@go-to-k/cdkd 0.278.21 → 0.278.22

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-dvS1K_ET.js";
+import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-CkuG2VD5.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BN1QMZlz.js";
+import { t as ASGProvider } from "./asg-provider-BBsW05cu.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
@@ -4868,7 +4868,7 @@ function coerceCfnBoolean(value) {
 * S3's CreateBucket is synchronous - no polling needed, unlike CC API which
 * requires async polling (1s→1.5s→2.25s...) adding seconds per resource.
 */
-var S3BucketProvider = class {
+var S3BucketProvider = class S3BucketProvider {
 	s3Client;
 	logger = getLogger().child("S3BucketProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::S3::Bucket", /* @__PURE__ */ new Set([
@@ -5142,6 +5142,7 @@ var S3BucketProvider = class {
 	* - BucketKeyEnabled
 	*/
 	async applyBucketEncryption(bucketName, encryptionConfig) {
+		if (!Array.isArray(encryptionConfig?.ServerSideEncryptionConfiguration)) throw new Error(`BucketEncryption.ServerSideEncryptionConfiguration must be an array (got ${encryptionConfig?.ServerSideEncryptionConfiguration === void 0 ? "undefined" : typeof encryptionConfig.ServerSideEncryptionConfiguration}) — check for an unresolved intrinsic or a mis-nested template value`);
 		const rules = encryptionConfig.ServerSideEncryptionConfiguration.map((rule) => {
 			const byDefault = rule["ServerSideEncryptionByDefault"];
 			return {
@@ -5525,30 +5526,91 @@ var S3BucketProvider = class {
 		this.logger.debug(`Applied object lock configuration to bucket ${bucketName}`);
 	}
 	/**
-	* Apply additional bucket configuration after creation
+	* Apply additional bucket configuration after creation.
+	*
+	* `options.skipDiffManaged` is passed by `update()` for the three
+	* sub-configs that moved onto the diff path (`VersioningConfiguration` /
+	* `OwnershipControls` / `BucketEncryption`, issue #1466). They stay here for
+	* CREATE — where there is no previous side to diff against — but on UPDATE
+	* they must go through `applySubConfigDiffs` so a REMOVED property is reset
+	* to the CloudFormation default instead of silently surviving. Applying them
+	* in both places would double-PUT.
 	*/
-	async applyConfiguration(bucketName, properties, skipTags = false) {
+	async applyConfiguration(bucketName, properties, options = {}) {
+		const { skipTags = false, skipDiffManaged = false } = options;
 		const versioningConfig = properties["VersioningConfiguration"];
-		if (versioningConfig) await this.applyVersioning(bucketName, versioningConfig);
+		if (!skipDiffManaged && versioningConfig) await this.applyVersioning(bucketName, versioningConfig);
 		const tags = properties["Tags"];
 		if (!skipTags && tags && Array.isArray(tags) && tags.length > 0) await this.applyTags(bucketName, tags);
 		const ownershipControls = properties["OwnershipControls"];
-		if (ownershipControls?.Rules) {
-			await this.s3Client.send(new PutBucketOwnershipControlsCommand({
-				Bucket: bucketName,
-				OwnershipControls: { Rules: ownershipControls.Rules.map((r) => ({ ObjectOwnership: r.ObjectOwnership })) }
-			}));
-			this.logger.debug(`Applied ownership controls to bucket ${bucketName}`);
-		}
+		const normalizedOwnership = S3BucketProvider.emptyListConfigToUndefined(ownershipControls, "Rules");
+		if (!skipDiffManaged && normalizedOwnership !== void 0) await this.applyOwnershipControls(bucketName, normalizedOwnership);
 		const publicAccessBlock = properties["PublicAccessBlockConfiguration"];
 		if (publicAccessBlock) await this.applyPublicAccessBlockConfiguration(bucketName, publicAccessBlock);
-		const bucketEncryption = properties["BucketEncryption"];
-		if (bucketEncryption?.ServerSideEncryptionConfiguration && Array.isArray(bucketEncryption.ServerSideEncryptionConfiguration) && bucketEncryption.ServerSideEncryptionConfiguration.length > 0) await this.applyBucketEncryption(bucketName, bucketEncryption);
