@go-to-k/cdkd 0.281.0 → 0.281.2

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-Bebl98bx.js";
+import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-drWGPyTA.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-BSx4Vrth.js";
+import { t as ASGProvider } from "./asg-provider-n21zWyH-.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -54,7 +54,7 @@ import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGrap
 import { parse, print } from "graphql";
 import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$11, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
@@ -10727,6 +10727,7 @@ var LambdaUrlProvider = class {
 		this.logger.debug(`Creating Lambda URL ${logicalId}`);
 		const targetFunctionArn = properties["TargetFunctionArn"];
 		if (!targetFunctionArn) throw new ProvisioningError(`TargetFunctionArn is required for Lambda URL ${logicalId}`, resourceType, logicalId);
+		if (context?.replayingState === true && properties["AuthType"] === void 0) this.logger.warn(`Lambda URL ${logicalId} is being restored from a cdkd state record that carries no AuthType, so cdkd cannot vouch for the auth type the URL had. Creating it with the default (NONE), which makes the function URL PUBLIC. Verify the URL's auth type after the rollback completes and set 'authType' explicitly in your CDK code if it should be AWS_IAM.`);
 		const authType = requireConfigString(properties["AuthType"], "NONE", "AWS::Lambda::Url AuthType", replayWarn(this.logger, context));
 		try {
 			const cors = properties["Cors"];
@@ -10776,6 +10777,12 @@ var LambdaUrlProvider = class {
 		} });
 		const previousAuthType = previousProperties["AuthType"];
 		const authType = authTypeUnusable ? typeof previousAuthType === "string" && previousAuthType.trim() !== "" ? previousAuthType : void 0 : requestedAuthType;
+		let effectiveProperties;
+		if (authTypeUnusable) {
+			effectiveProperties = { ...properties };
+			if (authType === void 0) delete effectiveProperties["AuthType"];
+			else effectiveProperties["AuthType"] = authType;
+		}
 		const updateParams = {
 			FunctionName: physicalId,
 			...authType !== void 0 && { AuthType: authType }
@@ -10796,7 +10803,8 @@ var LambdaUrlProvider = class {
 				attributes: {
 					FunctionUrl: response.FunctionUrl,
 					FunctionArn: response.FunctionArn
-				}
+				},
+				...effectiveProperties && { effectiveProperties }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -13621,12 +13629,18 @@ var DynamoDBGlobalTableProvider = class {
 		};
 		const diagnostics = [];
 		if (billingMode === "PROVISIONED") createParams.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion, "min", diagnostics);
+		let effectiveProperties;
 		const streamSpecInput = properties["StreamSpecification"];
 		const needsStream = replicas.some((r) => r["Region"] !== currentRegion) || replicas.length > 1;
 		if (streamSpecInput != null) {
 			let streamViewType;
+			let streamSpecSubstituted = false;
 			try {
-				streamViewType = readConfigString(streamSpecInput, "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification", replayWarn(this.logger, context));
+				const replayDowngrade = replayWarn(this.logger, context).onUnusable;
+				streamViewType = readConfigString(streamSpecInput, "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification", replayDowngrade ? { onUnusable: (message) => {
+					streamSpecSubstituted = true;
+					replayDowngrade(message);
+				} } : {});
 			} catch (error) {
 				throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 			}
@@ -13634,6 +13648,10 @@ var DynamoDBGlobalTableProvider = class {
 				StreamEnabled: true,
 				StreamViewType: streamViewType
 			};
+			if (streamSpecSubstituted) effectiveProperties = {
+				...properties,
+				StreamSpecification: { StreamViewType: streamViewType }
+			};
 		} else if (needsStream) {
 			this.logger.info(`Auto-enabling streams (NEW_AND_OLD_IMAGES) on ${logicalId} — required for cross-region replication`);
 			createParams.StreamSpecification = {
