@go-to-k/cdkd 0.278.39 → 0.278.41

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as describeTypeWithThrottleRetry, $t as AwsClients, A as red, At as Synthesizer, B as isTerminationProtectionPropagationError, Bt as resolveUseCdkBootstrapAssets, C as isStatefulRecreateTargetSync, Ct as buildDockerImage, D as cyan, Dt as runDockerStreaming, E as bold, Et as runDockerForeground, F as ProviderRegistry, Ft as resolveAutoAssetStorage, G as normalizeAwsTagsToCfn, Gt as MIGRATE_TMP_PREFIX, H as cfnRefValueFromPhysicalId, Ht as warnDeprecatedNoPrefixCliFlag, I as findActionableSilentDrops, It as resolveCaptureObservedState, J as readConfigString, Jt as expectedOwnerParam, K as resolveExplicitPhysicalId, Kt as findLargeInlineResources, L as CloudControlProvider, Lt as resolveSkipPrefix, M as IAMRoleProvider, Mt as getDefaultStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as getLegacyStateBucketName, O as gray, Ot as AssetManifestLoader, P as clearOnUpdateRemoval, Pt as resolveApp, Q as DiffCalculator, Qt as resolveBucketRegion, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefault, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateContainerRepoName, T as formatResourceLine, Tn as withErrorHandling, Tt as getDockerCmd, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_BODY_LIMIT, V as IntrinsicFunctionResolver, Vt as stateBucketExistenceConfirmed, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_URL_LIMIT, X as requireConfigString, Xt as processStackMessages, Y as requireConfigArray, Yt as AssemblyReader, Z as applyRoleArnIfSet, _ as createPreDeleteFinalSnapshot, _n as ResourceUpdateNotSupportedError, _t as BOOTSTRAP_MARKER_PREFIX, a as DeploymentEventsStore, at as LockManager, b as unsupportedFinalSnapshotError, bt as parseBootstrapMarker, c as replayFailedOperations, cn as LocalInvokeBuildError$1, ct as shouldRetainResource, d as IMPLICIT_DELETE_DEPENDENCIES, dt as WorkGraph, en as getAwsClients, et as withRetry, f as computeImplicitDeleteEdges, fn as MissingCdkCliError, ft as buildAssetRedirectMap, g as ccRoutedFinalSnapshotError, gn as ResourceTimeoutError, gt as AssetModeResolver, h as buildFinalSnapshotIdentifier, hn as ProvisioningError, ht as rewriteTemplateAssetReferences, i as DeploymentEventsReader, in as CdkdError, it as TemplateParser, j as yellow, jt as synthesisStatusMessage, k as green, kt as getDockerImageBySourceHash, l as replayRollback, ln as LocalMigrateError, lt as AssetPublisher, m as PRE_DELETE_SNAPSHOT_TYPES, mn as PartialFailureError, mt as loadPublishableAssetManifest, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as setAwsClients, nt as isThrottlingError, o as planFailedOps, ot as S3StateBackend, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as NestedStackChildDirectDestroyError, pt as createAssetRedirectResolver, q as assertRegionMatch, qt as uploadCfnTemplate, r as DeployEngine, rt as DagBuilder, s as planRollback, sn as DeployCancelledError, st as rebuildClientForBucketRegion, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resetAwsClients, tt as isRetryableTransientError, u as withResourceDeadline, un as LocalStartServiceError, ut as stringifyValue, v as isFinalSnapshotError, vn as StackHasActiveImportsError, vt as ensureAssetStorage, w as renderStatefulReason, wn as normalizeAwsError, wt as formatDockerLoginError, x as extractDeploymentEventError, xt as validateAssetBucketName, y as refusesFinalSnapshot, yn as StackTerminationProtectionError, yt as getBootstrapMarkerKey, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefaultAndSource } from "./deploy-engine-BJVpWi-B.js";