+		const normalizedEncryption = S3BucketProvider.emptyListConfigToUndefined(properties["BucketEncryption"], "ServerSideEncryptionConfiguration");
+		if (!skipDiffManaged && normalizedEncryption !== void 0) await this.applyBucketEncryption(bucketName, normalizedEncryption);
+	}
+	/**
+	* CFn property: OwnershipControls
+	* SDK: PutBucketOwnershipControls
+	*/
+	async applyOwnershipControls(bucketName, ownershipControls) {
+		if (!Array.isArray(ownershipControls?.Rules)) throw new Error(`OwnershipControls.Rules must be an array (got ${ownershipControls?.Rules === void 0 ? "undefined" : typeof ownershipControls.Rules}) — check for an unresolved intrinsic or a mis-nested template value`);
+		await this.s3Client.send(new PutBucketOwnershipControlsCommand({
+			Bucket: bucketName,
+			OwnershipControls: { Rules: ownershipControls.Rules.map((r) => ({ ObjectOwnership: r.ObjectOwnership })) }
+		}));
+		this.logger.debug(`Applied ownership controls to bucket ${bucketName}`);
+	}
+	/**
+	* Normalize an "empty container" sub-config value to `undefined` so the diff
+	* path cannot mistake a placeholder for a real value.
+	*
+	* `readCurrentState` always-emits placeholder shapes for un-configured
+	* features (`BucketEncryption: { ServerSideEncryptionConfiguration: [] }`,
+	* and the `OwnershipControls: { Rules: [] }` added with issue #1466), and a
+	* `cdkd drift --revert` round-trip feeds those back through `update()`.
+	*
+	* The rule is "empty container == not declared", applied to BOTH sides. Per
+	* pairing that means:
+	*   empty desired  + absent previous -> no call (without this, a Put with an
+	*                                      empty list, which both APIs reject)
+	*   absent desired + empty previous  -> no call (without this, a Delete
+	*                                      against a bucket that never had it)
+	*   empty desired  + REAL previous   -> Delete. This one is NOT suppressed
+	*                                      and must not be: it is a genuine
+	*                                      declared -> not-declared transition,
+	*                                      which is exactly what CloudFormation
+	*                                      removes.
+	*
+	* "Empty" is deliberately NARROW. Only two shapes fold to `undefined`:
+	* a block with NO keys at all (`{}`), and a block whose list key holds an
+	* empty array. Everything else — a non-object, an array where the object
+	* belongs (wrong nesting), a block whose list key is absent but which
+	* carries OTHER keys, or a non-array list (an unresolved intrinsic) — is
+	* MALFORMED, not empty, and passes through so the apply call refuses it by
+	* name. Folding any of those to `undefined` would emit a Delete and
+	* silently downgrade a live bucket (KMS -> AES256) while the template still
+	* declares the config.
+	*
+	* NOTE this helper does NOT cover `VersioningConfiguration` (it has no list
+	* key), and that property is NOT malformed-shape-refused anywhere: a
+	* malformed value there still resolves to 'Suspended', matching `main`.
+	* That pre-existing gap is tracked in issue #1471 — see the note in
+	* `applySubConfigDiffs` for why guarding it is not as simple as it looks.
+	*/
+	static emptyListConfigToUndefined(config, listKey) {
+		if (config === void 0 || config === null) return void 0;
+		if (typeof config !== "object" || Array.isArray(config)) return config;
+		const list = config[listKey];
+		if (list === void 0 || list === null) return Object.keys(config).length === 0 ? void 0 : config;
+		if (Array.isArray(list) && list.length === 0) return void 0;
+		return config;
 	}
 	/**
 	* Diff CFn-shape sub-config values between previous and new state.
 	*
-	* Three transitions:
+	* Four transitions:
 	* - undefined -> defined  (value differs from previous, OR previous undefined): Put
 	* - defined -> undefined: Delete
 	* - defined -> defined (different): Put
@@ -5593,13 +5655,33 @@ var S3BucketProvider = class {
 	* Apply the diff between previous and new sub-configs, issuing Put / Delete
 	* SDK calls only for differing keys. Called from `update()`.
