@go-to-k/cdkd 0.281.24 → 0.281.26

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as MIGRATE_TMP_PREFIX, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as getDefaultStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerStreaming, G as getAccountInfo, Gt as resolveSkipPrefix, H as isTerminationProtectionPropagationError, Ht as resolveApp, I as ProviderRegistry, It as AssetManifestLoader, J as normalizeAwsTagsToCfn, Jt as resolveUseCdkBootstrapAssets, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefault, L as findActionableSilentDrops, Lt as getDockerImageBySourceHash, M as yellow, Mt as formatDockerLoginError, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as getDockerCmd, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as runDockerForeground, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_URL_LIMIT, R as findSilentDropProperties, Rt as Synthesizer, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveAutoAssetStorage, V as disableInstanceApiTermination, Vt as getLegacyStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveCaptureObservedState, X as assertRegionMatch, Xt as warnDeprecatedNoPrefixCliFlag, Y as resolveExplicitPhysicalId, Yt as stateBucketExistenceConfirmed, Z as coerceCfnBoolean, Zt as CFN_TEMPLATE_BODY_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as findLargeInlineResources, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as buildDockerImage, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as expectedOwnerParam, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefaultAndSource, r as DeployEngine, rn as derivePartitionAndUrlSuffix, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as uploadCfnTemplate, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as synthesisStatusMessage } from "./deploy-engine-BkXNtI7L.js";
+import { $ as configStringRefusal, $t as MIGRATE_TMP_PREFIX, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as getDefaultStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerStreaming, G as getAccountInfo, Gt as resolveSkipPrefix, H as isTerminationProtectionPropagationError, Ht as resolveApp, I as ProviderRegistry, It as AssetManifestLoader, J as normalizeAwsTagsToCfn, Jt as resolveUseCdkBootstrapAssets, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefault, L as findActionableSilentDrops, Lt as getDockerImageBySourceHash, M as yellow, Mt as formatDockerLoginError, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as getDockerCmd, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as runDockerForeground, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_URL_LIMIT, R as findSilentDropProperties, Rt as Synthesizer, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveAutoAssetStorage, V as disableInstanceApiTermination, Vt as getLegacyStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveCaptureObservedState, X as assertRegionMatch, Xt as warnDeprecatedNoPrefixCliFlag, Y as resolveExplicitPhysicalId, Yt as stateBucketExistenceConfirmed, Z as coerceCfnBoolean, Zt as CFN_TEMPLATE_BODY_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as findLargeInlineResources, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as buildDockerImage, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as expectedOwnerParam, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefaultAndSource, r as DeployEngine, rn as derivePartitionAndUrlSuffix, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as uploadCfnTemplate, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as synthesisStatusMessage } from "./deploy-engine-XC8HOR51.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CxK7d3pH.js";
+import { t as ASGProvider } from "./asg-provider-II3TmZ4t.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -5172,10 +5172,81 @@ function foldToleratedAliases(bag, aliases) {
 	}
 	return out ?? bag;
 }
+/** The transition date member, held in a CONST so the fold writes it COMPUTED. */
+const TRANSITION_DATE_KEY = "TransitionDate";
 /** The lifecycle `Transitions[]` aliases the applier accepts (issue #1748). */
 const TRANSITION_ALIASES = [["TransitionInDays", "Days"], ["TransitionDate", "Date"]];
 /** The lifecycle `NoncurrentVersionTransitions[]` alias (issue #1748). */
 const NONCURRENT_VERSION_TRANSITION_ALIASES = [["TransitionInDays", "NoncurrentDays"]];
+/** The refusal path for the notification EventBridge boolean (issue #1759). */
+const EVENTBRIDGE_CONFIG_PATH = "AWS::S3::Bucket NotificationConfiguration.EventBridgeConfiguration";
+/**
+* The block's own key, held in a CONST so the fold below writes it as a
+* COMPUTED key.
+*
+* Load-bearing, not style: `gen-nested-key-coverage`'s write-evidence walk reads
+* a bag-derived spread-and-patch literal that NAMES a member
+* (`{ ...config, EventBridgeConfiguration: … }`) as the #1475 whole-blob
+* HAND-OFF and wildcard-credits everything beneath that path as DELIVERED — so
+* a DIFF-side fold spelled that way would switch the write pass off for the
+* whole notification subtree, and the critic's only visible complaint would be
+* that some allow-list entries went "stale". Same reason
+* {@link canonicalizeBlock} exists.
+*/
+const EVENTBRIDGE_CONFIG_KEY = "EventBridgeConfiguration";
+/**
+* What a DECLARED `EventBridgeConfiguration` block with no `EventBridgeEnabled`
+* key means. CFn marks the member required, so the block's presence is the
+* affirmative declaration; this is also the pre-#1759 behavior for that shape.
+*/
+const EVENTBRIDGE_DEFAULT_ENABLED = true;
+/**
+* The boolean the wire derives from a USABLE `EventBridgeConfiguration` block
+* (issue #1759) — the ONE definition `applyNotificationConfiguration` and
+* {@link effectiveNotificationConfiguration} share, so the value that goes on
+* the wire and the value recorded into state cannot drift apart.
+*
+* Callers MUST have cleared `configBooleanRefusal` first; the `??` is only
+* correct once every declared-but-unusable value has been refused.
+*/
+function eventBridgeEnabledOf(eb) {
+	return coerceCfnBoolean(isPlainObject$1(eb) ? eb["EventBridgeEnabled"] : void 0) ?? EVENTBRIDGE_DEFAULT_ENABLED;
+}
+/** The notification families whose empty declaration is never SENT (issue #1759). */
+const NOTIFICATION_LIST_KEYS = [
+	"TopicConfigurations",
+	"QueueConfigurations",
+	"LambdaConfigurations"
+];
+/**
+* Drop a declared-but-EMPTY collection the applier never sends (issue #1759).
+*
+* MEASURED before choosing this answer, because the sibling shape answers the
+* opposite way: the lifecycle / CORS empty-collection skip RECORDS its
+* placeholder (issue #1718) precisely because `readLifecycle` / `readCors`
+* always emit `{Rules: []}` / `{CorsRules: []}` for an unconfigured bucket, so
+* the declared empty collection already equals the readback. `readNotification`
+* does NOT: each family is emitted only under
+* `resp.<Family> && resp.<Family>.length > 0`, so an unconfigured bucket comes
+* back with the key ABSENT. A record keeping `[]` therefore describes a key set
+* AWS can never report, and the honest answer here is the DROP.
+*
+* Scoped to a genuinely EMPTY ARRAY. A non-array declaration is skipped by the
+* applier's `Array.isArray(...)` gate too, but it is MALFORMED: dropping it
+* would make the desired side compare equal and stop the difference being
+* reported, which is the concealment `.claude/rules/providers.md` finding 3
+* refuses. It is left visible instead.
