@go-to-k/cdkd 0.280.2 → 0.280.4

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-DK0y5OP8.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-CttwgBIB.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-CwKNCS78.js";
+import { t as ASGProvider } from "./asg-provider-Cyuov8l5.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -43,7 +43,7 @@ import readline from "node:readline/promises";
 import { writeFileSync as writeFileSync$1 } from "fs";
 import * as zlib from "node:zlib";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
-import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
+import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
 import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
@@ -5075,7 +5075,13 @@ var S3BucketProvider = class S3BucketProvider {
 	* - CFn Transition.TransitionInDays -> SDK Transition.Days
 	* - CFn Transition.TransitionDate -> SDK Transition.Date
 	*/
-	async applyLifecycleConfiguration(bucketName, lifecycleConfig) {
+	async applyLifecycleConfiguration(bucketName, lifecycleConfig, onUnusable) {
+		for (const rule of lifecycleConfig.Rules) {
+			const rawTagFilters = rule["Filter"]?.["TagFilters"] ?? rule["TagFilters"];
+			if (rawTagFilters != null) {
+				if (requireConfigArray(rawTagFilters, "AWS::S3::Bucket LifecycleConfiguration.Rules[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) return;
+			}
+		}
 		const gatherScope = (rule) => {
 			const filter = rule["Filter"];
 			return {
@@ -5088,7 +5094,7 @@ var S3BucketProvider = class S3BucketProvider {
 		const isPlainPrefixOnly = (rule) => {
 			if (rule["Filter"] !== void 0) return false;
 			const s = gatherScope(rule);
-			return s.prefix !== void 0 && (s.tagFilters === void 0 || s.tagFilters.length === 0) && s.sizeGt === void 0 && s.sizeLt === void 0;
+			return s.prefix !== void 0 && (s.tagFilters == null || s.tagFilters.length === 0) && s.sizeGt === void 0 && s.sizeLt === void 0;
 		};
 		const useFilterForm = !lifecycleConfig.Rules.every(isPlainPrefixOnly);
 		const rules = lifecycleConfig.Rules.map((rule) => {
@@ -5141,7 +5147,7 @@ var S3BucketProvider = class S3BucketProvider {
 			const abort = isPlainObject$1(rule["AbortIncompleteMultipartUpload"]) ? rule["AbortIncompleteMultipartUpload"] : void 0;
 			if (abort) sdkRule.AbortIncompleteMultipartUpload = { DaysAfterInitiation: abort["DaysAfterInitiation"] };
 			const { prefix, tagFilters, sizeGt, sizeLt } = gatherScope(rule);
-			const hasTags = tagFilters !== void 0 && tagFilters.length > 0;
+			const hasTags = tagFilters != null && tagFilters.length > 0;
 			if ((hasTags ? 1 : 0) + (prefix !== void 0 ? 1 : 0) + (sizeGt !== void 0 ? 1 : 0) + (sizeLt !== void 0 ? 1 : 0) > 1) sdkRule.Filter = { And: {
 				Prefix: prefix,
 				Tags: hasTags ? tagFilters : void 0,
@@ -5367,13 +5373,14 @@ var S3BucketProvider = class S3BucketProvider {
 	* CFn property: MetricsConfigurations[] (array of configurations)
 	* SDK: PutBucketMetricsConfiguration (one per configuration, keyed by Id)
 	*/
-	async applyMetricsConfigurations(bucketName, configs) {
+	async applyMetricsConfigurations(bucketName, configs, onUnusable) {
 		for (const config of configs) {
 			const id = config["Id"];
 			const metricsConfig = { Id: id };
 			const prefix = config["Prefix"];
 			const accessPointArn = config["AccessPointArn"];
 			const tagFilters = config["TagFilters"];
+			if (tagFilters != null && requireConfigArray(tagFilters, "AWS::S3::Bucket MetricsConfigurations[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) continue;