+import { $ as describeTypeWithThrottleRetry, $t as AwsClients, A as red, At as Synthesizer, B as isTerminationProtectionPropagationError, Bt as resolveUseCdkBootstrapAssets, C as isStatefulRecreateTargetSync, Ct as buildDockerImage, D as cyan, Dt as runDockerStreaming, E as bold, Et as runDockerForeground, F as ProviderRegistry, Ft as resolveAutoAssetStorage, G as normalizeAwsTagsToCfn, Gt as MIGRATE_TMP_PREFIX, H as cfnRefValueFromPhysicalId, Ht as warnDeprecatedNoPrefixCliFlag, I as findActionableSilentDrops, It as resolveCaptureObservedState, J as readConfigString, Jt as expectedOwnerParam, K as resolveExplicitPhysicalId, Kt as findLargeInlineResources, L as CloudControlProvider, Lt as resolveSkipPrefix, M as IAMRoleProvider, Mt as getDefaultStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as getLegacyStateBucketName, O as gray, Ot as AssetManifestLoader, P as clearOnUpdateRemoval, Pt as resolveApp, Q as DiffCalculator, Qt as resolveBucketRegion, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefault, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateContainerRepoName, T as formatResourceLine, Tn as withErrorHandling, Tt as getDockerCmd, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_BODY_LIMIT, V as IntrinsicFunctionResolver, Vt as stateBucketExistenceConfirmed, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_URL_LIMIT, X as requireConfigString, Xt as processStackMessages, Y as requireConfigArray, Yt as AssemblyReader, Z as applyRoleArnIfSet, _ as createPreDeleteFinalSnapshot, _n as ResourceUpdateNotSupportedError, _t as BOOTSTRAP_MARKER_PREFIX, a as DeploymentEventsStore, at as LockManager, b as unsupportedFinalSnapshotError, bt as parseBootstrapMarker, c as replayFailedOperations, cn as LocalInvokeBuildError$1, ct as shouldRetainResource, d as IMPLICIT_DELETE_DEPENDENCIES, dt as WorkGraph, en as getAwsClients, et as withRetry, f as computeImplicitDeleteEdges, fn as MissingCdkCliError, ft as buildAssetRedirectMap, g as ccRoutedFinalSnapshotError, gn as ResourceTimeoutError, gt as AssetModeResolver, h as buildFinalSnapshotIdentifier, hn as ProvisioningError, ht as rewriteTemplateAssetReferences, i as DeploymentEventsReader, in as CdkdError, it as TemplateParser, j as yellow, jt as synthesisStatusMessage, k as green, kt as getDockerImageBySourceHash, l as replayRollback, ln as LocalMigrateError, lt as AssetPublisher, m as PRE_DELETE_SNAPSHOT_TYPES, mn as PartialFailureError, mt as loadPublishableAssetManifest, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as setAwsClients, nt as isThrottlingError, o as planFailedOps, ot as S3StateBackend, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as NestedStackChildDirectDestroyError, pt as createAssetRedirectResolver, q as assertRegionMatch, qt as uploadCfnTemplate, r as DeployEngine, rt as DagBuilder, s as planRollback, sn as DeployCancelledError, st as rebuildClientForBucketRegion, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resetAwsClients, tt as isRetryableTransientError, u as withResourceDeadline, un as LocalStartServiceError, ut as stringifyValue, v as isFinalSnapshotError, vn as StackHasActiveImportsError, vt as ensureAssetStorage, w as renderStatefulReason, wn as normalizeAwsError, wt as formatDockerLoginError, x as extractDeploymentEventError, xt as validateAssetBucketName, y as refusesFinalSnapshot, yn as StackTerminationProtectionError, yt as getBootstrapMarkerKey, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefaultAndSource } from "./deploy-engine-CiMIsVFt.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-CJJC8plY.js";