+*/
+function dropEmptyNotificationFamilies(config) {
+	let out;
+	for (const listKey of NOTIFICATION_LIST_KEYS) {
+		const list = config[listKey];
+		if (!Array.isArray(list) || list.length > 0) continue;
+		out ??= { ...config };
+		delete out[listKey];
+	}
+	return out ?? config;
+}
 /** The `NotificationConfiguration` ARN aliases, per family (issue #1748). */
 const NOTIFICATION_ARN_ALIASES = [
 	["TopicConfigurations", [["Topic", "TopicArn"]]],
@@ -5248,6 +5319,439 @@ function effectiveNotificationConfiguration(config) {
 	if (!isPlainObject$1(config)) return config;
 	let out = config;
 	for (const [listKey, aliases] of NOTIFICATION_ARN_ALIASES) out = canonicalizeItemList(out, listKey, (item) => foldNotificationEvents(foldToleratedAliases(item, aliases)));
+	out = dropEmptyNotificationFamilies(out);
+	return foldEventBridgeConfiguration(out);
+}
+/**
+* Normalize `EventBridgeConfiguration` onto the shape `readNotification` emits
+* (issue #1759, items 2 and 3 of the same block).
+*
+* CFn is stringly typed, so `EventBridgeEnabled: 'true'` is a legitimate
+* declaration; the wire turns the value into presence/absence and
+* `readNotification` emits the BOOLEAN (`{EventBridgeEnabled: <bool>}`, the
+* #1430 shape). A record holding the STRING can therefore never match the
+* readback. This is #1633's lossless-coercion arm and it meets the #1643 bar —
+* what AWS reports back is exactly the boolean cdkd derived at send time. A
+* declared `null` folds to `false` for the same reason: the applier reads it as
+* "block omitted" and sends nothing.
+*
+* Keyed off the DECLARED shape and off the wire's own predicate, never off a
+* refusal: a value `configBooleanRefusal` rejects is left COMPLETELY alone (no
+* patch, and the key not dropped), because the wire SKIPS the whole Put for it
+* and AWS keeps the previous configuration. Folding it would collapse the
+* desired side onto the retained value, the provider would never be called, and
+* the skip warning would stop — the "mirror what the wire does" rule.
+*
+* MEASURED AND DELIBERATELY NOT FOLDED (1) — the per-item `Id`, which issue
+* #1755 asked to be measured rather than assumed. The applier sends
+* `Id: t['Id']`, so a template declaring none sends none, AWS GENERATES one, and
+* `readNotification` emits it (`if (t.Id !== undefined) e['Id'] = t.Id`). That is
+* an AWS-COMPUTED value, not a spelling: it belongs in `observedProperties`,
+* which `readCurrentState` already populates, and `.claude/rules/providers.md` is
+* explicit that a computed value in `properties` makes the DESIRED baseline drift
+* from the template and disables the #1160 absent-field removal derivation. There
+* is also nothing to fold TOWARDS — the value does not exist at send time, which
+* is the #1643 "knowable at send time" test failing. So: no fold, by measurement
+* rather than by omission.
+*
+* MEASURED AND DELIBERATELY NOT FOLDED (2): `readNotification` emits
+* `EventBridgeConfiguration` UNCONDITIONALLY, so a notification configuration
+* that declares no EventBridge block at all is one key short of the readback.
+* That is NOT this class — nothing was declared, so there is no spelling to
+* normalize, and supplying the key would record one the template does not have
+* on EVERY notification-configured bucket (the shape #1723 records as the
+* reason its own arm was left unanswered). `readNotification`'s own comment
+* already scopes that difference: it is a ONE-TIME, self-clearing drift on the
+* `properties`-fallback baseline, deliberately accepted by #1430, not the
+* permanent phantom drift this fold exists to remove.
+*
+* @returns `config` BY IDENTITY when nothing is declared, when the declared
+*   block is already the emitted shape, or when it is unfoldable.
+*/
+function foldEventBridgeConfiguration(config) {
+	const eb = config[EVENTBRIDGE_CONFIG_KEY];
+	if (eb === void 0) return config;
+	if (eb !== null && configBooleanRefusal(eb, "EventBridgeEnabled", EVENTBRIDGE_CONFIG_PATH)) return config;
+	const enabled = eb === null ? false : eventBridgeEnabledOf(eb);
+	const declared = isPlainObject$1(eb) ? eb["EventBridgeEnabled"] : void 0;
+	if (isPlainObject$1(eb) && Object.keys(eb).length === 1 && Object.is(declared, enabled)) return config;
+	return {
+		...config,
+		[EVENTBRIDGE_CONFIG_KEY]: { EventBridgeEnabled: enabled }
+	};
+}
+/** The refusal paths the lifecycle applier and its fold SHARE (issue #1755). */
+const LIFECYCLE_RULE_PATH = "AWS::S3::Bucket LifecycleConfiguration.Rules[]";
+const LIFECYCLE_FILTER_PATH = `${LIFECYCLE_RULE_PATH}.Filter`;
+const LIFECYCLE_TAG_FILTERS_PATH = `${LIFECYCLE_RULE_PATH}.TagFilters`;
+/** What `readConfigString(rule, 'Status', ...)` substitutes for an ABSENT key. */
+const LIFECYCLE_DEFAULT_STATUS = "Enabled";
+/** The rule's status member, held in a CONST so the fold writes it COMPUTED. */
+const LIFECYCLE_STATUS_KEY = "Status";
+/**
+* Gather a rule's full location scope — module-level so the applier and the
+* fold run the SAME function rather than two copies that can disagree about
+* which key wins (`.claude/rules/providers.md`: share ONE helper with the
+* provisioning path, or state and template end up narrowed to different keys
+* and the fix becomes the bug).
+*
+* `TagFilters` lives at the RULE level in the CFn schema and CDK synthesizes it
+* there; the `Filter`-side reads are cdkd's accommodation for SDK-shaped /
+* imported input.
+*/
+function lifecycleRuleScope(rule) {
+	const filter = rule["Filter"];
+	return {
+		prefix: filter?.["Prefix"] ?? rule["Prefix"],
+		tagFilters: filter?.["TagFilters"] ?? rule["TagFilters"],
+		sizeGt: filter?.["ObjectSizeGreaterThan"] ?? rule["ObjectSizeGreaterThan"],
+		sizeLt: filter?.["ObjectSizeLessThan"] ?? rule["ObjectSizeLessThan"]
+	};
+}
+/**
+* Can this rule stay in the deprecated V1 (top-level `Prefix`) form? See
+* {@link lifecycleUsesFilterForm} — S3 forbids MIXING the two forms in one
+* configuration, so the answer is decided across the whole rule list.
