@go-to-k/cdkd 0.278.40 → 0.278.42

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as describeTypeWithThrottleRetry, $t as AwsClients, A as red, At as Synthesizer, B as isTerminationProtectionPropagationError, Bt as resolveUseCdkBootstrapAssets, C as isStatefulRecreateTargetSync, Ct as buildDockerImage, D as cyan, Dt as runDockerStreaming, E as bold, Et as runDockerForeground, F as ProviderRegistry, Ft as resolveAutoAssetStorage, G as normalizeAwsTagsToCfn, Gt as MIGRATE_TMP_PREFIX, H as cfnRefValueFromPhysicalId, Ht as warnDeprecatedNoPrefixCliFlag, I as findActionableSilentDrops, It as resolveCaptureObservedState, J as readConfigString, Jt as expectedOwnerParam, K as resolveExplicitPhysicalId, Kt as findLargeInlineResources, L as CloudControlProvider, Lt as resolveSkipPrefix, M as IAMRoleProvider, Mt as getDefaultStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as getLegacyStateBucketName, O as gray, Ot as AssetManifestLoader, P as clearOnUpdateRemoval, Pt as resolveApp, Q as DiffCalculator, Qt as resolveBucketRegion, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefault, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateContainerRepoName, T as formatResourceLine, Tn as withErrorHandling, Tt as getDockerCmd, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_BODY_LIMIT, V as IntrinsicFunctionResolver, Vt as stateBucketExistenceConfirmed, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_URL_LIMIT, X as requireConfigString, Xt as processStackMessages, Y as requireConfigArray, Yt as AssemblyReader, Z as applyRoleArnIfSet, _ as createPreDeleteFinalSnapshot, _n as ResourceUpdateNotSupportedError, _t as BOOTSTRAP_MARKER_PREFIX, a as DeploymentEventsStore, at as LockManager, b as unsupportedFinalSnapshotError, bt as parseBootstrapMarker, c as replayFailedOperations, cn as LocalInvokeBuildError$1, ct as shouldRetainResource, d as IMPLICIT_DELETE_DEPENDENCIES, dt as WorkGraph, en as getAwsClients, et as withRetry, f as computeImplicitDeleteEdges, fn as MissingCdkCliError, ft as buildAssetRedirectMap, g as ccRoutedFinalSnapshotError, gn as ResourceTimeoutError, gt as AssetModeResolver, h as buildFinalSnapshotIdentifier, hn as ProvisioningError, ht as rewriteTemplateAssetReferences, i as DeploymentEventsReader, in as CdkdError, it as TemplateParser, j as yellow, jt as synthesisStatusMessage, k as green, kt as getDockerImageBySourceHash, l as replayRollback, ln as LocalMigrateError, lt as AssetPublisher, m as PRE_DELETE_SNAPSHOT_TYPES, mn as PartialFailureError, mt as loadPublishableAssetManifest, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as setAwsClients, nt as isThrottlingError, o as planFailedOps, ot as S3StateBackend, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as NestedStackChildDirectDestroyError, pt as createAssetRedirectResolver, q as assertRegionMatch, qt as uploadCfnTemplate, r as DeployEngine, rt as DagBuilder, s as planRollback, sn as DeployCancelledError, st as rebuildClientForBucketRegion, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resetAwsClients, tt as isRetryableTransientError, u as withResourceDeadline, un as LocalStartServiceError, ut as stringifyValue, v as isFinalSnapshotError, vn as StackHasActiveImportsError, vt as ensureAssetStorage, w as renderStatefulReason, wn as normalizeAwsError, wt as formatDockerLoginError, x as extractDeploymentEventError, xt as validateAssetBucketName, y as refusesFinalSnapshot, yn as StackTerminationProtectionError, yt as getBootstrapMarkerKey, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefaultAndSource } from "./deploy-engine-CI_K8S3J.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-DxexHYwK.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-z4TiJLsS.js";
+import { t as ASGProvider } from "./asg-provider-mwqciloR.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3688,11 +3688,11 @@ var IAMAccessKeyProvider = class {
 	* exist on AWS without a cdkd state record, and the next deploy's re-CREATE
 	* would burn the user's 2-keys-per-user quota.
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating IAM access key ${logicalId}`);
 		const userName = properties["UserName"];
 		if (!userName) throw new ProvisioningError(`AccessKey ${logicalId} requires UserName`, resourceType, logicalId);
-		const status = properties["Status"] ?? "Active";
+		const status = requireConfigString(properties["Status"], "Active", "AWS::IAM::AccessKey Status", replayWarn(this.logger, context));
 		try {
 			const response = await this.iamClient.send(new CreateAccessKeyCommand({ UserName: userName }));
 			const accessKeyId = response.AccessKey?.AccessKeyId;
@@ -3747,10 +3747,11 @@ var IAMAccessKeyProvider = class {
 	* that REMOVES `Status` resets to the CFn default `Active` (absent-field
 	* removal semantics), so the desired status is always sent explicitly.