 			const tagCount = tagFilters?.length ?? 0;
 			if ((prefix ? 1 : 0) + tagCount + (accessPointArn ? 1 : 0) > 1) metricsConfig.Filter = { And: {
 				Prefix: prefix,
@@ -5456,6 +5463,7 @@ var S3BucketProvider = class S3BucketProvider {
 			};
 			const prefix = config["Prefix"];
 			const tagFilters = config["TagFilters"];
+			if (tagFilters != null && requireConfigArray(tagFilters, "AWS::S3::Bucket AnalyticsConfigurations[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) continue;
 			const tagCount = tagFilters?.length ?? 0;
 			if ((prefix ? 1 : 0) + tagCount > 1) analyticsConfig.Filter = { And: {
 				Prefix: prefix,
@@ -5494,7 +5502,7 @@ var S3BucketProvider = class S3BucketProvider {
 	* CFn property: IntelligentTieringConfigurations[]
 	* SDK: PutBucketIntelligentTieringConfiguration (one per configuration, keyed by Id)
 	*/
-	async applyIntelligentTieringConfigurations(bucketName, configs) {
+	async applyIntelligentTieringConfigurations(bucketName, configs, onUnusable) {
 		for (const config of configs) {
 			const id = config["Id"];
 			const tierings = config["Tierings"];
@@ -5508,6 +5516,7 @@ var S3BucketProvider = class S3BucketProvider {
 			};
 			const prefix = config["Prefix"];
 			const tagFilters = config["TagFilters"];
+			if (tagFilters != null && requireConfigArray(tagFilters, "AWS::S3::Bucket IntelligentTieringConfigurations[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) continue;
 			const tagCount = tagFilters?.length ?? 0;
 			if ((prefix ? 1 : 0) + tagCount > 1) itConfig.Filter = { And: {
 				Prefix: prefix,
@@ -5852,7 +5861,7 @@ var S3BucketProvider = class S3BucketProvider {
 		});
 		await this.diffSubConfig(bucketName, previousProperties["LifecycleConfiguration"], properties["LifecycleConfiguration"], async (cfg) => {
 			if (!cfg.Rules || !Array.isArray(cfg.Rules) || cfg.Rules.length === 0) return;
-			await this.applyLifecycleConfiguration(bucketName, cfg);
+			await this.applyLifecycleConfiguration(bucketName, cfg, (m) => this.logger.warn(m));
 		}, async () => {
 			await this.s3Client.send(new DeleteBucketLifecycleCommand({ Bucket: bucketName }));
 			this.logger.debug(`Deleted lifecycle configuration on bucket ${bucketName}`);
@@ -5882,7 +5891,7 @@ var S3BucketProvider = class S3BucketProvider {
 			this.logger.debug(`Cleared object lock rule on bucket ${bucketName}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["AccelerateConfiguration"], properties["AccelerateConfiguration"], async (cfg) => this.applyAccelerateConfiguration(bucketName, cfg), async () => this.applyAccelerateConfiguration(bucketName, { AccelerationStatus: "Suspended" }));
-		await this.diffArrayConfigById(bucketName, previousProperties["MetricsConfigurations"], properties["MetricsConfigurations"], async (_id, cfg) => this.applyMetricsConfigurations(bucketName, [cfg]), async (id) => {
+		await this.diffArrayConfigById(bucketName, previousProperties["MetricsConfigurations"], properties["MetricsConfigurations"], async (_id, cfg) => this.applyMetricsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m)), async (id) => {
 			await this.s3Client.send(new DeleteBucketMetricsConfigurationCommand({
 				Bucket: bucketName,
 				Id: id
@@ -5896,7 +5905,7 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 			this.logger.debug(`Deleted analytics configuration ${id} on bucket ${bucketName}`);
 		});
-		await this.diffArrayConfigById(bucketName, previousProperties["IntelligentTieringConfigurations"], properties["IntelligentTieringConfigurations"], async (_id, cfg) => this.applyIntelligentTieringConfigurations(bucketName, [cfg]), async (id) => {