 	*
-	* Versioning / PublicAccessBlock / Tags / OwnershipControls / BucketEncryption
-	* stay on `applyConfiguration` (the unconditional always-PUT path) because
-	* their AWS APIs don't have a clean "delete" counterpart and they
-	* round-trip safely as no-ops when state == AWS-current. The 12 sub-configs
-	* below DO have proper Put/Delete pairs so the diff path is preferable.
+	* PublicAccessBlockConfiguration and Tags stay on `applyConfiguration` /
+	* `applyTagDiff`. `PublicAccessBlockConfiguration` is deliberately NOT on the
+	* diff path: a live CloudFormation A/B (issue #1466) confirmed CFn ALSO
+	* leaves the block in place when the property is removed, so cdkd is at
+	* parity and adding an `onRemove` here would CREATE a divergence.
+	*
+	* VersioningConfiguration / OwnershipControls / BucketEncryption used to sit
+	* on that always-PUT path too, on the assumption that their APIs had no clean
+	* "delete" counterpart. That was wrong in all three cases and made removal a
+	* silent no-op (issue #1466): the same A/B showed CFn suspends versioning,
+	* deletes ownership controls, and resets encryption to the SSE-S3 default.
+	* They are now diffed here like every other Put/Delete pair.
 	*/
 	async applySubConfigDiffs(bucketName, properties, previousProperties) {
+		const previousVersioning = previousProperties["VersioningConfiguration"];
+		const nextVersioning = properties["VersioningConfiguration"];
+		const versioningChanged = JSON.stringify(previousVersioning ?? null) !== JSON.stringify(nextVersioning ?? null);
+		const desiredVersioningStatus = nextVersioning == null ? "Suspended" : nextVersioning["Status"] || "Suspended";
+		if (versioningChanged && nextVersioning != null && desiredVersioningStatus !== "Suspended") await this.applyVersioning(bucketName, nextVersioning);
+		await this.diffSubConfig(bucketName, S3BucketProvider.emptyListConfigToUndefined(previousProperties["OwnershipControls"], "Rules"), S3BucketProvider.emptyListConfigToUndefined(properties["OwnershipControls"], "Rules"), async (cfg) => this.applyOwnershipControls(bucketName, cfg), async () => {
+			await this.s3Client.send(new DeleteBucketOwnershipControlsCommand({ Bucket: bucketName }));
+			this.logger.debug(`Deleted ownership controls on bucket ${bucketName}`);
+		});
+		await this.diffSubConfig(bucketName, S3BucketProvider.emptyListConfigToUndefined(previousProperties["BucketEncryption"], "ServerSideEncryptionConfiguration"), S3BucketProvider.emptyListConfigToUndefined(properties["BucketEncryption"], "ServerSideEncryptionConfiguration"), async (cfg) => this.applyBucketEncryption(bucketName, cfg), async () => {
+			await this.s3Client.send(new DeleteBucketEncryptionCommand({ Bucket: bucketName }));
+			this.logger.debug(`Deleted bucket encryption on bucket ${bucketName}`);
+		});
 		await this.diffSubConfig(bucketName, previousProperties["LifecycleConfiguration"], properties["LifecycleConfiguration"], async (cfg) => {
 			if (!cfg.Rules || !Array.isArray(cfg.Rules) || cfg.Rules.length === 0) return;
 			await this.applyLifecycleConfiguration(bucketName, cfg);
@@ -5660,6 +5742,14 @@ var S3BucketProvider = class {
 			}));
 			this.logger.debug(`Deleted inventory configuration ${id} on bucket ${bucketName}`);
 		});
+		if (versioningChanged && desiredVersioningStatus === "Suspended") {
+			const hasObjectLock = (p) => {
+				if (p["ObjectLockEnabled"] === true || p["ObjectLockEnabled"] === "true") return true;
+				return p["ObjectLockConfiguration"]?.["ObjectLockEnabled"] === "Enabled";
+			};
+			if (hasObjectLock(properties) || hasObjectLock(previousProperties)) this.logger.warn(`Bucket ${bucketName}: versioning would be suspended (VersioningConfiguration removed or set to Suspended), but the bucket has Object Lock enabled and S3 does not allow suspending versioning on it. Leaving versioning enabled.`);
+			else await this.applyVersioning(bucketName, { Status: "Suspended" });
+		}
 	}
 	/**
 	* Apply ALL sub-configs unconditionally on initial create. Used by
@@ -5752,7 +5842,10 @@ var S3BucketProvider = class {
 			};
 		}
 		try {
-			await this.applyConfiguration(physicalId, properties, true);
+			await this.applyConfiguration(physicalId, properties, {
+				skipTags: true,
+				skipDiffManaged: true
+			});
 			await this.applySubConfigDiffs(physicalId, properties, previousProperties);
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 			const attributes = await this.buildAttributes(physicalId);
@@ -5804,7 +5897,8 @@ var S3BucketProvider = class {
 	* returns `undefined`.