 	*/
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating IAM access key ${logicalId}: ${physicalId}`);
 		const userName = properties["UserName"];
-		const status = properties["Status"] ?? "Active";
+		const previousStatus = previousProperties["Status"] === "Inactive" ? "Inactive" : "Active";
+		const status = properties["Status"] === void 0 ? "Active" : requireConfigString(properties["Status"], previousStatus, "AWS::IAM::AccessKey Status", { onUnusable: (message) => this.logger.warn(message) });
 		try {
 			await this.iamClient.send(new UpdateAccessKeyCommand({
 				UserName: userName,
@@ -5109,7 +5110,8 @@ var S3BucketProvider = class S3BucketProvider {
 		});
 		await this.s3Client.send(new PutBucketLifecycleConfigurationCommand({
 			Bucket: bucketName,
-			LifecycleConfiguration: { Rules: rules }
+			LifecycleConfiguration: { Rules: rules },
+			TransitionDefaultMinimumObjectSize: lifecycleConfig["TransitionDefaultMinimumObjectSize"]
 		}));
 		this.logger.debug(`Applied lifecycle configuration to bucket ${bucketName}`);
 	}
@@ -5146,12 +5148,14 @@ var S3BucketProvider = class S3BucketProvider {
 		if (!Array.isArray(encryptionConfig?.ServerSideEncryptionConfiguration)) throw new Error(`BucketEncryption.ServerSideEncryptionConfiguration must be an array (got ${encryptionConfig?.ServerSideEncryptionConfiguration === void 0 ? "undefined" : typeof encryptionConfig.ServerSideEncryptionConfiguration}) — check for an unresolved intrinsic or a mis-nested template value`);
 		const rules = encryptionConfig.ServerSideEncryptionConfiguration.map((rule) => {
 			const byDefault = rule["ServerSideEncryptionByDefault"];
+			const blocked = rule["BlockedEncryptionTypes"];
 			return {
 				ApplyServerSideEncryptionByDefault: byDefault ? {
 					SSEAlgorithm: byDefault["SSEAlgorithm"],
 					KMSMasterKeyID: byDefault["KMSMasterKeyID"]
 				} : void 0,
-				BucketKeyEnabled: rule["BucketKeyEnabled"]
+				BucketKeyEnabled: rule["BucketKeyEnabled"],
+				BlockedEncryptionTypes: blocked != null && blocked["EncryptionType"] !== void 0 ? { EncryptionType: blocked["EncryptionType"] } : void 0
 			};
 		});
 		await this.s3Client.send(new PutBucketEncryptionCommand({
@@ -5178,12 +5182,21 @@ var S3BucketProvider = class S3BucketProvider {
 			this.logger.debug(`Cleared logging configuration on bucket ${bucketName}`);
 			return;
 		}
+		const loggingEnabled = {
+			TargetBucket: destinationBucket,
+			TargetPrefix: readConfigString(loggingConfig, "LogFilePrefix", "", "AWS::S3::Bucket LoggingConfiguration")
+		};
+		const keyFormat = loggingConfig["TargetObjectKeyFormat"];
+		if (keyFormat != null) {
+			const sdkKeyFormat = {};
+			if (keyFormat["SimplePrefix"] !== void 0) sdkKeyFormat.SimplePrefix = {};
+			const partitioned = keyFormat["PartitionedPrefix"];
+			if (partitioned != null && partitioned["PartitionDateSource"] !== void 0) sdkKeyFormat.PartitionedPrefix = { PartitionDateSource: partitioned["PartitionDateSource"] };
+			if (Object.keys(sdkKeyFormat).length > 0) loggingEnabled.TargetObjectKeyFormat = sdkKeyFormat;
+		}
 		await this.s3Client.send(new PutBucketLoggingCommand({
 			Bucket: bucketName,
-			BucketLoggingStatus: { LoggingEnabled: {
-				TargetBucket: destinationBucket,
-				TargetPrefix: readConfigString(loggingConfig, "LogFilePrefix", "", "AWS::S3::Bucket LoggingConfiguration")
-			} }
+			BucketLoggingStatus: { LoggingEnabled: loggingEnabled }
 		}));
 		this.logger.debug(`Applied logging configuration to bucket ${bucketName}`);
 	}
@@ -5454,6 +5467,54 @@ var S3BucketProvider = class S3BucketProvider {
 	*   - Rules[] (replication rules)
 	* SDK: PutBucketReplication with ReplicationConfiguration
 	*/
+	/**
+	* Build the SDK `Destination` for one replication rule.
+	*
+	* Before issue #1495 this was an inline literal carrying `Bucket` / `Account`
+	* / `StorageClass` only, so FOUR whole sub-blocks the CFn schema declares
+	* were accepted from the template and never sent — each one silently:
+	*
+	* - `AccessControlTranslation` — cross-account replication with owner
+	*   override; without it the replicas keep the SOURCE account's ownership.
