@go-to-k/cdkd 0.280.35 → 0.280.36

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-DjdMx6fC.js";
+import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-BcorBRVN.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CL2zlhEi.js";
+import { t as ASGProvider } from "./asg-provider-DeR16ts4.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4820,6 +4820,23 @@ function isTruthyCfnBoolean(value) {
 * single transition entry makes S3 answer `MalformedXML` for the WHOLE
 * lifecycle configuration, so the legacy singular readers screen with this.
 */
+/**
+* The `Id` of one per-item configuration, normalized to a string.
+*
+* `diffArrayConfigById` accepts an `Id` under a TRUTHINESS test, so an
+* unquoted-YAML `Id: 1` is a NUMBER that reaches the Put and lands in the
+* skipped-id set as a number. A `typeof id === 'string'` predicate on the other
+* side then reads that item as NOT skipped and records the never-applied
+* desired value — reviving, for exactly that shape, the phantom drift issue
+* #1612 exists to remove. Both sides go through this helper so they cannot
+* disagree about what an `Id` is.
+*/
+function configItemId(item) {
+	if (!isPlainObject$1(item)) return void 0;
+	const id = item["Id"];
+	if (typeof id === "string") return id;
+	if (typeof id === "number" && Number.isFinite(id)) return String(id);
+}
 function isPlainObject$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -4984,12 +5001,17 @@ var S3BucketProvider = class S3BucketProvider {
 	/**
 	* Apply versioning configuration if specified
 	*/
+	/**
+	* @returns `true` when `PutBucketVersioning` was issued, `false` when the
+	*   replay downgrade SKIPPED it. The caller records that skip in
+	*   `effectiveProperties` so state describes what AWS holds (issue #1612).
+	*/
 	async applyVersioning(bucketName, versioningConfig, onUnusable) {
 		if (onUnusable) {
 			const refusal = configStringRefusal(versioningConfig, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration");
 			if (refusal !== void 0) {
 				onUnusable(`${refusal}. No PutBucketVersioning is issued rather than applying the Suspended default, which would turn object versioning OFF on an existing bucket (on a replayed create it means the bucket is left unversioned); the same value is REFUSED on a template-path create`);
-				return;
+				return false;
 			}
 		}
 		const status = readConfigString(versioningConfig, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration");
@@ -4998,6 +5020,7 @@ var S3BucketProvider = class S3BucketProvider {
 			VersioningConfiguration: { Status: status }
 		}));
 		this.logger.debug(`Applied versioning (${status}) to bucket ${bucketName}`);
+		return true;
 	}
 	/**
 	* Apply tags if specified
@@ -5115,16 +5138,20 @@ var S3BucketProvider = class S3BucketProvider {
 	* - CFn uses TagFilters, SDK uses Tag/Tags in Filter
 	* - CFn Transition.TransitionInDays -> SDK Transition.Days
 	* - CFn Transition.TransitionDate -> SDK Transition.Date
+	*
+	* @returns `true` when the Put was issued, `false` when a replay downgrade
+	*   SKIPPED the whole configuration (issue #1612 — the caller records that in
+	*   `effectiveProperties`).
 	*/
 	async applyLifecycleConfiguration(bucketName, lifecycleConfig, onUnusable) {
 		for (const rule of lifecycleConfig.Rules) {
 			const rawFilter = rule["Filter"];
-			if (rawFilter != null && requireConfigObject(rawFilter, "AWS::S3::Bucket LifecycleConfiguration.Rules[].Filter", { ...onUnusable ? { onUnusable } : {} }) === void 0) return;
+			if (rawFilter != null && requireConfigObject(rawFilter, "AWS::S3::Bucket LifecycleConfiguration.Rules[].Filter", { ...onUnusable ? { onUnusable } : {} }) === void 0) return false;
 			const rawTagFilters = rawFilter?.["TagFilters"] ?? rule["TagFilters"];
 			if (rawTagFilters != null) {
-				if (requireConfigArray(rawTagFilters, "AWS::S3::Bucket LifecycleConfiguration.Rules[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) return;
+				if (requireConfigArray(rawTagFilters, "AWS::S3::Bucket LifecycleConfiguration.Rules[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) return false;
 			}
-			if (this.skipOnUnusableConfigString(rule, "Status", "Enabled", "AWS::S3::Bucket LifecycleConfiguration.Rules[]", "Leaving the whole lifecycle configuration unapplied here", onUnusable)) return;
+			if (this.skipOnUnusableConfigString(rule, "Status", "Enabled", "AWS::S3::Bucket LifecycleConfiguration.Rules[]", "Leaving the whole lifecycle configuration unapplied here", onUnusable)) return false;
 		}
 		const gatherScope = (rule) => {
 			const filter = rule["Filter"];
@@ -5211,6 +5238,7 @@ var S3BucketProvider = class S3BucketProvider {
 			TransitionDefaultMinimumObjectSize: lifecycleConfig["TransitionDefaultMinimumObjectSize"]
 		}));
 		this.logger.debug(`Applied lifecycle configuration to bucket ${bucketName}`);
+		return true;
 	}
 	/**
 	* Apply public access block configuration
@@ -5269,12 +5297,16 @@ var S3BucketProvider = class S3BucketProvider {
 	*   - LogFilePrefix -> SDK TargetPrefix
 	* SDK: PutBucketLogging with BucketLoggingStatus.LoggingEnabled
 	*/
+	/**
+	* @returns `true` when a `PutBucketLogging` (set or clear) was issued,
+	*   `false` when the replay downgrade SKIPPED it (issue #1612).
