@go-to-k/cdkd 0.281.1 → 0.281.2

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-CGL3Vw1P.js";
+import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-drWGPyTA.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DYdmsCfd.js";
+import { t as ASGProvider } from "./asg-provider-n21zWyH-.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -54,7 +54,7 @@ import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGrap
 import { parse, print } from "graphql";
 import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$11, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
@@ -41101,6 +41101,134 @@ function isKmsEncryption(value) {
 	return value["EncryptionType"] === "KMS";
 }
 /**
+* The seven shard-level metrics `ALL` expands to.
+*
+* MEASURED, not copied from the docs (us-east-1, 2026-08-12): an
+* `EnableEnhancedMonitoring(ShardLevelMetrics: ['ALL'])` responds with exactly
+* these seven in `DesiredShardLevelMetrics`, and once the stream settles back
+* to ACTIVE `DescribeStream` reports the same seven — never the literal `ALL`.
+* The readback order is AWS-chosen and matched neither the input order nor
+* alphabetical, which is why the type also declares the path unordered (see
+* {@link KinesisStreamProvider.getDriftUnorderedPaths}).
+*/
+const ALL_SHARD_LEVEL_METRICS = [
+	"IncomingBytes",
+	"IncomingRecords",
+	"OutgoingBytes",
+	"OutgoingRecords",
+	"WriteProvisionedThroughputExceeded",
+	"ReadProvisionedThroughputExceeded",
+	"IteratorAgeMilliseconds"
+];
+/**
+* Whether a value is a usable shard-level-metrics list: an array whose every
+* element is a string.
+*
+* A MIXED array (`['IncomingBytes', {Ref: 'X'}]`) is deliberately UNUSABLE
+* rather than partially usable. Filtering the unresolved element away would put
+* a list on the wire that the template never declared, while state recorded the
+* declared one — the permanent phantom drift `effectiveProperties` exists to
+* prevent, arrived at through the back door.
+*/
+function isUsableMetricsList(value) {
+	return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+/**
+* Expand the `ALL` shard-level-metrics shorthand into the seven metric names
+* AWS actually stores.
+*
+* This is the ONE definition of the rule, shared by the provisioning path (what
+* goes on the wire, and therefore what `effectiveProperties` records) and by
+* {@link KinesisStreamProvider.canonicalizeDesiredProperties} (what the diff
+* compares). Deriving it twice is how state and template end up narrowed
+* differently — see the `effectiveProperties` contract in
+* `.claude/rules/providers.md`.
+*
+* Idempotent: an already-expanded list is returned with its own values (deduped
+* and otherwise untouched), so a state-borne bag that has been through this
+* before is unchanged. An UNUSABLE value is returned as-is — the callers that
+* put bytes on the wire refuse it via {@link readShardLevelMetrics} rather than
+* sending a partial list, and `canonicalizeDesiredProperties` must stay a total
+* function because the diff runs on bags no provider validated.
+*/
+function expandShardLevelMetrics(value) {
+	if (!isUsableMetricsList(value)) return value;
+	const names = value;
+	const expanded = names.includes("ALL") ? [...names.filter((n) => n !== "ALL"), ...ALL_SHARD_LEVEL_METRICS] : names;
+	const seen = /* @__PURE__ */ new Set();
+	const deduped = [];
+	for (const name of expanded) {
+		if (seen.has(name)) continue;
+		seen.add(name);
+		deduped.push(name);
+	}
+	if (deduped.length === names.length && deduped.every((n, i) => n === names[i])) return value;
+	return deduped;
+}
+/**
+* Classify a declared `DesiredShardLevelMetrics` value, expanding `ALL` when it
+* is usable.
+*
+* Callers own the ACTION per the update-path rules in
+* `.claude/rules/providers.md`: a create refuses an unusable value (it is
+* template-borne), an update WARNS and skips (it may be replaying a state
+* record, where refusing would leave the resource un-rollbackable). The
+* previous side is never routed through the refusal at all — see
+* {@link previousMetricNames}.