+import { t as ASGProvider } from "./asg-provider-CoBHZKJt.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -5109,7 +5109,8 @@ var S3BucketProvider = class S3BucketProvider {
 		});
 		await this.s3Client.send(new PutBucketLifecycleConfigurationCommand({
 			Bucket: bucketName,
-			LifecycleConfiguration: { Rules: rules }
+			LifecycleConfiguration: { Rules: rules },
+			TransitionDefaultMinimumObjectSize: lifecycleConfig["TransitionDefaultMinimumObjectSize"]
 		}));
 		this.logger.debug(`Applied lifecycle configuration to bucket ${bucketName}`);
 	}
@@ -5146,12 +5147,14 @@ var S3BucketProvider = class S3BucketProvider {
 		if (!Array.isArray(encryptionConfig?.ServerSideEncryptionConfiguration)) throw new Error(`BucketEncryption.ServerSideEncryptionConfiguration must be an array (got ${encryptionConfig?.ServerSideEncryptionConfiguration === void 0 ? "undefined" : typeof encryptionConfig.ServerSideEncryptionConfiguration}) — check for an unresolved intrinsic or a mis-nested template value`);
 		const rules = encryptionConfig.ServerSideEncryptionConfiguration.map((rule) => {
 			const byDefault = rule["ServerSideEncryptionByDefault"];
+			const blocked = rule["BlockedEncryptionTypes"];
 			return {
 				ApplyServerSideEncryptionByDefault: byDefault ? {
 					SSEAlgorithm: byDefault["SSEAlgorithm"],
 					KMSMasterKeyID: byDefault["KMSMasterKeyID"]
 				} : void 0,
-				BucketKeyEnabled: rule["BucketKeyEnabled"]
+				BucketKeyEnabled: rule["BucketKeyEnabled"],
+				BlockedEncryptionTypes: blocked != null && blocked["EncryptionType"] !== void 0 ? { EncryptionType: blocked["EncryptionType"] } : void 0
 			};
 		});
 		await this.s3Client.send(new PutBucketEncryptionCommand({
@@ -5178,12 +5181,21 @@ var S3BucketProvider = class S3BucketProvider {
 			this.logger.debug(`Cleared logging configuration on bucket ${bucketName}`);
 			return;
 		}
+		const loggingEnabled = {
+			TargetBucket: destinationBucket,
+			TargetPrefix: readConfigString(loggingConfig, "LogFilePrefix", "", "AWS::S3::Bucket LoggingConfiguration")
+		};
+		const keyFormat = loggingConfig["TargetObjectKeyFormat"];
+		if (keyFormat != null) {
+			const sdkKeyFormat = {};
+			if (keyFormat["SimplePrefix"] !== void 0) sdkKeyFormat.SimplePrefix = {};
+			const partitioned = keyFormat["PartitionedPrefix"];
+			if (partitioned != null && partitioned["PartitionDateSource"] !== void 0) sdkKeyFormat.PartitionedPrefix = { PartitionDateSource: partitioned["PartitionDateSource"] };
+			if (Object.keys(sdkKeyFormat).length > 0) loggingEnabled.TargetObjectKeyFormat = sdkKeyFormat;
+		}
 		await this.s3Client.send(new PutBucketLoggingCommand({
 			Bucket: bucketName,
-			BucketLoggingStatus: { LoggingEnabled: {
-				TargetBucket: destinationBucket,
-				TargetPrefix: readConfigString(loggingConfig, "LogFilePrefix", "", "AWS::S3::Bucket LoggingConfiguration")
-			} }
+			BucketLoggingStatus: { LoggingEnabled: loggingEnabled }
 		}));
 		this.logger.debug(`Applied logging configuration to bucket ${bucketName}`);
 	}
@@ -5454,6 +5466,54 @@ var S3BucketProvider = class S3BucketProvider {
 	*   - Rules[] (replication rules)
 	* SDK: PutBucketReplication with ReplicationConfiguration
 	*/
+	/**
+	* Build the SDK `Destination` for one replication rule.