+		await this.diffArrayConfigById(bucketName, previousProperties["IntelligentTieringConfigurations"], properties["IntelligentTieringConfigurations"], async (_id, cfg) => this.applyIntelligentTieringConfigurations(bucketName, [cfg], (m) => this.logger.warn(m)), async (id) => {
 			await this.s3Client.send(new DeleteBucketIntelligentTieringConfigurationCommand({
 				Bucket: bucketName,
 				Id: id
@@ -5930,7 +5939,7 @@ var S3BucketProvider = class S3BucketProvider {
 		const corsConfig = properties["CorsConfiguration"];
 		if (corsConfig?.CorsRules && Array.isArray(corsConfig.CorsRules) && corsConfig.CorsRules.length > 0) await this.applyCorsConfiguration(bucketName, corsConfig);
 		const lifecycleConfig = properties["LifecycleConfiguration"];
-		if (lifecycleConfig?.Rules && Array.isArray(lifecycleConfig.Rules) && lifecycleConfig.Rules.length > 0) await this.applyLifecycleConfiguration(bucketName, lifecycleConfig);
+		if (lifecycleConfig?.Rules && Array.isArray(lifecycleConfig.Rules) && lifecycleConfig.Rules.length > 0) await this.applyLifecycleConfiguration(bucketName, lifecycleConfig, replayOnUnusable);
 		const loggingConfig = properties["LoggingConfiguration"];
 		if (readConfigString(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") !== "") await this.applyLoggingConfiguration(bucketName, loggingConfig);
 		const websiteConfig = properties["WebsiteConfiguration"];
@@ -5938,11 +5947,11 @@ var S3BucketProvider = class S3BucketProvider {
 		const accelerateConfig = properties["AccelerateConfiguration"];
 		if (accelerateConfig) await this.applyAccelerateConfiguration(bucketName, accelerateConfig);
 		const metricsConfigs = properties["MetricsConfigurations"];
-		if (metricsConfigs && Array.isArray(metricsConfigs) && metricsConfigs.length > 0) await this.applyMetricsConfigurations(bucketName, metricsConfigs);
+		if (metricsConfigs && Array.isArray(metricsConfigs) && metricsConfigs.length > 0) await this.applyMetricsConfigurations(bucketName, metricsConfigs, replayOnUnusable);
 		const analyticsConfigs = properties["AnalyticsConfigurations"];
 		if (analyticsConfigs && Array.isArray(analyticsConfigs) && analyticsConfigs.length > 0) await this.applyAnalyticsConfigurations(bucketName, analyticsConfigs, replayOnUnusable);
 		const itConfigs = properties["IntelligentTieringConfigurations"];
-		if (itConfigs && Array.isArray(itConfigs) && itConfigs.length > 0) await this.applyIntelligentTieringConfigurations(bucketName, itConfigs);
+		if (itConfigs && Array.isArray(itConfigs) && itConfigs.length > 0) await this.applyIntelligentTieringConfigurations(bucketName, itConfigs, replayOnUnusable);
 		const inventoryConfigs = properties["InventoryConfigurations"];
 		if (inventoryConfigs && Array.isArray(inventoryConfigs) && inventoryConfigs.length > 0) await this.applyInventoryConfigurations(bucketName, inventoryConfigs, replayOnUnusable);
 		const replConfig = properties["ReplicationConfiguration"];
@@ -21772,7 +21781,11 @@ var ApiGatewayV2Provider = class {
 			"Description",
 			"Tags",
 			"StageVariables",
-			"DefaultRouteSettings"
+			"DefaultRouteSettings",
+			"AccessLogSettings",
+			"ClientCertificateId",
+			"DeploymentId",
+			"RouteSettings"
 		])],
 		["AWS::ApiGatewayV2::Integration", /* @__PURE__ */ new Set([
 			"ApiId",
@@ -21791,7 +21804,12 @@ var ApiGatewayV2Provider = class {
 			"AuthorizationType",
 			"AuthorizerId",
 			"AuthorizationScopes",
-			"OperationName"
+			"OperationName",
+			"ApiKeyRequired",