+*/
+function readShardLevelMetrics(value) {
+	if (value == null) return { kind: "absent" };
+	if (!isUsableMetricsList(value)) return {
+		kind: "unusable",
+		reason: `AWS::Kinesis::Stream DesiredShardLevelMetrics must be an array of metric-name strings, got ${JSON.stringify(value)}`
+	};
+	const expanded = expandShardLevelMetrics(value);
+	return {
+		kind: "usable",
+		metrics: expanded,
+		expanded
+	};
+}
+/**
+* Read the PREVIOUS side leniently: it comes from cdkd state, not the user's
+* template, so an unreadable value recorded by an older binary must never
+* refuse the update (the #1471 desired-side-only rule). An unusable previous
+* side simply contributes no metrics to disable.
+*/
+function previousMetricNames(value) {
+	const expanded = expandShardLevelMetrics(value);
+	return isUsableMetricsList(expanded) ? expanded : [];
+}
+function readMaxRecordSize(value) {
+	if (value == null) return { kind: "absent" };
+	if (typeof value === "number" && Number.isFinite(value)) return {
+		kind: "usable",
+		size: value
+	};
+	if (typeof value === "string" && value.trim() !== "") {
+		const n = Number(value);
+		if (Number.isFinite(n)) return {
+			kind: "usable",
+			size: n
+		};
+	}
+	return {
+		kind: "unusable",
+		reason: `AWS::Kinesis::Stream MaxRecordSizeInKiB must be a number, got ${JSON.stringify(value)}`
+	};
+}
+/**
+* The comparison-side read: the UPDATE path needs both sides reduced to the
+* same shape so a state record holding the number and a template holding the
+* numeric string do not read as a change and re-issue the call every deploy.
+* Unusable / absent both yield `undefined`, which the caller treats as "no
+* declared size" rather than refusing — the previous side is state-borne.
+*/
+function comparableRecordSize(value) {
+	const read = readMaxRecordSize(value);
+	return read.kind === "usable" ? read.size : void 0;
+}
+/**
 * AWS Kinesis Stream Provider
 *
 * Implements resource provisioning for AWS::Kinesis::Stream using the Kinesis SDK.
@@ -41118,7 +41246,9 @@ var KinesisStreamProvider = class {
 		"ShardCount",
 		"Tags",
 		"RetentionPeriodHours",
-		"StreamEncryption"
+		"StreamEncryption",
+		"DesiredShardLevelMetrics",
+		"MaxRecordSizeInKiB"
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new KinesisClient(this.providerRegion ? { region: this.providerRegion } : {});
@@ -41127,17 +41257,25 @@ var KinesisStreamProvider = class {
 	/**
 	* Create a Kinesis stream
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Kinesis stream ${logicalId}`);
 		const streamName = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
+		const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"]);
+		if (desiredRead.kind === "unusable") if (context?.replayingState === true) this.logger.warn(`${desiredRead.reason}. Replaying a state record, so the shard-level metrics are left unset on ${streamName} rather than refusing the restore`);
+		else throw new ProvisioningError(desiredRead.reason, resourceType, logicalId, streamName);
+		const maxRecordRead = readMaxRecordSize(properties["MaxRecordSizeInKiB"]);
+		if (maxRecordRead.kind === "unusable") if (context?.replayingState === true) this.logger.warn(`${maxRecordRead.reason}. Replaying a state record, so ${streamName} is created with AWS's default maximum record size rather than refusing the restore`);
+		else throw new ProvisioningError(maxRecordRead.reason, resourceType, logicalId, streamName);
 		try {
 			const streamModeDetails = properties["StreamModeDetails"];
 			const streamMode = readConfigString(streamModeDetails, "StreamMode", "PROVISIONED", "AWS::Kinesis::Stream StreamModeDetails");
 			const shardCount = streamMode === "PROVISIONED" ? Number(properties["ShardCount"] ?? 1) : void 0;
+			const maxRecordSizeInKiB = maxRecordRead.kind === "usable" ? maxRecordRead.size : void 0;
 			await this.getClient().send(new CreateStreamCommand({
 				StreamName: streamName,
 				...shardCount !== void 0 && { ShardCount: shardCount },
-				StreamModeDetails: { StreamMode: streamMode }
+				StreamModeDetails: { StreamMode: streamMode },
+				...maxRecordSizeInKiB !== void 0 && { MaxRecordSizeInKiB: maxRecordSizeInKiB }
 			}));
