@go-to-k/cdkd 0.281.23 → 0.281.25

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as MIGRATE_TMP_PREFIX, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as getDefaultStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerStreaming, G as getAccountInfo, Gt as resolveSkipPrefix, H as isTerminationProtectionPropagationError, Ht as resolveApp, I as ProviderRegistry, It as AssetManifestLoader, J as normalizeAwsTagsToCfn, Jt as resolveUseCdkBootstrapAssets, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefault, L as findActionableSilentDrops, Lt as getDockerImageBySourceHash, M as yellow, Mt as formatDockerLoginError, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as getDockerCmd, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as runDockerForeground, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_URL_LIMIT, R as findSilentDropProperties, Rt as Synthesizer, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveAutoAssetStorage, V as disableInstanceApiTermination, Vt as getLegacyStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveCaptureObservedState, X as assertRegionMatch, Xt as warnDeprecatedNoPrefixCliFlag, Y as resolveExplicitPhysicalId, Yt as stateBucketExistenceConfirmed, Z as coerceCfnBoolean, Zt as CFN_TEMPLATE_BODY_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as findLargeInlineResources, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as buildDockerImage, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as expectedOwnerParam, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefaultAndSource, r as DeployEngine, rn as derivePartitionAndUrlSuffix, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as uploadCfnTemplate, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as synthesisStatusMessage } from "./deploy-engine-uxo_FCje.js";
+import { $ as configStringRefusal, $t as MIGRATE_TMP_PREFIX, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as getDefaultStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerStreaming, G as getAccountInfo, Gt as resolveSkipPrefix, H as isTerminationProtectionPropagationError, Ht as resolveApp, I as ProviderRegistry, It as AssetManifestLoader, J as normalizeAwsTagsToCfn, Jt as resolveUseCdkBootstrapAssets, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefault, L as findActionableSilentDrops, Lt as getDockerImageBySourceHash, M as yellow, Mt as formatDockerLoginError, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as getDockerCmd, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as runDockerForeground, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_URL_LIMIT, R as findSilentDropProperties, Rt as Synthesizer, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveAutoAssetStorage, V as disableInstanceApiTermination, Vt as getLegacyStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveCaptureObservedState, X as assertRegionMatch, Xt as warnDeprecatedNoPrefixCliFlag, Y as resolveExplicitPhysicalId, Yt as stateBucketExistenceConfirmed, Z as coerceCfnBoolean, Zt as CFN_TEMPLATE_BODY_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as findLargeInlineResources, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as buildDockerImage, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as expectedOwnerParam, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefaultAndSource, r as DeployEngine, rn as derivePartitionAndUrlSuffix, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as uploadCfnTemplate, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as synthesisStatusMessage } from "./deploy-engine-C8Kq3Cei.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CCSQkGwO.js";
+import { t as ASGProvider } from "./asg-provider-Cm5r4o8r.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -5172,10 +5172,81 @@ function foldToleratedAliases(bag, aliases) {
 	}
 	return out ?? bag;
 }
+/** The transition date member, held in a CONST so the fold writes it COMPUTED. */
+const TRANSITION_DATE_KEY = "TransitionDate";
 /** The lifecycle `Transitions[]` aliases the applier accepts (issue #1748). */
 const TRANSITION_ALIASES = [["TransitionInDays", "Days"], ["TransitionDate", "Date"]];
 /** The lifecycle `NoncurrentVersionTransitions[]` alias (issue #1748). */
 const NONCURRENT_VERSION_TRANSITION_ALIASES = [["TransitionInDays", "NoncurrentDays"]];
+/** The refusal path for the notification EventBridge boolean (issue #1759). */
+const EVENTBRIDGE_CONFIG_PATH = "AWS::S3::Bucket NotificationConfiguration.EventBridgeConfiguration";
+/**
+* The block's own key, held in a CONST so the fold below writes it as a
+* COMPUTED key.
+*
+* Load-bearing, not style: `gen-nested-key-coverage`'s write-evidence walk reads
+* a bag-derived spread-and-patch literal that NAMES a member
+* (`{ ...config, EventBridgeConfiguration: … }`) as the #1475 whole-blob
+* HAND-OFF and wildcard-credits everything beneath that path as DELIVERED — so
+* a DIFF-side fold spelled that way would switch the write pass off for the
+* whole notification subtree, and the critic's only visible complaint would be
+* that some allow-list entries went "stale". Same reason
+* {@link canonicalizeBlock} exists.
+*/
+const EVENTBRIDGE_CONFIG_KEY = "EventBridgeConfiguration";
+/**
+* What a DECLARED `EventBridgeConfiguration` block with no `EventBridgeEnabled`
+* key means. CFn marks the member required, so the block's presence is the
+* affirmative declaration; this is also the pre-#1759 behavior for that shape.
+*/
+const EVENTBRIDGE_DEFAULT_ENABLED = true;
+/**
+* The boolean the wire derives from a USABLE `EventBridgeConfiguration` block
+* (issue #1759) — the ONE definition `applyNotificationConfiguration` and
+* {@link effectiveNotificationConfiguration} share, so the value that goes on
+* the wire and the value recorded into state cannot drift apart.
+*
+* Callers MUST have cleared `configBooleanRefusal` first; the `??` is only
+* correct once every declared-but-unusable value has been refused.
+*/
+function eventBridgeEnabledOf(eb) {
+	return coerceCfnBoolean(isPlainObject$1(eb) ? eb["EventBridgeEnabled"] : void 0) ?? EVENTBRIDGE_DEFAULT_ENABLED;
+}
+/** The notification families whose empty declaration is never SENT (issue #1759). */
+const NOTIFICATION_LIST_KEYS = [
+	"TopicConfigurations",
+	"QueueConfigurations",
+	"LambdaConfigurations"
+];
+/**
+* Drop a declared-but-EMPTY collection the applier never sends (issue #1759).
+*
+* MEASURED before choosing this answer, because the sibling shape answers the
+* opposite way: the lifecycle / CORS empty-collection skip RECORDS its
+* placeholder (issue #1718) precisely because `readLifecycle` / `readCors`
+* always emit `{Rules: []}` / `{CorsRules: []}` for an unconfigured bucket, so
+* the declared empty collection already equals the readback. `readNotification`
+* does NOT: each family is emitted only under
+* `resp.<Family> && resp.<Family>.length > 0`, so an unconfigured bucket comes
+* back with the key ABSENT. A record keeping `[]` therefore describes a key set
+* AWS can never report, and the honest answer here is the DROP.
+*
+* Scoped to a genuinely EMPTY ARRAY. A non-array declaration is skipped by the
+* applier's `Array.isArray(...)` gate too, but it is MALFORMED: dropping it
+* would make the desired side compare equal and stop the difference being
+* reported, which is the concealment `.claude/rules/providers.md` finding 3
+* refuses. It is left visible instead.
+*/
+function dropEmptyNotificationFamilies(config) {
+	let out;
+	for (const listKey of NOTIFICATION_LIST_KEYS) {
+		const list = config[listKey];
+		if (!Array.isArray(list) || list.length > 0) continue;
+		out ??= { ...config };
+		delete out[listKey];
+	}
+	return out ?? config;
+}
 /** The `NotificationConfiguration` ARN aliases, per family (issue #1748). */
 const NOTIFICATION_ARN_ALIASES = [
 	["TopicConfigurations", [["Topic", "TopicArn"]]],
@@ -5248,6 +5319,439 @@ function effectiveNotificationConfiguration(config) {
 	if (!isPlainObject$1(config)) return config;
 	let out = config;
 	for (const [listKey, aliases] of NOTIFICATION_ARN_ALIASES) out = canonicalizeItemList(out, listKey, (item) => foldNotificationEvents(foldToleratedAliases(item, aliases)));
+	out = dropEmptyNotificationFamilies(out);
+	return foldEventBridgeConfiguration(out);
+}
+/**
+* Normalize `EventBridgeConfiguration` onto the shape `readNotification` emits
+* (issue #1759, items 2 and 3 of the same block).
+*
+* CFn is stringly typed, so `EventBridgeEnabled: 'true'` is a legitimate
+* declaration; the wire turns the value into presence/absence and
+* `readNotification` emits the BOOLEAN (`{EventBridgeEnabled: <bool>}`, the
+* #1430 shape). A record holding the STRING can therefore never match the
+* readback. This is #1633's lossless-coercion arm and it meets the #1643 bar —
+* what AWS reports back is exactly the boolean cdkd derived at send time. A
+* declared `null` folds to `false` for the same reason: the applier reads it as
+* "block omitted" and sends nothing.
+*
+* Keyed off the DECLARED shape and off the wire's own predicate, never off a
+* refusal: a value `configBooleanRefusal` rejects is left COMPLETELY alone (no
+* patch, and the key not dropped), because the wire SKIPS the whole Put for it
+* and AWS keeps the previous configuration. Folding it would collapse the
+* desired side onto the retained value, the provider would never be called, and
+* the skip warning would stop — the "mirror what the wire does" rule.