+			"ModelSelectionExpression",
+			"RequestModels",
+			"RequestParameters",
+			"RouteResponseSelectionExpression"
 		])],
 		["AWS::ApiGatewayV2::Authorizer", /* @__PURE__ */ new Set([
 			"ApiId",
@@ -21950,6 +21968,10 @@ var ApiGatewayV2Provider = class {
 				Description: properties["Description"],
 				StageVariables: properties["StageVariables"],
 				DefaultRouteSettings: properties["DefaultRouteSettings"],
+				AccessLogSettings: properties["AccessLogSettings"],
+				ClientCertificateId: properties["ClientCertificateId"],
+				DeploymentId: properties["DeploymentId"],
+				RouteSettings: properties["RouteSettings"],
 				Tags: this.cfnTagsToRecord(properties["Tags"])
 			}));
 			this.logger.debug(`Successfully created API Gateway V2 Stage ${logicalId}: ${stageName}`);
@@ -22047,7 +22069,12 @@ var ApiGatewayV2Provider = class {
 				AuthorizationType: properties["AuthorizationType"],
 				AuthorizerId: properties["AuthorizerId"],
 				AuthorizationScopes: properties["AuthorizationScopes"],
-				OperationName: properties["OperationName"]
+				OperationName: properties["OperationName"],
+				ApiKeyRequired: properties["ApiKeyRequired"],
+				ModelSelectionExpression: properties["ModelSelectionExpression"],
+				RequestModels: properties["RequestModels"],
+				RequestParameters: properties["RequestParameters"],
+				RouteResponseSelectionExpression: properties["RouteResponseSelectionExpression"]
 			}))).RouteId;
 			this.logger.debug(`Successfully created API Gateway V2 Route ${logicalId}: ${routeId}`);
 			return {
@@ -22187,6 +22214,10 @@ var ApiGatewayV2Provider = class {
 			result["Description"] = resp.Description ?? "";
 			if (resp.StageVariables !== void 0) result["StageVariables"] = resp.StageVariables;
 			if (resp.DefaultRouteSettings !== void 0) result["DefaultRouteSettings"] = resp.DefaultRouteSettings;
+			if (resp.AccessLogSettings !== void 0) result["AccessLogSettings"] = resp.AccessLogSettings;
+			if (resp.ClientCertificateId !== void 0) result["ClientCertificateId"] = resp.ClientCertificateId;
+			if (properties?.["DeploymentId"] !== void 0 && resp.DeploymentId !== void 0) result["DeploymentId"] = resp.DeploymentId;
+			if (resp.RouteSettings !== void 0) result["RouteSettings"] = resp.RouteSettings;
 			return result;
 		} catch (err) {
 			if (err instanceof NotFoundException$3) return void 0;
@@ -22232,6 +22263,11 @@ var ApiGatewayV2Provider = class {
 				result["AuthorizationScopes"] = resp.AuthorizationScopes ? [...resp.AuthorizationScopes] : [];
 			}
 			if (resp.OperationName !== void 0) result["OperationName"] = resp.OperationName;
+			result["ApiKeyRequired"] = resp.ApiKeyRequired ?? false;
+			if (resp.ModelSelectionExpression !== void 0) result["ModelSelectionExpression"] = resp.ModelSelectionExpression;
+			if (resp.RequestModels !== void 0) result["RequestModels"] = resp.RequestModels;
+			if (resp.RequestParameters !== void 0) result["RequestParameters"] = resp.RequestParameters;
+			if (resp.RouteResponseSelectionExpression !== void 0) result["RouteResponseSelectionExpression"] = resp.RouteResponseSelectionExpression;
 			return result;
 		} catch (err) {
 			if (err instanceof NotFoundException$3) return void 0;
@@ -22391,8 +22427,11 @@ var ApiGatewayV2Provider = class {
 	* `UpdateStage` keys on `(ApiId, StageName)` — `StageName` is the
 	* physicalId and immutable. Mutable fields cdkd manages:
 	* `AutoDeploy` / `Description` / `StageVariables` /
-	* `DefaultRouteSettings`. `ApiId` is also immutable (a stage cannot be
-	* moved between APIs).