 			this.logger.debug(`CreateStream initiated for ${streamName}, waiting for ACTIVE status`);
 			const streamInfo = await this.waitForStreamActive(streamName);
@@ -41174,10 +41312,21 @@ var KinesisStreamProvider = class {
 				}));
 				await this.waitForStreamActive(streamName);
 			}
+			const desiredMetrics = desiredRead.kind === "usable" ? desiredRead.expanded : void 0;
+			const metricsToEnable = desiredRead.kind === "usable" ? desiredRead.metrics : [];
+			if (metricsToEnable.length > 0) {
+				this.logger.debug(`Enabling ${metricsToEnable.length} shard-level metric(s) on ${streamName}`);
+				await this.getClient().send(new EnableEnhancedMonitoringCommand({
+					StreamName: streamName,
+					ShardLevelMetrics: metricsToEnable
+				}));
+				await this.waitForStreamActive(streamName);
+			}
 			this.logger.debug(`Successfully created Kinesis stream ${logicalId}: ${streamName}`);
 			return {
 				physicalId: streamName,
-				attributes: { Arn: streamInfo.streamArn }
+				attributes: { Arn: streamInfo.streamArn },
+				...this.effectiveMetricsProperties(properties, desiredMetrics)
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -41263,10 +41412,49 @@ var KinesisStreamProvider = class {
 					await this.waitForStreamActive(physicalId);
 				}
 			}
+			const desiredSizeRead = readMaxRecordSize(properties["MaxRecordSizeInKiB"]);
+			if (desiredSizeRead.kind === "unusable") this.logger.warn(`${desiredSizeRead.reason}. Leaving the maximum record size on ${physicalId} unchanged; the same value is REFUSED on a template-path create`);
+			const newMaxRecordSize = comparableRecordSize(properties["MaxRecordSizeInKiB"]);
+			const oldMaxRecordSize = comparableRecordSize(previousProperties["MaxRecordSizeInKiB"]);
+			if (newMaxRecordSize !== void 0 && newMaxRecordSize !== oldMaxRecordSize) {
+				this.logger.debug(`Updating max record size for ${physicalId}: ${oldMaxRecordSize} -> ${newMaxRecordSize}`);
+				await this.getClient().send(new UpdateMaxRecordSizeCommand({
+					StreamARN: await this.resolveStreamArn(physicalId),
+					MaxRecordSizeInKiB: newMaxRecordSize
+				}));
+				await this.waitForStreamActive(physicalId);
+			}
+			const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"]);
+			let desiredMetrics;
+			if (desiredRead.kind === "unusable") this.logger.warn(`${desiredRead.reason}. Leaving the shard-level metrics on ${physicalId} unchanged rather than disabling the live ones; the same value is REFUSED on a template-path create`);
+			else {
+				desiredMetrics = desiredRead.kind === "usable" ? desiredRead.expanded : void 0;
+				const desiredSet = desiredRead.kind === "usable" ? desiredRead.metrics : [];
+				const previousSet = previousMetricNames(previousProperties["DesiredShardLevelMetrics"]);
+				const toDisable = previousSet.filter((m) => !desiredSet.includes(m));
+				const toEnable = desiredSet.filter((m) => !previousSet.includes(m));
+				if (toDisable.length > 0) {
+					this.logger.debug(`Disabling ${toDisable.length} shard-level metric(s) on ${physicalId}`);
+					await this.getClient().send(new DisableEnhancedMonitoringCommand({
+						StreamName: physicalId,
+						ShardLevelMetrics: toDisable
+					}));
+					await this.waitForStreamActive(physicalId);
+				}
+				if (toEnable.length > 0) {
+					this.logger.debug(`Enabling ${toEnable.length} shard-level metric(s) on ${physicalId}`);
+					await this.getClient().send(new EnableEnhancedMonitoringCommand({
+						StreamName: physicalId,
+						ShardLevelMetrics: toEnable
+					}));
+					await this.waitForStreamActive(physicalId);
+				}
+			}
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: { Arn: (await this.getClient().send(new DescribeStreamCommand({ StreamName: physicalId }))).StreamDescription?.StreamARN }
+				attributes: { Arn: (await this.getClient().send(new DescribeStreamCommand({ StreamName: physicalId }))).StreamDescription?.StreamARN },
+				...this.effectiveMetricsProperties(properties, desiredMetrics)
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -41295,6 +41483,52 @@ var KinesisStreamProvider = class {
 		}
 	}
 	/**
+	* The `effectiveProperties` half of the `ALL` expansion (issue #609).