+*
+* MEASURED AND DELIBERATELY NOT FOLDED (1) — the per-item `Id`, which issue
+* #1755 asked to be measured rather than assumed. The applier sends
+* `Id: t['Id']`, so a template declaring none sends none, AWS GENERATES one, and
+* `readNotification` emits it (`if (t.Id !== undefined) e['Id'] = t.Id`). That is
+* an AWS-COMPUTED value, not a spelling: it belongs in `observedProperties`,
+* which `readCurrentState` already populates, and `.claude/rules/providers.md` is
+* explicit that a computed value in `properties` makes the DESIRED baseline drift
+* from the template and disables the #1160 absent-field removal derivation. There
+* is also nothing to fold TOWARDS — the value does not exist at send time, which
+* is the #1643 "knowable at send time" test failing. So: no fold, by measurement
+* rather than by omission.
+*
+* MEASURED AND DELIBERATELY NOT FOLDED (2): `readNotification` emits
+* `EventBridgeConfiguration` UNCONDITIONALLY, so a notification configuration
+* that declares no EventBridge block at all is one key short of the readback.
+* That is NOT this class — nothing was declared, so there is no spelling to
+* normalize, and supplying the key would record one the template does not have
+* on EVERY notification-configured bucket (the shape #1723 records as the
+* reason its own arm was left unanswered). `readNotification`'s own comment
+* already scopes that difference: it is a ONE-TIME, self-clearing drift on the
+* `properties`-fallback baseline, deliberately accepted by #1430, not the
+* permanent phantom drift this fold exists to remove.
+*
+* @returns `config` BY IDENTITY when nothing is declared, when the declared
+*   block is already the emitted shape, or when it is unfoldable.
+*/
+function foldEventBridgeConfiguration(config) {
+	const eb = config[EVENTBRIDGE_CONFIG_KEY];
+	if (eb === void 0) return config;
+	if (eb !== null && configBooleanRefusal(eb, "EventBridgeEnabled", EVENTBRIDGE_CONFIG_PATH)) return config;
+	const enabled = eb === null ? false : eventBridgeEnabledOf(eb);
+	const declared = isPlainObject$1(eb) ? eb["EventBridgeEnabled"] : void 0;
+	if (isPlainObject$1(eb) && Object.keys(eb).length === 1 && Object.is(declared, enabled)) return config;
+	return {
+		...config,
+		[EVENTBRIDGE_CONFIG_KEY]: { EventBridgeEnabled: enabled }
+	};
+}
+/** The refusal paths the lifecycle applier and its fold SHARE (issue #1755). */
+const LIFECYCLE_RULE_PATH = "AWS::S3::Bucket LifecycleConfiguration.Rules[]";
+const LIFECYCLE_FILTER_PATH = `${LIFECYCLE_RULE_PATH}.Filter`;
+const LIFECYCLE_TAG_FILTERS_PATH = `${LIFECYCLE_RULE_PATH}.TagFilters`;
+/** What `readConfigString(rule, 'Status', ...)` substitutes for an ABSENT key. */
+const LIFECYCLE_DEFAULT_STATUS = "Enabled";
+/** The rule's status member, held in a CONST so the fold writes it COMPUTED. */
+const LIFECYCLE_STATUS_KEY = "Status";
+/**
+* Gather a rule's full location scope — module-level so the applier and the
+* fold run the SAME function rather than two copies that can disagree about
+* which key wins (`.claude/rules/providers.md`: share ONE helper with the
+* provisioning path, or state and template end up narrowed to different keys
+* and the fix becomes the bug).
+*
+* `TagFilters` lives at the RULE level in the CFn schema and CDK synthesizes it
+* there; the `Filter`-side reads are cdkd's accommodation for SDK-shaped /
+* imported input.
+*/
+function lifecycleRuleScope(rule) {
+	const filter = rule["Filter"];
+	return {
+		prefix: filter?.["Prefix"] ?? rule["Prefix"],
+		tagFilters: filter?.["TagFilters"] ?? rule["TagFilters"],
+		sizeGt: filter?.["ObjectSizeGreaterThan"] ?? rule["ObjectSizeGreaterThan"],
+		sizeLt: filter?.["ObjectSizeLessThan"] ?? rule["ObjectSizeLessThan"]
+	};
+}
+/**
+* Can this rule stay in the deprecated V1 (top-level `Prefix`) form? See
+* {@link lifecycleUsesFilterForm} — S3 forbids MIXING the two forms in one
+* configuration, so the answer is decided across the whole rule list.
+*/
+function lifecycleRuleIsPlainPrefixOnly(rule) {
+	if (rule["Filter"] != null) return false;
+	const s = lifecycleRuleScope(rule);
+	return s.prefix !== void 0 && (s.tagFilters == null || s.tagFilters.length === 0) && s.sizeGt === void 0 && s.sizeLt === void 0;
+}
+/** V1 vs V2 is decided ONCE for the whole configuration — see the applier's note. */
+function lifecycleUsesFilterForm(rules) {
+	return !rules.every(lifecycleRuleIsPlainPrefixOnly);
+}
+/** Discards the message; the fold only needs the PREDICATE's answer. */
+const IGNORE_REFUSAL_MESSAGE = () => {};
+/**
+* Would `applyLifecycleConfiguration` REFUSE this rule, and therefore skip the
+* whole Put? (issue #1755)
+*
+* Runs the applier's own three guards rather than restating them — the
+* "do not HAND-ROLL the mirror, run the wire's own predicate" rule, whose
+* cautionary tale is the S3 schedule fold, where an approximation disagreed
+* with the wire on three of nine container shapes.
+*/
+function lifecycleRuleRefused(rule) {
+	const rawFilter = rule["Filter"];
+	if (rawFilter != null && requireConfigObject(rawFilter, LIFECYCLE_FILTER_PATH, { onUnusable: IGNORE_REFUSAL_MESSAGE }) === void 0) return true;
+	const rawTagFilters = rawFilter?.["TagFilters"] ?? rule["TagFilters"];
+	if (rawTagFilters != null && requireConfigArray(rawTagFilters, LIFECYCLE_TAG_FILTERS_PATH, { onUnusable: IGNORE_REFUSAL_MESSAGE }) === void 0) return true;
+	return configStringRefusal(rule, "Status", LIFECYCLE_DEFAULT_STATUS, LIFECYCLE_RULE_PATH) !== void 0;
+}
+/**
+* Deep, key-ORDER-insensitive equality — the identity test for a fold that
+* rebuilds nested objects (`Filter`) even when nothing about them changed.
+*
+* `Object.is` alone would report every folded rule as changed and rewrite the
+* state record of every lifecycle-configured bucket; `JSON.stringify` would
+* report a pure reordering as a change, which is not one worth recording.
+*/
+function deepSameValue(a, b) {
+	if (Object.is(a, b)) return true;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((element, index) => deepSameValue(element, b[index]));
+	}
+	if (isPlainObject$1(a) && isPlainObject$1(b)) {
+		const keysA = Object.keys(a);
+		if (keysA.length !== Object.keys(b).length) return false;
+		return keysA.every((key) => key in b && deepSameValue(a[key], b[key]));
+	}
+	return false;
+}
+/**
+* The ISO string `readLifecycle` emits for a date the applier sends as
+* `new Date(value)`.
+*
+* DETERMINISM IS A PRECONDITION, not a nicety (PR review). `new Date(str)`
+* resolves an offset-less string in the HOST's local zone — `new Date('0')` is
+* `1999-12-31T15:00:00Z` under JST and `2000-01-01T00:00:00Z` under UTC, and
+* `'2030-01-01T00:00:00'` (ISO, no offset) is local by spec. The APPLIER shares
+* that dependence, so the wire and the readback still agree on any one machine —
+* but this feeds `canonicalizeDesiredProperties`, a DIFF-side pure function that
+* runs wherever the CLI runs. A CI runner in UTC and a laptop in JST would
+* canonicalize the SAME template to different ISO strings and manufacture a diff
+* neither machine can clear, which is strictly worse than the phantom drift the
+* fold exists to remove. So only the forms whose meaning is fixed by the ISO
+* 8601 spec are folded: a bare `YYYY-MM-DD` (spec-UTC), a date-time carrying
+* `Z` or a `±HH:MM` offset, and an epoch NUMBER. Everything else — `'Jan 1
+* 2030'`, `'0'`, an offset-less date-time — is left ALONE, which keeps the
+* record machine-independent at the cost of not normalizing a shape almost no
+* template uses.
+*
+* @returns `undefined` for a value that cannot become a valid `Date`, or whose
+*   `Date` would depend on the host timezone — in both cases there is no
+*   effective value this can claim AWS will report, so the fold leaves the rule
+*   alone.
