@go-to-k/cdkd 0.278.49 → 0.278.51

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-BgLg1tet.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-C1otn94r.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-t9dJL0zs.js";
+import { t as ASGProvider } from "./asg-provider-B2jsUFUl.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4824,6 +4824,53 @@ function isPlainObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
+* Is this `Destination` block written in the CFn FLATTENED form
+* (`{ BucketArn, Format, ... }`) rather than the SDK NESTED one
+* (`{ S3BucketDestination: { ... } }`)?
+*
+* ONE predicate, called from both `resolveS3BucketDestination` (which picks the
+* bag) and `s3BucketDestinationPath` (which names it). They were written out
+* twice and a reviewer rightly pointed out that two copies of a branch
+* condition must be edited together or a refusal starts naming the wrong key.
+*
+* `Bucket` is probed alongside `BucketArn` because the readers accept it
+* (`s3Dest['BucketArn'] ?? s3Dest['Bucket']`); omitting it made a
+* `{ Bucket }`-only block take the nested branch, find nothing, and drop — the
+* same silent drop one shape over.
+*/
+function isFlattenedDestination(dest) {
+	return Boolean(dest["BucketArn"] || dest["Bucket"] || dest["BucketAccountId"] || dest["Format"]);
+}
+/**
+* The CFn path of the destination bag `resolveS3BucketDestination` will pick —
+* issue #1493 item 3, which is a MESSAGE concern, not a value one.
+*
+* Kept separate from the resolver rather than returned alongside the bag:
+* `gen-nested-key-coverage`'s write-evidence walk follows a plain
+* `const x = this.helper(...)` binding to the members written beneath it, and
+* a DESTRUCTURED `const { bag, path } = ...` is a shape it cannot follow — so
+* pairing the two silently withdrew the write evidence for
+* `Destination.BucketArn` / `.BucketAccountId` and turned an opted-in target
+* red with no behavior change at all. Measured against the pre-change provider
+* via the critic's `--providers-dir=` seam.
+*/
+function s3BucketDestinationPath(dest, destinationPath) {
+	return isPlainObject$1(dest) && isFlattenedDestination(dest) ? destinationPath : `${destinationPath}.S3BucketDestination`;
+}
+/**
+* Name a malformed value in a refusal message, the way `config-shape.ts`'s
+* private `describe` does for the string-reading guards. Kept local rather than
+* exported from there because `resolveS3BucketDestination` is S3-specific
+* branch selection, not a shared shape guard — the two only share the wording.
+*/
+function describeValue(value) {
+	if (value === null) return "null";
+	if (Array.isArray(value)) return "an array";
+	if (typeof value === "string") return `a string ${JSON.stringify(value)}`;
+	if (isPlainObject$1(value)) return `an object with keys [${Object.keys(value).join(", ")}]`;
+	return `a ${typeof value} (${String(value)})`;
+}
+/**
 * Coerce a CFn numeric to a finite number. CloudFormation is stringly typed —
 * a hand-written or imported template (the audience the legacy lifecycle
 * branches exist for) can carry `"365"` where the schema says number.
@@ -5345,12 +5392,61 @@ var S3BucketProvider = class S3BucketProvider {
 		this.logger.debug(`Applied ${configs.length} metrics configuration(s) to bucket ${bucketName}`);
 	}
 	/**
+	* Pick the `S3BucketDestination` bag out of an analytics / inventory
+	* `Destination` block, refusing a shape that would otherwise be dropped.
+	*
+	* Two shapes are legitimate and both must keep working: the CFn FLATTENED
+	* form (`Destination: { BucketArn, Format, ... }`, what the schema declares)
+	* and the SDK NESTED form (`Destination: { S3BucketDestination: { ... } }`,
+	* accepted because state records and hand-written templates carry it).
+	*
+	* Issue #1493 item 2: the branch was picked by probing member presence
+	* (`dest?.['BucketAccountId'] || dest?.['BucketArn'] || dest?.['Format']`),
+	* so a `Destination` that is a STRING / array / unresolved intrinsic indexed
+	* every probe to `undefined`, fell through to an equally-`undefined`
+	* `S3BucketDestination`, and the caller's `s3Dest ? … : undefined` omitted
+	* the whole block from the Put — a configuration silently deployed without
+	* the destination it declared. Unlike the sibling defaulting class this is a
+	* DROP, not a substituted default, so `readConfigString` does not cover it:
+	* it needs its own decision, and per issue #1513's precedent that decision is
+	* REFUSE on the template-borne create path, WARN on the replay-reachable
+	* update path (`onUnusable`), where the desired bag can be a historical cdkd
+	* state record with no template-side remedy.
