@go-to-k/cdkd 0.280.22 → 0.280.24

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-DObU-2va.js";
+import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-60FIug-P.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-DVoWhe5E.js";
+import { t as ASGProvider } from "./asg-provider-Dpx4B6UA.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4984,7 +4984,14 @@ var S3BucketProvider = class S3BucketProvider {
 	/**
 	* Apply versioning configuration if specified
 	*/
-	async applyVersioning(bucketName, versioningConfig) {
+	async applyVersioning(bucketName, versioningConfig, onUnusable) {
+		if (onUnusable) {
+			const refusal = configStringRefusal(versioningConfig, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration");
+			if (refusal !== void 0) {
+				onUnusable(`${refusal}. No PutBucketVersioning is issued rather than applying the Suspended default, which would turn object versioning OFF on an existing bucket (on a replayed create it means the bucket is left unversioned); the same value is REFUSED on a template-path create`);
+				return;
+			}
+		}
 		const status = readConfigString(versioningConfig, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration");
 		await this.s3Client.send(new PutBucketVersioningCommand({
 			Bucket: bucketName,
@@ -5262,7 +5269,14 @@ var S3BucketProvider = class S3BucketProvider {
 	*   - LogFilePrefix -> SDK TargetPrefix
 	* SDK: PutBucketLogging with BucketLoggingStatus.LoggingEnabled
 	*/
-	async applyLoggingConfiguration(bucketName, loggingConfig) {
+	async applyLoggingConfiguration(bucketName, loggingConfig, onUnusable) {
+		if (onUnusable) {
+			const refusal = configStringRefusal(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") ?? configStringRefusal(loggingConfig, "LogFilePrefix", "", "AWS::S3::Bucket LoggingConfiguration");
+			if (refusal !== void 0) {
+				onUnusable(`${refusal}. No PutBucketLogging is issued rather than clearing access logging, which would turn it OFF on an existing bucket (on a replayed create it means the bucket comes up with no access logging); the same value is REFUSED on a template-path create`);
+				return;
+			}
+		}
 		const destinationBucket = readConfigString(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration");
 		if (!loggingConfig || destinationBucket === "") {
 			await this.s3Client.send(new PutBucketLoggingCommand({
@@ -5589,11 +5603,20 @@ var S3BucketProvider = class S3BucketProvider {
 			const s3Dest = this.resolveS3BucketDestination(rawDest, inventoryDestPath, onUnusable);
 			if (s3Dest === void 0 && rawDest != null) continue;
 			const destPath = s3BucketDestinationPath(rawDest, inventoryDestPath);
+			const scheduleFrequencyRefusal = onUnusable ? configStringRefusal(config, "ScheduleFrequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[]") : void 0;
+			if (scheduleFrequencyRefusal !== void 0 && config["Schedule"] == null) {
+				onUnusable?.(`${scheduleFrequencyRefusal}. Skipping this inventory configuration: there is no Schedule.Frequency to fall back to, and defaulting to Weekly would silently re-cadence a live inventory report; the same value is REFUSED on a template-path create`);
+				continue;
+			}
+			if (scheduleFrequencyRefusal !== void 0) onUnusable?.(`${scheduleFrequencyRefusal}. Falling back to Schedule.Frequency; the same value is REFUSED on a template-path create`);
+			const useScheduleFrequency = config["ScheduleFrequency"] !== void 0 && scheduleFrequencyRefusal === void 0;
+			if (!useScheduleFrequency && this.skipOnUnusableConfigString(config["Schedule"], "Frequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[].Schedule", "Skipping this inventory configuration", onUnusable)) continue;
+			const frequency = useScheduleFrequency ? requireConfigString(config["ScheduleFrequency"], "Weekly", "AWS::S3::Bucket InventoryConfigurations[].ScheduleFrequency") : readConfigString(config["Schedule"], "Frequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[].Schedule");
 			const inventoryConfig = {
 				Id: id,
 				IsEnabled: config["Enabled"] ?? true,
 				IncludedObjectVersions: readConfigString(config, "IncludedObjectVersions", "All", "AWS::S3::Bucket InventoryConfigurations[]"),
-				Schedule: { Frequency: config["ScheduleFrequency"] !== void 0 ? requireConfigString(config["ScheduleFrequency"], "Weekly", "AWS::S3::Bucket InventoryConfigurations[].ScheduleFrequency") : readConfigString(config["Schedule"], "Frequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[].Schedule") },
+				Schedule: { Frequency: frequency },
 				Destination: { S3BucketDestination: s3Dest ? {
 					Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
 					AccountId: s3Dest["BucketAccountId"],
@@ -5762,9 +5785,10 @@ var S3BucketProvider = class S3BucketProvider {
 	* in both places would double-PUT.