+*/
+const TIMEZONE_INDEPENDENT_DATE = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2}))?$/;
+function cfnDateToIso(value) {
+	if (typeof value === "string" && !TIMEZONE_INDEPENDENT_DATE.test(value)) return void 0;
+	if (typeof value !== "string" && typeof value !== "number") return void 0;
+	const parsed = new Date(value);
+	return Number.isNaN(parsed.getTime()) ? void 0 : parsed.toISOString();
+}
+/** The legacy SINGULAR action objects the CFn schema still declares (issue #1754). */
+const LEGACY_SINGULAR_TRANSITIONS = [["Transitions", "Transition"], ["NoncurrentVersionTransitions", "NoncurrentVersionTransition"]];
+/**
+* Merge the legacy singular `Transition` / `NoncurrentVersionTransition` into
+* the plural array, exactly as the wire does (issue #1754).
+*
+* The CFn `Rule` definition still declares BOTH spellings and
+* `applyLifecycleConfiguration` folds the singular into the plural array via
+* {@link mergeLegacySingular}, so `readLifecycle` can only ever emit the plural.
+* A rule declaring the singular therefore recorded a key AWS can never
+* report — the #1686 never-emitted-KEY class through the SHAPE — with no
+* warning anywhere, because nothing is malformed and nothing is substituted.
+*
+* It shares `mergeLegacySingular` itself rather than re-deriving the collision
+* rule, per the share-ONE-helper rule. What it does NOT do is pass a no-op
+* callback and fold regardless: on a `StorageClass` COLLISION the wire DROPS the
+* singular and WARNS, so a colliding rule is left COMPLETELY alone (both keys
+* kept). The NON-colliding case, which is the population this exists for, has
+* no fault to report and folds.
+*
+* Be precise about WHICH signal that preserves, because the obvious answer is
+* wrong (PR review). It is NOT the deploy-time warning: the record and the
+* canonicalized template are folded by the same function either way, so they
+* compare equal after the first deploy and the Put stops re-firing whichever
+* choice is made. What leaving it alone preserves is the `cdkd drift` report —
+* state keeps a `Transition` key `readLifecycle` can never emit, so drift
+* re-reports the rule until the template drops one of the two declarations.
+* Folding it would make state match the readback exactly and render a
+* template fault S3 itself rejects completely invisible.
+*
+* @returns `rule` BY IDENTITY when no legacy singular is declared.
+*/
+function foldLegacySingularTransitions(rule) {
+	let out;
+	for (const [pluralKey, singularKey] of LEGACY_SINGULAR_TRANSITIONS) {
+		const singular = rule[singularKey];
+		const hasSingular = isPlainObject$1(singular);
+		const plural = rule[pluralKey];
+		const needsFilter = Array.isArray(plural) && plural.some((element) => !isPlainObject$1(element));
+		if (!hasSingular && !needsFilter) continue;
+		let collided = false;
+		const merged = mergeLegacySingular(plural, hasSingular ? singular : void 0, () => {
+			collided = true;
+		});
+		out ??= { ...rule };
+		if (collided) {
+			if (needsFilter) out[pluralKey] = merged;
+			continue;
+		}
+		out[pluralKey] = merged;
+		if (hasSingular) delete out[singularKey];
+	}
+	return out ?? rule;
+}
+/**
+* Emit a transition's `TransitionDate` as the ISO string the readback emits
+* (PR review of issues #1754 / #1755).
+*
+* The alias fold above only RENAMES `Date` -> `TransitionDate`, but the applier
+* sends `new Date(t['TransitionDate'] ?? t['Date'])` and `readLifecycle` emits
+* `t.Date.toISOString()` — so a hand-written / imported `TransitionDate:
+* '2030-01-01'` recorded a value the readback can never match, with no warning
+* and nothing malformed. Exactly the class {@link foldLifecycleExpiration}
+* closes for the RULE-level `ExpirationDate` one member over; found by review
+* because the fold and the readback were compared per member rather than
+* per item.
+*
+* `NoncurrentVersionTransitions` needs no twin of this: `toSdkNvt` has no date
+* member at all.
+*
+* @returns the item BY IDENTITY when no date is declared, or when it is one the
+*   applier would put on the wire as an Invalid Date (nothing to record).
+*/
+function foldTransitionDate(item) {
+	const declared = item[TRANSITION_DATE_KEY];
+	if (!declared) return item;
+	const iso = cfnDateToIso(declared);
+	if (iso === void 0 || iso === declared) return item;
+	const out = { ...item };
+	out[TRANSITION_DATE_KEY] = iso;
+	return out;
+}
+/**
+* Drop a declared-but-EMPTY transition list (issue #1755).
+*
+* The applier sets `sdkRule.Transitions` / `.NoncurrentVersionTransitions` only
+* when the merged array is non-empty, and `readLifecycle` emits each only under
+* `r.<List> && r.<List>.length > 0` — so an empty declaration is one key the
+* readback can never carry. Measured on the reverse-mapper, not assumed: the
+* lifecycle block's OWN empty-collection placeholder answers the opposite way
+* (issue #1718) because `readLifecycle` DOES emit `{Rules: []}`.
+*/
+function dropEmptyTransitionLists(rule) {
+	let out;
+	for (const [pluralKey] of LEGACY_SINGULAR_TRANSITIONS) {
+		const list = rule[pluralKey];
+		if (!Array.isArray(list) || list.length > 0) continue;
+		out ??= { ...rule };
+		delete out[pluralKey];
+	}
+	return out ?? rule;
+}
+/**
+* Reshape the rule's expiration onto the CFn spellings `readLifecycle` emits
+* (issue #1755 item 1).
+*
+* The CFn `Rule` definition declares `ExpirationDate` / `ExpirationInDays` and
+* the RULE-level `ExpiredObjectDeleteMarker`, and has NO `Expiration` member;
+* the applier additionally accepts a cdkd-only `Expiration` OBJECT as a third
+* source. The readback used to emit only the SDK-shaped `Expiration` object, so
+* state and the readback carried different key sets for essentially every
+* lifecycle-configured bucket CDK creates. The fix is split, per the issue: the
+* READBACK now emits the CFn scalars (recording the SDK shape instead would put
+* a spelling in state that no CFn template can declare), and this is the desired
+* side folding onto the same choice.
+*
+* The rule is left COMPLETELY alone in three cases, each because the wire does
+* something this fold must not conceal:
+*
+* - a rule-level `ExpiredObjectDeleteMarker` the wire cannot read
+*   (`coerceCfnBoolean` answers `undefined`): the wire silently ignores it, and
+*   nothing warns, so the difference is the user's only signal;
+* - a date the wire would send as an Invalid Date, or one whose `Date` depends
+*   on the host timezone (see {@link cfnDateToIso});
+* - a rule-level `ExpiredObjectDeleteMarker: true` ALONGSIDE a `Days` / `Date`:
+*   S3 forbids the combination, so the applier sends the `Days` / `Date` and
+*   WARNS that the marker was not applied. Folding the marker away on both sides
+*   would stop that difference being reported, so `cdkd drift` re-reporting it
+*   until the template drops one of the two is the correct standing signal.
+*
+* @returns `rule` BY IDENTITY when nothing expiration-shaped is declared.
+*/
+function foldLifecycleExpiration(rule) {
+	const declaredMarker = rule["ExpiredObjectDeleteMarker"];
+	const ruleLevelMarker = coerceCfnBoolean(declaredMarker);
+	if (declaredMarker !== void 0 && ruleLevelMarker === void 0) return rule;
+	if (rule["ExpirationInDays"] === void 0 && rule["ExpirationDate"] === void 0 && rule["Expiration"] === void 0 && declaredMarker === void 0) return rule;
+	const expiration = rule["ExpirationInDays"] || rule["ExpirationDate"] || rule["Expiration"];
+	let days;
+	let date;
+	let marker;
+	if (typeof expiration === "number") days = expiration;
+	else if (typeof expiration === "string") {
+		const iso = cfnDateToIso(expiration);
+		if (iso === void 0) return rule;
+		date = iso;
+	} else if (isPlainObject$1(expiration)) {
+		if (expiration["Days"] !== void 0) days = expiration["Days"];
+		if (expiration["Date"]) {
+			const iso = cfnDateToIso(expiration["Date"]);
+			if (iso === void 0) return rule;
+			date = iso;
+		}
+		const nested = expiration["ExpiredObjectDeleteMarker"];
+		if (nested !== void 0) {
+			if (typeof nested !== "boolean") return rule;
+			marker = nested;
+		}
+	} else if (expiration) return rule;
+	if (ruleLevelMarker === true) {
+		if (days !== void 0 || date !== void 0) return rule;
+		days = void 0;
+		date = void 0;
+		marker = true;
+	}
+	const out = { ...rule };
+	delete out["ExpirationInDays"];
+	delete out["ExpirationDate"];
+	delete out["Expiration"];
+	delete out["ExpiredObjectDeleteMarker"];
+	if (days !== void 0) out["ExpirationInDays"] = days;
+	if (date !== void 0) out["ExpirationDate"] = date;
+	if (marker !== void 0) out["ExpiredObjectDeleteMarker"] = marker;
+	return out;
+}
+/**
+* Fold the legacy scalar `NoncurrentVersionExpirationInDays` onto the OBJECT
+* form `readLifecycle` emits (issue #1755 item 2).