+	* `DefaultRouteSettings` / `AccessLogSettings` / `ClientCertificateId` /
+	* `DeploymentId` / `RouteSettings`. `ApiId` is also immutable (a stage
+	* cannot be moved between APIs). `AccessLogSettings` and per-key
+	* `RouteSettings` can only be CLEARED through their dedicated delete APIs —
+	* see {@link applyStageRemovals}.
 	*/
 	async updateStage(logicalId, physicalId, resourceType, properties, previousProperties) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
@@ -22426,7 +22465,40 @@ var ApiGatewayV2Provider = class {
 			input.DefaultRouteSettings = properties["DefaultRouteSettings"];
 			changed = true;
 		}
+		if (properties["AccessLogSettings"] !== void 0 && !this.deepEqual(properties["AccessLogSettings"], previousProperties["AccessLogSettings"])) {
+			input.AccessLogSettings = properties["AccessLogSettings"];
+			changed = true;
+		}
+		const accessLogRemoved = properties["AccessLogSettings"] === void 0 && previousProperties["AccessLogSettings"] !== void 0;
+		if (properties["RouteSettings"] !== void 0 && !this.deepEqual(properties["RouteSettings"], previousProperties["RouteSettings"])) {
+			input.RouteSettings = properties["RouteSettings"];
+			changed = true;
+		}
+		const droppedRouteSettingKeys = this.droppedKeys(properties["RouteSettings"], previousProperties["RouteSettings"]);
+		{
+			const r = this.clearableUpdate(properties["ClientCertificateId"], previousProperties["ClientCertificateId"], "");
+			if (r.changed) {
+				input.ClientCertificateId = r.value;
+				changed = true;
+			}
+		}
+		if (properties["DeploymentId"] !== void 0 && properties["DeploymentId"] !== previousProperties["DeploymentId"]) {
+			input.DeploymentId = properties["DeploymentId"];
+			changed = true;
+		}
 		if (!changed) {
+			if (accessLogRemoved || droppedRouteSettingKeys.length > 0) {
+				try {
+					await this.applyStageRemovals(apiId, physicalId, accessLogRemoved, droppedRouteSettingKeys);
+				} catch (error) {
+					const cause = error instanceof Error ? error : void 0;
+					throw new ProvisioningError(`Failed to update API Gateway V2 Stage ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+				}
+				return {
+					physicalId,
+					wasReplaced: false
+				};
+			}
 			this.logger.debug(`No mutable Stage fields changed for ${logicalId}; skipping UpdateStage`);
 			return {
 				physicalId,
@@ -22436,6 +22508,7 @@ var ApiGatewayV2Provider = class {
 		this.logger.debug(`Updating API Gateway V2 Stage ${logicalId}: ${physicalId}`);
 		try {
 			await this.getClient().send(new UpdateStageCommand$1(input));
+			await this.applyStageRemovals(apiId, physicalId, accessLogRemoved, droppedRouteSettingKeys);
 			return {
 				physicalId,
 				wasReplaced: false
@@ -22516,7 +22589,9 @@ var ApiGatewayV2Provider = class {
 	/**
 	* `UpdateRoute` keys on `(ApiId, RouteId)`. Mutable fields cdkd
 	* manages: `RouteKey` / `Target` / `AuthorizationType` /
-	* `AuthorizerId` / `AuthorizationScopes` / `OperationName`.