+	*
+	* Also returns the CFn path of the bag it picked (issue #1493 item 3): the
+	* callers used to hardcode `…Destination.S3BucketDestination` in the
+	* `containerPath` they pass to `readConfigString`, so a refusal on the
+	* FLATTENED branch — where the bag IS `dest` itself — named a key the user's
+	* template does not contain.
+	*
+	* @returns the picked bag, or `undefined` when the block was ABSENT or was
+	*   refused on a warn-only path. The caller distinguishes the two by testing
+	*   its own `Destination` value — see the `continue` at each call site.
+	*/
+	resolveS3BucketDestination(dest, destinationPath, onUnusable) {
+		const nestedPath = `${destinationPath}.S3BucketDestination`;
+		const drop = (message) => {
+			if (onUnusable) {
+				onUnusable(`${message}. Leaving this configuration unchanged; the same value is REFUSED on a template-path create`);
+				return;
+			}
+			throw new Error(message);
+		};
+		if (dest === void 0 || dest === null) return;
+		if (!isPlainObject$1(dest)) return drop(`${destinationPath} must be an object (got ${describeValue(dest)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		const bag = isFlattenedDestination(dest) ? dest : dest["S3BucketDestination"];
+		if (bag === void 0 || bag === null) return drop(`${destinationPath} carries neither a bucket (BucketArn / Bucket) nor a nested S3BucketDestination object (got ${describeValue(dest)}) — the destination would otherwise be dropped from the request with no error`);
+		if (!isPlainObject$1(bag)) return drop(`${nestedPath} must be an object (got ${describeValue(bag)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		if (!bag["BucketArn"] && !bag["Bucket"]) return drop(`${bag === dest ? destinationPath : nestedPath} has no destination bucket (BucketArn / Bucket) (got ${describeValue(bag)}) — the request would be rejected by S3, or silently carry no destination`);
+		return bag;
+	}
+	/**
 	* Apply analytics configurations
 	*
 	* CFn property: AnalyticsConfigurations[] (array of configurations)
 	* SDK: PutBucketAnalyticsConfiguration (one per configuration, keyed by Id)
 	*/
-	async applyAnalyticsConfigurations(bucketName, configs) {
+	async applyAnalyticsConfigurations(bucketName, configs, onUnusable) {
 		for (const config of configs) {
 			const id = config["Id"];
 			const storageClassAnalysis = config["StorageClassAnalysis"];
@@ -5368,16 +5464,19 @@ var S3BucketProvider = class S3BucketProvider {
 				else if (prefix) analyticsConfig.Filter = { Prefix: prefix };
 				else if (tagFilters && tagFilters.length > 0) analyticsConfig.Filter = { Tag: tagFilters[0] };
 			}
-			if (storageClassAnalysis?.["DataExport"]) {
+			if (storageClassAnalysis?.["DataExport"] != null) {
 				const dataExport = storageClassAnalysis["DataExport"];
-				const dest = dataExport["Destination"];
-				const s3Dest = dest?.["BucketAccountId"] || dest?.["BucketArn"] || dest?.["Format"] ? dest : dest?.["S3BucketDestination"];
+				const analyticsDestPath = "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport.Destination";
+				const rawDest = dataExport["Destination"];
+				const s3Dest = this.resolveS3BucketDestination(rawDest, analyticsDestPath, onUnusable);
+				if (s3Dest === void 0 && rawDest != null) continue;
+				const destPath = s3BucketDestinationPath(rawDest, analyticsDestPath);
 				analyticsConfig.StorageClassAnalysis = { DataExport: {
 					OutputSchemaVersion: readConfigString(dataExport, "OutputSchemaVersion", "V_1", "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport"),
 					Destination: s3Dest ? { S3BucketDestination: {
 						Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