+*
+* CFn declares BOTH spellings here — unlike the expiration sibling above — so
+* the readback has to pick one and the desired side has to fold to the same
+* choice. The OBJECT wins because it is the only one that can express
+* `NewerNoncurrentVersions`, so folding towards it is lossless in both
+* directions; and it is also what the wire already prefers when both are
+* declared, which is why a rule carrying both simply DROPS the scalar here.
+*
+* `coerceCfnNumber`, not `typeof === 'number'`: it is the predicate the wire
+* runs, and the wire sends the COERCED number, so a hand-written `"365"` is
+* recorded as `365` — exactly what AWS reports back.
+*/
+function foldNoncurrentVersionExpiration(rule) {
+	const legacy = rule["NoncurrentVersionExpirationInDays"];
+	if (legacy === void 0) return rule;
+	const declaredObject = rule["NoncurrentVersionExpiration"];
+	if (declaredObject !== void 0 && !isPlainObject$1(declaredObject)) return rule;
+	const out = { ...rule };
+	delete out["NoncurrentVersionExpirationInDays"];
+	if (isPlainObject$1(declaredObject)) return out;
+	const days = coerceCfnNumber(legacy);
+	if (days === void 0) return rule;
+	out["NoncurrentVersionExpiration"] = { NoncurrentDays: days };
+	return out;
+}
+/**
+* Rebuild the rule's location scope in the shape `readLifecycle` emits for the
+* `Filter` the applier actually sends (issue #1755 item 3).
+*
+* This is not a spelling at all but a defaulted-but-SENT member (#1718's
+* class): a rule with no declared scope is SENT `Filter: {Prefix: ''}` in a V2
+* configuration, AWS holds it, the readback reports it, and the record was one
+* key short. The fold is wider than the issue's headline because the same round
+* trip moves three more shapes — a bare top-level `Prefix` becomes
+* `Filter: {Prefix}`, rule-level `TagFilters` become `Filter: {TagFilters}`, and
+* rule-level `ObjectSize*` move under `Filter` — all of which the readback emits
+* only under `Filter`.
+*
+* `useFilterForm` is decided ACROSS ALL RULES, which is why this takes it as a
+* parameter instead of being a pure per-rule function: in a V1 configuration
+* (every rule scoped by exactly one top-level `Prefix`) nothing moves at all.
+*
+* WHY THIS RECORDS `Filter` WHEN THE EXPIRATION SIBLING REFUSED THE SDK SHAPE,
+* since the two answer the same objection opposite ways one member apart (PR
+* review — without this, the next author "fixes" one to match the other). The
+* CFn `Rule` definition declares no `Filter` member either, so by the
+* `Expiration` argument this too should have been fixed on the READBACK side.
+* It is not, for a reason that does not apply there: the rule-level CFn scalars
+* can express every `Expiration` the SDK returns, and so the reverse map is
+* LOSSLESS — whereas the V2 `Filter` carries a distinction with no rule-level
+* spelling at all. A scope-less rule is SENT `Filter: {Prefix: ''}`, and the
+* only rule-level rendering of that is a top-level `Prefix: ''`, which is the V1
+* form — a different configuration that S3 forbids mixing with V2. Reverse-
+* mapping would therefore destroy the V1/V2 distinction state needs to
+* reproduce the call. `readLifecycle` has emitted `Filter` since issue #1388, so
+* both sides already meet there; this fold makes the desired side agree rather
+* than moving the meeting point.
+*/
+function foldLifecycleScope(rule, useFilterForm) {
+	const { prefix, tagFilters, sizeGt, sizeLt } = lifecycleRuleScope(rule);
+	const hasTags = tagFilters != null && tagFilters.length > 0;
+	const componentCount = (hasTags ? 1 : 0) + (prefix !== void 0 ? 1 : 0) + (sizeGt !== void 0 ? 1 : 0) + (sizeLt !== void 0 ? 1 : 0);
+	let filter;
+	if (componentCount > 1) {
+		filter = {};
+		if (prefix !== void 0) filter["Prefix"] = prefix;
+		if (hasTags) filter["TagFilters"] = tagFilters;
+		if (sizeGt !== void 0) filter["ObjectSizeGreaterThan"] = sizeGt;
+		if (sizeLt !== void 0) filter["ObjectSizeLessThan"] = sizeLt;
+	} else if (hasTags) filter = { TagFilters: tagFilters };
+	else if (sizeGt !== void 0) filter = { ObjectSizeGreaterThan: sizeGt };
+	else if (sizeLt !== void 0) filter = { ObjectSizeLessThan: sizeLt };
+	else if (useFilterForm) filter = { Prefix: prefix ?? "" };
+	const out = { ...rule };
+	delete out["Filter"];
+	delete out["Prefix"];
+	delete out["TagFilters"];
+	delete out["ObjectSizeGreaterThan"];
+	delete out["ObjectSizeLessThan"];
+	if (filter !== void 0) out["Filter"] = filter;
+	else if (prefix !== void 0) out["Prefix"] = prefix;
 	return out;
 }
 /**
@@ -5268,29 +5772,65 @@ function effectiveNotificationConfiguration(config) {
 * the same two item shapes, so fixing only the reported one would have left its
 * siblings broken — the "diff the WHOLE blob, not the reported key" rule.
 *
-* Two things deliberately NOT folded here, tracked rather than left unstated:
-* the legacy SINGULAR `Transition` / `NoncurrentVersionTransition` objects,
-* which `mergeLegacySingular` folds into the plural on the wire so the readback
-* can never emit them either — a MERGE with a collision arm that WARNS, not an
-* alias rename, so it needs its own decision (issue #1754); and the RULE-level
-* divergences the round-trip fence measured beside these
-* (`ExpirationInDays` / `NoncurrentVersionExpirationInDays` recorded against an
-* `Expiration` / `NoncurrentVersionExpiration` readback, and the sent-but-
-* unrecorded `Filter: {Prefix: ''}`), which are reshapes belonging on the
-* READBACK side and are wider than this class (issue #1755). So a rule using
-* these aliases converges on the aliases and still differs on those keys until
-* #1755 lands — which is the honest state, not a claim this makes lifecycle
-* whole.
-*
-* @returns `config` BY IDENTITY when no tolerated spelling is declared.
+* Issues #1754 / #1755 finished the block, so the "still differs on those keys"
+* caveat this doc carried is gone: the legacy SINGULAR `Transition` /
+* `NoncurrentVersionTransition` objects are MERGED here exactly as the wire
+* merges them ({@link foldLegacySingularTransitions}), the rule-level
+* `Expiration` / `NoncurrentVersionExpiration` reshapes are folded onto the
+* spellings the readback emits ({@link foldLifecycleExpiration} /
+* {@link foldNoncurrentVersionExpiration}), and the sent-but-unrecorded
+* `Filter` is supplied from the rule's full gathered SCOPE
+* ({@link foldLifecycleScope}).
+*
+* @returns `config` BY IDENTITY when the declared bag IS what goes on the wire.
 */
 function effectiveLifecycleConfiguration(config) {
 	if (!isPlainObject$1(config)) return config;
-	return canonicalizeItemList(config, "Rules", (rule) => {
-		let out = canonicalizeItemList(rule, "Transitions", (t) => foldToleratedAliases(t, TRANSITION_ALIASES));
-		out = canonicalizeItemList(out, "NoncurrentVersionTransitions", (nvt) => foldToleratedAliases(nvt, NONCURRENT_VERSION_TRANSITION_ALIASES));
-		return out;
-	});
+	const rules = config["Rules"];
+	if (!Array.isArray(rules)) return config;
+	const objectRules = rules.filter(isPlainObject$1);
+	if (objectRules.length !== rules.length || objectRules.length === 0) return config;
+	if (objectRules.some(lifecycleRuleRefused)) return config;
+	const useFilterForm = lifecycleUsesFilterForm(objectRules);
+	return canonicalizeItemList(config, "Rules", (rule) => effectiveLifecycleRule(rule, useFilterForm));
+}
+/**
+* The one rule fold both sides share — the CFn-shaped bag `readLifecycle` emits
+* for the SDK rule `applyLifecycleConfiguration` builds from this rule.
+*
+* Ordered the way the wire is: the legacy singular is merged into the plural
+* BEFORE the alias fold runs, because the singular can carry the SDK day/date
+* spellings too.
+*
+* MEASURED against the REAL synthesized `s3-lifecycle` fixture templates (every
+* bucket, both phases): the recorded rule and the emitted one carry identical
+* KEYS and identical VALUES, and differ only in key ORDER — the record keeps the
+* template's, the readback uses the reverse-mapper's. That is pre-existing and
+* unchanged here (the record was always template-ordered), and it does not reach
+* `cdkd drift`, whose baseline is `observedProperties` — captured from this very
+* reverse-mapper, so both sides carry its order. It is stated because a reader
+* comparing the two by `JSON.stringify` will see a difference and should know it
+* was measured rather than missed.