+	* - `EncryptionConfiguration.ReplicaKmsKeyID` — the replica-side SSE-KMS key;
+	*   dropped, the replicas are not encrypted with the declared key. CDK's
+	*   `aws-s3` L2 emits this for a `replicationRules` entry with a KMS key.
+	* - `ReplicationTime` + `Metrics` — S3 Replication Time Control. RTC is a
+	*   billed SLA feature and both blocks are required to enable it, so a
+	*   template asking for RTC got plain asynchronous replication.
+	*
+	* CFn and the SDK spell every member identically here (verified against
+	* `@aws-sdk/client-s3`'s `Destination`), but the block is assembled member by
+	* member rather than forwarded so a CFn-only member cannot ride through.
+	*/
+	buildReplicationDestination(dest) {
+		const sdkDest = {
+			Bucket: dest["Bucket"],
+			Account: dest["Account"],
+			StorageClass: dest["StorageClass"]
+		};
+		const acl = dest["AccessControlTranslation"];
+		if (acl != null && acl["Owner"] !== void 0) sdkDest["AccessControlTranslation"] = { Owner: acl["Owner"] };
+		const encryption = dest["EncryptionConfiguration"];
+		if (encryption != null && encryption["ReplicaKmsKeyID"] !== void 0) sdkDest["EncryptionConfiguration"] = { ReplicaKmsKeyID: encryption["ReplicaKmsKeyID"] };
+		const replicationTime = dest["ReplicationTime"];
+		if (replicationTime != null) {
+			const time = replicationTime["Time"];
+			const rt = {};
+			if (replicationTime["Status"] !== void 0) rt["Status"] = replicationTime["Status"];
+			if (time != null && time["Minutes"] !== void 0) rt["Time"] = { Minutes: time["Minutes"] };
+			if (Object.keys(rt).length > 0) sdkDest["ReplicationTime"] = rt;
+		}
+		const metrics = dest["Metrics"];
+		if (metrics != null) {
+			const threshold = metrics["EventThreshold"];
+			const m = {};
+			if (metrics["Status"] !== void 0) m["Status"] = metrics["Status"];
+			if (threshold != null && threshold["Minutes"] !== void 0) m["EventThreshold"] = { Minutes: threshold["Minutes"] };
+			if (Object.keys(m).length > 0) sdkDest["Metrics"] = m;
+		}
+		return sdkDest;
+	}
 	async applyReplicationConfiguration(bucketName, replConfig) {
 		const rules = replConfig["Rules"];
 		await this.s3Client.send(new PutBucketReplicationCommand({
@@ -5466,12 +5527,17 @@ var S3BucketProvider = class S3BucketProvider {
 						ID: rule["Id"],
 						Status: readConfigString(rule, "Status", "Enabled", "AWS::S3::Bucket ReplicationConfiguration.Rules[]"),
 						Priority: rule["Priority"],
-						Destination: {
-							Bucket: dest["Bucket"],
-							Account: dest["Account"],
-							StorageClass: dest["StorageClass"]
-						}
+						Destination: this.buildReplicationDestination(dest)
 					};
+					const criteria = rule["SourceSelectionCriteria"];
+					if (criteria != null) {
+						const sdkCriteria = {};
+						const replicaMods = criteria["ReplicaModifications"];
+						if (replicaMods != null && replicaMods["Status"] !== void 0) sdkCriteria["ReplicaModifications"] = { Status: replicaMods["Status"] };
+						const sseKms = criteria["SseKmsEncryptedObjects"];
+						if (sseKms != null && sseKms["Status"] !== void 0) sdkCriteria["SseKmsEncryptedObjects"] = { Status: sseKms["Status"] };
+						if (Object.keys(sdkCriteria).length > 0) sdkRule["SourceSelectionCriteria"] = sdkCriteria;
+					}
 					const filter = rule["Filter"];
 					if (filter) {
 						const and = filter["And"];
@@ -5987,6 +6053,7 @@ var S3BucketProvider = class S3BucketProvider {
 					out["ServerSideEncryptionByDefault"] = sseOut;
 				}
 				if (rule.BucketKeyEnabled !== void 0) out["BucketKeyEnabled"] = rule.BucketKeyEnabled;
+				if (rule.BlockedEncryptionTypes?.EncryptionType !== void 0) out["BlockedEncryptionTypes"] = { EncryptionType: rule.BlockedEncryptionTypes.EncryptionType };
 				return out;
 			}) };
 		} catch (err) {
@@ -6023,59 +6090,66 @@ var S3BucketProvider = class S3BucketProvider {