+	* `AuthorizerId` / `AuthorizationScopes` / `OperationName` /
+	* `ApiKeyRequired` / `RequestModels` / `RequestParameters` /
+	* `ModelSelectionExpression` / `RouteResponseSelectionExpression`.
 	*/
 	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
@@ -22563,7 +22638,46 @@ var ApiGatewayV2Provider = class {
 				changed = true;
 			}
 		}
+		{
+			const r = this.clearableUpdate(properties["ApiKeyRequired"], previousProperties["ApiKeyRequired"], false);
+			if (r.changed) {
+				input.ApiKeyRequired = r.value;
+				changed = true;
+			}
+		}
+		{
+			const merged = this.mapWithRemovals(properties["RequestModels"], previousProperties["RequestModels"]);
+			if (merged !== void 0) {
+				input.RequestModels = merged;
+				changed = true;
+			}
+		}
+		if (properties["RequestParameters"] !== void 0 && !this.deepEqual(properties["RequestParameters"], previousProperties["RequestParameters"])) {
+			input.RequestParameters = properties["RequestParameters"];
+			changed = true;
+		}
+		const droppedRequestParameterKeys = this.droppedKeys(properties["RequestParameters"], previousProperties["RequestParameters"]);
+		if (properties["ModelSelectionExpression"] !== void 0 && properties["ModelSelectionExpression"] !== previousProperties["ModelSelectionExpression"]) {
+			input.ModelSelectionExpression = properties["ModelSelectionExpression"];
+			changed = true;
+		}
+		if (properties["RouteResponseSelectionExpression"] !== void 0 && properties["RouteResponseSelectionExpression"] !== previousProperties["RouteResponseSelectionExpression"]) {
+			input.RouteResponseSelectionExpression = properties["RouteResponseSelectionExpression"];
+			changed = true;
+		}
 		if (!changed) {
+			if (droppedRequestParameterKeys.length > 0) {
+				try {
+					await this.deleteRouteRequestParameters(apiId, physicalId, droppedRequestParameterKeys);
+				} catch (error) {
+					const cause = error instanceof Error ? error : void 0;
+					throw new ProvisioningError(`Failed to update API Gateway V2 Route ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+				}
+				return {
+					physicalId,
+					wasReplaced: false
+				};
+			}
 			this.logger.debug(`No mutable Route fields changed for ${logicalId}; skipping UpdateRoute`);
 			return {
 				physicalId,
@@ -22573,6 +22687,7 @@ var ApiGatewayV2Provider = class {
 		this.logger.debug(`Updating API Gateway V2 Route ${logicalId}: ${physicalId}`);
 		try {
 			await this.getClient().send(new UpdateRouteCommand(input));
+			await this.deleteRouteRequestParameters(apiId, physicalId, droppedRequestParameterKeys);
 			return {
 				physicalId,
 				wasReplaced: false
@@ -22713,16 +22828,85 @@ var ApiGatewayV2Provider = class {
 		};
 	}
 	/**
-	* Resolve a `Record<string, string>` update field (`StageVariables`,
-	* Integration `RequestParameters`) with per-key removal awareness.
+	* Keys present in `previous` but absent from `next` — the set a
+	* merge-semantics map silently keeps unless each is deleted BY NAME. A
+	* whole-block removal (`next` undefined) therefore yields every previous key.
+	*/
+	droppedKeys(next, previous) {
+		if (previous == null || typeof previous !== "object" || Array.isArray(previous)) return [];
+		const prevMap = previous;
+		const nextMap = next != null && typeof next === "object" && !Array.isArray(next) ? next : {};
+		return Object.keys(prevMap).filter((key) => !Object.prototype.hasOwnProperty.call(nextMap, key));
+	}
+	/**
+	* Send a delete that is idempotent by intent.