+*
+* @returns `rule` BY IDENTITY when the declared rule already IS that bag, so an
+*   ordinary CFn-spelled template records byte-for-byte as before. The compare
+*   is deep and key-ORDER-insensitive for the same reason: a reordering is not a
+*   difference worth rewriting a state record for.
+*/
+function effectiveLifecycleRule(rule, useFilterForm) {
+	let out = foldLegacySingularTransitions(rule);
+	out = canonicalizeItemList(out, "Transitions", (t) => foldTransitionDate(foldToleratedAliases(t, TRANSITION_ALIASES)));
+	out = canonicalizeItemList(out, "NoncurrentVersionTransitions", (nvt) => foldToleratedAliases(nvt, NONCURRENT_VERSION_TRANSITION_ALIASES));
+	out = dropEmptyTransitionLists(out);
+	out = foldLifecycleExpiration(out);
+	out = foldNoncurrentVersionExpiration(out);
+	out = foldLifecycleScope(out, useFilterForm);
+	if (out[LIFECYCLE_STATUS_KEY] === void 0) {
+		const withStatus = { ...out };
+		withStatus[LIFECYCLE_STATUS_KEY] = LIFECYCLE_DEFAULT_STATUS;
+		out = withStatus;
+	}
+	return deepSameValue(rule, out) ? rule : out;
 }
 /**
 * Apply a WHOLE-BLOCK fold to one top-level property on BOTH sides of a diff —
@@ -5649,32 +6189,18 @@ var S3BucketProvider = class S3BucketProvider {
 	async applyLifecycleConfiguration(bucketName, lifecycleConfig, onUnusable) {
 		for (const rule of lifecycleConfig.Rules) {
 			const rawFilter = rule["Filter"];
-			if (rawFilter != null && requireConfigObject(rawFilter, "AWS::S3::Bucket LifecycleConfiguration.Rules[].Filter", { ...onUnusable ? { onUnusable } : {} }) === void 0) return false;
+			if (rawFilter != null && requireConfigObject(rawFilter, LIFECYCLE_FILTER_PATH, { ...onUnusable ? { onUnusable } : {} }) === void 0) return false;
 			const rawTagFilters = rawFilter?.["TagFilters"] ?? rule["TagFilters"];
 			if (rawTagFilters != null) {
-				if (requireConfigArray(rawTagFilters, "AWS::S3::Bucket LifecycleConfiguration.Rules[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) return false;
+				if (requireConfigArray(rawTagFilters, LIFECYCLE_TAG_FILTERS_PATH, { ...onUnusable ? { onUnusable } : {} }) === void 0) return false;
 			}
-			if (this.skipOnUnusableConfigString(rule, "Status", "Enabled", "AWS::S3::Bucket LifecycleConfiguration.Rules[]", "Leaving the whole lifecycle configuration unapplied here", onUnusable)) return false;
+			if (this.skipOnUnusableConfigString(rule, "Status", LIFECYCLE_DEFAULT_STATUS, LIFECYCLE_RULE_PATH, "Leaving the whole lifecycle configuration unapplied here", onUnusable)) return false;
 		}
-		const gatherScope = (rule) => {
-			const filter = rule["Filter"];
-			return {
-				prefix: filter?.["Prefix"] ?? rule["Prefix"],
-				tagFilters: filter?.["TagFilters"] ?? rule["TagFilters"],
-				sizeGt: filter?.["ObjectSizeGreaterThan"] ?? rule["ObjectSizeGreaterThan"],
-				sizeLt: filter?.["ObjectSizeLessThan"] ?? rule["ObjectSizeLessThan"]
-			};
-		};
-		const isPlainPrefixOnly = (rule) => {
-			if (rule["Filter"] != null) return false;
-			const s = gatherScope(rule);
-			return s.prefix !== void 0 && (s.tagFilters == null || s.tagFilters.length === 0) && s.sizeGt === void 0 && s.sizeLt === void 0;
-		};
-		const useFilterForm = !lifecycleConfig.Rules.every(isPlainPrefixOnly);
+		const useFilterForm = lifecycleUsesFilterForm(lifecycleConfig.Rules);
 		const rules = lifecycleConfig.Rules.map((rule) => {
 			const sdkRule = {
 				ID: rule["Id"],
-				Status: readConfigString(rule, "Status", "Enabled", "AWS::S3::Bucket LifecycleConfiguration.Rules[]"),
+				Status: readConfigString(rule, "Status", LIFECYCLE_DEFAULT_STATUS, LIFECYCLE_RULE_PATH),
 				Prefix: useFilterForm ? void 0 : rule["Prefix"]
 			};
 			const expiration = rule["ExpirationInDays"] || rule["ExpirationDate"] || rule["Expiration"];
@@ -5720,7 +6246,7 @@ var S3BucketProvider = class S3BucketProvider {
 			if (allTransitions.length > 0) sdkRule.Transitions = allTransitions.map(toSdkTransition);
 			const abort = isPlainObject$1(rule["AbortIncompleteMultipartUpload"]) ? rule["AbortIncompleteMultipartUpload"] : void 0;
 			if (abort) sdkRule.AbortIncompleteMultipartUpload = { DaysAfterInitiation: abort["DaysAfterInitiation"] };
-			const { prefix, tagFilters, sizeGt, sizeLt } = gatherScope(rule);
+			const { prefix, tagFilters, sizeGt, sizeLt } = lifecycleRuleScope(rule);
 			const hasTags = tagFilters != null && tagFilters.length > 0;
 			if ((hasTags ? 1 : 0) + (prefix !== void 0 ? 1 : 0) + (sizeGt !== void 0 ? 1 : 0) + (sizeLt !== void 0 ? 1 : 0) > 1) sdkRule.Filter = { And: {
 				Prefix: prefix,
@@ -5906,7 +6432,7 @@ var S3BucketProvider = class S3BucketProvider {
 	* SDK uses the same structure (PutBucketNotificationConfiguration replaces
 	* the entire notification configuration in one call).
 	*/
-	async applyNotificationConfiguration(bucketName, notifConfig) {
+	async applyNotificationConfiguration(bucketName, notifConfig, onUnusable) {
 		const cfg = {};
 		if (notifConfig) {
 			const topics = notifConfig["TopicConfigurations"];
@@ -5931,13 +6457,22 @@ var S3BucketProvider = class S3BucketProvider {
 				Filter: this.cfnNotifFilterToSdk(l["Filter"])
 			}));
 			const eb = notifConfig["EventBridgeConfiguration"];
-			if (eb !== void 0 && (!isPlainObject$1(eb) || coerceCfnBoolean(eb["EventBridgeEnabled"]) !== false)) cfg.EventBridgeConfiguration = {};
+			if (eb != null) {
+				const ebRefusal = configBooleanRefusal(eb, "EventBridgeEnabled", EVENTBRIDGE_CONFIG_PATH);
+				if (ebRefusal !== void 0) {
+					if (!onUnusable) throw new Error(`${ebRefusal}. Omit the block entirely to leave EventBridge delivery disabled`);
+					onUnusable(`${ebRefusal}. Leaving the whole notification configuration unapplied here: PutBucketNotificationConfiguration is a full replace, and treating an unreadable value as ${EVENTBRIDGE_DEFAULT_ENABLED} would ENABLE EventBridge delivery the template may have been disabling; the same value is REFUSED on a template-path create`);
+					return false;
+				}
+				if (eventBridgeEnabledOf(eb)) cfg.EventBridgeConfiguration = {};
+			}
 		}
 		await this.s3Client.send(new PutBucketNotificationConfigurationCommand({
 			Bucket: bucketName,
 			NotificationConfiguration: cfg
 		}));
 		this.logger.debug(`Applied notification configuration to bucket ${bucketName}`);
+		return true;
 	}
 	/**
 	* Convert CFn notification Filter ({ S3Key: { Rules: [{ Name, Value }] } })
@@ -6951,9 +7486,11 @@ var S3BucketProvider = class S3BucketProvider {
 			await this.applyLoggingConfiguration(bucketName, void 0);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["NotificationConfiguration"], properties["NotificationConfiguration"], async (cfg) => {
-			await this.applyNotificationConfiguration(bucketName, cfg);
-			recordEffectiveFold("NotificationConfiguration", effectiveNotificationConfiguration(cfg));
-		}, async () => this.applyNotificationConfiguration(bucketName, void 0));
+			if (!await this.applyNotificationConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("NotificationConfiguration");
+			else recordEffectiveFold("NotificationConfiguration", effectiveNotificationConfiguration(cfg));
+		}, async () => {
+			await this.applyNotificationConfiguration(bucketName, void 0);
+		});
 		await this.diffSubConfig(bucketName, previousProperties["ReplicationConfiguration"], properties["ReplicationConfiguration"], async (cfg) => {
 			if (!await this.applyReplicationConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("ReplicationConfiguration");
 		}, async () => {
@@ -7067,10 +7604,8 @@ var S3BucketProvider = class S3BucketProvider {
 		};
 		const replayOnUnusable = replayWarn(this.logger, context).onUnusable;
 		const notifConfig = properties["NotificationConfiguration"];
-		if (notifConfig) {
-			await this.applyNotificationConfiguration(bucketName, notifConfig);