 	}
 	async readLifecycle(bucket) {
 		try {
-			return { Rules: ((await this.s3Client.send(new GetBucketLifecycleConfigurationCommand({ Bucket: bucket }))).Rules ?? []).map((r) => {
-				const out = {};
-				if (r.ID !== void 0) out["Id"] = r.ID;
-				if (r.Status !== void 0) out["Status"] = r.Status;
-				if (r.Prefix !== void 0) out["Prefix"] = r.Prefix;
-				if (r.Expiration) {
-					const exp = {};
-					if (r.Expiration.Days !== void 0) exp["Days"] = r.Expiration.Days;
-					if (r.Expiration.Date !== void 0) exp["Date"] = r.Expiration.Date.toISOString();
-					if (r.Expiration.ExpiredObjectDeleteMarker !== void 0) exp["ExpiredObjectDeleteMarker"] = r.Expiration.ExpiredObjectDeleteMarker;
-					out["Expiration"] = exp;
-				}
-				if (r.Transitions && r.Transitions.length > 0) out["Transitions"] = r.Transitions.map((t) => {
-					const item = {};
-					if (t.Days !== void 0) item["TransitionInDays"] = t.Days;
-					if (t.Date !== void 0) item["TransitionDate"] = t.Date.toISOString();
-					if (t.StorageClass !== void 0) item["StorageClass"] = t.StorageClass;
-					return item;
-				});
-				if (r.NoncurrentVersionExpiration) {
-					const nve = {};
-					if (r.NoncurrentVersionExpiration.NoncurrentDays !== void 0) nve["NoncurrentDays"] = r.NoncurrentVersionExpiration.NoncurrentDays;
-					if (r.NoncurrentVersionExpiration.NewerNoncurrentVersions !== void 0) nve["NewerNoncurrentVersions"] = r.NoncurrentVersionExpiration.NewerNoncurrentVersions;
-					out["NoncurrentVersionExpiration"] = nve;
-				}
-				if (r.NoncurrentVersionTransitions && r.NoncurrentVersionTransitions.length > 0) out["NoncurrentVersionTransitions"] = r.NoncurrentVersionTransitions.map((nvt) => {
-					const item = {};
-					if (nvt.NoncurrentDays !== void 0) item["TransitionInDays"] = nvt.NoncurrentDays;
-					if (nvt.StorageClass !== void 0) item["StorageClass"] = nvt.StorageClass;
-					if (nvt.NewerNoncurrentVersions !== void 0) item["NewerNoncurrentVersions"] = nvt.NewerNoncurrentVersions;
-					return item;
-				});
-				if (r.AbortIncompleteMultipartUpload) out["AbortIncompleteMultipartUpload"] = { DaysAfterInitiation: r.AbortIncompleteMultipartUpload.DaysAfterInitiation };
-				if (r.Filter) {
-					const f = r.Filter;
-					const cfnFilter = {};
-					const and = f["And"];
-					const tagOnly = f["Tag"];
-					if (and) {
-						if (and["Prefix"] !== void 0) cfnFilter["Prefix"] = and["Prefix"];
-						if (and["Tags"]) cfnFilter["TagFilters"] = and["Tags"];
-						if (and["ObjectSizeGreaterThan"] !== void 0) cfnFilter["ObjectSizeGreaterThan"] = and["ObjectSizeGreaterThan"];
-						if (and["ObjectSizeLessThan"] !== void 0) cfnFilter["ObjectSizeLessThan"] = and["ObjectSizeLessThan"];
-					} else if (tagOnly) cfnFilter["TagFilters"] = [tagOnly];
-					else {
-						if (f["Prefix"] !== void 0) cfnFilter["Prefix"] = f["Prefix"];
-						if (f["ObjectSizeGreaterThan"] !== void 0) cfnFilter["ObjectSizeGreaterThan"] = f["ObjectSizeGreaterThan"];
-						if (f["ObjectSizeLessThan"] !== void 0) cfnFilter["ObjectSizeLessThan"] = f["ObjectSizeLessThan"];
+			const resp = await this.s3Client.send(new GetBucketLifecycleConfigurationCommand({ Bucket: bucket }));
+			const rules = resp.Rules ?? [];
+			const lifecycleOut = {};
+			if (resp.TransitionDefaultMinimumObjectSize !== void 0) lifecycleOut["TransitionDefaultMinimumObjectSize"] = resp.TransitionDefaultMinimumObjectSize;
+			return {
+				...lifecycleOut,
+				Rules: rules.map((r) => {
+					const out = {};
+					if (r.ID !== void 0) out["Id"] = r.ID;
+					if (r.Status !== void 0) out["Status"] = r.Status;
+					if (r.Prefix !== void 0) out["Prefix"] = r.Prefix;
+					if (r.Expiration) {
+						const exp = {};
+						if (r.Expiration.Days !== void 0) exp["Days"] = r.Expiration.Days;