 						BucketAccountId: s3Dest["BucketAccountId"],
-						Format: readConfigString(s3Dest, "Format", "CSV", "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport.Destination.S3BucketDestination"),
+						Format: readConfigString(s3Dest, "Format", "CSV", destPath, { ...onUnusable ? { onUnusable } : {} }),
 						Prefix: s3Dest["Prefix"]
 					} } : void 0
 				} };
@@ -5432,11 +5531,14 @@ var S3BucketProvider = class S3BucketProvider {
 	* CFn property: InventoryConfigurations[]
 	* SDK: PutBucketInventoryConfiguration (one per configuration, keyed by Id)
 	*/
-	async applyInventoryConfigurations(bucketName, configs) {
+	async applyInventoryConfigurations(bucketName, configs, onUnusable) {
 		for (const config of configs) {
 			const id = config["Id"];
-			const dest = config["Destination"];
-			const s3Dest = dest?.["BucketArn"] || dest?.["Format"] ? dest : dest?.["S3BucketDestination"];
+			const inventoryDestPath = "AWS::S3::Bucket InventoryConfigurations[].Destination";
+			const rawDest = config["Destination"];
+			const s3Dest = this.resolveS3BucketDestination(rawDest, inventoryDestPath, onUnusable);
+			if (s3Dest === void 0 && rawDest != null) continue;
+			const destPath = s3BucketDestinationPath(rawDest, inventoryDestPath);
 			const inventoryConfig = {
 				Id: id,
 				IsEnabled: config["Enabled"] ?? true,
@@ -5445,7 +5547,7 @@ var S3BucketProvider = class S3BucketProvider {
 				Destination: { S3BucketDestination: s3Dest ? {
 					Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
 					AccountId: s3Dest["BucketAccountId"],
-					Format: readConfigString(s3Dest, "Format", "CSV", "AWS::S3::Bucket InventoryConfigurations[].Destination.S3BucketDestination"),
+					Format: readConfigString(s3Dest, "Format", "CSV", destPath, { ...onUnusable ? { onUnusable } : {} }),
 					Prefix: s3Dest["Prefix"]
 				} : void 0 },
 				OptionalFields: config["OptionalFields"],
@@ -5789,7 +5891,7 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 			this.logger.debug(`Deleted metrics configuration ${id} on bucket ${bucketName}`);
 		});
-		await this.diffArrayConfigById(bucketName, previousProperties["AnalyticsConfigurations"], properties["AnalyticsConfigurations"], async (_id, cfg) => this.applyAnalyticsConfigurations(bucketName, [cfg]), async (id) => {
+		await this.diffArrayConfigById(bucketName, previousProperties["AnalyticsConfigurations"], properties["AnalyticsConfigurations"], async (_id, cfg) => this.applyAnalyticsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m)), async (id) => {
 			await this.s3Client.send(new DeleteBucketAnalyticsConfigurationCommand({
 				Bucket: bucketName,
 				Id: id
@@ -5803,7 +5905,7 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 			this.logger.debug(`Deleted intelligent tiering configuration ${id} on bucket ${bucketName}`);
 		});
-		await this.diffArrayConfigById(bucketName, previousProperties["InventoryConfigurations"], properties["InventoryConfigurations"], async (_id, cfg) => this.applyInventoryConfigurations(bucketName, [cfg]), async (id) => {
+		await this.diffArrayConfigById(bucketName, previousProperties["InventoryConfigurations"], properties["InventoryConfigurations"], async (_id, cfg) => this.applyInventoryConfigurations(bucketName, [cfg], (m) => this.logger.warn(m)), async (id) => {
 			await this.s3Client.send(new DeleteBucketInventoryConfigurationCommand({
 				Bucket: bucketName,
 				Id: id
@@ -5823,7 +5925,8 @@ var S3BucketProvider = class S3BucketProvider {
 	* Apply ALL sub-configs unconditionally on initial create. Used by
 	* `create()` so the bucket starts out matching the template.
