@go-to-k/cdkd 0.278.50 → 0.278.52

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-D2mbS9va.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-64dVN8O1.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-C217C6UE.js";
+import { t as ASGProvider } from "./asg-provider-CjVpdcoW.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4824,6 +4824,53 @@ function isPlainObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
+* Is this `Destination` block written in the CFn FLATTENED form
+* (`{ BucketArn, Format, ... }`) rather than the SDK NESTED one
+* (`{ S3BucketDestination: { ... } }`)?
+*
+* ONE predicate, called from both `resolveS3BucketDestination` (which picks the
+* bag) and `s3BucketDestinationPath` (which names it). They were written out
+* twice and a reviewer rightly pointed out that two copies of a branch
+* condition must be edited together or a refusal starts naming the wrong key.
+*
+* `Bucket` is probed alongside `BucketArn` because the readers accept it
+* (`s3Dest['BucketArn'] ?? s3Dest['Bucket']`); omitting it made a
+* `{ Bucket }`-only block take the nested branch, find nothing, and drop — the
+* same silent drop one shape over.
+*/
+function isFlattenedDestination(dest) {
+	return Boolean(dest["BucketArn"] || dest["Bucket"] || dest["BucketAccountId"] || dest["Format"]);
+}
+/**
+* The CFn path of the destination bag `resolveS3BucketDestination` will pick —
+* issue #1493 item 3, which is a MESSAGE concern, not a value one.
+*
+* Kept separate from the resolver rather than returned alongside the bag:
+* `gen-nested-key-coverage`'s write-evidence walk follows a plain
+* `const x = this.helper(...)` binding to the members written beneath it, and
+* a DESTRUCTURED `const { bag, path } = ...` is a shape it cannot follow — so
+* pairing the two silently withdrew the write evidence for
+* `Destination.BucketArn` / `.BucketAccountId` and turned an opted-in target
+* red with no behavior change at all. Measured against the pre-change provider
+* via the critic's `--providers-dir=` seam.
+*/
+function s3BucketDestinationPath(dest, destinationPath) {
+	return isPlainObject$1(dest) && isFlattenedDestination(dest) ? destinationPath : `${destinationPath}.S3BucketDestination`;
+}
+/**
+* Name a malformed value in a refusal message, the way `config-shape.ts`'s
+* private `describe` does for the string-reading guards. Kept local rather than
+* exported from there because `resolveS3BucketDestination` is S3-specific
+* branch selection, not a shared shape guard — the two only share the wording.
+*/
+function describeValue(value) {
+	if (value === null) return "null";
+	if (Array.isArray(value)) return "an array";
+	if (typeof value === "string") return `a string ${JSON.stringify(value)}`;
+	if (isPlainObject$1(value)) return `an object with keys [${Object.keys(value).join(", ")}]`;
+	return `a ${typeof value} (${String(value)})`;
+}
+/**
 * Coerce a CFn numeric to a finite number. CloudFormation is stringly typed —
 * a hand-written or imported template (the audience the legacy lifecycle
 * branches exist for) can carry `"365"` where the schema says number.
@@ -5345,12 +5392,61 @@ var S3BucketProvider = class S3BucketProvider {
 		this.logger.debug(`Applied ${configs.length} metrics configuration(s) to bucket ${bucketName}`);
 	}
 	/**
+	* Pick the `S3BucketDestination` bag out of an analytics / inventory
+	* `Destination` block, refusing a shape that would otherwise be dropped.
+	*
+	* Two shapes are legitimate and both must keep working: the CFn FLATTENED
+	* form (`Destination: { BucketArn, Format, ... }`, what the schema declares)
+	* and the SDK NESTED form (`Destination: { S3BucketDestination: { ... } }`,
+	* accepted because state records and hand-written templates carry it).