+						if (r.Expiration.Date !== void 0) exp["Date"] = r.Expiration.Date.toISOString();
+						if (r.Expiration.ExpiredObjectDeleteMarker !== void 0) exp["ExpiredObjectDeleteMarker"] = r.Expiration.ExpiredObjectDeleteMarker;
+						out["Expiration"] = exp;
 					}
-					if (Object.keys(cfnFilter).length > 0) out["Filter"] = cfnFilter;
-				}
-				return out;
-			}) };
+					if (r.Transitions && r.Transitions.length > 0) out["Transitions"] = r.Transitions.map((t) => {
+						const item = {};
+						if (t.Days !== void 0) item["TransitionInDays"] = t.Days;
+						if (t.Date !== void 0) item["TransitionDate"] = t.Date.toISOString();
+						if (t.StorageClass !== void 0) item["StorageClass"] = t.StorageClass;
+						return item;
+					});
+					if (r.NoncurrentVersionExpiration) {
+						const nve = {};
+						if (r.NoncurrentVersionExpiration.NoncurrentDays !== void 0) nve["NoncurrentDays"] = r.NoncurrentVersionExpiration.NoncurrentDays;
+						if (r.NoncurrentVersionExpiration.NewerNoncurrentVersions !== void 0) nve["NewerNoncurrentVersions"] = r.NoncurrentVersionExpiration.NewerNoncurrentVersions;
+						out["NoncurrentVersionExpiration"] = nve;
+					}
+					if (r.NoncurrentVersionTransitions && r.NoncurrentVersionTransitions.length > 0) out["NoncurrentVersionTransitions"] = r.NoncurrentVersionTransitions.map((nvt) => {
+						const item = {};
+						if (nvt.NoncurrentDays !== void 0) item["TransitionInDays"] = nvt.NoncurrentDays;
+						if (nvt.StorageClass !== void 0) item["StorageClass"] = nvt.StorageClass;
+						if (nvt.NewerNoncurrentVersions !== void 0) item["NewerNoncurrentVersions"] = nvt.NewerNoncurrentVersions;
+						return item;
+					});
+					if (r.AbortIncompleteMultipartUpload) out["AbortIncompleteMultipartUpload"] = { DaysAfterInitiation: r.AbortIncompleteMultipartUpload.DaysAfterInitiation };
+					if (r.Filter) {
+						const f = r.Filter;
+						const cfnFilter = {};
+						const and = f["And"];
+						const tagOnly = f["Tag"];
+						if (and) {
+							if (and["Prefix"] !== void 0) cfnFilter["Prefix"] = and["Prefix"];
+							if (and["Tags"]) cfnFilter["TagFilters"] = and["Tags"];
+							if (and["ObjectSizeGreaterThan"] !== void 0) cfnFilter["ObjectSizeGreaterThan"] = and["ObjectSizeGreaterThan"];
+							if (and["ObjectSizeLessThan"] !== void 0) cfnFilter["ObjectSizeLessThan"] = and["ObjectSizeLessThan"];
+						} else if (tagOnly) cfnFilter["TagFilters"] = [tagOnly];
+						else {
+							if (f["Prefix"] !== void 0) cfnFilter["Prefix"] = f["Prefix"];
+							if (f["ObjectSizeGreaterThan"] !== void 0) cfnFilter["ObjectSizeGreaterThan"] = f["ObjectSizeGreaterThan"];
+							if (f["ObjectSizeLessThan"] !== void 0) cfnFilter["ObjectSizeLessThan"] = f["ObjectSizeLessThan"];
+						}
+						if (Object.keys(cfnFilter).length > 0) out["Filter"] = cfnFilter;
+					}
+					return out;
+				})
+			};
 		} catch (err) {
 			if (err.name === "NoSuchLifecycleConfiguration") return { Rules: [] };
 			throw err;
@@ -6141,6 +6215,17 @@ var S3BucketProvider = class S3BucketProvider {
 		const out = {};
 		if (resp.LoggingEnabled.TargetBucket !== void 0) out["DestinationBucketName"] = resp.LoggingEnabled.TargetBucket;
 		if (resp.LoggingEnabled.TargetPrefix !== void 0) out["LogFilePrefix"] = resp.LoggingEnabled.TargetPrefix;
+		const keyFormat = resp.LoggingEnabled.TargetObjectKeyFormat;
+		if (keyFormat) {
+			const cfnKeyFormat = {};
+			if (keyFormat.SimplePrefix !== void 0) cfnKeyFormat["SimplePrefix"] = {};
+			if (keyFormat.PartitionedPrefix) {
+				const partitioned = {};
+				if (keyFormat.PartitionedPrefix.PartitionDateSource !== void 0) partitioned["PartitionDateSource"] = keyFormat.PartitionedPrefix.PartitionDateSource;
+				cfnKeyFormat["PartitionedPrefix"] = partitioned;
+			}
+			if (Object.keys(cfnKeyFormat).length > 0) out["TargetObjectKeyFormat"] = cfnKeyFormat;