+*/
+function lifecycleRuleIsPlainPrefixOnly(rule) {
+	if (rule["Filter"] != null) return false;
+	const s = lifecycleRuleScope(rule);
+	return s.prefix !== void 0 && (s.tagFilters == null || s.tagFilters.length === 0) && s.sizeGt === void 0 && s.sizeLt === void 0;
+}
+/** V1 vs V2 is decided ONCE for the whole configuration — see the applier's note. */
+function lifecycleUsesFilterForm(rules) {
+	return !rules.every(lifecycleRuleIsPlainPrefixOnly);
+}
+/** Discards the message; the fold only needs the PREDICATE's answer. */
+const IGNORE_REFUSAL_MESSAGE = () => {};
+/**
+* Would `applyLifecycleConfiguration` REFUSE this rule, and therefore skip the
+* whole Put? (issue #1755)
+*
+* Runs the applier's own three guards rather than restating them — the
+* "do not HAND-ROLL the mirror, run the wire's own predicate" rule, whose
+* cautionary tale is the S3 schedule fold, where an approximation disagreed
+* with the wire on three of nine container shapes.
+*/
+function lifecycleRuleRefused(rule) {
+	const rawFilter = rule["Filter"];
+	if (rawFilter != null && requireConfigObject(rawFilter, LIFECYCLE_FILTER_PATH, { onUnusable: IGNORE_REFUSAL_MESSAGE }) === void 0) return true;
+	const rawTagFilters = rawFilter?.["TagFilters"] ?? rule["TagFilters"];
+	if (rawTagFilters != null && requireConfigArray(rawTagFilters, LIFECYCLE_TAG_FILTERS_PATH, { onUnusable: IGNORE_REFUSAL_MESSAGE }) === void 0) return true;
+	return configStringRefusal(rule, "Status", LIFECYCLE_DEFAULT_STATUS, LIFECYCLE_RULE_PATH) !== void 0;
+}
+/**
+* Deep, key-ORDER-insensitive equality — the identity test for a fold that
+* rebuilds nested objects (`Filter`) even when nothing about them changed.
+*
+* `Object.is` alone would report every folded rule as changed and rewrite the
+* state record of every lifecycle-configured bucket; `JSON.stringify` would
+* report a pure reordering as a change, which is not one worth recording.
+*/
+function deepSameValue(a, b) {
+	if (Object.is(a, b)) return true;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((element, index) => deepSameValue(element, b[index]));
+	}
+	if (isPlainObject$1(a) && isPlainObject$1(b)) {
+		const keysA = Object.keys(a);
+		if (keysA.length !== Object.keys(b).length) return false;
+		return keysA.every((key) => key in b && deepSameValue(a[key], b[key]));
+	}
+	return false;
+}
+/**
+* The ISO string `readLifecycle` emits for a date the applier sends as
+* `new Date(value)`.
+*
+* DETERMINISM IS A PRECONDITION, not a nicety (PR review). `new Date(str)`
+* resolves an offset-less string in the HOST's local zone — `new Date('0')` is
+* `1999-12-31T15:00:00Z` under JST and `2000-01-01T00:00:00Z` under UTC, and
+* `'2030-01-01T00:00:00'` (ISO, no offset) is local by spec. The APPLIER shares
+* that dependence, so the wire and the readback still agree on any one machine —
+* but this feeds `canonicalizeDesiredProperties`, a DIFF-side pure function that
+* runs wherever the CLI runs. A CI runner in UTC and a laptop in JST would
+* canonicalize the SAME template to different ISO strings and manufacture a diff
+* neither machine can clear, which is strictly worse than the phantom drift the
+* fold exists to remove. So only the forms whose meaning is fixed by the ISO
+* 8601 spec are folded: a bare `YYYY-MM-DD` (spec-UTC), a date-time carrying
+* `Z` or a `±HH:MM` offset, and an epoch NUMBER. Everything else — `'Jan 1
+* 2030'`, `'0'`, an offset-less date-time — is left ALONE, which keeps the
+* record machine-independent at the cost of not normalizing a shape almost no
+* template uses.
+*
+* @returns `undefined` for a value that cannot become a valid `Date`, or whose
+*   `Date` would depend on the host timezone — in both cases there is no
+*   effective value this can claim AWS will report, so the fold leaves the rule
+*   alone.
+*/
+const TIMEZONE_INDEPENDENT_DATE = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2}))?$/;
+function cfnDateToIso(value) {
+	if (typeof value === "string" && !TIMEZONE_INDEPENDENT_DATE.test(value)) return void 0;
+	if (typeof value !== "string" && typeof value !== "number") return void 0;
+	const parsed = new Date(value);
+	return Number.isNaN(parsed.getTime()) ? void 0 : parsed.toISOString();
+}
+/** The legacy SINGULAR action objects the CFn schema still declares (issue #1754). */
+const LEGACY_SINGULAR_TRANSITIONS = [["Transitions", "Transition"], ["NoncurrentVersionTransitions", "NoncurrentVersionTransition"]];
+/**
+* Merge the legacy singular `Transition` / `NoncurrentVersionTransition` into
+* the plural array, exactly as the wire does (issue #1754).
+*
+* The CFn `Rule` definition still declares BOTH spellings and
+* `applyLifecycleConfiguration` folds the singular into the plural array via
+* {@link mergeLegacySingular}, so `readLifecycle` can only ever emit the plural.
+* A rule declaring the singular therefore recorded a key AWS can never
+* report — the #1686 never-emitted-KEY class through the SHAPE — with no
+* warning anywhere, because nothing is malformed and nothing is substituted.
+*
+* It shares `mergeLegacySingular` itself rather than re-deriving the collision
+* rule, per the share-ONE-helper rule. What it does NOT do is pass a no-op
+* callback and fold regardless: on a `StorageClass` COLLISION the wire DROPS the
+* singular and WARNS, so a colliding rule is left COMPLETELY alone (both keys
+* kept). The NON-colliding case, which is the population this exists for, has
+* no fault to report and folds.
+*
+* Be precise about WHICH signal that preserves, because the obvious answer is
+* wrong (PR review). It is NOT the deploy-time warning: the record and the
+* canonicalized template are folded by the same function either way, so they
+* compare equal after the first deploy and the Put stops re-firing whichever
+* choice is made. What leaving it alone preserves is the `cdkd drift` report —
+* state keeps a `Transition` key `readLifecycle` can never emit, so drift
+* re-reports the rule until the template drops one of the two declarations.
+* Folding it would make state match the readback exactly and render a
+* template fault S3 itself rejects completely invisible.
+*
+* @returns `rule` BY IDENTITY when no legacy singular is declared.