 	*
 	* Coverage: `BucketName`, `VersioningConfiguration`, `BucketEncryption`,
-	* `PublicAccessBlockConfiguration`, `Tags`, plus all 12 sub-configs:
+	* `OwnershipControls`, `PublicAccessBlockConfiguration`, `Tags`, plus all 12
+	* sub-configs:
 	* `LifecycleConfiguration`, `CorsConfiguration`, `WebsiteConfiguration`,
 	* `LoggingConfiguration`, `NotificationConfiguration`,
 	* `ReplicationConfiguration`, `ObjectLockConfiguration`,
@@ -5820,9 +5914,10 @@ var S3BucketProvider = class {
 			if (err instanceof NoSuchBucket || e.name === "NotFound" || e.name === "NoSuchBucket" || e.$metadata?.httpStatusCode === 404) return;
 			throw err;
 		}
-		const [versioning, encryption, pab, tags, lifecycle, cors, website, logging, notification, replication, objectLock, accelerate, metrics, analytics, intelligentTier, inventory] = await Promise.all([
+		const [versioning, encryption, ownership, pab, tags, lifecycle, cors, website, logging, notification, replication, objectLock, accelerate, metrics, analytics, intelligentTier, inventory] = await Promise.all([
 			this.readVersioning(physicalId),
 			this.readEncryption(physicalId),
+			this.readOwnershipControls(physicalId),
 			this.readPublicAccessBlock(physicalId),
 			this.readTags(physicalId),
 			this.readLifecycle(physicalId),
@@ -5842,6 +5937,7 @@ var S3BucketProvider = class {
 			BucketName: physicalId,
 			VersioningConfiguration: versioning,
 			BucketEncryption: encryption,
+			OwnershipControls: ownership,
 			PublicAccessBlockConfiguration: pab,
 			Tags: tags,
 			LifecycleConfiguration: lifecycle,
@@ -5861,6 +5957,22 @@ var S3BucketProvider = class {
 	async readVersioning(bucket) {
 		return { Status: (await this.s3Client.send(new GetBucketVersioningCommand({ Bucket: bucket }))).Status ?? "Suspended" };
 	}
+	/**
+	* OwnershipControls { Rules: [{ ObjectOwnership }] }. Always emit a
+	* placeholder (empty `Rules`) so a console-side change on a bucket that
+	* declares the property surfaces as drift. Added with issue #1466 — without
+	* a read here, `cdkd drift` could not see ownership controls at all, which
+	* is why the removal bug that issue fixes produced no signal from ANY
+	* command.
+	*/
+	async readOwnershipControls(bucket) {
+		try {
+			return { Rules: ((await this.s3Client.send(new GetBucketOwnershipControlsCommand({ Bucket: bucket }))).OwnershipControls?.Rules ?? []).map((r) => ({ ObjectOwnership: r.ObjectOwnership })) };
+		} catch (err) {
+			if (err.name === "OwnershipControlsNotFoundError") return { Rules: [] };
+			throw err;
+		}
+	}
 	async readEncryption(bucket) {
 		try {
 			return { ServerSideEncryptionConfiguration: ((await this.s3Client.send(new GetBucketEncryptionCommand({ Bucket: bucket }))).ServerSideEncryptionConfiguration?.Rules ?? []).map((rule) => {
@@ -65486,7 +65598,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.21");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.22");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;