+		}
 		return out;
 	}
 	async readNotification(bucket) {
@@ -6201,8 +6286,34 @@ var S3BucketProvider = class S3BucketProvider {
 					if (r.Destination.Bucket !== void 0) d["Bucket"] = r.Destination.Bucket;
 					if (r.Destination.Account !== void 0) d["Account"] = r.Destination.Account;
 					if (r.Destination.StorageClass !== void 0) d["StorageClass"] = r.Destination.StorageClass;
+					const acl = r.Destination.AccessControlTranslation;
+					if (acl?.Owner !== void 0) d["AccessControlTranslation"] = { Owner: acl.Owner };
+					const enc = r.Destination.EncryptionConfiguration;
+					if (enc?.ReplicaKmsKeyID !== void 0) d["EncryptionConfiguration"] = { ReplicaKmsKeyID: enc.ReplicaKmsKeyID };
+					const rtIn = r.Destination.ReplicationTime;
+					if (rtIn) {
+						const rt = {};
+						if (rtIn.Status !== void 0) rt["Status"] = rtIn.Status;
+						if (rtIn.Time?.Minutes !== void 0) rt["Time"] = { Minutes: rtIn.Time.Minutes };
+						if (Object.keys(rt).length > 0) d["ReplicationTime"] = rt;
+					}
+					const metricsIn = r.Destination.Metrics;
+					if (metricsIn) {
+						const m = {};
+						if (metricsIn.Status !== void 0) m["Status"] = metricsIn.Status;
+						if (metricsIn.EventThreshold?.Minutes !== void 0) m["EventThreshold"] = { Minutes: metricsIn.EventThreshold.Minutes };
+						if (Object.keys(m).length > 0) d["Metrics"] = m;
+					}
 					ruleOut["Destination"] = d;
 				}
+				if (r.SourceSelectionCriteria) {
+					const criteria = {};
+					const replicaMods = r.SourceSelectionCriteria.ReplicaModifications;
+					if (replicaMods?.Status !== void 0) criteria["ReplicaModifications"] = { Status: replicaMods.Status };
+					const sseKms = r.SourceSelectionCriteria.SseKmsEncryptedObjects;
+					if (sseKms?.Status !== void 0) criteria["SseKmsEncryptedObjects"] = { Status: sseKms.Status };
+					if (Object.keys(criteria).length > 0) ruleOut["SourceSelectionCriteria"] = criteria;
+				}
 				if (r.Filter) {
 					const f = r.Filter;
 					const cfnFilter = {};
@@ -6218,7 +6329,7 @@ var S3BucketProvider = class S3BucketProvider {
 					else if (f["Prefix"] !== void 0) cfnFilter["Prefix"] = f["Prefix"];
 					if (Object.keys(cfnFilter).length > 0) ruleOut["Filter"] = cfnFilter;
 				}
-				if (r.DeleteMarkerReplication) ruleOut["DeleteMarkerReplication"] = { Status: r.DeleteMarkerReplication.Status };
+				if (r.DeleteMarkerReplication?.Status !== void 0) ruleOut["DeleteMarkerReplication"] = { Status: r.DeleteMarkerReplication.Status };
 				return ruleOut;
 			});
 			return out;
@@ -10682,7 +10793,10 @@ var LambdaEventInvokeConfigProvider = class {
 	}
 	buildPutInput(properties) {
 		const functionName = properties["FunctionName"];
-		const qualifier = properties["Qualifier"] ?? "$LATEST";
+		const qualifier = requireConfigString(properties["Qualifier"], "$LATEST", "AWS::Lambda::EventInvokeConfig Qualifier", {
+			coerceNumber: true,
+			onUnusable: (message) => this.logger.warn(message)
+		});
 		const input = { FunctionName: functionName };
 		if (qualifier !== "$LATEST") input.Qualifier = qualifier;
 		if (properties["MaximumEventAgeInSeconds"] !== void 0) input.MaximumEventAgeInSeconds = Number(properties["MaximumEventAgeInSeconds"]);
@@ -10691,11 +10805,14 @@ var LambdaEventInvokeConfigProvider = class {
 		if (dest) input.DestinationConfig = dest;
 		return input;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Lambda EventInvokeConfig ${logicalId}`);
 		const functionName = properties["FunctionName"];
 		if (!functionName) throw new ProvisioningError(`FunctionName is required for Lambda EventInvokeConfig ${logicalId}`, resourceType, logicalId);
-		const qualifier = properties["Qualifier"] ?? "$LATEST";
+		const qualifier = requireConfigString(properties["Qualifier"], "$LATEST", "AWS::Lambda::EventInvokeConfig Qualifier", {