+	*
+	* Before issue #1495 this was an inline literal carrying `Bucket` / `Account`
+	* / `StorageClass` only, so FOUR whole sub-blocks the CFn schema declares
+	* were accepted from the template and never sent — each one silently:
+	*
+	* - `AccessControlTranslation` — cross-account replication with owner
+	*   override; without it the replicas keep the SOURCE account's ownership.
+	* - `EncryptionConfiguration.ReplicaKmsKeyID` — the replica-side SSE-KMS key;
+	*   dropped, the replicas are not encrypted with the declared key. CDK's
+	*   `aws-s3` L2 emits this for a `replicationRules` entry with a KMS key.
+	* - `ReplicationTime` + `Metrics` — S3 Replication Time Control. RTC is a
+	*   billed SLA feature and both blocks are required to enable it, so a
+	*   template asking for RTC got plain asynchronous replication.
+	*
+	* CFn and the SDK spell every member identically here (verified against
+	* `@aws-sdk/client-s3`'s `Destination`), but the block is assembled member by
+	* member rather than forwarded so a CFn-only member cannot ride through.
+	*/
+	buildReplicationDestination(dest) {
+		const sdkDest = {
+			Bucket: dest["Bucket"],
+			Account: dest["Account"],
+			StorageClass: dest["StorageClass"]
+		};
+		const acl = dest["AccessControlTranslation"];
+		if (acl != null && acl["Owner"] !== void 0) sdkDest["AccessControlTranslation"] = { Owner: acl["Owner"] };
+		const encryption = dest["EncryptionConfiguration"];
+		if (encryption != null && encryption["ReplicaKmsKeyID"] !== void 0) sdkDest["EncryptionConfiguration"] = { ReplicaKmsKeyID: encryption["ReplicaKmsKeyID"] };
+		const replicationTime = dest["ReplicationTime"];
+		if (replicationTime != null) {
+			const time = replicationTime["Time"];
+			const rt = {};
+			if (replicationTime["Status"] !== void 0) rt["Status"] = replicationTime["Status"];
+			if (time != null && time["Minutes"] !== void 0) rt["Time"] = { Minutes: time["Minutes"] };
+			if (Object.keys(rt).length > 0) sdkDest["ReplicationTime"] = rt;
+		}
+		const metrics = dest["Metrics"];
+		if (metrics != null) {
+			const threshold = metrics["EventThreshold"];
+			const m = {};
+			if (metrics["Status"] !== void 0) m["Status"] = metrics["Status"];
+			if (threshold != null && threshold["Minutes"] !== void 0) m["EventThreshold"] = { Minutes: threshold["Minutes"] };
+			if (Object.keys(m).length > 0) sdkDest["Metrics"] = m;
+		}
+		return sdkDest;
+	}
 	async applyReplicationConfiguration(bucketName, replConfig) {
 		const rules = replConfig["Rules"];
 		await this.s3Client.send(new PutBucketReplicationCommand({
@@ -5466,12 +5526,17 @@ var S3BucketProvider = class S3BucketProvider {
 						ID: rule["Id"],
 						Status: readConfigString(rule, "Status", "Enabled", "AWS::S3::Bucket ReplicationConfiguration.Rules[]"),
 						Priority: rule["Priority"],
-						Destination: {
-							Bucket: dest["Bucket"],
-							Account: dest["Account"],
-							StorageClass: dest["StorageClass"]
-						}
+						Destination: this.buildReplicationDestination(dest)
 					};
+					const criteria = rule["SourceSelectionCriteria"];
+					if (criteria != null) {
+						const sdkCriteria = {};