@@ -13720,7 +13738,8 @@ var DynamoDBGlobalTableProvider = class {
 					TableId: tableInfo.tableId,
 					StreamArn: tableInfo.streamArn,
 					TableName: tableName
-				}
+				},
+				...effectiveProperties && { effectiveProperties }
 			};
 		} catch (wiringError) {
 			this.logger.warn(`Wiring failed after CreateTable for ${tableName}; attempting best-effort cleanup`);
@@ -13844,6 +13863,7 @@ var DynamoDBGlobalTableProvider = class {
 		const removedButStillReferenced = oldAttrs.filter((o) => !newAttrs.some((n) => n.AttributeName === o.AttributeName)).filter((a) => a.AttributeName !== void 0 && desiredKeyAttrNames.has(a.AttributeName));
 		if (removedButStillReferenced.length > 0) throw new ProvisioningError(`AttributeDefinitions removals are immutable on AWS::DynamoDB::GlobalTable while a key schema still references them (offenders: ${removedButStillReferenced.map((a) => a.AttributeName).join(", ")}); replacement required`, resourceType, logicalId, physicalId);
 		const currentRegion = await this.dynamoDBClient.config.region() ?? "";
+		let effectiveProperties;
 		try {
 			await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
 			const describeResp = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
@@ -13914,7 +13934,7 @@ var DynamoDBGlobalTableProvider = class {
 				let streamSpecUnusable = false;
 				const streamViewType = readConfigString(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification", { onUnusable: (message) => {
 					streamSpecUnusable = true;
-					this.logger.warn(`${message} The table's existing stream configuration is left untouched for this update rather than re-pointed at the default.`);
+					this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${message} The table's existing stream configuration is left untouched for this update rather than re-pointed at the default.`);
 				} });
 				if (!streamSpecUnusable) {
 					flatUpdate.StreamSpecification = {
@@ -13922,6 +13942,12 @@ var DynamoDBGlobalTableProvider = class {
 						StreamViewType: streamViewType
 					};
 					flatChanged = true;
+				} else {
+					const previousStreamSpec = previousProperties["StreamSpecification"];
+					const previousStreamSpecUsable = previousStreamSpec !== void 0 && previousStreamSpec !== null && configStringRefusal(previousStreamSpec, "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification") === void 0;
+					effectiveProperties = { ...properties };
+					if (previousStreamSpecUsable) effectiveProperties["StreamSpecification"] = { ...previousStreamSpec };
+					else delete effectiveProperties["StreamSpecification"];
 				}
 			}
 			const awsOnDemand = describeResp.Table?.OnDemandThroughput;
@@ -14202,7 +14228,8 @@ var DynamoDBGlobalTableProvider = class {
 					TableId: finalDescribe.Table?.TableId,
 					StreamArn: finalDescribe.Table?.LatestStreamArn,
 					TableName: physicalId
-				}
+				},
+				...effectiveProperties && { effectiveProperties }
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -41074,6 +41101,134 @@ function isKmsEncryption(value) {
 	return value["EncryptionType"] === "KMS";
 }
 /**
+* The seven shard-level metrics `ALL` expands to.
+*
+* MEASURED, not copied from the docs (us-east-1, 2026-08-12): an
+* `EnableEnhancedMonitoring(ShardLevelMetrics: ['ALL'])` responds with exactly
+* these seven in `DesiredShardLevelMetrics`, and once the stream settles back
+* to ACTIVE `DescribeStream` reports the same seven — never the literal `ALL`.
+* The readback order is AWS-chosen and matched neither the input order nor
+* alphabetical, which is why the type also declares the path unordered (see
+* {@link KinesisStreamProvider.getDriftUnorderedPaths}).
+*/
+const ALL_SHARD_LEVEL_METRICS = [
+	"IncomingBytes",
+	"IncomingRecords",
+	"OutgoingBytes",
+	"OutgoingRecords",
+	"WriteProvisionedThroughputExceeded",
+	"ReadProvisionedThroughputExceeded",
+	"IteratorAgeMilliseconds"
+];
+/**
+* Whether a value is a usable shard-level-metrics list: an array whose every
+* element is a string.