+	*
+	* Issue #1493 item 2: the branch was picked by probing member presence
+	* (`dest?.['BucketAccountId'] || dest?.['BucketArn'] || dest?.['Format']`),
+	* so a `Destination` that is a STRING / array / unresolved intrinsic indexed
+	* every probe to `undefined`, fell through to an equally-`undefined`
+	* `S3BucketDestination`, and the caller's `s3Dest ? … : undefined` omitted
+	* the whole block from the Put — a configuration silently deployed without
+	* the destination it declared. Unlike the sibling defaulting class this is a
+	* DROP, not a substituted default, so `readConfigString` does not cover it:
+	* it needs its own decision, and per issue #1513's precedent that decision is
+	* REFUSE on the template-borne create path, WARN on the replay-reachable
+	* update path (`onUnusable`), where the desired bag can be a historical cdkd
+	* state record with no template-side remedy.
+	*
+	* Also returns the CFn path of the bag it picked (issue #1493 item 3): the
+	* callers used to hardcode `…Destination.S3BucketDestination` in the
+	* `containerPath` they pass to `readConfigString`, so a refusal on the
+	* FLATTENED branch — where the bag IS `dest` itself — named a key the user's
+	* template does not contain.
+	*
+	* @returns the picked bag, or `undefined` when the block was ABSENT or was
+	*   refused on a warn-only path. The caller distinguishes the two by testing
+	*   its own `Destination` value — see the `continue` at each call site.
+	*/
+	resolveS3BucketDestination(dest, destinationPath, onUnusable) {
+		const nestedPath = `${destinationPath}.S3BucketDestination`;
+		const drop = (message) => {
+			if (onUnusable) {
+				onUnusable(`${message}. Leaving this configuration unchanged; the same value is REFUSED on a template-path create`);
+				return;
+			}
+			throw new Error(message);
+		};
+		if (dest === void 0 || dest === null) return;
+		if (!isPlainObject$1(dest)) return drop(`${destinationPath} must be an object (got ${describeValue(dest)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		const bag = isFlattenedDestination(dest) ? dest : dest["S3BucketDestination"];
+		if (bag === void 0 || bag === null) return drop(`${destinationPath} carries neither a bucket (BucketArn / Bucket) nor a nested S3BucketDestination object (got ${describeValue(dest)}) — the destination would otherwise be dropped from the request with no error`);
+		if (!isPlainObject$1(bag)) return drop(`${nestedPath} must be an object (got ${describeValue(bag)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		if (!bag["BucketArn"] && !bag["Bucket"]) return drop(`${bag === dest ? destinationPath : nestedPath} has no destination bucket (BucketArn / Bucket) (got ${describeValue(bag)}) — the request would be rejected by S3, or silently carry no destination`);
+		return bag;
+	}
+	/**
 	* Apply analytics configurations
 	*
 	* CFn property: AnalyticsConfigurations[] (array of configurations)
 	* SDK: PutBucketAnalyticsConfiguration (one per configuration, keyed by Id)
 	*/
-	async applyAnalyticsConfigurations(bucketName, configs) {
+	async applyAnalyticsConfigurations(bucketName, configs, onUnusable) {
 		for (const config of configs) {
 			const id = config["Id"];
 			const storageClassAnalysis = config["StorageClassAnalysis"];
@@ -5368,16 +5464,19 @@ var S3BucketProvider = class S3BucketProvider {
 				else if (prefix) analyticsConfig.Filter = { Prefix: prefix };
 				else if (tagFilters && tagFilters.length > 0) analyticsConfig.Filter = { Tag: tagFilters[0] };
 			}
-			if (storageClassAnalysis?.["DataExport"]) {
+			if (storageClassAnalysis?.["DataExport"] != null) {
 				const dataExport = storageClassAnalysis["DataExport"];
-				const dest = dataExport["Destination"];
-				const s3Dest = dest?.["BucketAccountId"] || dest?.["BucketArn"] || dest?.["Format"] ? dest : dest?.["S3BucketDestination"];
+				const analyticsDestPath = "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport.Destination";
+				const rawDest = dataExport["Destination"];
+				const s3Dest = this.resolveS3BucketDestination(rawDest, analyticsDestPath, onUnusable);