+*/
+function foldLegacySingularTransitions(rule) {
+	let out;
+	for (const [pluralKey, singularKey] of LEGACY_SINGULAR_TRANSITIONS) {
+		const singular = rule[singularKey];
+		const hasSingular = isPlainObject$1(singular);
+		const plural = rule[pluralKey];
+		const needsFilter = Array.isArray(plural) && plural.some((element) => !isPlainObject$1(element));
+		if (!hasSingular && !needsFilter) continue;
+		let collided = false;
+		const merged = mergeLegacySingular(plural, hasSingular ? singular : void 0, () => {
+			collided = true;
+		});
+		out ??= { ...rule };
+		if (collided) {
+			if (needsFilter) out[pluralKey] = merged;
+			continue;
+		}
+		out[pluralKey] = merged;
+		if (hasSingular) delete out[singularKey];
+	}
+	return out ?? rule;
+}
+/**
+* Emit a transition's `TransitionDate` as the ISO string the readback emits
+* (PR review of issues #1754 / #1755).
+*
+* The alias fold above only RENAMES `Date` -> `TransitionDate`, but the applier
+* sends `new Date(t['TransitionDate'] ?? t['Date'])` and `readLifecycle` emits
+* `t.Date.toISOString()` — so a hand-written / imported `TransitionDate:
+* '2030-01-01'` recorded a value the readback can never match, with no warning
+* and nothing malformed. Exactly the class {@link foldLifecycleExpiration}
+* closes for the RULE-level `ExpirationDate` one member over; found by review
+* because the fold and the readback were compared per member rather than
+* per item.
+*
+* `NoncurrentVersionTransitions` needs no twin of this: `toSdkNvt` has no date
+* member at all.
+*
+* @returns the item BY IDENTITY when no date is declared, or when it is one the
+*   applier would put on the wire as an Invalid Date (nothing to record).
+*/
+function foldTransitionDate(item) {
+	const declared = item[TRANSITION_DATE_KEY];
+	if (!declared) return item;
+	const iso = cfnDateToIso(declared);
+	if (iso === void 0 || iso === declared) return item;
+	const out = { ...item };
+	out[TRANSITION_DATE_KEY] = iso;
+	return out;
+}
+/**
+* Drop a declared-but-EMPTY transition list (issue #1755).
+*
+* The applier sets `sdkRule.Transitions` / `.NoncurrentVersionTransitions` only
+* when the merged array is non-empty, and `readLifecycle` emits each only under
+* `r.<List> && r.<List>.length > 0` — so an empty declaration is one key the
+* readback can never carry. Measured on the reverse-mapper, not assumed: the
+* lifecycle block's OWN empty-collection placeholder answers the opposite way
+* (issue #1718) because `readLifecycle` DOES emit `{Rules: []}`.
+*/
+function dropEmptyTransitionLists(rule) {
+	let out;
+	for (const [pluralKey] of LEGACY_SINGULAR_TRANSITIONS) {
+		const list = rule[pluralKey];
+		if (!Array.isArray(list) || list.length > 0) continue;
+		out ??= { ...rule };
+		delete out[pluralKey];
+	}
+	return out ?? rule;
+}
+/**
+* Reshape the rule's expiration onto the CFn spellings `readLifecycle` emits
+* (issue #1755 item 1).
+*
+* The CFn `Rule` definition declares `ExpirationDate` / `ExpirationInDays` and
+* the RULE-level `ExpiredObjectDeleteMarker`, and has NO `Expiration` member;
+* the applier additionally accepts a cdkd-only `Expiration` OBJECT as a third
+* source. The readback used to emit only the SDK-shaped `Expiration` object, so
+* state and the readback carried different key sets for essentially every
+* lifecycle-configured bucket CDK creates. The fix is split, per the issue: the
+* READBACK now emits the CFn scalars (recording the SDK shape instead would put
+* a spelling in state that no CFn template can declare), and this is the desired
+* side folding onto the same choice.
+*
+* The rule is left COMPLETELY alone in three cases, each because the wire does
+* something this fold must not conceal:
+*
+* - a rule-level `ExpiredObjectDeleteMarker` the wire cannot read
+*   (`coerceCfnBoolean` answers `undefined`): the wire silently ignores it, and
+*   nothing warns, so the difference is the user's only signal;
+* - a date the wire would send as an Invalid Date, or one whose `Date` depends
+*   on the host timezone (see {@link cfnDateToIso});
+* - a rule-level `ExpiredObjectDeleteMarker: true` ALONGSIDE a `Days` / `Date`:
+*   S3 forbids the combination, so the applier sends the `Days` / `Date` and
+*   WARNS that the marker was not applied. Folding the marker away on both sides
+*   would stop that difference being reported, so `cdkd drift` re-reporting it
+*   until the template drops one of the two is the correct standing signal.
+*
+* @returns `rule` BY IDENTITY when nothing expiration-shaped is declared.
+*/
+function foldLifecycleExpiration(rule) {
+	const declaredMarker = rule["ExpiredObjectDeleteMarker"];
+	const ruleLevelMarker = coerceCfnBoolean(declaredMarker);
+	if (declaredMarker !== void 0 && ruleLevelMarker === void 0) return rule;
+	if (rule["ExpirationInDays"] === void 0 && rule["ExpirationDate"] === void 0 && rule["Expiration"] === void 0 && declaredMarker === void 0) return rule;
+	const expiration = rule["ExpirationInDays"] || rule["ExpirationDate"] || rule["Expiration"];
+	let days;
+	let date;
+	let marker;
+	if (typeof expiration === "number") days = expiration;
+	else if (typeof expiration === "string") {
+		const iso = cfnDateToIso(expiration);
+		if (iso === void 0) return rule;
+		date = iso;
+	} else if (isPlainObject$1(expiration)) {
+		if (expiration["Days"] !== void 0) days = expiration["Days"];
+		if (expiration["Date"]) {
+			const iso = cfnDateToIso(expiration["Date"]);
+			if (iso === void 0) return rule;
+			date = iso;
+		}
+		const nested = expiration["ExpiredObjectDeleteMarker"];
+		if (nested !== void 0) {
+			if (typeof nested !== "boolean") return rule;
+			marker = nested;
+		}
+	} else if (expiration) return rule;
+	if (ruleLevelMarker === true) {
+		if (days !== void 0 || date !== void 0) return rule;
+		days = void 0;
+		date = void 0;
+		marker = true;
+	}
+	const out = { ...rule };
+	delete out["ExpirationInDays"];
+	delete out["ExpirationDate"];
+	delete out["Expiration"];
+	delete out["ExpiredObjectDeleteMarker"];
+	if (days !== void 0) out["ExpirationInDays"] = days;
+	if (date !== void 0) out["ExpirationDate"] = date;
+	if (marker !== void 0) out["ExpiredObjectDeleteMarker"] = marker;
+	return out;
+}
+/**
+* Fold the legacy scalar `NoncurrentVersionExpirationInDays` onto the OBJECT
+* form `readLifecycle` emits (issue #1755 item 2).