 	*/
-	async applyAllSubConfigsForCreate(bucketName, properties) {
+	async applyAllSubConfigsForCreate(bucketName, properties, context) {
+		const replayOnUnusable = replayWarn(this.logger, context).onUnusable;
 		const notifConfig = properties["NotificationConfiguration"];
 		if (notifConfig) await this.applyNotificationConfiguration(bucketName, notifConfig);
 		const corsConfig = properties["CorsConfiguration"];
@@ -5839,11 +5942,11 @@ var S3BucketProvider = class S3BucketProvider {
 		const metricsConfigs = properties["MetricsConfigurations"];
 		if (metricsConfigs && Array.isArray(metricsConfigs) && metricsConfigs.length > 0) await this.applyMetricsConfigurations(bucketName, metricsConfigs);
 		const analyticsConfigs = properties["AnalyticsConfigurations"];
-		if (analyticsConfigs && Array.isArray(analyticsConfigs) && analyticsConfigs.length > 0) await this.applyAnalyticsConfigurations(bucketName, analyticsConfigs);
+		if (analyticsConfigs && Array.isArray(analyticsConfigs) && analyticsConfigs.length > 0) await this.applyAnalyticsConfigurations(bucketName, analyticsConfigs, replayOnUnusable);
 		const itConfigs = properties["IntelligentTieringConfigurations"];
 		if (itConfigs && Array.isArray(itConfigs) && itConfigs.length > 0) await this.applyIntelligentTieringConfigurations(bucketName, itConfigs);
 		const inventoryConfigs = properties["InventoryConfigurations"];
-		if (inventoryConfigs && Array.isArray(inventoryConfigs) && inventoryConfigs.length > 0) await this.applyInventoryConfigurations(bucketName, inventoryConfigs);
+		if (inventoryConfigs && Array.isArray(inventoryConfigs) && inventoryConfigs.length > 0) await this.applyInventoryConfigurations(bucketName, inventoryConfigs, replayOnUnusable);
 		const replConfig = properties["ReplicationConfiguration"];
 		if (replConfig) await this.applyReplicationConfiguration(bucketName, replConfig);
 		const objectLockConfig = properties["ObjectLockConfiguration"];
@@ -5852,7 +5955,7 @@ var S3BucketProvider = class S3BucketProvider {
 	/**
 	* Create an S3 bucket
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating S3 bucket ${logicalId}`);
 		const bucketName = properties["BucketName"] || generateResourceName(logicalId, {
 			maxLength: 63,
@@ -5875,7 +5978,7 @@ var S3BucketProvider = class S3BucketProvider {
 			}
 			try {
 				await this.applyConfiguration(bucketName, properties);
-				await this.applyAllSubConfigsForCreate(bucketName, properties);
+				await this.applyAllSubConfigsForCreate(bucketName, properties, context);
 			} catch (innerError) {
 				if (createdNewBucket) try {
 					await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
@@ -7823,7 +7926,7 @@ var SNSTopicProvider = class {
 			}
 		}
 		if (JSON.stringify(properties["DeliveryStatusLogging"]) !== JSON.stringify(previousProperties["DeliveryStatusLogging"])) {
-			const desiredAttributes = buildDeliveryStatusAttributeMap(properties["DeliveryStatusLogging"], logicalId, "throw");
+			const desiredAttributes = buildDeliveryStatusAttributeMap(properties["DeliveryStatusLogging"], logicalId, "warn");
 			const previousAttributes = buildDeliveryStatusAttributeMap(previousProperties["DeliveryStatusLogging"], logicalId, "skip");
 			for (const [attributeName, attributeValue] of desiredAttributes) {
 				if (previousAttributes.get(attributeName) === attributeValue) continue;
@@ -8205,11 +8308,24 @@ const SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES = [
 * rate on create and update alike).
 *
 * `onMalformed` picks the failure mode for a malformed container / entry
-* / unknown protocol: `'throw'` for the DESIRED side (a template error
-* must fail fast, naming the offending value), `'skip'` for the PREVIOUS
-* side (cdkd state — refusing a value an older binary recorded would make
-* the stack permanently undeployable, and an entry whose protocol cannot
-* be canonicalized maps to no attribute names anyway).
+* / unknown protocol, and encodes the create-vs-update distinction
+* (issue #1538):
+*
+* - `'throw'` — the CREATE desired side, which is always template-borne:
+*   a template error must fail fast, naming the offending value.