+	*
+	* Returns a spreadable `{ effectiveProperties }` ONLY when the expansion
+	* actually rewrote the declared value; otherwise `{}`, so the engine records
+	* the desired bag verbatim (the `??` gate on the engine side treats an absent
+	* field as "record the desired properties"). The returned bag is a COMPLETE
+	* replacement, not a patch, per the `EffectivePropertiesResult` contract.
+	*/
+	effectiveMetricsProperties(properties, expanded) {
+		if (expanded === void 0) return {};
+		if (expanded === properties["DesiredShardLevelMetrics"]) return {};
+		return { effectiveProperties: {
+			...properties,
+			DesiredShardLevelMetrics: expanded
+		} };
+	}
+	/**
+	* Narrow the desired bag the same way the provisioning path does, so the
+	* diff compares the EXPANDED metric list on both sides.
+	*
+	* Required paired half of the `effectiveProperties` above: without it, state
+	* holds the seven expanded names while the template still says `ALL`, and
+	* every later `cdkd deploy` / `cdkd diff` reads that as a user-made change.
+	* Shares {@link expandShardLevelMetrics} rather than re-deriving the rule.
+	*/
+	canonicalizeDesiredProperties(resourceType, properties) {
+		if (resourceType !== "AWS::Kinesis::Stream") return properties;
+		if (!("DesiredShardLevelMetrics" in properties)) return properties;
+		const expanded = expandShardLevelMetrics(properties["DesiredShardLevelMetrics"]);
+		if (expanded === properties["DesiredShardLevelMetrics"]) return properties;
+		return {
+			...properties,
+			DesiredShardLevelMetrics: expanded
+		};
+	}
+	/**
+	* `DesiredShardLevelMetrics` is a SET: AWS returns it in an order that
+	* matched neither the request order nor alphabetical when measured
+	* (us-east-1, 2026-08-12), so comparing positionally would report drift on a
+	* stream nobody touched.
+	*/
+	getDriftUnorderedPaths(resourceType) {
+		if (resourceType !== "AWS::Kinesis::Stream") return [];
+		return ["DesiredShardLevelMetrics"];
+	}
+	/**
 	* Apply a diff between old and new CFn-shape Tags arrays via Kinesis's
 	* `AddTagsToStream` (map shape) / `RemoveTagsFromStream` (TagKeys list)
 	* APIs.
@@ -41338,8 +41572,10 @@ var KinesisStreamProvider = class {
 	*
 	* Issues `DescribeStream` and surfaces the keys cdkd's `create()`
 	* accepts: `Name`, `StreamModeDetails`, `ShardCount`, `RetentionPeriodHours`,
-	* and `StreamEncryption`. Tags are surfaced via a follow-up
-	* `ListTagsForStream` with `aws:*` filtered out.
+	* `StreamEncryption`, and `DesiredShardLevelMetrics`. Tags are surfaced via a
+	* follow-up `ListTagsForStream` with `aws:*` filtered out, and
+	* `MaxRecordSizeInKiB` via a follow-up `DescribeStreamSummary` (the field is
+	* absent from `DescribeStream`'s `StreamDescription` shape).
 	*
 	* `ShardCount` is reported as the count of `Shards[]` in the stream
 	* description (only present for PROVISIONED-mode streams; ON_DEMAND
@@ -41375,6 +41611,14 @@ var KinesisStreamProvider = class {
 			if (stream.KeyId !== void 0) encryption["KeyId"] = stream.KeyId;
 			result["StreamEncryption"] = encryption;
 		}
+		result["DesiredShardLevelMetrics"] = (stream.EnhancedMonitoring ?? []).flatMap((entry) => entry.ShardLevelMetrics ?? []);
+		try {
+			const maxRecordSize = (await this.getClient().send(new DescribeStreamSummaryCommand({ StreamName: physicalId }))).StreamDescriptionSummary?.MaxRecordSizeInKiB;
+			if (maxRecordSize !== void 0) result["MaxRecordSizeInKiB"] = maxRecordSize;
+		} catch (err) {
+			if (err instanceof ResourceNotFoundException$10) return void 0;
+			throw err;
+		}
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForStreamCommand({ StreamName: physicalId }))).Tags);
 		} catch (err) {
@@ -72376,7 +72620,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.1");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.2");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;