+*
+* CFn declares BOTH spellings here — unlike the expiration sibling above — so
+* the readback has to pick one and the desired side has to fold to the same
+* choice. The OBJECT wins because it is the only one that can express
+* `NewerNoncurrentVersions`, so folding towards it is lossless in both
+* directions; and it is also what the wire already prefers when both are
+* declared, which is why a rule carrying both simply DROPS the scalar here.
+*
+* `coerceCfnNumber`, not `typeof === 'number'`: it is the predicate the wire
+* runs, and the wire sends the COERCED number, so a hand-written `"365"` is
+* recorded as `365` — exactly what AWS reports back.
+*/
+function foldNoncurrentVersionExpiration(rule) {
+	const legacy = rule["NoncurrentVersionExpirationInDays"];
+	if (legacy === void 0) return rule;
+	const declaredObject = rule["NoncurrentVersionExpiration"];
+	if (declaredObject !== void 0 && !isPlainObject$1(declaredObject)) return rule;
+	const out = { ...rule };
+	delete out["NoncurrentVersionExpirationInDays"];
+	if (isPlainObject$1(declaredObject)) return out;
+	const days = coerceCfnNumber(legacy);
+	if (days === void 0) return rule;
+	out["NoncurrentVersionExpiration"] = { NoncurrentDays: days };
+	return out;
+}
+/**
+* Rebuild the rule's location scope in the shape `readLifecycle` emits for the
+* `Filter` the applier actually sends (issue #1755 item 3).
+*
+* This is not a spelling at all but a defaulted-but-SENT member (#1718's
+* class): a rule with no declared scope is SENT `Filter: {Prefix: ''}` in a V2
+* configuration, AWS holds it, the readback reports it, and the record was one
+* key short. The fold is wider than the issue's headline because the same round
+* trip moves three more shapes — a bare top-level `Prefix` becomes
+* `Filter: {Prefix}`, rule-level `TagFilters` become `Filter: {TagFilters}`, and
+* rule-level `ObjectSize*` move under `Filter` — all of which the readback emits
+* only under `Filter`.
+*
+* `useFilterForm` is decided ACROSS ALL RULES, which is why this takes it as a
+* parameter instead of being a pure per-rule function: in a V1 configuration
+* (every rule scoped by exactly one top-level `Prefix`) nothing moves at all.
+*
+* WHY THIS RECORDS `Filter` WHEN THE EXPIRATION SIBLING REFUSED THE SDK SHAPE,
+* since the two answer the same objection opposite ways one member apart (PR
+* review — without this, the next author "fixes" one to match the other). The
+* CFn `Rule` definition declares no `Filter` member either, so by the
+* `Expiration` argument this too should have been fixed on the READBACK side.
+* It is not, for a reason that does not apply there: the rule-level CFn scalars
+* can express every `Expiration` the SDK returns, and so the reverse map is
+* LOSSLESS — whereas the V2 `Filter` carries a distinction with no rule-level
+* spelling at all. A scope-less rule is SENT `Filter: {Prefix: ''}`, and the
+* only rule-level rendering of that is a top-level `Prefix: ''`, which is the V1
+* form — a different configuration that S3 forbids mixing with V2. Reverse-
+* mapping would therefore destroy the V1/V2 distinction state needs to
+* reproduce the call. `readLifecycle` has emitted `Filter` since issue #1388, so
+* both sides already meet there; this fold makes the desired side agree rather
+* than moving the meeting point.
+*/
+function foldLifecycleScope(rule, useFilterForm) {
+	const { prefix, tagFilters, sizeGt, sizeLt } = lifecycleRuleScope(rule);
+	const hasTags = tagFilters != null && tagFilters.length > 0;
+	const componentCount = (hasTags ? 1 : 0) + (prefix !== void 0 ? 1 : 0) + (sizeGt !== void 0 ? 1 : 0) + (sizeLt !== void 0 ? 1 : 0);
+	let filter;
+	if (componentCount > 1) {
+		filter = {};
+		if (prefix !== void 0) filter["Prefix"] = prefix;
+		if (hasTags) filter["TagFilters"] = tagFilters;
+		if (sizeGt !== void 0) filter["ObjectSizeGreaterThan"] = sizeGt;
+		if (sizeLt !== void 0) filter["ObjectSizeLessThan"] = sizeLt;
+	} else if (hasTags) filter = { TagFilters: tagFilters };
+	else if (sizeGt !== void 0) filter = { ObjectSizeGreaterThan: sizeGt };
+	else if (sizeLt !== void 0) filter = { ObjectSizeLessThan: sizeLt };
+	else if (useFilterForm) filter = { Prefix: prefix ?? "" };
+	const out = { ...rule };
+	delete out["Filter"];
+	delete out["Prefix"];
+	delete out["TagFilters"];
+	delete out["ObjectSizeGreaterThan"];
+	delete out["ObjectSizeLessThan"];
+	if (filter !== void 0) out["Filter"] = filter;
+	else if (prefix !== void 0) out["Prefix"] = prefix;
 	return out;
 }
 /**
@@ -5268,29 +5772,65 @@ function effectiveNotificationConfiguration(config) {
 * the same two item shapes, so fixing only the reported one would have left its
 * siblings broken — the "diff the WHOLE blob, not the reported key" rule.
 *
-* Two things deliberately NOT folded here, tracked rather than left unstated:
-* the legacy SINGULAR `Transition` / `NoncurrentVersionTransition` objects,
-* which `mergeLegacySingular` folds into the plural on the wire so the readback
-* can never emit them either — a MERGE with a collision arm that WARNS, not an
-* alias rename, so it needs its own decision (issue #1754); and the RULE-level
-* divergences the round-trip fence measured beside these
-* (`ExpirationInDays` / `NoncurrentVersionExpirationInDays` recorded against an
-* `Expiration` / `NoncurrentVersionExpiration` readback, and the sent-but-
-* unrecorded `Filter: {Prefix: ''}`), which are reshapes belonging on the
-* READBACK side and are wider than this class (issue #1755). So a rule using
-* these aliases converges on the aliases and still differs on those keys until
-* #1755 lands — which is the honest state, not a claim this makes lifecycle
-* whole.
-*
-* @returns `config` BY IDENTITY when no tolerated spelling is declared.