+				if (s3Dest === void 0 && rawDest != null) continue;
+				const destPath = s3BucketDestinationPath(rawDest, analyticsDestPath);
 				analyticsConfig.StorageClassAnalysis = { DataExport: {
 					OutputSchemaVersion: readConfigString(dataExport, "OutputSchemaVersion", "V_1", "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport"),
 					Destination: s3Dest ? { S3BucketDestination: {
 						Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
 						BucketAccountId: s3Dest["BucketAccountId"],
-						Format: readConfigString(s3Dest, "Format", "CSV", "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport.Destination.S3BucketDestination"),
+						Format: readConfigString(s3Dest, "Format", "CSV", destPath, { ...onUnusable ? { onUnusable } : {} }),
 						Prefix: s3Dest["Prefix"]
 					} } : void 0
 				} };
@@ -5432,11 +5531,14 @@ var S3BucketProvider = class S3BucketProvider {
 	* CFn property: InventoryConfigurations[]
 	* SDK: PutBucketInventoryConfiguration (one per configuration, keyed by Id)
 	*/
-	async applyInventoryConfigurations(bucketName, configs) {
+	async applyInventoryConfigurations(bucketName, configs, onUnusable) {
 		for (const config of configs) {
 			const id = config["Id"];
-			const dest = config["Destination"];
-			const s3Dest = dest?.["BucketArn"] || dest?.["Format"] ? dest : dest?.["S3BucketDestination"];
+			const inventoryDestPath = "AWS::S3::Bucket InventoryConfigurations[].Destination";
+			const rawDest = config["Destination"];
+			const s3Dest = this.resolveS3BucketDestination(rawDest, inventoryDestPath, onUnusable);
+			if (s3Dest === void 0 && rawDest != null) continue;
+			const destPath = s3BucketDestinationPath(rawDest, inventoryDestPath);
 			const inventoryConfig = {
 				Id: id,
 				IsEnabled: config["Enabled"] ?? true,
@@ -5445,7 +5547,7 @@ var S3BucketProvider = class S3BucketProvider {
 				Destination: { S3BucketDestination: s3Dest ? {
 					Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
 					AccountId: s3Dest["BucketAccountId"],
-					Format: readConfigString(s3Dest, "Format", "CSV", "AWS::S3::Bucket InventoryConfigurations[].Destination.S3BucketDestination"),
+					Format: readConfigString(s3Dest, "Format", "CSV", destPath, { ...onUnusable ? { onUnusable } : {} }),
 					Prefix: s3Dest["Prefix"]
 				} : void 0 },
 				OptionalFields: config["OptionalFields"],
@@ -5789,7 +5891,7 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 			this.logger.debug(`Deleted metrics configuration ${id} on bucket ${bucketName}`);
 		});
-		await this.diffArrayConfigById(bucketName, previousProperties["AnalyticsConfigurations"], properties["AnalyticsConfigurations"], async (_id, cfg) => this.applyAnalyticsConfigurations(bucketName, [cfg]), async (id) => {
+		await this.diffArrayConfigById(bucketName, previousProperties["AnalyticsConfigurations"], properties["AnalyticsConfigurations"], async (_id, cfg) => this.applyAnalyticsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m)), async (id) => {
 			await this.s3Client.send(new DeleteBucketAnalyticsConfigurationCommand({
 				Bucket: bucketName,
 				Id: id
@@ -5803,7 +5905,7 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 			this.logger.debug(`Deleted intelligent tiering configuration ${id} on bucket ${bucketName}`);
 		});
-		await this.diffArrayConfigById(bucketName, previousProperties["InventoryConfigurations"], properties["InventoryConfigurations"], async (_id, cfg) => this.applyInventoryConfigurations(bucketName, [cfg]), async (id) => {
+		await this.diffArrayConfigById(bucketName, previousProperties["InventoryConfigurations"], properties["InventoryConfigurations"], async (_id, cfg) => this.applyInventoryConfigurations(bucketName, [cfg], (m) => this.logger.warn(m)), async (id) => {
 			await this.s3Client.send(new DeleteBucketInventoryConfigurationCommand({
 				Bucket: bucketName,
 				Id: id
@@ -5823,7 +5925,8 @@ var S3BucketProvider = class S3BucketProvider {
 	* Apply ALL sub-configs unconditionally on initial create. Used by
 	* `create()` so the bucket starts out matching the template.