+						const replicaMods = criteria["ReplicaModifications"];
+						if (replicaMods != null && replicaMods["Status"] !== void 0) sdkCriteria["ReplicaModifications"] = { Status: replicaMods["Status"] };
+						const sseKms = criteria["SseKmsEncryptedObjects"];
+						if (sseKms != null && sseKms["Status"] !== void 0) sdkCriteria["SseKmsEncryptedObjects"] = { Status: sseKms["Status"] };
+						if (Object.keys(sdkCriteria).length > 0) sdkRule["SourceSelectionCriteria"] = sdkCriteria;
+					}
 					const filter = rule["Filter"];
 					if (filter) {
 						const and = filter["And"];
@@ -5987,6 +6052,7 @@ var S3BucketProvider = class S3BucketProvider {
 					out["ServerSideEncryptionByDefault"] = sseOut;
 				}
 				if (rule.BucketKeyEnabled !== void 0) out["BucketKeyEnabled"] = rule.BucketKeyEnabled;
+				if (rule.BlockedEncryptionTypes?.EncryptionType !== void 0) out["BlockedEncryptionTypes"] = { EncryptionType: rule.BlockedEncryptionTypes.EncryptionType };
 				return out;
 			}) };
 		} catch (err) {
@@ -6023,59 +6089,66 @@ var S3BucketProvider = class S3BucketProvider {
 	}
 	async readLifecycle(bucket) {
 		try {
-			return { Rules: ((await this.s3Client.send(new GetBucketLifecycleConfigurationCommand({ Bucket: bucket }))).Rules ?? []).map((r) => {
-				const out = {};
-				if (r.ID !== void 0) out["Id"] = r.ID;
-				if (r.Status !== void 0) out["Status"] = r.Status;
-				if (r.Prefix !== void 0) out["Prefix"] = r.Prefix;
-				if (r.Expiration) {
-					const exp = {};
-					if (r.Expiration.Days !== void 0) exp["Days"] = r.Expiration.Days;
-					if (r.Expiration.Date !== void 0) exp["Date"] = r.Expiration.Date.toISOString();
-					if (r.Expiration.ExpiredObjectDeleteMarker !== void 0) exp["ExpiredObjectDeleteMarker"] = r.Expiration.ExpiredObjectDeleteMarker;
-					out["Expiration"] = exp;
-				}
-				if (r.Transitions && r.Transitions.length > 0) out["Transitions"] = r.Transitions.map((t) => {
-					const item = {};
-					if (t.Days !== void 0) item["TransitionInDays"] = t.Days;
-					if (t.Date !== void 0) item["TransitionDate"] = t.Date.toISOString();
-					if (t.StorageClass !== void 0) item["StorageClass"] = t.StorageClass;
-					return item;
-				});
-				if (r.NoncurrentVersionExpiration) {
-					const nve = {};
-					if (r.NoncurrentVersionExpiration.NoncurrentDays !== void 0) nve["NoncurrentDays"] = r.NoncurrentVersionExpiration.NoncurrentDays;
-					if (r.NoncurrentVersionExpiration.NewerNoncurrentVersions !== void 0) nve["NewerNoncurrentVersions"] = r.NoncurrentVersionExpiration.NewerNoncurrentVersions;
-					out["NoncurrentVersionExpiration"] = nve;
-				}
-				if (r.NoncurrentVersionTransitions && r.NoncurrentVersionTransitions.length > 0) out["NoncurrentVersionTransitions"] = r.NoncurrentVersionTransitions.map((nvt) => {
-					const item = {};
-					if (nvt.NoncurrentDays !== void 0) item["TransitionInDays"] = nvt.NoncurrentDays;
-					if (nvt.StorageClass !== void 0) item["StorageClass"] = nvt.StorageClass;
-					if (nvt.NewerNoncurrentVersions !== void 0) item["NewerNoncurrentVersions"] = nvt.NewerNoncurrentVersions;
-					return item;
-				});