+* Issues #1754 / #1755 finished the block, so the "still differs on those keys"
+* caveat this doc carried is gone: the legacy SINGULAR `Transition` /
+* `NoncurrentVersionTransition` objects are MERGED here exactly as the wire
+* merges them ({@link foldLegacySingularTransitions}), the rule-level
+* `Expiration` / `NoncurrentVersionExpiration` reshapes are folded onto the
+* spellings the readback emits ({@link foldLifecycleExpiration} /
+* {@link foldNoncurrentVersionExpiration}), and the sent-but-unrecorded
+* `Filter` is supplied from the rule's full gathered SCOPE
+* ({@link foldLifecycleScope}).
+*
+* @returns `config` BY IDENTITY when the declared bag IS what goes on the wire.
 */
 function effectiveLifecycleConfiguration(config) {
 	if (!isPlainObject$1(config)) return config;
-	return canonicalizeItemList(config, "Rules", (rule) => {
-		let out = canonicalizeItemList(rule, "Transitions", (t) => foldToleratedAliases(t, TRANSITION_ALIASES));
-		out = canonicalizeItemList(out, "NoncurrentVersionTransitions", (nvt) => foldToleratedAliases(nvt, NONCURRENT_VERSION_TRANSITION_ALIASES));
-		return out;
-	});
+	const rules = config["Rules"];
+	if (!Array.isArray(rules)) return config;
+	const objectRules = rules.filter(isPlainObject$1);
+	if (objectRules.length !== rules.length || objectRules.length === 0) return config;
+	if (objectRules.some(lifecycleRuleRefused)) return config;
+	const useFilterForm = lifecycleUsesFilterForm(objectRules);
+	return canonicalizeItemList(config, "Rules", (rule) => effectiveLifecycleRule(rule, useFilterForm));
+}
+/**
+* The one rule fold both sides share — the CFn-shaped bag `readLifecycle` emits
+* for the SDK rule `applyLifecycleConfiguration` builds from this rule.
+*
+* Ordered the way the wire is: the legacy singular is merged into the plural
+* BEFORE the alias fold runs, because the singular can carry the SDK day/date
+* spellings too.
+*
+* MEASURED against the REAL synthesized `s3-lifecycle` fixture templates (every
+* bucket, both phases): the recorded rule and the emitted one carry identical
+* KEYS and identical VALUES, and differ only in key ORDER — the record keeps the
+* template's, the readback uses the reverse-mapper's. That is pre-existing and
+* unchanged here (the record was always template-ordered), and it does not reach
+* `cdkd drift`, whose baseline is `observedProperties` — captured from this very
+* reverse-mapper, so both sides carry its order. It is stated because a reader
+* comparing the two by `JSON.stringify` will see a difference and should know it
+* was measured rather than missed.
+*
+* @returns `rule` BY IDENTITY when the declared rule already IS that bag, so an
+*   ordinary CFn-spelled template records byte-for-byte as before. The compare
+*   is deep and key-ORDER-insensitive for the same reason: a reordering is not a
+*   difference worth rewriting a state record for.
+*/
+function effectiveLifecycleRule(rule, useFilterForm) {
+	let out = foldLegacySingularTransitions(rule);
+	out = canonicalizeItemList(out, "Transitions", (t) => foldTransitionDate(foldToleratedAliases(t, TRANSITION_ALIASES)));
+	out = canonicalizeItemList(out, "NoncurrentVersionTransitions", (nvt) => foldToleratedAliases(nvt, NONCURRENT_VERSION_TRANSITION_ALIASES));
+	out = dropEmptyTransitionLists(out);
+	out = foldLifecycleExpiration(out);
+	out = foldNoncurrentVersionExpiration(out);
+	out = foldLifecycleScope(out, useFilterForm);
+	if (out[LIFECYCLE_STATUS_KEY] === void 0) {
+		const withStatus = { ...out };
+		withStatus[LIFECYCLE_STATUS_KEY] = LIFECYCLE_DEFAULT_STATUS;
+		out = withStatus;
+	}
+	return deepSameValue(rule, out) ? rule : out;
 }
 /**
 * Apply a WHOLE-BLOCK fold to one top-level property on BOTH sides of a diff —
@@ -5649,32 +6189,18 @@ var S3BucketProvider = class S3BucketProvider {
 	async applyLifecycleConfiguration(bucketName, lifecycleConfig, onUnusable) {
 		for (const rule of lifecycleConfig.Rules) {
 			const rawFilter = rule["Filter"];
-			if (rawFilter != null && requireConfigObject(rawFilter, "AWS::S3::Bucket LifecycleConfiguration.Rules[].Filter", { ...onUnusable ? { onUnusable } : {} }) === void 0) return false;
+			if (rawFilter != null && requireConfigObject(rawFilter, LIFECYCLE_FILTER_PATH, { ...onUnusable ? { onUnusable } : {} }) === void 0) return false;
 			const rawTagFilters = rawFilter?.["TagFilters"] ?? rule["TagFilters"];
 			if (rawTagFilters != null) {
-				if (requireConfigArray(rawTagFilters, "AWS::S3::Bucket LifecycleConfiguration.Rules[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) return false;
+				if (requireConfigArray(rawTagFilters, LIFECYCLE_TAG_FILTERS_PATH, { ...onUnusable ? { onUnusable } : {} }) === void 0) return false;
 			}
-			if (this.skipOnUnusableConfigString(rule, "Status", "Enabled", "AWS::S3::Bucket LifecycleConfiguration.Rules[]", "Leaving the whole lifecycle configuration unapplied here", onUnusable)) return false;
+			if (this.skipOnUnusableConfigString(rule, "Status", LIFECYCLE_DEFAULT_STATUS, LIFECYCLE_RULE_PATH, "Leaving the whole lifecycle configuration unapplied here", onUnusable)) return false;
 		}
-		const gatherScope = (rule) => {
-			const filter = rule["Filter"];
-			return {
-				prefix: filter?.["Prefix"] ?? rule["Prefix"],
-				tagFilters: filter?.["TagFilters"] ?? rule["TagFilters"],
-				sizeGt: filter?.["ObjectSizeGreaterThan"] ?? rule["ObjectSizeGreaterThan"],
-				sizeLt: filter?.["ObjectSizeLessThan"] ?? rule["ObjectSizeLessThan"]
-			};
-		};
-		const isPlainPrefixOnly = (rule) => {
-			if (rule["Filter"] != null) return false;
-			const s = gatherScope(rule);
-			return s.prefix !== void 0 && (s.tagFilters == null || s.tagFilters.length === 0) && s.sizeGt === void 0 && s.sizeLt === void 0;
-		};
-		const useFilterForm = !lifecycleConfig.Rules.every(isPlainPrefixOnly);
+		const useFilterForm = lifecycleUsesFilterForm(lifecycleConfig.Rules);
 		const rules = lifecycleConfig.Rules.map((rule) => {
 			const sdkRule = {
 				ID: rule["Id"],
-				Status: readConfigString(rule, "Status", "Enabled", "AWS::S3::Bucket LifecycleConfiguration.Rules[]"),
+				Status: readConfigString(rule, "Status", LIFECYCLE_DEFAULT_STATUS, LIFECYCLE_RULE_PATH),
 				Prefix: useFilterForm ? void 0 : rule["Prefix"]
 			};
 			const expiration = rule["ExpirationInDays"] || rule["ExpirationDate"] || rule["Expiration"];
@@ -5720,7 +6246,7 @@ var S3BucketProvider = class S3BucketProvider {
 			if (allTransitions.length > 0) sdkRule.Transitions = allTransitions.map(toSdkTransition);
 			const abort = isPlainObject$1(rule["AbortIncompleteMultipartUpload"]) ? rule["AbortIncompleteMultipartUpload"] : void 0;
 			if (abort) sdkRule.AbortIncompleteMultipartUpload = { DaysAfterInitiation: abort["DaysAfterInitiation"] };
-			const { prefix, tagFilters, sizeGt, sizeLt } = gatherScope(rule);
+			const { prefix, tagFilters, sizeGt, sizeLt } = lifecycleRuleScope(rule);
 			const hasTags = tagFilters != null && tagFilters.length > 0;
 			if ((hasTags ? 1 : 0) + (prefix !== void 0 ? 1 : 0) + (sizeGt !== void 0 ? 1 : 0) + (sizeLt !== void 0 ? 1 : 0) > 1) sdkRule.Filter = { And: {
 				Prefix: prefix,
@@ -5906,7 +6432,7 @@ var S3BucketProvider = class S3BucketProvider {
 	* SDK uses the same structure (PutBucketNotificationConfiguration replaces
 	* the entire notification configuration in one call).