+			coerceNumber: true,
+			...replayWarn(this.logger, context)
+		});
 		try {
 			await this.lambdaClient.send(new PutFunctionEventInvokeConfigCommand(this.buildPutInput(properties)));
 			const physicalId = this.buildPhysicalId(functionName, qualifier);
@@ -17131,20 +17248,20 @@ var EC2Provider = class {
 		const awsClients = getAwsClients();
 		this.ec2Client = awsClients.ec2;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::EC2::VPC": return this.createVpc(logicalId, resourceType, properties);
 			case "AWS::EC2::Subnet": return this.createSubnet(logicalId, resourceType, properties);
 			case "AWS::EC2::InternetGateway": return this.createInternetGateway(logicalId, resourceType, properties);
-			case "AWS::EC2::EIP": return this.createEip(logicalId, resourceType, properties);
+			case "AWS::EC2::EIP": return this.createEip(logicalId, resourceType, properties, context);
 			case "AWS::EC2::VPCGatewayAttachment": return this.createVpcGatewayAttachment(logicalId, resourceType, properties);
 			case "AWS::EC2::NatGateway": return this.createNatGateway(logicalId, resourceType, properties);
 			case "AWS::EC2::RouteTable": return this.createRouteTable(logicalId, resourceType, properties);
 			case "AWS::EC2::Route": return this.createRoute(logicalId, resourceType, properties);
 			case "AWS::EC2::SubnetRouteTableAssociation": return this.createSubnetRouteTableAssociation(logicalId, resourceType, properties);
 			case "AWS::EC2::SecurityGroup": return this.createSecurityGroup(logicalId, resourceType, properties);
-			case "AWS::EC2::SecurityGroupIngress": return this.createSecurityGroupIngress(logicalId, resourceType, properties);
-			case "AWS::EC2::Instance": return this.createInstance(logicalId, resourceType, properties);
+			case "AWS::EC2::SecurityGroupIngress": return this.createSecurityGroupIngress(logicalId, resourceType, properties, context?.replayingState === true ? (message) => this.logger.warn(message) : void 0);
+			case "AWS::EC2::Instance": return this.createInstance(logicalId, resourceType, properties, context);
 			case "AWS::EC2::NetworkAcl": return this.createNetworkAcl(logicalId, resourceType, properties);
 			case "AWS::EC2::NetworkAclEntry": return this.createNetworkAclEntry(logicalId, resourceType, properties);
 			case "AWS::EC2::SubnetNetworkAclAssociation": return this.createSubnetNetworkAclAssociation(logicalId, resourceType, properties);
@@ -17592,11 +17709,11 @@ var EC2Provider = class {
 		if (physicalId.startsWith("eipalloc-")) return { allocationId: physicalId };
 		return { publicIp: physicalId };
 	}
-	async createEip(logicalId, resourceType, properties) {
+	async createEip(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating EIP ${logicalId}`);
 		try {
 			const response = await this.ec2Client.send(new AllocateAddressCommand({
-				Domain: properties["Domain"] ?? "vpc",
+				Domain: requireConfigString(properties["Domain"], "vpc", "AWS::EC2::EIP Domain", replayWarn(this.logger, context)),
 				NetworkBorderGroup: properties["NetworkBorderGroup"],
 				PublicIpv4Pool: properties["PublicIpv4Pool"]
 			}));
@@ -18144,17 +18261,32 @@ var EC2Provider = class {
 			return;
 		}
 	}
-	async createSecurityGroupIngress(logicalId, resourceType, properties) {
+	/**
+	* @param onUnusableProtocol When supplied, a malformed `IpProtocol` WARNS and
+	*   defaults instead of throwing. Passed by `updateSecurityGroupIngress`,
+	*   which reaches this method as the re-create half of a delete-then-create
+	*   replacement: by then `RevokeSecurityGroupIngress` has already committed,
+	*   so a refusal would leave the rule deleted from AWS with the op failed —
+	*   and on a rollback replay the value comes from a STATE record, which no
+	*   template edit can fix. Absent (the plain CREATE dispatch) it throws.