-				if (r.AbortIncompleteMultipartUpload) out["AbortIncompleteMultipartUpload"] = { DaysAfterInitiation: r.AbortIncompleteMultipartUpload.DaysAfterInitiation };
-				if (r.Filter) {
-					const f = r.Filter;
-					const cfnFilter = {};
-					const and = f["And"];
-					const tagOnly = f["Tag"];
-					if (and) {
-						if (and["Prefix"] !== void 0) cfnFilter["Prefix"] = and["Prefix"];
-						if (and["Tags"]) cfnFilter["TagFilters"] = and["Tags"];
-						if (and["ObjectSizeGreaterThan"] !== void 0) cfnFilter["ObjectSizeGreaterThan"] = and["ObjectSizeGreaterThan"];
-						if (and["ObjectSizeLessThan"] !== void 0) cfnFilter["ObjectSizeLessThan"] = and["ObjectSizeLessThan"];
-					} else if (tagOnly) cfnFilter["TagFilters"] = [tagOnly];
-					else {
-						if (f["Prefix"] !== void 0) cfnFilter["Prefix"] = f["Prefix"];
-						if (f["ObjectSizeGreaterThan"] !== void 0) cfnFilter["ObjectSizeGreaterThan"] = f["ObjectSizeGreaterThan"];
-						if (f["ObjectSizeLessThan"] !== void 0) cfnFilter["ObjectSizeLessThan"] = f["ObjectSizeLessThan"];
+			const resp = await this.s3Client.send(new GetBucketLifecycleConfigurationCommand({ Bucket: bucket }));
+			const rules = resp.Rules ?? [];
+			const lifecycleOut = {};
+			if (resp.TransitionDefaultMinimumObjectSize !== void 0) lifecycleOut["TransitionDefaultMinimumObjectSize"] = resp.TransitionDefaultMinimumObjectSize;
+			return {
+				...lifecycleOut,
+				Rules: rules.map((r) => {
+					const out = {};
+					if (r.ID !== void 0) out["Id"] = r.ID;
+					if (r.Status !== void 0) out["Status"] = r.Status;
+					if (r.Prefix !== void 0) out["Prefix"] = r.Prefix;
+					if (r.Expiration) {
+						const exp = {};
+						if (r.Expiration.Days !== void 0) exp["Days"] = r.Expiration.Days;
+						if (r.Expiration.Date !== void 0) exp["Date"] = r.Expiration.Date.toISOString();
+						if (r.Expiration.ExpiredObjectDeleteMarker !== void 0) exp["ExpiredObjectDeleteMarker"] = r.Expiration.ExpiredObjectDeleteMarker;
+						out["Expiration"] = exp;
 					}
-					if (Object.keys(cfnFilter).length > 0) out["Filter"] = cfnFilter;
-				}
-				return out;
-			}) };
+					if (r.Transitions && r.Transitions.length > 0) out["Transitions"] = r.Transitions.map((t) => {
+						const item = {};
+						if (t.Days !== void 0) item["TransitionInDays"] = t.Days;
+						if (t.Date !== void 0) item["TransitionDate"] = t.Date.toISOString();
+						if (t.StorageClass !== void 0) item["StorageClass"] = t.StorageClass;
+						return item;
+					});
+					if (r.NoncurrentVersionExpiration) {
+						const nve = {};
+						if (r.NoncurrentVersionExpiration.NoncurrentDays !== void 0) nve["NoncurrentDays"] = r.NoncurrentVersionExpiration.NoncurrentDays;
+						if (r.NoncurrentVersionExpiration.NewerNoncurrentVersions !== void 0) nve["NewerNoncurrentVersions"] = r.NoncurrentVersionExpiration.NewerNoncurrentVersions;
+						out["NoncurrentVersionExpiration"] = nve;
+					}
+					if (r.NoncurrentVersionTransitions && r.NoncurrentVersionTransitions.length > 0) out["NoncurrentVersionTransitions"] = r.NoncurrentVersionTransitions.map((nvt) => {
+						const item = {};