 	*/
 	async applyConfiguration(bucketName, properties, options = {}) {
-		const { skipTags = false, skipDiffManaged = false } = options;
+		const { skipTags = false, skipDiffManaged = false, context } = options;
+		const replayOnUnusable = replayWarn(this.logger, context).onUnusable;
 		const versioningConfig = properties["VersioningConfiguration"];
-		if (!skipDiffManaged && versioningConfig != null) await this.applyVersioning(bucketName, versioningConfig);
+		if (!skipDiffManaged && versioningConfig != null) await this.applyVersioning(bucketName, versioningConfig, replayOnUnusable);
 		const tags = properties["Tags"];
 		if (!skipTags && tags && Array.isArray(tags) && tags.length > 0) await this.applyTags(bucketName, tags);
 		const ownershipControls = properties["OwnershipControls"];
@@ -5897,8 +5921,10 @@ var S3BucketProvider = class S3BucketProvider {
 		const previousVersioning = previousProperties["VersioningConfiguration"];
 		const nextVersioning = properties["VersioningConfiguration"];
 		const versioningChanged = JSON.stringify(previousVersioning ?? null) !== JSON.stringify(nextVersioning ?? null);
-		const desiredVersioningStatus = readConfigString(nextVersioning, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration");
-		if (versioningChanged && nextVersioning != null && desiredVersioningStatus !== "Suspended") await this.applyVersioning(bucketName, nextVersioning);
+		const versioningRefusal = configStringRefusal(nextVersioning, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration");
+		if (versioningRefusal !== void 0 && versioningChanged) this.logger.warn(`Bucket ${bucketName}: ${versioningRefusal}. Leaving the bucket's LIVE versioning state unchanged — neither enabling nor suspending it; the same value is REFUSED on a template-path create`);
+		const desiredVersioningStatus = versioningRefusal === void 0 ? readConfigString(nextVersioning, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration") : void 0;
+		if (versioningRefusal === void 0 && versioningChanged && nextVersioning != null && desiredVersioningStatus !== "Suspended") await this.applyVersioning(bucketName, nextVersioning, (m) => this.logger.warn(m));
 		await this.diffSubConfig(bucketName, S3BucketProvider.emptyListConfigToUndefined(previousProperties["OwnershipControls"], "Rules"), S3BucketProvider.emptyListConfigToUndefined(properties["OwnershipControls"], "Rules"), async (cfg) => this.applyOwnershipControls(bucketName, cfg), async () => {
 			await this.s3Client.send(new DeleteBucketOwnershipControlsCommand({ Bucket: bucketName }));
 			this.logger.debug(`Deleted ownership controls on bucket ${bucketName}`);
@@ -5925,7 +5951,7 @@ var S3BucketProvider = class S3BucketProvider {
 			await this.s3Client.send(new DeleteBucketWebsiteCommand({ Bucket: bucketName }));
 			this.logger.debug(`Deleted website configuration on bucket ${bucketName}`);
 		});
-		await this.diffSubConfig(bucketName, previousProperties["LoggingConfiguration"], properties["LoggingConfiguration"], async (cfg) => this.applyLoggingConfiguration(bucketName, cfg), async () => this.applyLoggingConfiguration(bucketName, void 0));
+		await this.diffSubConfig(bucketName, previousProperties["LoggingConfiguration"], properties["LoggingConfiguration"], async (cfg) => this.applyLoggingConfiguration(bucketName, cfg, (m) => this.logger.warn(m)), async () => this.applyLoggingConfiguration(bucketName, void 0));
 		await this.diffSubConfig(bucketName, previousProperties["NotificationConfiguration"], properties["NotificationConfiguration"], async (cfg) => this.applyNotificationConfiguration(bucketName, cfg), async () => this.applyNotificationConfiguration(bucketName, void 0));
 		await this.diffSubConfig(bucketName, previousProperties["ReplicationConfiguration"], properties["ReplicationConfiguration"], async (cfg) => this.applyReplicationConfiguration(bucketName, cfg, (m) => this.logger.warn(m)), async () => {
 			await this.s3Client.send(new DeleteBucketReplicationCommand({ Bucket: bucketName }));
@@ -5989,7 +6015,9 @@ var S3BucketProvider = class S3BucketProvider {
 		const lifecycleConfig = properties["LifecycleConfiguration"];
 		if (lifecycleConfig?.Rules && Array.isArray(lifecycleConfig.Rules) && lifecycleConfig.Rules.length > 0) await this.applyLifecycleConfiguration(bucketName, lifecycleConfig, replayOnUnusable);
 		const loggingConfig = properties["LoggingConfiguration"];
-		if (readConfigString(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") !== "") await this.applyLoggingConfiguration(bucketName, loggingConfig);
+		const loggingRefusal = replayOnUnusable ? configStringRefusal(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") : void 0;