+*
+* A MIXED array (`['IncomingBytes', {Ref: 'X'}]`) is deliberately UNUSABLE
+* rather than partially usable. Filtering the unresolved element away would put
+* a list on the wire that the template never declared, while state recorded the
+* declared one — the permanent phantom drift `effectiveProperties` exists to
+* prevent, arrived at through the back door.
+*/
+function isUsableMetricsList(value) {
+	return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+/**
+* Expand the `ALL` shard-level-metrics shorthand into the seven metric names
+* AWS actually stores.
+*
+* This is the ONE definition of the rule, shared by the provisioning path (what
+* goes on the wire, and therefore what `effectiveProperties` records) and by
+* {@link KinesisStreamProvider.canonicalizeDesiredProperties} (what the diff
+* compares). Deriving it twice is how state and template end up narrowed
+* differently — see the `effectiveProperties` contract in
+* `.claude/rules/providers.md`.
+*
+* Idempotent: an already-expanded list is returned with its own values (deduped
+* and otherwise untouched), so a state-borne bag that has been through this
+* before is unchanged. An UNUSABLE value is returned as-is — the callers that
+* put bytes on the wire refuse it via {@link readShardLevelMetrics} rather than
+* sending a partial list, and `canonicalizeDesiredProperties` must stay a total
+* function because the diff runs on bags no provider validated.
+*/
+function expandShardLevelMetrics(value) {
+	if (!isUsableMetricsList(value)) return value;
+	const names = value;
+	const expanded = names.includes("ALL") ? [...names.filter((n) => n !== "ALL"), ...ALL_SHARD_LEVEL_METRICS] : names;
+	const seen = /* @__PURE__ */ new Set();
+	const deduped = [];
+	for (const name of expanded) {
+		if (seen.has(name)) continue;
+		seen.add(name);
+		deduped.push(name);
+	}
+	if (deduped.length === names.length && deduped.every((n, i) => n === names[i])) return value;
+	return deduped;
+}
+/**
+* Classify a declared `DesiredShardLevelMetrics` value, expanding `ALL` when it
+* is usable.
+*
+* Callers own the ACTION per the update-path rules in
+* `.claude/rules/providers.md`: a create refuses an unusable value (it is
+* template-borne), an update WARNS and skips (it may be replaying a state
+* record, where refusing would leave the resource un-rollbackable). The
+* previous side is never routed through the refusal at all — see
+* {@link previousMetricNames}.
+*/
+function readShardLevelMetrics(value) {
+	if (value == null) return { kind: "absent" };
+	if (!isUsableMetricsList(value)) return {
+		kind: "unusable",
+		reason: `AWS::Kinesis::Stream DesiredShardLevelMetrics must be an array of metric-name strings, got ${JSON.stringify(value)}`
+	};
+	const expanded = expandShardLevelMetrics(value);
+	return {
+		kind: "usable",
+		metrics: expanded,
+		expanded
+	};
+}
+/**
+* Read the PREVIOUS side leniently: it comes from cdkd state, not the user's
+* template, so an unreadable value recorded by an older binary must never
+* refuse the update (the #1471 desired-side-only rule). An unusable previous
+* side simply contributes no metrics to disable.
+*/
+function previousMetricNames(value) {
+	const expanded = expandShardLevelMetrics(value);
+	return isUsableMetricsList(expanded) ? expanded : [];
+}
+function readMaxRecordSize(value) {
+	if (value == null) return { kind: "absent" };
+	if (typeof value === "number" && Number.isFinite(value)) return {
+		kind: "usable",
+		size: value
+	};
+	if (typeof value === "string" && value.trim() !== "") {
+		const n = Number(value);
+		if (Number.isFinite(n)) return {
+			kind: "usable",
+			size: n
+		};
+	}
+	return {
+		kind: "unusable",
+		reason: `AWS::Kinesis::Stream MaxRecordSizeInKiB must be a number, got ${JSON.stringify(value)}`
+	};
+}
+/**
+* The comparison-side read: the UPDATE path needs both sides reduced to the
+* same shape so a state record holding the number and a template holding the
+* numeric string do not read as a change and re-issue the call every deploy.