+						if (nvt.NoncurrentDays !== void 0) item["TransitionInDays"] = nvt.NoncurrentDays;
+						if (nvt.StorageClass !== void 0) item["StorageClass"] = nvt.StorageClass;
+						if (nvt.NewerNoncurrentVersions !== void 0) item["NewerNoncurrentVersions"] = nvt.NewerNoncurrentVersions;
+						return item;
+					});
+					if (r.AbortIncompleteMultipartUpload) out["AbortIncompleteMultipartUpload"] = { DaysAfterInitiation: r.AbortIncompleteMultipartUpload.DaysAfterInitiation };
+					if (r.Filter) {
+						const f = r.Filter;
+						const cfnFilter = {};
+						const and = f["And"];
+						const tagOnly = f["Tag"];
+						if (and) {
+							if (and["Prefix"] !== void 0) cfnFilter["Prefix"] = and["Prefix"];
+							if (and["Tags"]) cfnFilter["TagFilters"] = and["Tags"];
+							if (and["ObjectSizeGreaterThan"] !== void 0) cfnFilter["ObjectSizeGreaterThan"] = and["ObjectSizeGreaterThan"];
+							if (and["ObjectSizeLessThan"] !== void 0) cfnFilter["ObjectSizeLessThan"] = and["ObjectSizeLessThan"];
+						} else if (tagOnly) cfnFilter["TagFilters"] = [tagOnly];
+						else {
+							if (f["Prefix"] !== void 0) cfnFilter["Prefix"] = f["Prefix"];
+							if (f["ObjectSizeGreaterThan"] !== void 0) cfnFilter["ObjectSizeGreaterThan"] = f["ObjectSizeGreaterThan"];
+							if (f["ObjectSizeLessThan"] !== void 0) cfnFilter["ObjectSizeLessThan"] = f["ObjectSizeLessThan"];
+						}
+						if (Object.keys(cfnFilter).length > 0) out["Filter"] = cfnFilter;
+					}
+					return out;
+				})
+			};
 		} catch (err) {
 			if (err.name === "NoSuchLifecycleConfiguration") return { Rules: [] };
 			throw err;
@@ -6141,6 +6214,17 @@ var S3BucketProvider = class S3BucketProvider {
 		const out = {};
 		if (resp.LoggingEnabled.TargetBucket !== void 0) out["DestinationBucketName"] = resp.LoggingEnabled.TargetBucket;
 		if (resp.LoggingEnabled.TargetPrefix !== void 0) out["LogFilePrefix"] = resp.LoggingEnabled.TargetPrefix;
+		const keyFormat = resp.LoggingEnabled.TargetObjectKeyFormat;
+		if (keyFormat) {
+			const cfnKeyFormat = {};
+			if (keyFormat.SimplePrefix !== void 0) cfnKeyFormat["SimplePrefix"] = {};
+			if (keyFormat.PartitionedPrefix) {
+				const partitioned = {};
+				if (keyFormat.PartitionedPrefix.PartitionDateSource !== void 0) partitioned["PartitionDateSource"] = keyFormat.PartitionedPrefix.PartitionDateSource;
+				cfnKeyFormat["PartitionedPrefix"] = partitioned;
+			}
+			if (Object.keys(cfnKeyFormat).length > 0) out["TargetObjectKeyFormat"] = cfnKeyFormat;
+		}
 		return out;
 	}
 	async readNotification(bucket) {
@@ -6201,8 +6285,34 @@ var S3BucketProvider = class S3BucketProvider {
 					if (r.Destination.Bucket !== void 0) d["Bucket"] = r.Destination.Bucket;
 					if (r.Destination.Account !== void 0) d["Account"] = r.Destination.Account;
 					if (r.Destination.StorageClass !== void 0) d["StorageClass"] = r.Destination.StorageClass;
+					const acl = r.Destination.AccessControlTranslation;
+					if (acl?.Owner !== void 0) d["AccessControlTranslation"] = { Owner: acl.Owner };
+					const enc = r.Destination.EncryptionConfiguration;
+					if (enc?.ReplicaKmsKeyID !== void 0) d["EncryptionConfiguration"] = { ReplicaKmsKeyID: enc.ReplicaKmsKeyID };