+* - `'warn'` — the UPDATE desired side, which is NOT always template-borne:
+*   the rollback executor's revert arm and `cdkd drift --revert` both call
+*   `update()` with a state-derived bag as the DESIRED properties, so a
+*   state record carrying an unsupported protocol / malformed shape (a
+*   hand-written imported template, or a record an older binary wrote)
+*   must warn-and-skip rather than fail the update permanently — there is
+*   no template-side remedy. Skip semantics are well-defined: an entry
+*   whose protocol cannot be canonicalized maps to no attribute names, a
+*   non-array container yields an empty map, and a non-object entry is
+*   skipped. Each warning names the logicalId and the offending value.
+* - `'skip'` — the PREVIOUS side (cdkd state): same tolerance, silently —
+*   warning on every update about a value the user cannot act on from the
+*   template would be pure noise (guard-the-desired-side-only rule).
 *
 * Two entries whose `Protocol` values canonicalize to the SAME prefix
 * (`http/s` + `https`, say) collapse onto one set of attribute names. The
@@ -8223,38 +8339,46 @@ const SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES = [
 * produced `HTTPS*` names AWS rejected outright, so no such template ever
 * deployed.
 *
-* The collision WARNS rather than throws because this function's `'throw'`
-* side is also fed by the rollback executor's `update()` replay of a cdkd
-* STATE record, where the user has no template-side remedy. NOTE the three
-* pre-existing throws below (unsupported protocol, non-array container,
-* non-object entry) sit on that same side and are NOT covered by that
-* reasoning — a state record carrying one of those is permanently
-* unreplayable. That is a real but latent gap, tracked as issue #1538;
-* #1529 deliberately did not widen its scope to change the create path's
-* validation contract.
+* The collision WARNS rather than throws for the same reason `'warn'` mode
+* exists: the update desired side is also fed by the rollback executor's
+* `update()` replay of a cdkd STATE record, where the user has no
+* template-side remedy. The three malformed-value sites below (unsupported
+* protocol, non-array container, non-object entry) used to throw on that
+* side too, which made such a state record permanently unreplayable —
+* fixed by issue #1538, which moved `update()`'s desired side to `'warn'`
+* while `create()` keeps `'throw'` (a template create must still fail
+* fast; #1529 / #1536 deliberately left that contract unchanged).
 */
 function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed) {
 	const map = /* @__PURE__ */ new Map();
 	if (logging == null) return map;
+	const warn = (message) => {
+		getLogger().child("SNSTopicProvider").warn(message);
+	};
 	const seenProtocols = /* @__PURE__ */ new Set();
 	if (!Array.isArray(logging)) {
-		if (onMalformed === "skip") return map;
-		throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)}`);
+		if (onMalformed === "throw") throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)}`);
+		if (onMalformed === "warn") warn(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)} — treating it as empty for this update, so previously set delivery-status attributes are reset. The desired properties can come from a cdkd state record (rollback replay / drift --revert), so this does not fail the update; fix the template (or the state record on a replay) to clear this warning.`);
+		return map;
 	}
 	for (const entry of logging) {
 		if (entry == null || typeof entry !== "object" || Array.isArray(entry)) {
-			if (onMalformed === "skip") continue;
-			throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging entries must be {Protocol, ...} objects, got ${JSON.stringify(entry)}`);
+			if (onMalformed === "throw") throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging entries must be {Protocol, ...} objects, got ${JSON.stringify(entry)}`);
+			if (onMalformed === "warn") warn(`SNS topic ${logicalId}: skipping DeliveryStatusLogging entry ${JSON.stringify(entry)} — entries must be {Protocol, ...} objects. Attributes previously set for the skipped entry's protocol are reset, as if the entry had been removed.`);
+			continue;
 		}
 		const config = entry;
 		let protocol;
 		if (onMalformed === "throw") protocol = normalizeDeliveryStatusProtocolOrThrow(config["Protocol"], logicalId);
 		else {
 			const normalized = normalizeDeliveryStatusProtocol(config["Protocol"]);
-			if (normalized === void 0) continue;