+* Unusable / absent both yield `undefined`, which the caller treats as "no
+* declared size" rather than refusing — the previous side is state-borne.
+*/
+function comparableRecordSize(value) {
+	const read = readMaxRecordSize(value);
+	return read.kind === "usable" ? read.size : void 0;
+}
+/**
 * AWS Kinesis Stream Provider
 *
 * Implements resource provisioning for AWS::Kinesis::Stream using the Kinesis SDK.
@@ -41091,7 +41246,9 @@ var KinesisStreamProvider = class {
 		"ShardCount",
 		"Tags",
 		"RetentionPeriodHours",
-		"StreamEncryption"
+		"StreamEncryption",
+		"DesiredShardLevelMetrics",
+		"MaxRecordSizeInKiB"
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new KinesisClient(this.providerRegion ? { region: this.providerRegion } : {});
@@ -41100,17 +41257,25 @@ var KinesisStreamProvider = class {
 	/**
 	* Create a Kinesis stream
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Kinesis stream ${logicalId}`);
 		const streamName = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
+		const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"]);
+		if (desiredRead.kind === "unusable") if (context?.replayingState === true) this.logger.warn(`${desiredRead.reason}. Replaying a state record, so the shard-level metrics are left unset on ${streamName} rather than refusing the restore`);
+		else throw new ProvisioningError(desiredRead.reason, resourceType, logicalId, streamName);
+		const maxRecordRead = readMaxRecordSize(properties["MaxRecordSizeInKiB"]);
+		if (maxRecordRead.kind === "unusable") if (context?.replayingState === true) this.logger.warn(`${maxRecordRead.reason}. Replaying a state record, so ${streamName} is created with AWS's default maximum record size rather than refusing the restore`);
+		else throw new ProvisioningError(maxRecordRead.reason, resourceType, logicalId, streamName);
 		try {
 			const streamModeDetails = properties["StreamModeDetails"];
 			const streamMode = readConfigString(streamModeDetails, "StreamMode", "PROVISIONED", "AWS::Kinesis::Stream StreamModeDetails");
 			const shardCount = streamMode === "PROVISIONED" ? Number(properties["ShardCount"] ?? 1) : void 0;
+			const maxRecordSizeInKiB = maxRecordRead.kind === "usable" ? maxRecordRead.size : void 0;
 			await this.getClient().send(new CreateStreamCommand({
 				StreamName: streamName,
 				...shardCount !== void 0 && { ShardCount: shardCount },
-				StreamModeDetails: { StreamMode: streamMode }
+				StreamModeDetails: { StreamMode: streamMode },
+				...maxRecordSizeInKiB !== void 0 && { MaxRecordSizeInKiB: maxRecordSizeInKiB }
 			}));
 			this.logger.debug(`CreateStream initiated for ${streamName}, waiting for ACTIVE status`);
 			const streamInfo = await this.waitForStreamActive(streamName);
@@ -41147,10 +41312,21 @@ var KinesisStreamProvider = class {
 				}));
 				await this.waitForStreamActive(streamName);
 			}
+			const desiredMetrics = desiredRead.kind === "usable" ? desiredRead.expanded : void 0;
+			const metricsToEnable = desiredRead.kind === "usable" ? desiredRead.metrics : [];
+			if (metricsToEnable.length > 0) {
+				this.logger.debug(`Enabling ${metricsToEnable.length} shard-level metric(s) on ${streamName}`);
+				await this.getClient().send(new EnableEnhancedMonitoringCommand({
+					StreamName: streamName,
+					ShardLevelMetrics: metricsToEnable
+				}));
+				await this.waitForStreamActive(streamName);
+			}
 			this.logger.debug(`Successfully created Kinesis stream ${logicalId}: ${streamName}`);
 			return {
 				physicalId: streamName,
-				attributes: { Arn: streamInfo.streamArn }