-			recordEffectiveFold("NotificationConfiguration", effectiveNotificationConfiguration(notifConfig));
-		}
+		if (notifConfig) if (!await this.applyNotificationConfiguration(bucketName, notifConfig, replayOnUnusable)) overrides.set("NotificationConfiguration", void 0);
+		else recordEffectiveFold("NotificationConfiguration", effectiveNotificationConfiguration(notifConfig));
 		const corsConfig = properties["CorsConfiguration"];
 		if (corsConfig?.CorsRules && Array.isArray(corsConfig.CorsRules) && corsConfig.CorsRules.length > 0) await this.applyCorsConfiguration(bucketName, corsConfig);
 		else if (corsConfig != null) this.announceCreateEmptyCollectionSkip("CorsConfiguration", "CorsConfiguration.CorsRules");
@@ -7421,11 +7956,9 @@ var S3BucketProvider = class S3BucketProvider {
 					if (r.Status !== void 0) out["Status"] = r.Status;
 					if (r.Prefix !== void 0) out["Prefix"] = r.Prefix;
 					if (r.Expiration) {
-						const exp = {};
-						if (r.Expiration.Days !== void 0) exp["Days"] = r.Expiration.Days;
-						if (r.Expiration.Date !== void 0) exp["Date"] = r.Expiration.Date.toISOString();
-						if (r.Expiration.ExpiredObjectDeleteMarker !== void 0) exp["ExpiredObjectDeleteMarker"] = r.Expiration.ExpiredObjectDeleteMarker;
-						out["Expiration"] = exp;
+						if (r.Expiration.Days !== void 0) out["ExpirationInDays"] = r.Expiration.Days;
+						if (r.Expiration.Date !== void 0) out["ExpirationDate"] = r.Expiration.Date.toISOString();
+						if (r.Expiration.ExpiredObjectDeleteMarker !== void 0) out["ExpiredObjectDeleteMarker"] = r.Expiration.ExpiredObjectDeleteMarker;
 					}
 					if (r.Transitions && r.Transitions.length > 0) out["Transitions"] = r.Transitions.map((t) => {
 						const item = {};
@@ -58338,9 +58871,17 @@ function stackTreeToJson(roots) {
 * PR B2 — until that lands, the orchestrator hard-errors at submission
 * time with a clear pointer.
 *
-* The list is intentionally narrow. Other resource types CFn may not yet
-* support for import are surfaced as errors by the CreateChangeSet call
-* itself; we do not try to maintain a closed allowlist here.
+* The list is intentionally narrow, and stays hand-written because each member
+* is a cdkd / CDK construct rather than something the registry describes.
+*
+* It is NOT the only refusal, though — the "defer to the CreateChangeSet
+* error" note this comment used to end on was revisited in issue
+* [#1659](https://github.com/go-to-k/cdkd/issues/1659). Types AWS refuses for
+* IMPORT because their registry schema declares no `read` handler are now
+* caught by {@link buildImportPlan}'s pre-flight instead, which needs no
+* hand-maintained list (the signal is derived from the schema cdkd already
+* fetches for the identifier) and names every offender in one pass — AWS's own
+* error names only some of them.
 */
 const NEVER_IMPORTABLE_TYPES = /* @__PURE__ */ new Set(["AWS::CDK::Metadata"]);
 /**
@@ -58513,6 +59054,16 @@ const COMPOSITE_ID_SPLITTERS = {
 			propertiesOverlay: { ApiId: apiId }
 		};
 	},
+	"AWS::S3Tables::Namespace": (physicalId) => {
+		const parts = physicalId.split("|");
+		if (parts.length !== 2) throw new Error(`expected 2 parts ('<tableBucketARN>|<namespaceName>'), got ${parts.length}: '${physicalId}'`);
+		const [tableBucketARN, namespace] = parts;
+		if (!tableBucketARN || !namespace) throw new Error(`empty part in '<tableBucketARN>|<namespaceName>': '${physicalId}'`);
+		return { resourceIdentifier: {
+			TableBucketARN: tableBucketARN,
+			Namespace: namespace
+		} };
+	},
 	"AWS::Lambda::Permission": (physicalId, properties) => {
 		const functionName = readStringProperty(properties, "FunctionName", "AWS::Lambda::Permission");
 		return {
@@ -58598,6 +59149,144 @@ function readStringProperty(properties, key, resourceType) {
 	return v;
 }
 /**
+* Types whose cdkd physicalId is a COMPOSITE (`|`-joined) string while
+* CloudFormation's `primaryIdentifier` is a SINGLE field — so the physicalId is
+* NOT the identifier value, and it is not a SPLIT of the composite either
+* (issue [#1659](https://github.com/go-to-k/cdkd/issues/1659)).
+*
+* ## Why this table exists next to `COMPOSITE_ID_SPLITTERS`
+*
+* `resolveResourceIdentifier` used to conflate two independent questions: the
+* ARITY of the CFn identifier, and the FORMAT of cdkd's physical id. The
+* single-field branch assumed "the physicalId IS the identifier value", which
+* holds for every type whose id is a scalar and silently produces a wrong value
+* for a composite-id type whose CFn identifier happens to be single-field —
+* `{ TableARN: 'arn:aws:s3tables:...|analytics|events' }` for an
+* `AWS::S3Tables::Table`. `COMPOSITE_ID_SPLITTERS` cannot fix that: it is only
+* consulted on the multi-field branch, so registering a type there would add an
+* entry no code path reaches.
+*
+* This table is consulted BEFORE the arity branch, so the two concerns are
+* separated: a registered type never takes the "physicalId is the identifier"
+* assumption regardless of what the schema's field count says.
+*
+* ## Why a RESOLVE and not a split
+*
+* The correct identifier for each member is a different value entirely, not a
+* segment of the composite — an ARN AWS minted, or an `sgr-` rule id. So each
+* entry reads the value cdkd recorded in state (`attributes`), and refuses when
+* it is absent rather than guessing.
+*
+* ## Live measurement (us-east-1, 2026-08-13)
+*
+* Every field below is BOTH the type's single-field `primaryIdentifier` AND
+* `readOnlyProperties`, which is why each resolution returns an EMPTY
+* `propertiesOverlay`: writing a read-only property into the synth template's
+* `Properties` block is rejected by CFn at changeset-create.
+*
+* | Type | `primaryIdentifier` | recorded as |
+* |---|---|---|
+* | `AWS::AppSync::DataSource` | `DataSourceArn` | `attributes.DataSourceArn` |
+* | `AWS::AppSync::Resolver` | `ResolverArn` | `attributes.ResolverArn` |
+* | `AWS::S3Tables::Table` | `TableARN` | `attributes.TableARN` |
+* | `AWS::EC2::SecurityGroupIngress` | `Id` | NOTHING (issue #1761) |
+*
+* All four declare a `read` handler, so CFn genuinely does accept them for
+* IMPORT — unlike `AWS::Glue::Table`, the type issue #1659's title names, which
+* CFn rejects outright (see {@link typeIsImportUnsupported}).
+*/
+const COMPOSITE_PHYSICAL_ID_IDENTIFIERS = {
+	"AWS::AppSync::DataSource": recordedArnIdentifier({
+		resourceType: "AWS::AppSync::DataSource",
+		field: "DataSourceArn",
+		physicalIdShape: "<apiId>|<name>",
+		arnServiceSegment: "appsync"
+	}),
+	"AWS::AppSync::Resolver": recordedArnIdentifier({
+		resourceType: "AWS::AppSync::Resolver",
+		field: "ResolverArn",
+		physicalIdShape: "<apiId>|<typeName>|<fieldName>",
+		arnServiceSegment: "appsync"
+	}),
+	"AWS::S3Tables::Table": recordedArnIdentifier({
+		resourceType: "AWS::S3Tables::Table",
+		field: "TableARN",
+		physicalIdShape: "<tableBucketARN>|<namespace>|<name>",
+		arnServiceSegment: "s3tables"
+	}),
+	"AWS::EC2::SecurityGroupIngress": {
+		field: "Id",
+		resolve: ({ logicalId }) => {
+			throw new Error(`cdkd's physical id for AWS::EC2::SecurityGroupIngress is the composite '<groupId>|<ipProtocol>|<fromPort>|<toPort>', but CloudFormation IMPORT identifies the rule by the 'sgr-...' security-group rule id AWS assigns, which cdkd does not record in state (tracked in https://github.com/go-to-k/cdkd/issues/1761). Remove '${logicalId}' from the stack before exporting (the rule stays in AWS and can be re-declared in CloudFormation afterwards), or destroy it first and let CloudFormation create it fresh.`);
+		}
+	}
+};
+/**
+* Build the {@link CompositePhysicalIdIdentifier} for a type whose CFn
+* identifier is an ARN cdkd records in `attributes` under the SAME name as the
+* `primaryIdentifier` field.