 	*/
-	async applyAllSubConfigsForCreate(bucketName, properties) {
+	async applyAllSubConfigsForCreate(bucketName, properties, context) {
+		const replayOnUnusable = replayWarn(this.logger, context).onUnusable;
 		const notifConfig = properties["NotificationConfiguration"];
 		if (notifConfig) await this.applyNotificationConfiguration(bucketName, notifConfig);
 		const corsConfig = properties["CorsConfiguration"];
@@ -5839,11 +5942,11 @@ var S3BucketProvider = class S3BucketProvider {
 		const metricsConfigs = properties["MetricsConfigurations"];
 		if (metricsConfigs && Array.isArray(metricsConfigs) && metricsConfigs.length > 0) await this.applyMetricsConfigurations(bucketName, metricsConfigs);
 		const analyticsConfigs = properties["AnalyticsConfigurations"];
-		if (analyticsConfigs && Array.isArray(analyticsConfigs) && analyticsConfigs.length > 0) await this.applyAnalyticsConfigurations(bucketName, analyticsConfigs);
+		if (analyticsConfigs && Array.isArray(analyticsConfigs) && analyticsConfigs.length > 0) await this.applyAnalyticsConfigurations(bucketName, analyticsConfigs, replayOnUnusable);
 		const itConfigs = properties["IntelligentTieringConfigurations"];
 		if (itConfigs && Array.isArray(itConfigs) && itConfigs.length > 0) await this.applyIntelligentTieringConfigurations(bucketName, itConfigs);
 		const inventoryConfigs = properties["InventoryConfigurations"];
-		if (inventoryConfigs && Array.isArray(inventoryConfigs) && inventoryConfigs.length > 0) await this.applyInventoryConfigurations(bucketName, inventoryConfigs);
+		if (inventoryConfigs && Array.isArray(inventoryConfigs) && inventoryConfigs.length > 0) await this.applyInventoryConfigurations(bucketName, inventoryConfigs, replayOnUnusable);
 		const replConfig = properties["ReplicationConfiguration"];
 		if (replConfig) await this.applyReplicationConfiguration(bucketName, replConfig);
 		const objectLockConfig = properties["ObjectLockConfiguration"];
@@ -5852,7 +5955,7 @@ var S3BucketProvider = class S3BucketProvider {
 	/**
 	* Create an S3 bucket
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating S3 bucket ${logicalId}`);
 		const bucketName = properties["BucketName"] || generateResourceName(logicalId, {
 			maxLength: 63,
@@ -5875,7 +5978,7 @@ var S3BucketProvider = class S3BucketProvider {
 			}
 			try {
 				await this.applyConfiguration(bucketName, properties);
-				await this.applyAllSubConfigsForCreate(bucketName, properties);
+				await this.applyAllSubConfigsForCreate(bucketName, properties, context);
 			} catch (innerError) {
 				if (createdNewBucket) try {
 					await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
@@ -42655,6 +42758,25 @@ function mapHttpEndpointDescriptionToCfn(desc) {
 //#endregion
 //#region src/provisioning/providers/cloudtrail-provider.ts
 /**
+* The selector set a trail carries when its template declares NO
+* `EventSelectors`, and therefore the RESET payload for a removal.