+				attributes: { Arn: streamInfo.streamArn },
+				...this.effectiveMetricsProperties(properties, desiredMetrics)
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -41236,10 +41412,49 @@ var KinesisStreamProvider = class {
 					await this.waitForStreamActive(physicalId);
 				}
 			}
+			const desiredSizeRead = readMaxRecordSize(properties["MaxRecordSizeInKiB"]);
+			if (desiredSizeRead.kind === "unusable") this.logger.warn(`${desiredSizeRead.reason}. Leaving the maximum record size on ${physicalId} unchanged; the same value is REFUSED on a template-path create`);
+			const newMaxRecordSize = comparableRecordSize(properties["MaxRecordSizeInKiB"]);
+			const oldMaxRecordSize = comparableRecordSize(previousProperties["MaxRecordSizeInKiB"]);
+			if (newMaxRecordSize !== void 0 && newMaxRecordSize !== oldMaxRecordSize) {
+				this.logger.debug(`Updating max record size for ${physicalId}: ${oldMaxRecordSize} -> ${newMaxRecordSize}`);
+				await this.getClient().send(new UpdateMaxRecordSizeCommand({
+					StreamARN: await this.resolveStreamArn(physicalId),
+					MaxRecordSizeInKiB: newMaxRecordSize
+				}));
+				await this.waitForStreamActive(physicalId);
+			}
+			const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"]);
+			let desiredMetrics;
+			if (desiredRead.kind === "unusable") this.logger.warn(`${desiredRead.reason}. Leaving the shard-level metrics on ${physicalId} unchanged rather than disabling the live ones; the same value is REFUSED on a template-path create`);
+			else {
+				desiredMetrics = desiredRead.kind === "usable" ? desiredRead.expanded : void 0;
+				const desiredSet = desiredRead.kind === "usable" ? desiredRead.metrics : [];
+				const previousSet = previousMetricNames(previousProperties["DesiredShardLevelMetrics"]);
+				const toDisable = previousSet.filter((m) => !desiredSet.includes(m));
+				const toEnable = desiredSet.filter((m) => !previousSet.includes(m));
+				if (toDisable.length > 0) {
+					this.logger.debug(`Disabling ${toDisable.length} shard-level metric(s) on ${physicalId}`);
+					await this.getClient().send(new DisableEnhancedMonitoringCommand({
+						StreamName: physicalId,
+						ShardLevelMetrics: toDisable
+					}));
+					await this.waitForStreamActive(physicalId);
+				}
+				if (toEnable.length > 0) {
+					this.logger.debug(`Enabling ${toEnable.length} shard-level metric(s) on ${physicalId}`);
+					await this.getClient().send(new EnableEnhancedMonitoringCommand({
+						StreamName: physicalId,
+						ShardLevelMetrics: toEnable
+					}));
+					await this.waitForStreamActive(physicalId);
+				}
+			}
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: { Arn: (await this.getClient().send(new DescribeStreamCommand({ StreamName: physicalId }))).StreamDescription?.StreamARN }
+				attributes: { Arn: (await this.getClient().send(new DescribeStreamCommand({ StreamName: physicalId }))).StreamDescription?.StreamARN },
+				...this.effectiveMetricsProperties(properties, desiredMetrics)
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -41268,6 +41483,52 @@ var KinesisStreamProvider = class {
 		}
 	}
 	/**
+	* The `effectiveProperties` half of the `ALL` expansion (issue #609).
+	*
+	* Returns a spreadable `{ effectiveProperties }` ONLY when the expansion
+	* actually rewrote the declared value; otherwise `{}`, so the engine records
+	* the desired bag verbatim (the `??` gate on the engine side treats an absent
+	* field as "record the desired properties"). The returned bag is a COMPLETE
+	* replacement, not a patch, per the `EffectivePropertiesResult` contract.