+			if (normalized === void 0) {
+				if (onMalformed === "warn") warn(`SNS topic ${logicalId}: skipping DeliveryStatusLogging entry with unsupported protocol ${JSON.stringify(config["Protocol"])}. Expected one of ${SNS_DELIVERY_STATUS_PROTOCOL_SPELLINGS.join(", ")} (case-insensitive). Attributes previously set for the skipped entry's protocol are reset, as if the entry had been removed.`);
+				continue;
+			}
 			protocol = normalized;
 		}
-		if (onMalformed === "throw" && seenProtocols.has(protocol)) getLogger().child("SNSTopicProvider").warn(`SNS topic ${logicalId}: DeliveryStatusLogging declares more than one entry for the "${protocol}" attribute prefix (${JSON.stringify(config["Protocol"])} canonicalizes to it). AWS has one attribute set per prefix, so these are merged per field — a later entry overwrites only the sub-fields it declares, and a field it omits keeps the earlier entry's value. Declare a single entry per protocol.`);
+		if (onMalformed !== "skip" && seenProtocols.has(protocol)) warn(`SNS topic ${logicalId}: DeliveryStatusLogging declares more than one entry for the "${protocol}" attribute prefix (${JSON.stringify(config["Protocol"])} canonicalizes to it). AWS has one attribute set per prefix, so these are merged per field — a later entry overwrites only the sub-fields it declares, and a field it omits keeps the earlier entry's value. Declare a single entry per protocol.`);
 		seenProtocols.add(protocol);
 		for (const suffix of SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES) {
 			const value = config[suffix];
@@ -8330,10 +8454,13 @@ function normalizeDeliveryStatusProtocol(input) {
 	}
 }
 /**
-* Variant used by `create()` / `update()` to fail fast when a template
-* carries an unknown protocol. Throws a clear error naming the offending
-* value so the user sees what to fix instead of AWS's generic
-* `InvalidParameter` rejection.
+* Variant used by `create()` (the `'throw'` mode of
+* `buildDeliveryStatusAttributeMap`) to fail fast when a template carries
+* an unknown protocol. Throws a clear error naming the offending value so
+* the user sees what to fix instead of AWS's generic `InvalidParameter`
+* rejection. `update()`'s desired side warns-and-skips instead (issue
+* #1538) because its bag can be a cdkd state record on a rollback replay
+* or `drift --revert`.
 */
 function normalizeDeliveryStatusProtocolOrThrow(input, logicalId) {
 	const normalized = normalizeDeliveryStatusProtocol(input);
@@ -9910,11 +10037,11 @@ var LambdaUrlProvider = class {
 	/**
 	* Create a Lambda Function URL
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Lambda URL ${logicalId}`);
 		const targetFunctionArn = properties["TargetFunctionArn"];
 		if (!targetFunctionArn) throw new ProvisioningError(`TargetFunctionArn is required for Lambda URL ${logicalId}`, resourceType, logicalId);
-		const authType = requireConfigString(properties["AuthType"], "NONE", "AWS::Lambda::Url AuthType");
+		const authType = requireConfigString(properties["AuthType"], "NONE", "AWS::Lambda::Url AuthType", replayWarn(this.logger, context));
 		try {
 			const cors = properties["Cors"];
 			const createParams = {
@@ -11519,7 +11646,7 @@ var DynamoDBTableProvider = class {
 	/**
 	* Create a DynamoDB table
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating DynamoDB table ${logicalId}`);
 		const tableName = properties["TableName"] || generateResourceName(logicalId, { maxLength: 255 });
 		const keySchema = properties["KeySchema"];
@@ -11528,7 +11655,7 @@ var DynamoDBTableProvider = class {
 		if (!attributeDefinitions) throw new ProvisioningError(`AttributeDefinitions is required for DynamoDB table ${logicalId}`, resourceType, logicalId);
 		let tableCreated = false;
 		try {
-			const billingMode = properties["BillingMode"] || "PROVISIONED";
+			const billingMode = requireConfigString(properties["BillingMode"], "PROVISIONED", "AWS::DynamoDB::Table BillingMode", replayWarn(this.logger, context));
 			const createParams = {
 				TableName: tableName,
 				KeySchema: keySchema,
@@ -11602,9 +11729,15 @@ var DynamoDBTableProvider = class {
 			if (table?.TableArn) await this.applyTagDiff(table.TableArn, previousProperties["Tags"], properties["Tags"]);
 			const normalizeTableClass = (v) => typeof v === "string" && v.length > 0 ? v : "STANDARD";
 			const tableClassChanged = normalizeTableClass(properties["TableClass"]) !== normalizeTableClass(previousProperties["TableClass"]);