+*
+* Two accepted sources, mirroring the splitter family's "both shapes exist in
+* state in the wild" contract:
+*
+* 1. the recorded attribute, which is what a fresh deploy and a cdkd `import`
+*    both write; and
+* 2. a physicalId that is ALREADY the bare ARN. Two live producers:
+*    `S3TablesProvider.importTable` records it for a Cloud-Control-routed
+*    table (CC's identifier for the type IS the ARN), and an AppSync child
+*    adopted through `cdkd import --migrate-from-cloudformation` records
+*    CloudFormation's `PhysicalResourceId` verbatim, which is likewise the
+*    ARN.
+*
+* **Both sources are validated by the SAME predicate.** An earlier cut checked
+* the ARN's shape only on source 2 — the rare one — while source 1, which
+* fires on essentially every export, accepted any non-blank string verbatim.
+* That is the wrong way round: a hand-edited state row, a row written by an
+* older binary that recorded the composite under the attribute name, or an ARN
+* for a different service sitting under `attributes.<field>` would each have
+* been shipped as the IMPORT identifier and silently adopted the WRONG
+* resource, which is precisely what this table exists to prevent.
+*
+* Anything failing both sources is refused. That covers the degraded record
+* `docs/state-management.md` describes — written by a cdkd older than the fix
+* that started recording the ARN, or by an import that could not reach STS —
+* and the remedy is the one that doc already gives.
+*/
+function recordedArnIdentifier(options) {
+	const { resourceType, field, physicalIdShape, arnServiceSegment } = options;
+	/**
+	* Is this value usable AS the type's CFn identifier?
+	*
+	* - `arn:` prefix and the type's own SERVICE segment: an ARN naming another
+	*   service is a different value entirely. Partition-agnostic by
+	*   construction, so `arn:aws-cn:s3tables:...` matches.
+	* - no `|`: cdkd's composite for `AWS::S3Tables::Table` is built FROM the
+	*   bucket ARN, so it satisfies both checks above — the separator test is
+	*   what distinguishes the composite from the identifier, on BOTH sources.
+	*/
+	const isUsableIdentifier = (value) => {
+		const trimmed = value.trim();
+		return trimmed.startsWith("arn:") && trimmed.includes(`:${arnServiceSegment}:`) && !trimmed.includes("|");
+	};
+	return {
+		field,
+		resolve: ({ logicalId, physicalId, attributes }) => {
+			const recorded = attributes[field];
+			if (typeof recorded === "string" && isUsableIdentifier(recorded)) return recorded.trim();
+			if (isUsableIdentifier(physicalId)) return physicalId.trim();
+			const recordedNote = typeof recorded === "string" && recorded.trim() ? `attributes.${field} is recorded as '${recorded.trim()}', which is not a ${arnServiceSegment} ARN` : `attributes.${field} is missing or empty`;
+			throw new Error(`cdkd's physical id for ${resourceType} is the composite '${physicalIdShape}', but CloudFormation IMPORT identifies the resource by its ${field}, which cdkd state does not record usably for '${logicalId}' (${recordedNote}). Re-deploy the stack once so cdkd records ${field}, then re-run cdkd export.`);
+		}
+	};
+}
+/**
+* Every type registered in {@link COMPOSITE_PHYSICAL_ID_IDENTIFIERS}. Exported
+* so a test can assert the table's SIZE, not just membership — a new entry
+* needs a measurement row in the table's doc comment, and a size-blind test
+* would let one land silently.
+*/
+const COMPOSITE_PHYSICAL_ID_IDENTIFIER_TYPES = Object.keys(COMPOSITE_PHYSICAL_ID_IDENTIFIERS);
+/**
 * Resource types AWS does NOT support in IMPORT changesets but DOES
 * support normal CREATE for. cdkd handles these via a pre-delete + phase-2
 * CREATE dance (see {@link RecreateBeforePhase2Entry}). When the user
@@ -58751,17 +59440,20 @@ async function exportCommand(stackArg, options) {
 				}
 			}
 		}
+		const { phase1Imports, phase2Creates, recreateBeforePhase2, nestedStackRows, blocked } = await buildImportPlan(state, template, awsClients.cloudFormation, resolvedStackName, {
+			recreateImportUnsupported: options.recreateImportUnsupported,
+			skipImportSupportPreflight: options.skipImportSupportPreflight
+		});
+		if (blocked.length > 0) {
+			logger.error("The following resources block migration:");
+			for (const b of blocked) logger.error(`  - ${b.logicalId} (${b.resourceType}): ${b.reason}`);
+			throw new Error(`${blocked.length} resource(s) block migration. Either destroy them first (cdkd destroy / cdkd state destroy cherry-picked), or remove them from the CDK app and re-synthesize.`);
+		}
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
 		if (!options.dryRun) {
 			if (!await lockManager.acquireLock(resolvedStackName, targetRegion, owner, "export")) throw new Error(`Could not acquire lock for stack '${resolvedStackName}' (${targetRegion}) — another cdkd process holds it. Wait for it to finish, or run 'cdkd force-unlock ${resolvedStackName}' if you are certain no other process is active.`);
 		}
 		try {
-			const { phase1Imports, phase2Creates, recreateBeforePhase2, nestedStackRows, blocked } = await buildImportPlan(state, template, awsClients.cloudFormation, resolvedStackName, { recreateImportUnsupported: options.recreateImportUnsupported });
-			if (blocked.length > 0) {
-				logger.error("The following resources block migration:");
-				for (const b of blocked) logger.error(`  - ${b.logicalId} (${b.resourceType}): ${b.reason}`);
-				throw new Error(`${blocked.length} resource(s) block migration. Either destroy them first (cdkd destroy / cdkd state destroy cherry-picked), or remove them from the CDK app and re-synthesize.`);
-			}
 			if (nestedStackRows.length > 0) {
 				const nestedStackTree = await buildCdkdStateStackTree(resolvedStackName, targetRegion, stateBackend, state);
 				reportDriftBaselineGaps(state, logger);
@@ -58804,7 +59496,8 @@ async function exportCommand(stackArg, options) {
 						dryRun: options.dryRun,
 						yes: options.yes,
 						includeNonImportable: options.includeNonImportable,
-						recreateImportUnsupported: options.recreateImportUnsupported
+						recreateImportUnsupported: options.recreateImportUnsupported,
+						skipImportSupportPreflight: options.skipImportSupportPreflight
 					}
 				})).outcome === "success") printNextSteps({
 					cfnStackName: options.cfnStackName ?? cdkd2cfnStackName(resolvedStackName),
@@ -59343,7 +60036,16 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 		}
 		let resolved;
 		try {
-			resolved = await resolveResourceIdentifier(resourceType, stateEntry.physicalId, stateEntry.properties ?? {}, cfnClient, identifierCache);
+			const schemaInfo = await cachedTypeSchemaInfo(resourceType, cfnClient, identifierCache);
+			if (!options.skipImportSupportPreflight && typeIsImportUnsupported(schemaInfo)) {
+				blocked.push({
+					logicalId,
+					resourceType,
+					reason: `AWS CloudFormation does not support ${resourceType} in IMPORT changesets: its CloudFormation registry schema declares no 'read' handler (and reports the type as NON_PROVISIONABLE), and IMPORT needs that handler to look the resource up by identifier. CreateChangeSet would reject the whole export with "ResourceTypes [${resourceType}] are not supported for Import". Remove the resource from the stack before exporting (it stays in AWS and can be re-declared in CloudFormation afterwards), or destroy it first and let CloudFormation create it fresh. If AWS has since added IMPORT support for this type, please open a cdkd issue.`
+				});
+				continue;
+			}
+			resolved = resolveResourceIdentifier(resourceType, logicalId, stateEntry.physicalId, stateEntry.properties ?? {}, stateEntry.attributes ?? {}, schemaInfo);
 		} catch (err) {
 			blocked.push({
 				logicalId,
@@ -59373,6 +60075,11 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 * `ResourcesToImport[].ResourceIdentifier` for the given resource type
 * and cdkd state's physical ID.
 *
+* Types whose cdkd physicalId is COMPOSITE while the CFn identifier is a
+* single field (`COMPOSITE_PHYSICAL_ID_IDENTIFIERS`): resolved from cdkd
+* state's recorded attributes, BEFORE the field-count branch below — the
+* physicalId is neither the identifier nor a source to split (issue #1659).
+*
 * Single-key types: the map has a single entry keyed by the schema's
 * primaryIdentifier field name (e.g. `{ BucketName: 'my-bucket' }`).