+*
+* Live CFn A/B (issue #1549, us-east-1, 2026-08-11): removing `EventSelectors`
+* from a deployed trail's template resets the live selectors to exactly this
+* shape — AWS echoes it back as `{ReadWriteType: 'All', IncludeManagementEvents:
+* true, DataResources: [], ExcludeManagementEventSources: []}`, the two empty
+* lists being response-side defaults that do NOT need sending.
+*
+* It is a VALUE, not an empty array, because `PutEventSelectors` rejects `[]`
+* with `InvalidEventSelectorsException: Specify a valid number of selectors
+* (1 to 5) for your trail` — the divergence from the `InsightSelectors` sibling,
+* where AWS documents `[]` as the removal shape.
+*/
+const DEFAULT_EVENT_SELECTORS = Object.freeze([Object.freeze({
+	ReadWriteType: "All",
+	IncludeManagementEvents: true
+})]);
+/**
 * SDK Provider for AWS CloudTrail resources
 *
 * Supports:
@@ -42783,15 +42905,29 @@ var CloudTrailProvider = class {
 				SnsTopicName: snsTopicName,
 				IsOrganizationTrail: isOrganizationTrail
 			}));
-			const newEventSelectors = properties["EventSelectors"];
+			const rawEventSelectors = properties["EventSelectors"];
+			let eventSelectorsUnusable = false;
+			let newEventSelectors;
+			if (rawEventSelectors != null) try {
+				newEventSelectors = requireConfigArray(rawEventSelectors, "AWS::CloudTrail::Trail EventSelectors");
+			} catch (error) {
+				eventSelectorsUnusable = true;
+				this.logger.warn(`${error instanceof Error ? error.message : String(error)} The trail's existing event selectors are left untouched for this update rather than reset to the AWS default.`);
+			}
 			const oldEventSelectors = previousProperties["EventSelectors"];
-			if (JSON.stringify(newEventSelectors) !== JSON.stringify(oldEventSelectors)) {
-				if (newEventSelectors && newEventSelectors.length > 0) {
-					this.logger.debug(`Updating event selectors for CloudTrail Trail ${logicalId}`);
+			if (!eventSelectorsUnusable && JSON.stringify(newEventSelectors) !== JSON.stringify(oldEventSelectors)) {
+				const isRemoval = newEventSelectors === void 0 || newEventSelectors.length === 0;
+				const eventSelectorsToSend = newEventSelectors === void 0 || newEventSelectors.length === 0 ? DEFAULT_EVENT_SELECTORS : newEventSelectors;
+				this.logger.debug(isRemoval ? `Resetting event selectors to the AWS default for CloudTrail Trail ${logicalId}` : `Updating event selectors for CloudTrail Trail ${logicalId}`);
+				try {
 					await this.getClient().send(new PutEventSelectorsCommand({
 						TrailName: physicalId,
-						EventSelectors: newEventSelectors
+						EventSelectors: [...eventSelectorsToSend]
 					}));
+				} catch (error) {
+					const message = error instanceof Error ? error.message : String(error);
+					if (!isRemoval || !/advanced[\s-]*event[\s-]*selector/i.test(message)) throw error;
+					this.logger.warn(`CloudTrail Trail ${logicalId}: skipping the EventSelectors reset — the trail is using AdvancedEventSelectors, which AWS manages through a separate API, so there are no basic event selectors to clear (${message})`);
 				}
 			}
 			const newInsightSelectors = properties["InsightSelectors"];
@@ -42803,7 +42939,8 @@ var CloudTrailProvider = class {
 					InsightSelectors: newInsightSelectors ?? []
 				}));
 			}
-			if (isLogging !== previousProperties["IsLogging"]) if (isLogging === false) {
+			const oldIsLogging = previousProperties["IsLogging"];
+			if (isLogging !== void 0 && isLogging !== oldIsLogging) if (isLogging === false) {
 				this.logger.debug(`Stopping logging for CloudTrail Trail ${logicalId}`);
 				await this.getClient().send(new StopLoggingCommand({ Name: physicalId }));
 			} else {
@@ -67602,7 +67739,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.50");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.52");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;