+	*/
+	effectiveMetricsProperties(properties, expanded) {
+		if (expanded === void 0) return {};
+		if (expanded === properties["DesiredShardLevelMetrics"]) return {};
+		return { effectiveProperties: {
+			...properties,
+			DesiredShardLevelMetrics: expanded
+		} };
+	}
+	/**
+	* Narrow the desired bag the same way the provisioning path does, so the
+	* diff compares the EXPANDED metric list on both sides.
+	*
+	* Required paired half of the `effectiveProperties` above: without it, state
+	* holds the seven expanded names while the template still says `ALL`, and
+	* every later `cdkd deploy` / `cdkd diff` reads that as a user-made change.
+	* Shares {@link expandShardLevelMetrics} rather than re-deriving the rule.
+	*/
+	canonicalizeDesiredProperties(resourceType, properties) {
+		if (resourceType !== "AWS::Kinesis::Stream") return properties;
+		if (!("DesiredShardLevelMetrics" in properties)) return properties;
+		const expanded = expandShardLevelMetrics(properties["DesiredShardLevelMetrics"]);
+		if (expanded === properties["DesiredShardLevelMetrics"]) return properties;
+		return {
+			...properties,
+			DesiredShardLevelMetrics: expanded
+		};
+	}
+	/**
+	* `DesiredShardLevelMetrics` is a SET: AWS returns it in an order that
+	* matched neither the request order nor alphabetical when measured
+	* (us-east-1, 2026-08-12), so comparing positionally would report drift on a
+	* stream nobody touched.
+	*/
+	getDriftUnorderedPaths(resourceType) {
+		if (resourceType !== "AWS::Kinesis::Stream") return [];
+		return ["DesiredShardLevelMetrics"];
+	}
+	/**
 	* Apply a diff between old and new CFn-shape Tags arrays via Kinesis's
 	* `AddTagsToStream` (map shape) / `RemoveTagsFromStream` (TagKeys list)
 	* APIs.
@@ -41311,8 +41572,10 @@ var KinesisStreamProvider = class {
 	*
 	* Issues `DescribeStream` and surfaces the keys cdkd's `create()`
 	* accepts: `Name`, `StreamModeDetails`, `ShardCount`, `RetentionPeriodHours`,
-	* and `StreamEncryption`. Tags are surfaced via a follow-up
-	* `ListTagsForStream` with `aws:*` filtered out.
+	* `StreamEncryption`, and `DesiredShardLevelMetrics`. Tags are surfaced via a
+	* follow-up `ListTagsForStream` with `aws:*` filtered out, and
+	* `MaxRecordSizeInKiB` via a follow-up `DescribeStreamSummary` (the field is
+	* absent from `DescribeStream`'s `StreamDescription` shape).
 	*
 	* `ShardCount` is reported as the count of `Shards[]` in the stream
 	* description (only present for PROVISIONED-mode streams; ON_DEMAND
@@ -41348,6 +41611,14 @@ var KinesisStreamProvider = class {
 			if (stream.KeyId !== void 0) encryption["KeyId"] = stream.KeyId;
 			result["StreamEncryption"] = encryption;
 		}
+		result["DesiredShardLevelMetrics"] = (stream.EnhancedMonitoring ?? []).flatMap((entry) => entry.ShardLevelMetrics ?? []);
+		try {
+			const maxRecordSize = (await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }))).StreamDescriptionSummary?.MaxRecordSizeInKiB;
+			if (maxRecordSize !== void 0) result["MaxRecordSizeInKiB"] = maxRecordSize;
+		} catch (err) {
+			if (err instanceof ResourceNotFoundException$10) return void 0;
+			throw err;
+		}
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForStreamCommand({ StreamName: physicalId }))).Tags);
 		} catch (err) {
@@ -72349,7 +72620,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.2");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;