 	*/
-	async applyNotificationConfiguration(bucketName, notifConfig) {
+	async applyNotificationConfiguration(bucketName, notifConfig, onUnusable) {
 		const cfg = {};
 		if (notifConfig) {
 			const topics = notifConfig["TopicConfigurations"];
@@ -5931,13 +6457,22 @@ var S3BucketProvider = class S3BucketProvider {
 				Filter: this.cfnNotifFilterToSdk(l["Filter"])
 			}));
 			const eb = notifConfig["EventBridgeConfiguration"];
-			if (eb !== void 0 && (!isPlainObject$1(eb) || coerceCfnBoolean(eb["EventBridgeEnabled"]) !== false)) cfg.EventBridgeConfiguration = {};
+			if (eb != null) {
+				const ebRefusal = configBooleanRefusal(eb, "EventBridgeEnabled", EVENTBRIDGE_CONFIG_PATH);
+				if (ebRefusal !== void 0) {
+					if (!onUnusable) throw new Error(`${ebRefusal}. Omit the block entirely to leave EventBridge delivery disabled`);
+					onUnusable(`${ebRefusal}. Leaving the whole notification configuration unapplied here: PutBucketNotificationConfiguration is a full replace, and treating an unreadable value as ${EVENTBRIDGE_DEFAULT_ENABLED} would ENABLE EventBridge delivery the template may have been disabling; the same value is REFUSED on a template-path create`);
+					return false;
+				}
+				if (eventBridgeEnabledOf(eb)) cfg.EventBridgeConfiguration = {};
+			}
 		}
 		await this.s3Client.send(new PutBucketNotificationConfigurationCommand({
 			Bucket: bucketName,
 			NotificationConfiguration: cfg
 		}));
 		this.logger.debug(`Applied notification configuration to bucket ${bucketName}`);
+		return true;
 	}
 	/**
 	* Convert CFn notification Filter ({ S3Key: { Rules: [{ Name, Value }] } })
@@ -6951,9 +7486,11 @@ var S3BucketProvider = class S3BucketProvider {
 			await this.applyLoggingConfiguration(bucketName, void 0);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["NotificationConfiguration"], properties["NotificationConfiguration"], async (cfg) => {
-			await this.applyNotificationConfiguration(bucketName, cfg);
-			recordEffectiveFold("NotificationConfiguration", effectiveNotificationConfiguration(cfg));
-		}, async () => this.applyNotificationConfiguration(bucketName, void 0));
+			if (!await this.applyNotificationConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("NotificationConfiguration");
+			else recordEffectiveFold("NotificationConfiguration", effectiveNotificationConfiguration(cfg));
+		}, async () => {
+			await this.applyNotificationConfiguration(bucketName, void 0);
+		});
 		await this.diffSubConfig(bucketName, previousProperties["ReplicationConfiguration"], properties["ReplicationConfiguration"], async (cfg) => {
 			if (!await this.applyReplicationConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("ReplicationConfiguration");
 		}, async () => {
@@ -7067,10 +7604,8 @@ var S3BucketProvider = class S3BucketProvider {
 		};
 		const replayOnUnusable = replayWarn(this.logger, context).onUnusable;
 		const notifConfig = properties["NotificationConfiguration"];
-		if (notifConfig) {
-			await this.applyNotificationConfiguration(bucketName, notifConfig);
-			recordEffectiveFold("NotificationConfiguration", effectiveNotificationConfiguration(notifConfig));
-		}
+		if (notifConfig) if (!await this.applyNotificationConfiguration(bucketName, notifConfig, replayOnUnusable)) overrides.set("NotificationConfiguration", void 0);
+		else recordEffectiveFold("NotificationConfiguration", effectiveNotificationConfiguration(notifConfig));
 		const corsConfig = properties["CorsConfiguration"];
 		if (corsConfig?.CorsRules && Array.isArray(corsConfig.CorsRules) && corsConfig.CorsRules.length > 0) await this.applyCorsConfiguration(bucketName, corsConfig);
 		else if (corsConfig != null) this.announceCreateEmptyCollectionSkip("CorsConfiguration", "CorsConfiguration.CorsRules");
@@ -7421,11 +7956,9 @@ var S3BucketProvider = class S3BucketProvider {
 					if (r.Status !== void 0) out["Status"] = r.Status;
 					if (r.Prefix !== void 0) out["Prefix"] = r.Prefix;
 					if (r.Expiration) {
-						const exp = {};
-						if (r.Expiration.Days !== void 0) exp["Days"] = r.Expiration.Days;
-						if (r.Expiration.Date !== void 0) exp["Date"] = r.Expiration.Date.toISOString();
-						if (r.Expiration.ExpiredObjectDeleteMarker !== void 0) exp["ExpiredObjectDeleteMarker"] = r.Expiration.ExpiredObjectDeleteMarker;
-						out["Expiration"] = exp;
+						if (r.Expiration.Days !== void 0) out["ExpirationInDays"] = r.Expiration.Days;
+						if (r.Expiration.Date !== void 0) out["ExpirationDate"] = r.Expiration.Date.toISOString();
+						if (r.Expiration.ExpiredObjectDeleteMarker !== void 0) out["ExpiredObjectDeleteMarker"] = r.Expiration.ExpiredObjectDeleteMarker;
 					}
 					if (r.Transitions && r.Transitions.length > 0) out["Transitions"] = r.Transitions.map((t) => {
 						const item = {};
@@ -62978,6 +63511,50 @@ function escapeRegExp(value) {
 */
 const KEY_TERMINATORS = "[^\\s\"'?]";
 /**
+* `(?:amazonaws\.com\.cn|amazonaws\.com|...)` — {@link AWS_URL_SUFFIXES} as a
+* non-capturing alternation, LONGEST FIRST so `amazonaws.com.cn` is tried
+* before its own `amazonaws.com` prefix instead of relying on backtracking.