-			const billingOrThroughputChanged = JSON.stringify(properties["BillingMode"]) !== JSON.stringify(previousProperties["BillingMode"]) || JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"]);
+			const prevBillingMode = previousProperties["BillingMode"];
+			let billingModeUnusable = false;
+			const requestedBillingMode = properties["BillingMode"] === void 0 ? void 0 : requireConfigString(properties["BillingMode"], "PROVISIONED", "AWS::DynamoDB::Table BillingMode", { onUnusable: (message) => {
+				billingModeUnusable = true;
+				this.logger.warn(`${message} The table's current billing mode${prevBillingMode ? ` (${prevBillingMode})` : ""} is kept for this update rather than flipped to the default.`);
+			} });
+			const billingMode = billingModeUnusable ? prevBillingMode : requestedBillingMode;
+			const billingOrThroughputChanged = JSON.stringify(billingMode) !== JSON.stringify(prevBillingMode) || JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"]);
 			if (billingOrThroughputChanged || tableClassChanged) {
-				const billingMode = properties["BillingMode"];
 				const updateInput = { TableName: physicalId };
 				if (billingOrThroughputChanged && billingMode) updateInput.BillingMode = billingMode;
 				if (tableClassChanged) updateInput.TableClass = normalizeTableClass(properties["TableClass"]);
@@ -12557,7 +12690,7 @@ var DynamoDBGlobalTableProvider = class {
 		if (streamSpecInput != null) {
 			let streamViewType;
 			try {
-				streamViewType = readConfigString(streamSpecInput, "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification");
+				streamViewType = readConfigString(streamSpecInput, "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification", replayWarn(this.logger, context));
 			} catch (error) {
 				throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 			}
@@ -12574,7 +12707,7 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		let sdkIndexes;
 		try {
-			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics);
+			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics, replayWarn(this.logger, context).onUnusable);
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
@@ -14554,9 +14687,16 @@ function pickAutoScalingCapacity(autoScaling, source) {
 * written before this fix (and hand-authored templates) can carry them, and
 * silently re-deriving over an explicit value would be a regression.
 */
-function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "min", diagnostics) {
+function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "min", diagnostics, onUnusableIndexes) {
 	const rawIndexes = properties["GlobalSecondaryIndexes"];
-	if (rawIndexes !== void 0 && !Array.isArray(rawIndexes)) throw new Error(`AWS::DynamoDB::GlobalTable GlobalSecondaryIndexes must be an array, got ${typeof rawIndexes} (${JSON.stringify(rawIndexes)?.slice(0, 200)}). An unresolved intrinsic here would otherwise deploy a table with no indexes.`);
+	if (rawIndexes !== void 0 && !Array.isArray(rawIndexes)) {
+		const shapeDetail = `AWS::DynamoDB::GlobalTable GlobalSecondaryIndexes must be an array, got ${typeof rawIndexes} (${JSON.stringify(rawIndexes)?.slice(0, 200)}).`;
+		if (onUnusableIndexes) {
+			onUnusableIndexes(`${shapeDetail} Omitting the malformed block, so this create carries NO indexes; the same value is REFUSED on a template-path create`);
+			return [];
+		}
+		throw new Error(`${shapeDetail} An unresolved intrinsic here would otherwise deploy a table with no indexes.`);
+	}
 	const cfnIndexes = rawIndexes ?? [];
 	if (cfnIndexes.length === 0) return [];
 	const replicas = properties["Replicas"] ?? [];
@@ -44575,9 +44715,9 @@ var S3DirectoryBucketProvider = class {
 	/**
 	* Create an S3 Express Directory Bucket
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating S3 Express Directory Bucket ${logicalId}`);
-		const dataRedundancy = requireConfigString(properties["DataRedundancy"], "SingleAvailabilityZone", "AWS::S3Express::DirectoryBucket DataRedundancy");
+		const dataRedundancy = requireConfigString(properties["DataRedundancy"], "SingleAvailabilityZone", "AWS::S3Express::DirectoryBucket DataRedundancy", replayWarn(this.logger, context));
 		const azName = properties["LocationName"]?.replace(/--x-s3$/, "") || "us-east-1a";
 		const azId = await this.getAzId(azName);
 		let bucketName = properties["BucketName"];
@@ -67565,7 +67705,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.49");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.51");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;