+		if (loggingRefusal !== void 0) replayOnUnusable?.(`${loggingRefusal}. Skipping the logging configuration; the same value is REFUSED on a template-path create`);
+		else if (readConfigString(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") !== "") await this.applyLoggingConfiguration(bucketName, loggingConfig, replayOnUnusable);
 		const websiteConfig = properties["WebsiteConfiguration"];
 		if (websiteConfig) await this.applyWebsiteConfiguration(bucketName, websiteConfig);
 		const accelerateConfig = properties["AccelerateConfiguration"];
@@ -6032,7 +6060,7 @@ var S3BucketProvider = class S3BucketProvider {
 				else throw createError;
 			}
 			try {
-				await this.applyConfiguration(bucketName, properties);
+				await this.applyConfiguration(bucketName, properties, { ...context ? { context } : {} });
 				await this.applyAllSubConfigsForCreate(bucketName, properties, context);
 			} catch (innerError) {
 				if (createdNewBucket) try {
@@ -17921,6 +17949,47 @@ var EventBridgeBusProvider = class {
 //#endregion
 //#region src/provisioning/providers/ec2-provider.ts
 /**
+* The `AWS::EC2::Route` destination keys, in CloudFormation's own precedence
+* order — which is also the order `createRoute`'s
+* `DestinationCidrBlock || DestinationIpv6CidrBlock || DestinationPrefixListId`
+* chain resolves them.
+*/
+const ROUTE_DESTINATION_KEYS = [
+	"DestinationCidrBlock",
+	"DestinationIpv6CidrBlock",
+	"DestinationPrefixListId"
+];
+/**
+* Split a Route property bag into the destination keys it DECLARES and the bag
+* carrying only the one that would actually be sent (issue #1591).
+*
+* ONE source for a decision two very different call sites have to agree on: the
+* provisioning path (`createRoute`, which narrows and warns) and the DIFF path
+* (the engine's canonicalizer, which must not report the losers as a change).
+* If those two disagreed the fix would be worse than the bug — state and
+* template would each be narrowed to a different key.
+*
+* The winner is simply `declared[0]`. That is not a shortcut: the list is built
+* in the same order and with the same truthiness predicate as the `||` chain,
+* so the first declared key IS what the chain resolves to. The predicate is
+* `Boolean`, not a hand-listed `undefined | null | ''` set, because the bag is
+* `unknown`-valued at runtime — an unquoted YAML `0` must be skipped by the
+* narrowing exactly as the chain skips it, or the two disagree on which key
+* was sent.
+*
+* `narrowed` is always a fresh object: the caller's bag is the engine's
+* `resolvedProps`, which it records for every resource that does NOT narrow.
+*/
+function narrowRouteDestinations(properties) {
+	const declared = ROUTE_DESTINATION_KEYS.filter((key) => Boolean(properties[key]));
+	const narrowed = { ...properties };
+	for (const losingKey of declared.slice(1)) delete narrowed[losingKey];
+	return {
+		declared,
+		narrowed
+	};
+}
+/**
 * AWS EC2 Networking Provider
 *
 * Implements resource provisioning for EC2 networking resources:
@@ -18768,15 +18837,15 @@ var EC2Provider = class {
 		const destinationPrefixListId = properties["DestinationPrefixListId"];
 		const destination = destinationCidrBlock || destinationIpv6CidrBlock || destinationPrefixListId;
 		if (!routeTableId || !destination) throw new ProvisioningError(`RouteTableId and one of DestinationCidrBlock/DestinationIpv6CidrBlock/DestinationPrefixListId are required for Route ${logicalId}`, resourceType, logicalId);
-		const declaredDestinations = [
-			["DestinationCidrBlock", destinationCidrBlock],
-			["DestinationIpv6CidrBlock", destinationIpv6CidrBlock],
-			["DestinationPrefixListId", destinationPrefixListId]
-		].filter(([, value]) => Boolean(value)).map(([key]) => key);
+		const { declared: declaredDestinations, narrowed: narrowedProperties } = narrowRouteDestinations(properties);
+		let effectiveProperties;
 		if (declaredDestinations.length > 1) {
 			const message = `Route ${logicalId} declares more than one destination (${declaredDestinations.join(", ")}). CloudFormation and EC2 accept exactly one of DestinationCidrBlock/DestinationIpv6CidrBlock/DestinationPrefixListId; remove the extra keys from the template.`;
-			if (onMultipleDestinations) onMultipleDestinations(`${message} Continuing with ${destination === destinationCidrBlock ? "DestinationCidrBlock" : destination === destinationIpv6CidrBlock ? "DestinationIpv6CidrBlock" : "DestinationPrefixListId"} and ignoring the rest.`);
-			else throw new ProvisioningError(message, resourceType, logicalId);
+			if (onMultipleDestinations) {
+				const usedKey = declaredDestinations[0];
+				effectiveProperties = narrowedProperties;
+				onMultipleDestinations(`${message} Continuing with ${usedKey} and ignoring the rest.`);
+			} else throw new ProvisioningError(message, resourceType, logicalId);
 		}
 		try {
