalId}: ${physicalId}`);
 		const allowAutoEmpty = context?.forceDataDelete === true || hasCdkAutoDeleteTag(properties, "aws-cdk:auto-delete-objects");
 		try {
-			if (allowAutoEmpty) {
-				this.logger.info(`Emptying directory bucket ${physicalId} before deletion (auto-delete opt-in present)`);
-				await this.emptyBucket(physicalId);
-			}
-			await this.s3Client.send(new DeleteBucketCommand({ Bucket: physicalId }));
-			this.logger.debug(`Successfully deleted S3 Express Directory Bucket ${logicalId}`);
+			await this.deleteBucketWithEmptyRetry(logicalId, physicalId, allowAutoEmpty);
 		} catch (error) {
-			const notEmptyMsg = error instanceof Error ? error.message : String(error);
-			if (!allowAutoEmpty && (notEmptyMsg.includes("not empty") || notEmptyMsg.includes("BucketNotEmpty"))) throw new ProvisioningError(`Failed to delete S3 Express Directory Bucket ${logicalId}: bucket ${physicalId} is not empty. Matching CloudFormation, cdkd does not delete a non-empty directory bucket without an explicit opt-in. Delete all objects first (e.g. aws s3 rm s3://${physicalId} --recursive) and destroy again.`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
 			if (error instanceof Error && (error.name === "NoSuchBucket" || error.name === "BucketNotFound")) {
 				assertRegionMatch(await this.s3Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Bucket ${physicalId} does not exist, skipping deletion`);
@@ -44030,6 +44097,35 @@ var S3DirectoryBucketProvider = class {
 		}
 	}
 	/**
+	* Delete the bucket, absorbing the write race on an opted-in auto-empty:
+	* an object written between the empty pass and the delete makes AWS reject
+	* the delete as not-empty, so re-empty and retry (bounded) — the same
+	* bounded loop as the standard-bucket sibling, ported per issue #609's
+	* "Tags becomes a handled property" note (the tag opt-in is mainstream
+	* now, so the ~zero-opt-in rationale for skipping the loop in PR #1347 no
+	* longer holds). Without the opt-in, the first not-empty error surfaces
+	* as the CloudFormation-parity guard (issue #1344).
+	*/
+	async deleteBucketWithEmptyRetry(logicalId, bucketName, allowAutoEmpty) {
+		const maxAttempts = 3;
+		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
+			await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
+			this.logger.debug(`Successfully deleted S3 Express Directory Bucket ${logicalId}`);
+			return;
+		} catch (error) {
+			const msg = error instanceof Error ? error.message : String(error);
+			if (msg.includes("not empty") || msg.includes("BucketNotEmpty")) {
+				if (!allowAutoEmpty) throw new Error(`bucket ${bucketName} is not empty. Matching CloudFormation, cdkd does not delete a non-empty directory bucket without an explicit opt-in. Delete all objects first (e.g. aws s3 rm s3://${bucketName} --recursive) and destroy again.`);
+				this.logger.info(`Directory bucket ${bucketName} not empty (attempt ${attempt}/${maxAttempts}), emptying (auto-delete opt-in present)...`);
+				await this.emptyBucket(bucketName);
+				continue;
+			}
+			throw error;
+		}
+		await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
+		this.logger.debug(`Successfully deleted S3 Express Directory Bucket ${logicalId}`);
+	}
+	/**
 	* Empty all objects from a directory bucket.
 	* Lists and deletes objects in batches of 1000.
 	*/
@@ -44060,10 +44156,11 @@ var S3DirectoryBucketProvider = class {
 	* CFn-property shape.
 	*
 	* Issues `HeadBucket` to verify existence and surfaces `BucketName`
-	* (the physicalId). `DataRedundancy` and `LocationName` are not exposed
-	* by any cheap S3 Express API — the only way to inspect them is by
-	* parsing the bucket name's `--<az-id>--x-s3` suffix, which is best
-	* effort. We surface them when they are recoverable from the bucket
+	* (the physicalId) plus `Tags` (via S3 Control `ListTagsForResource`,
+	* the directory-bucket tag read). `DataRedundancy` and `LocationName`
+	* are not exposed by any cheap S3 Express API — the only way to inspect
+	* them is by parsing the bucket name's `--<az-id>--x-s3` suffix, which is
+	* best effort. We surface them when they are recoverable from the bucket
 	* name to give the comparator a chance to detect mismatches.
 	*
 	* `--<az-id>--x-s3` suffix parsing: directory bucket names follow the
@@ -44089,8 +44186,17 @@ var S3DirectoryBucketProvider = class {
 		}
 		const result = { BucketName: physicalId };
 		if (physicalId.endsWith("--x-s3")) result["DataRedundancy"] = "SingleAvailabilityZone";
+		result["Tags"] = await this.readTags(physicalId);
 		return result;
 	}
+	async readTags(bucketName) {
+		const accountId = await this.getAccountId();
+		const resourceArn = await this.buildBucketArn(bucketName, accountId);
+		return normalizeAwsTagsToCfn((await this.getS3ControlClient().send(new ListTagsForResourceCommand$18({
+			AccountId: accountId,
+			ResourceArn: resourceArn
+		}))).Tags);
+	}
 	/**
 	* Adopt an existing S3 Express Directory Bucket into cdkd state.
 	*
@@ -44576,7 +44682,7 @@ var S3TablesProvider = class {
 	*/
 	async readTagsBestEffort(resourceArn) {
 		try {
-			const tags = (await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn }))).tags ?? {};
+			const tags = (await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn }))).tags ?? {};
 			const out = [];
 			for (const [Key, Value] of Object.entries(tags)) out.push({
 				Key,
@@ -44630,7 +44736,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$23({
+			await this.getClient().send(new UntagResourceCommand$24({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -44639,7 +44745,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$23({
+			await this.getClient().send(new TagResourceCommand$24({
 				resourceArn,
 				tags: upserts
 			}));
@@ -44671,7 +44777,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$23({
+			await this.getClient().send(new UntagResourceCommand$24({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -44680,7 +44786,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$23({
+			await this.getClient().send(new TagResourceCommand$24({
 				resourceArn,
 				tags: upserts
 			}));
@@ -66600,7 +66706,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.34");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.36");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;