 *
@@ -59382,16 +60089,27 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 * into one entry per field. Composite types without a registered
 * splitter surface a clear error pointing at where to add one.
 *
-* Prefers `DescribeType` (the authoritative AWS-internal registry) and
-* falls back to a hardcoded single-key table when DescribeType fails
-* (insufficient permissions, throttling, obscure type without a registry
-* entry).
-*/
-async function resolveResourceIdentifier(resourceType, physicalId, properties, cfnClient, cache) {
-	let entry = cache.get(resourceType);
-	if (entry === void 0) {
-		entry = await fetchPrimaryIdentifier(resourceType, cfnClient);
-		cache.set(resourceType, entry);
+* `entry` is the caller's already-resolved registry-schema info — see
+* {@link cachedTypeSchemaInfo}, which prefers `DescribeType` (the authoritative
+* AWS-internal registry) and falls back to a hardcoded single-key table when
+* DescribeType fails (insufficient permissions, throttling, obscure type
+* without a registry entry). Taking it as a parameter rather than fetching is
+* what keeps `buildImportPlan` to ONE DescribeType per type across both the
+* IMPORT pre-flight and this resolution.
+*/
+function resolveResourceIdentifier(resourceType, logicalId, physicalId, properties, attributes, entry) {
+	const compositeIdentifier = COMPOSITE_PHYSICAL_ID_IDENTIFIERS[resourceType];
+	if (compositeIdentifier) {
+		if (entry.fields.length !== 1 || entry.fields[0] !== compositeIdentifier.field) throw new Error(`${resourceType} is registered in COMPOSITE_PHYSICAL_ID_IDENTIFIERS as identified by '${compositeIdentifier.field}', but CloudFormation now reports primaryIdentifier [${entry.fields.join(", ")}]. The registry schema changed under cdkd — update the entry in src/cli/commands/export.ts (or move the type to COMPOSITE_ID_SPLITTERS if its identifier is now composite too)`);
+		const value = compositeIdentifier.resolve({
+			logicalId,
+			physicalId,
+			attributes
+		});
+		return {
+			resourceIdentifier: { [compositeIdentifier.field]: value },
+			propertiesOverlay: {}
+		};
 	}
 	if (entry.fields.length === 1) return { resourceIdentifier: { [entry.fields[0]]: physicalId } };
 	const splitter = COMPOSITE_ID_SPLITTERS[resourceType];
@@ -59406,6 +60124,53 @@ async function resolveResourceIdentifier(resourceType, physicalId, properties, c
 	return result;
 }
 /**
+* Cache-consulting wrapper around {@link fetchPrimaryIdentifier}. Shared by
+* `resolveResourceIdentifier` and `buildImportPlan`'s pre-flight so one
+* DescribeType per type answers both questions.
+*/
+async function cachedTypeSchemaInfo(resourceType, cfnClient, cache) {
+	const cached = cache.get(resourceType);
+	if (cached !== void 0) return cached;
+	const entry = await fetchPrimaryIdentifier(resourceType, cfnClient);
+	cache.set(resourceType, entry);
+	return entry;
+}
+/**
+* True when the registry schema says CloudFormation will refuse the type in an
+* IMPORT changeset (`ValidationError: ResourceTypes [<T>] are not supported
+* for Import`) — IMPORT looks the resource up by identifier through the type's
+* `read` handler, so a type without one cannot be adopted.
+*
+* Live-measured (us-east-1, 2026-08-13) against `CreateChangeSet
+* --change-set-type IMPORT`: `AWS::Glue::Table` / `AWS::Route53::RecordSet` /
+* `AWS::AppSync::ApiKey` / `AWS::EC2::NetworkAclEntry` /
+* `AWS::Route53::RecordSetGroup` / `AWS::SQS::QueuePolicy` /
+* `AWS::SNS::TopicPolicy` all lack a `read` handler, are all
+* `NON_PROVISIONABLE`, and were all rejected; `AWS::S3::Bucket`
+* (`FULLY_MUTABLE`, read handler present) passed the type check. Both shapes
+* of "no read handler" occur and both count: NO `handlers` block at all (the
+* legacy types) and a `handlers` block whose keys are only create / update /
+* delete (`AWS::EC2::NetworkAclEntry`).
+*
+* **Why the verdict needs TWO agreeing fields.** Reading "the `handlers` key is
+* missing" as a refusal on its own makes any partial or unusual response block
+* an export that works today — the one regression this pre-flight could cause,
+* and strictly worse than the status quo of letting AWS answer. So the refusal
+* also requires `ProvisioningType: NON_PROVISIONABLE`; a response satisfying
+* only one of the two resolves to `unknown` and is left to CreateChangeSet.
+*
+* The two were perfectly CORRELATED across the 21 types sampled on 2026-08-13
+* (every no-read-handler type was NON_PROVISIONABLE and vice versa), so on
+* today's registry the conjunction's real work is requiring a COMPLETE
+* DescribeType response before refusing. The `read` handler stays the primary
+* signal because it is the mechanistic reason CFn accepts a type for IMPORT —
+* refusing on `ProvisioningType` alone would reject a NON_PROVISIONABLE type
+* that does declare one, should AWS ever publish that combination.
+*/
+function typeIsImportUnsupported(entry) {
+	return entry.importSupport === "unsupported";
+}
+/**
 * Fetch the primary identifier field names for a resource type, with a
 * hardcoded single-key fallback when DescribeType is unavailable.
 */
@@ -59413,15 +60178,26 @@ async function fetchPrimaryIdentifier(resourceType, cfnClient) {
 	try {
 		const resp = await describeTypeWithThrottleRetry(resourceType, cfnClient);
 		if (resp.Schema) {
-			const primary = JSON.parse(resp.Schema).primaryIdentifier;
-			if (Array.isArray(primary) && primary.length > 0 && primary.every((p) => typeof p === "string")) return { fields: primary.map((p) => p.replace(/^\/properties\//, "")) };
+			const parsed = JSON.parse(resp.Schema);
+			const primary = parsed.primaryIdentifier;
+			if (Array.isArray(primary) && primary.length > 0 && primary.every((p) => typeof p === "string")) {
+				const fields = primary.map((p) => p.replace(/^\/properties\//, ""));
+				const handlers = parsed.handlers;
+				return {
+					fields,
+					importSupport: typeof handlers === "object" && handlers !== null && Object.prototype.hasOwnProperty.call(handlers, "read") ? "importable" : resp.ProvisioningType === "NON_PROVISIONABLE" ? "unsupported" : "unknown"
+				};
+			}
 		}
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
 		getLogger().debug(`DescribeType failed for ${resourceType}: ${msg} — using fallback`);
 	}
 	const fallback = PRIMARY_IDENTIFIER_FALLBACK[resourceType];
-	if (fallback) return { fields: [fallback] };
+	if (fallback) return {
+		fields: [fallback],
+		importSupport: "unknown"
+	};
 	throw new Error(`primary identifier unknown (DescribeType returned no usable schema and no fallback is registered). Add ${resourceType} to PRIMARY_IDENTIFIER_FALLBACK in export.ts, or open an issue.`);
 }
 /**
@@ -60347,7 +61123,10 @@ async function runPerStackImportLoop(args) {
 	const perStackPlans = [];
 	for (const node of leafFirst) {
 		const meta = nodesByCdkdName.get(node.stackName);
-		const plan = await buildImportPlan(meta.state, meta.template, deps.cfnClient, meta.cdkdStackName, { recreateImportUnsupported: options.recreateImportUnsupported });
+		const plan = await buildImportPlan(meta.state, meta.template, deps.cfnClient, meta.cdkdStackName, {
+			recreateImportUnsupported: options.recreateImportUnsupported,
+			skipImportSupportPreflight: options.skipImportSupportPreflight === true
+		});
 		if (plan.blocked.length > 0) {
 			const lines = plan.blocked.map((b) => `  - ${b.logicalId} (${b.resourceType}): ${b.reason}`);
 			throw new Error(`Stack '${meta.cdkdStackName}' has ${plan.blocked.length} resource(s) that block migration:\n${lines.join("\n")}`);
@@ -60763,7 +61542,7 @@ async function confirmPrompt$3(prompt) {
 	}
 }
 function createExportCommand() {
-	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.").option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (currently only AWS::ApiGatewayV2::Stage, emitted by CDK HttpApi). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
+	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.").option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--skip-import-support-preflight", "Skip the pre-flight that refuses resource types whose CloudFormation registry schema says CFn cannot IMPORT them (no read handler AND NON_PROVISIONABLE), and let CreateChangeSet answer instead. The pre-flight is a registry HEURISTIC, not AWS's supported-for-import list, so this is the escape hatch for a type AWS has since made importable. Expect the changeset to be rejected if the heuristic was right.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (currently only AWS::ApiGatewayV2::Stage, emitted by CDK HttpApi). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -74608,7 +75387,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.23");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.25");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;