 			await this.ec2Client.send(new CreateRouteCommand({
@@ -18798,7 +18867,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully created Route ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
-				attributes: {}
+				attributes: {},
+				...effectiveProperties && { effectiveProperties }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -18817,7 +18887,8 @@ var EC2Provider = class {
 			return {
 				physicalId: createResult.physicalId,
 				wasReplaced: true,
-				...createResult.attributes && { attributes: createResult.attributes }
+				...createResult.attributes && { attributes: createResult.attributes },
+				...createResult.effectiveProperties && { effectiveProperties: createResult.effectiveProperties }
 			};
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
@@ -20221,6 +20292,26 @@ var EC2Provider = class {
 			default: return [];
 		}
 	}
+	/**
+	* The diff-side half of the Route multi-destination narrowing (issue #1591).
+	*
+	* `createRoute` sends exactly one destination key and reports the narrowed
+	* bag via `effectiveProperties`, so state carries one key. Without the same
+	* narrowing here the template's extra keys read as an ADDED property on the
+	* next deploy — and every destination key is create-only in the registry
+	* schema, so the diff would classify a REPLACEMENT and the engine's
+	* replacement create (which passes no context, and so gets no
+	* `onMultipleDestinations` downgrade) would hit the #1566 refusal. A
+	* previously-green no-op deploy would start failing.
+	*
+	* Shares `narrowRouteDestinations` with the provisioning path so the two
+	* cannot disagree about which key survives.
+	*/
+	canonicalizeDesiredProperties(resourceType, properties) {
+		if (resourceType !== "AWS::EC2::Route") return properties;
+		const { declared, narrowed } = narrowRouteDestinations(properties);
+		return declared.length > 1 ? narrowed : properties;
+	}
 	async readVpcCurrentState(physicalId) {
 		const vpc = (await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0];
 		if (!vpc) return void 0;
@@ -51246,7 +51337,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 * Pure with respect to AWS state mutation — only reads state (the resolver
 * may read producer state for `Fn::ImportValue` / `Fn::GetStackOutput`).
 */
-async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, parameters) {
+async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties) {
 	const intrinsicResolver = new IntrinsicFunctionResolver(region);
 	let mergedParameters = parameters;
 	let parametersBound = false;
@@ -51286,7 +51377,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		...mergedParameters && { parameters: mergedParameters },
 		...conditions && { conditions }
 	});
-	return diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn);
+	return diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn, canonicalizeProperties);
 }
 /**
 * Resolve a nested-stack child's input `Parameters` (declared on the parent's
@@ -51347,13 +51438,13 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 * fail at deploy time.
 */
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parameters, assetRedirect } = args;
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parameters, canonicalizeProperties, assetRedirect } = args;
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
 	const node = {
 		stackName,
 		displayName,
 		region,
-		changes: await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, parameters),
+		changes: await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties),
 		ccApiRoutes: collectCcApiRoutes(template, state),
 		children: []
 	};
@@ -51379,6 +51470,7 @@ async function buildDiffTree(args) {
 			stateBackend,
 			diffCalculator,
 			parameters: childParameters,
+			...canonicalizeProperties && { canonicalizeProperties },
 			...assetRedirect && { assetRedirect }
 		}));
 	}
@@ -51736,6 +51828,9 @@ async function diffCommand(stacks, options) {
 			...options.profile && { profile: options.profile }
 		});
 		const diffCalculator = new DiffCalculator();
+		const diffProviderRegistry = new ProviderRegistry();
+		registerAllProviders(diffProviderRegistry);
+		const canonicalizeProperties = makeCanonicalizePropertiesFn(diffProviderRegistry);
 		const recursive = options.recursive ?? false;
 		const resolveAssetRedirect = createAssetRedirectResolver({
 			stateBackend,
@@ -51762,6 +51857,7 @@ async function diffCommand(stacks, options) {
 				recursive,
 				stateBackend,
 				diffCalculator,
+				canonicalizeProperties,
 				...assetRedirect && { assetRedirect }
 			}));
 		}
@@ -70245,7 +70341,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.22");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.24");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;