+	*
+	* These removal deletes run AFTER the merge-Update in the same update, so a
+	* partial failure (throttle on the second of two) leaves state unsaved and
+	* the next deploy recomputes the SAME dropped-key set and re-issues an
+	* already-applied delete. A console-side removal produces the same shape.
+	* Treating NotFound as success is what keeps that from becoming a permanent
+	* failure loop.
+	*/
+	async sendTolerantOfNotFound(send) {
+		try {
+			await send();
+		} catch (error) {
+			if (error instanceof NotFoundException$3) return;
+			throw error;
+		}
+	}
+	/**
+	* The two Stage members `UpdateStage` cannot clear.
+	*
+	* Both MERGE server-side — live-probed 2026-08-11: a stage keeps its
+	* `AccessLogSettings` verbatim through an `UpdateStage` that omits the
+	* member — so a removal that only omits the field is the silent no-op issue
+	* #1160 tracks (access logging, and its billing, keep running). AWS ships
+	* dedicated delete APIs for both; this mirrors the `DeleteCorsConfiguration`
+	* path on `::Api`.
+	*
+	* KNOWN BOUND: `DeleteRouteSettings` removes a whole ROUTE KEY, so dropping
+	* one member INSIDE a kept entry (`LoggingLevel` while `ThrottlingRateLimit`
+	* stays) still merges and survives — the #1225 sub-field class, one level
+	* below what this closes. Same for a partial `AccessLogSettings`.
+	*/
+	async applyStageRemovals(apiId, stageName, accessLogRemoved, droppedRouteSettingKeys) {
+		if (accessLogRemoved) await this.sendTolerantOfNotFound(() => this.getClient().send(new DeleteAccessLogSettingsCommand({
+			ApiId: apiId,
+			StageName: stageName
+		})));
+		for (const routeKey of droppedRouteSettingKeys) await this.sendTolerantOfNotFound(() => this.getClient().send(new DeleteRouteSettingsCommand({
+			ApiId: apiId,
+			StageName: stageName,
+			RouteKey: routeKey
+		})));
+	}
+	/**
+	* `RequestParameters` on a Route is an OBJECT-valued merge map, so a dropped
+	* key needs the per-key delete API (live-probed 2026-08-11:
+	* `DeleteRouteRequestParameter` clears exactly one parameter).
+	*/
+	async deleteRouteRequestParameters(apiId, routeId, droppedKeys) {
+		for (const key of droppedKeys) await this.sendTolerantOfNotFound(() => this.getClient().send(new DeleteRouteRequestParameterCommand({
+			ApiId: apiId,
+			RouteId: routeId,
+			RequestParameterKey: key
+		})));
+	}
+	/**
+	* Resolve a `Record<string, string>` update field (`StageVariables`, Route
+	* `RequestModels`, Integration `RequestParameters`) with per-key removal
+	* awareness.
 	*
 	* These maps also merge on the AWS side: sending `{}` (or a map missing
 	* a previously-present key) does NOT delete the dropped key — it is kept
-	* live. Live-probed 2026-07-22: a key is cleared only by sending it with
-	* an empty-string value. So the resolved map is `next` plus every key
-	* present in `previous` but absent from `next`, set to `''`. Whole-block
-	* removal (next `undefined`, previous populated) therefore sends every
-	* old key as `''`. Returns `undefined` when nothing changed.
+	* live. Live-probed 2026-07-22 (and again 2026-08-11 for `RequestModels`):
+	* a key is cleared only by sending it with an empty-string value. So the
+	* resolved map is `next` plus every key present in `previous` but absent
+	* from `next`, set to `''`. Whole-block removal (next `undefined`, previous
+	* populated) therefore sends every old key as `''`. Returns `undefined` when
+	* nothing changed.
 	*/
 	mapWithRemovals(next, previous) {
 		if (this.deepEqual(next, previous)) return void 0;
@@ -68365,7 +68549,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.2");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.4");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;