+	*/
+	async createSecurityGroupIngress(logicalId, resourceType, properties, onUnusableProtocol) {
 		this.logger.debug(`Creating SecurityGroupIngress ${logicalId}`);
 		const groupId = properties["GroupId"];
 		if (!groupId) throw new ProvisioningError(`GroupId is required for SecurityGroupIngress ${logicalId}`, resourceType, logicalId);
-		const ipProtocol = properties["IpProtocol"] ?? "-1";
+		const ipProtocol = requireConfigString(properties["IpProtocol"], "-1", "AWS::EC2::SecurityGroupIngress IpProtocol", {
+			coerceNumber: true,
+			...onUnusableProtocol && { onUnusable: onUnusableProtocol }
+		});
 		const fromPort = properties["FromPort"];
 		const toPort = properties["ToPort"];
 		try {
 			await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
 				GroupId: groupId,
-				IpPermissions: [this.buildIpPermission(properties)]
+				IpPermissions: [{
+					...this.buildIpPermission(properties),
+					IpProtocol: ipProtocol
+				}]
 			}));
 			const physicalId = `${groupId}|${ipProtocol}|${fromPort ?? "-1"}|${toPort ?? "-1"}`;
 			this.logger.debug(`Successfully created SecurityGroupIngress ${logicalId}: ${physicalId}`);
@@ -18183,7 +18315,7 @@ var EC2Provider = class {
 		};
 		try {
 			await this.deleteSecurityGroupIngress(logicalId, physicalId, resourceType, previousProperties);
-			const createResult = await this.createSecurityGroupIngress(logicalId, resourceType, properties);
+			const createResult = await this.createSecurityGroupIngress(logicalId, resourceType, properties, (message) => this.logger.warn(message));
 			return {
 				physicalId: createResult.physicalId,
 				wasReplaced: true,
@@ -18221,11 +18353,11 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to delete SecurityGroupIngress ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createInstance(logicalId, resourceType, properties) {
+	async createInstance(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating EC2 Instance ${logicalId}`);
 		const imageId = properties["ImageId"];
 		if (!imageId) throw new ProvisioningError(`ImageId is required for EC2 Instance ${logicalId}`, resourceType, logicalId);
-		const instanceType = properties["InstanceType"] ?? "t3.micro";
+		const instanceType = requireConfigString(properties["InstanceType"], "t3.micro", "AWS::EC2::Instance InstanceType", replayWarn(this.logger, context));
 		try {
 			const securityGroupIds = properties["SecurityGroupIds"];
 			const securityGroups = properties["SecurityGroups"];
@@ -19878,14 +20010,14 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	/**
 	* Create a resource
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::ApiGateway::Account": return this.createAccount(logicalId, resourceType, properties);
 			case "AWS::ApiGateway::Authorizer": return this.createAuthorizer(logicalId, resourceType, properties);
 			case "AWS::ApiGateway::Resource": return this.createResource(logicalId, resourceType, properties);
 			case "AWS::ApiGateway::Deployment": return this.createDeployment(logicalId, resourceType, properties);
 			case "AWS::ApiGateway::Stage": return this.createStage(logicalId, resourceType, properties);
-			case "AWS::ApiGateway::Method": return this.createMethod(logicalId, resourceType, properties);
+			case "AWS::ApiGateway::Method": return this.createMethod(logicalId, resourceType, properties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
@@ -20513,12 +20645,12 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	* fixed in PR #373; this cleanup makes any future shape of
 	* post-`PutMethod` failure self-healing on the next redeploy.
 	*/
-	async createMethod(logicalId, resourceType, properties) {
+	async createMethod(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating API Gateway Method ${logicalId}`);
 		const restApiId = properties["RestApiId"];
 		const resourceId = properties["ResourceId"];
 		const httpMethod = properties["HttpMethod"];
-		const authorizationType = properties["AuthorizationType"] ?? "NONE";
+		const authorizationType = requireConfigString(properties["AuthorizationType"], "NONE", "AWS::ApiGateway::Method AuthorizationType", replayWarn(this.logger, context));
 		const authorizerId = properties["AuthorizerId"];
 		const apiKeyRequired = properties["ApiKeyRequired"];
 		const operationName = properties["OperationName"];
@@ -28580,10 +28712,10 @@ var RDSDBProxyTargetGroupProvider = class {
 		if (!this.rdsClient) this.rdsClient = new RDSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.rdsClient;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		const dbProxyName = properties["DBProxyName"];
 		if (!dbProxyName) throw new ProvisioningError(`DBProxyName is required for AWS::RDS::DBProxyTargetGroup ${logicalId}`, resourceType, logicalId);
-		const targetGroupName = properties["TargetGroupName"] ?? "default";
+		const targetGroupName = requireConfigString(properties["TargetGroupName"], "default", "AWS::RDS::DBProxyTargetGroup TargetGroupName", replayWarn(this.logger, context));
 		const dbClusterIdentifiers = properties["DBClusterIdentifiers"];
 		const dbInstanceIdentifiers = properties["DBInstanceIdentifiers"];
 		const connectionPoolConfig = properties["ConnectionPoolConfigurationInfo"];
@@ -28642,10 +28774,10 @@ var RDSDBProxyTargetGroupProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		const dbProxyName = properties["DBProxyName"];
 		if (!dbProxyName) throw new ProvisioningError(`DBProxyName is required for AWS::RDS::DBProxyTargetGroup ${logicalId} update`, resourceType, logicalId, physicalId);
-		const targetGroupName = properties["TargetGroupName"] ?? "default";
+		const targetGroupName = requireConfigString(properties["TargetGroupName"], "default", "AWS::RDS::DBProxyTargetGroup TargetGroupName", { onUnusable: (message) => this.logger.warn(message) });
 		for (const field of ["DBProxyName", "TargetGroupName"]) {
 			const oldVal = previousProperties[field];
-			const newVal = properties[field];
+			const newVal = field === "TargetGroupName" ? targetGroupName : properties[field];
 			const normalize = (v) => field === "TargetGroupName" && (v === void 0 || v === "default") ? "default" : v;
 			if (JSON.stringify(normalize(oldVal)) !== JSON.stringify(normalize(newVal))) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `${field} is immutable on AWS::RDS::DBProxyTargetGroup — destroy + redeploy to change it`);
 		}
@@ -67219,7 +67351,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.40");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.42");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;