+*
+* The `(?:` is load-bearing, not stylistic: every matcher below reads its
+* results by GROUP INDEX (`match[1]` is the S3 key / the ECR tag, `match[2]`
+* the ECR digest), and this alternation sits BEFORE those groups in all three
+* patterns. Making it capturing would shift every index by one and silently
+* collect the suffix as if it were a key.
+*/
+const URL_SUFFIX_ALTERNATION = `(?:${[...[
+	"amazonaws.com",
+	"amazonaws.com.cn",
+	"amazonaws.eu",
+	"c2s.ic.gov",
+	"sc2s.sgov.gov",
+	"cloud.adc-e.uk",
+	"csp.hci.ic.gov"
+]].sort((a, b) => b.length - a.length).map(escapeRegExp).join("|")})`;
+/**
+* The HOST half of an ECR registry, as an alternation over the forms AWS
+* serves: `<acct>.dkr.ecr.<region>.<urlSuffix>`, its FIPS sibling
+* `<acct>.dkr.ecr-fips.<region>.<urlSuffix>`, and the short-form alias
+* `<acct>.dkr-ecr.<region>.on.aws`.
+*
+* Kept DELIBERATELY separate from the S3 matchers' shared
+* {@link URL_SUFFIX_ALTERNATION} rather than folded into it: `on.aws` is an
+* ECR-only endpoint, so adding it to the shared suffix set would also make
+* `https://<assetBucket>.s3.<region>.on.aws/<key>` a recognized S3 reference.
+* Widening either matcher only ever over-PROTECTS, but the two services' host
+* grammars genuinely differ and conflating them is how the next widening goes
+* wrong.
+*
+* Account and region are matched loosely on purpose (see the extractor doc):
+* collecting a reference from another account's or region's URI can only KEEP
+* more, never delete more — which is also why the two extra forms are worth
+* carrying even though cdkd's own publisher writes the plain one. Issue #1785
+* tracks deriving these host forms from ONE place shared with
+* `src/utils/ecr-uri.ts` instead of two hand-kept copies.
+*
+* Every group is non-capturing, for the {@link URL_SUFFIX_ALTERNATION} reason.
+*/
+const ECR_REGISTRY_HOST = `\\d{12}\\.(?:dkr\\.ecr(?:-fips)?\\.[a-z0-9-]+\\.${URL_SUFFIX_ALTERNATION}|dkr-ecr\\.[a-z0-9-]+\\.on\\.aws)`;
+/**
 * cdkd's publishers write content-addressed keys (`<sha256>.<ext>`). A
 * second, name-independent pass collects every such token from every
 * scanned string — belt-and-braces against URL captures that ran through
@@ -63015,21 +63592,26 @@ function tryDecodeBase64Text(value) {
 *   ApiGateway BodyS3Location / SFN DefinitionS3Location, ...) — handled
 *   in the walk itself; every sibling string value is collected.
 * - `s3://<assetBucket>/<key>` URIs.
-* - `https://<assetBucket>.s3[.<region>].amazonaws.com/<key>`
+* - `https://<assetBucket>.s3[.<region>].<urlSuffix>/<key>`
 *   (virtual-hosted style, region / dualstack variants included).
-* - `https://s3[.<region>].amazonaws.com/<assetBucket>/<key>` (path style).
-* - `<acct>.dkr.ecr.<region>.amazonaws.com/<containerRepo>:<tag>` and/or
-*   `...@sha256:<digest>` image URIs. Account / region are matched
-*   loosely on purpose: collecting a reference from another account's or
-*   region's URI can only over-protect (keep more), never delete more.
+* - `https://s3[.<region>].<urlSuffix>/<assetBucket>/<key>` (path style).
+* - `<ecrHost>/<containerRepo>:<tag>` and/or `...@sha256:<digest>` image
+*   URIs, where `<ecrHost>` is {@link ECR_REGISTRY_HOST}. Account / region
+*   are matched loosely on purpose: collecting a reference from another
+*   account's or region's URI can only over-protect (keep more), never
+*   delete more.
+*
+* `<urlSuffix>` in the two S3 shapes is {@link URL_SUFFIX_ALTERNATION}, i.e.
+* EVERY partition's suffix at once — see that constant for why a per-region
+* derived literal is the wrong shape here (issue #1781).
 */
 function buildReferenceExtractors(marker) {
 	const bucket = escapeRegExp(marker.assetBucket);
 	const repo = escapeRegExp(marker.containerRepo);
 	const s3UriRe = new RegExp(`s3://${bucket}/(${KEY_TERMINATORS}+)`, "g");
-	const virtualHostedRe = new RegExp(`https://${bucket}\\.s3[^/\\s]*\\.amazonaws\\.com/(${KEY_TERMINATORS}+)`, "g");
-	const pathStyleRe = new RegExp(`https://s3[^/\\s]*\\.amazonaws\\.com/${bucket}/(${KEY_TERMINATORS}+)`, "g");
-	const ecrRe = new RegExp(`\\d{12}\\.dkr\\.ecr\\.[a-z0-9-]+\\.amazonaws\\.com/${repo}(?::([A-Za-z0-9_][A-Za-z0-9._-]{0,127}))?(?:@(sha256:[0-9a-f]{64}))?`, "g");
+	const virtualHostedRe = new RegExp(`https://${bucket}\\.s3[^/\\s]*\\.${URL_SUFFIX_ALTERNATION}/(${KEY_TERMINATORS}+)`, "g");
+	const pathStyleRe = new RegExp(`https://s3[^/\\s]*\\.${URL_SUFFIX_ALTERNATION}/${bucket}/(${KEY_TERMINATORS}+)`, "g");
+	const ecrRe = new RegExp(`${ECR_REGISTRY_HOST}/${repo}(?::([A-Za-z0-9_][A-Za-z0-9._-]{0,127}))?(?:@(sha256:[0-9a-f]{64}))?`, "g");
 	const extractOnce = (value, refs) => {
 		for (const re of [
 			s3UriRe,
@@ -74854,7 +75436,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.24");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.26");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;