+					const rtIn = r.Destination.ReplicationTime;
+					if (rtIn) {
+						const rt = {};
+						if (rtIn.Status !== void 0) rt["Status"] = rtIn.Status;
+						if (rtIn.Time?.Minutes !== void 0) rt["Time"] = { Minutes: rtIn.Time.Minutes };
+						if (Object.keys(rt).length > 0) d["ReplicationTime"] = rt;
+					}
+					const metricsIn = r.Destination.Metrics;
+					if (metricsIn) {
+						const m = {};
+						if (metricsIn.Status !== void 0) m["Status"] = metricsIn.Status;
+						if (metricsIn.EventThreshold?.Minutes !== void 0) m["EventThreshold"] = { Minutes: metricsIn.EventThreshold.Minutes };
+						if (Object.keys(m).length > 0) d["Metrics"] = m;
+					}
 					ruleOut["Destination"] = d;
 				}
+				if (r.SourceSelectionCriteria) {
+					const criteria = {};
+					const replicaMods = r.SourceSelectionCriteria.ReplicaModifications;
+					if (replicaMods?.Status !== void 0) criteria["ReplicaModifications"] = { Status: replicaMods.Status };
+					const sseKms = r.SourceSelectionCriteria.SseKmsEncryptedObjects;
+					if (sseKms?.Status !== void 0) criteria["SseKmsEncryptedObjects"] = { Status: sseKms.Status };
+					if (Object.keys(criteria).length > 0) ruleOut["SourceSelectionCriteria"] = criteria;
+				}
 				if (r.Filter) {
 					const f = r.Filter;
 					const cfnFilter = {};
@@ -6218,7 +6328,7 @@ var S3BucketProvider = class S3BucketProvider {
 					else if (f["Prefix"] !== void 0) cfnFilter["Prefix"] = f["Prefix"];
 					if (Object.keys(cfnFilter).length > 0) ruleOut["Filter"] = cfnFilter;
 				}
-				if (r.DeleteMarkerReplication) ruleOut["DeleteMarkerReplication"] = { Status: r.DeleteMarkerReplication.Status };
+				if (r.DeleteMarkerReplication?.Status !== void 0) ruleOut["DeleteMarkerReplication"] = { Status: r.DeleteMarkerReplication.Status };
 				return ruleOut;
 			});
 			return out;
@@ -26676,10 +26786,11 @@ var ELBv2Provider = class {
 		try {
 			const rawMatcher = properties["Matcher"];
 			const matcher = rawMatcher && (rawMatcher.HttpCode !== void 0 || rawMatcher.GrpcCode !== void 0) ? rawMatcher : void 0;
+			const healthCheckPort = String(properties["Protocol"] ?? previousProperties["Protocol"] ?? "").toUpperCase() === "GENEVE" ? properties["HealthCheckPort"] : clearOnUpdateRemoval(properties["HealthCheckPort"], previousProperties["HealthCheckPort"], "traffic-port");
 			await this.getClient().send(new ModifyTargetGroupCommand({
 				TargetGroupArn: physicalId,
 				HealthCheckProtocol: properties["HealthCheckProtocol"],
-				HealthCheckPort: properties["HealthCheckPort"],
+				HealthCheckPort: healthCheckPort,
 				HealthCheckPath: properties["HealthCheckPath"],
 				HealthCheckEnabled: properties["HealthCheckEnabled"] !== void 0 ? Boolean(properties["HealthCheckEnabled"]) : void 0,
 				HealthCheckIntervalSeconds: properties["HealthCheckIntervalSeconds"] !== void 0 ? Number(properties["HealthCheckIntervalSeconds"]) : void 0,
@@ -67218,7 +67329,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.39");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.41");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;