+	*/
 	async applyLoggingConfiguration(bucketName, loggingConfig, onUnusable) {
 		if (onUnusable) {
 			const refusal = configStringRefusal(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") ?? configStringRefusal(loggingConfig, "LogFilePrefix", "", "AWS::S3::Bucket LoggingConfiguration");
 			if (refusal !== void 0) {
 				onUnusable(`${refusal}. No PutBucketLogging is issued rather than clearing access logging, which would turn it OFF on an existing bucket (on a replayed create it means the bucket comes up with no access logging); the same value is REFUSED on a template-path create`);
-				return;
+				return false;
 			}
 		}
 		const destinationBucket = readConfigString(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration");
@@ -5284,7 +5316,7 @@ var S3BucketProvider = class S3BucketProvider {
 				BucketLoggingStatus: {}
 			}));
 			this.logger.debug(`Cleared logging configuration on bucket ${bucketName}`);
-			return;
+			return true;
 		}
 		const loggingEnabled = {
 			TargetBucket: destinationBucket,
@@ -5303,6 +5335,7 @@ var S3BucketProvider = class S3BucketProvider {
 			BucketLoggingStatus: { LoggingEnabled: loggingEnabled }
 		}));
 		this.logger.debug(`Applied logging configuration to bucket ${bucketName}`);
+		return true;
 	}
 	/**
 	* Apply website configuration
@@ -5423,15 +5456,24 @@ var S3BucketProvider = class S3BucketProvider {
 	*
 	* CFn property: MetricsConfigurations[] (array of configurations)
 	* SDK: PutBucketMetricsConfiguration (one per configuration, keyed by Id)
+	*
+	* @returns the indexes (into `configs`) of the items a replay downgrade
+	*   SKIPPED — the per-item unit of `effectiveProperties` (issue #1612).
 	*/
 	async applyMetricsConfigurations(bucketName, configs, onUnusable) {
+		const skipped = [];
+		let index = -1;
 		for (const config of configs) {
+			index += 1;
 			const id = config["Id"];
 			const metricsConfig = { Id: id };
 			const prefix = config["Prefix"];
 			const accessPointArn = config["AccessPointArn"];
 			const tagFilters = config["TagFilters"];
-			if (tagFilters != null && requireConfigArray(tagFilters, "AWS::S3::Bucket MetricsConfigurations[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) continue;
+			if (tagFilters != null && requireConfigArray(tagFilters, "AWS::S3::Bucket MetricsConfigurations[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) {
+				skipped.push(index);
+				continue;
+			}
 			const tagCount = tagFilters?.length ?? 0;
 			if ((prefix ? 1 : 0) + tagCount + (accessPointArn ? 1 : 0) > 1) metricsConfig.Filter = { And: {
 				Prefix: prefix,
@@ -5447,7 +5489,8 @@ var S3BucketProvider = class S3BucketProvider {
 				MetricsConfiguration: metricsConfig
 			}));
 		}
-		this.logger.debug(`Applied ${configs.length} metrics configuration(s) to bucket ${bucketName}`);
+		this.logger.debug(`Applied ${configs.length - skipped.length} metrics configuration(s) to bucket ${bucketName}`);
+		return skipped;
 	}
 	/**
 	* Pick the `S3BucketDestination` bag out of an analytics / inventory
@@ -5503,12 +5546,21 @@ var S3BucketProvider = class S3BucketProvider {
 	*
 	* CFn property: AnalyticsConfigurations[] (array of configurations)
 	* SDK: PutBucketAnalyticsConfiguration (one per configuration, keyed by Id)
+	*
+	* @returns the indexes (into `configs`) of the items a replay downgrade
+	*   SKIPPED — the per-item unit of `effectiveProperties` (issue #1612).
 	*/
 	async applyAnalyticsConfigurations(bucketName, configs, onUnusable) {
+		const skipped = [];
+		let index = -1;
 		for (const config of configs) {
+			index += 1;
 			const id = config["Id"];
 			const rawStorageClassAnalysis = config["StorageClassAnalysis"];
-			if (rawStorageClassAnalysis != null && requireConfigObject(rawStorageClassAnalysis, "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis", { ...onUnusable ? { onUnusable } : {} }) === void 0) continue;
+			if (rawStorageClassAnalysis != null && requireConfigObject(rawStorageClassAnalysis, "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis", { ...onUnusable ? { onUnusable } : {} }) === void 0) {
+				skipped.push(index);
+				continue;
+			}
 			const storageClassAnalysis = rawStorageClassAnalysis;
 			const analyticsConfig = {
 				Id: id,
@@ -5516,7 +5568,10 @@ var S3BucketProvider = class S3BucketProvider {
 			};
 			const prefix = config["Prefix"];
 			const tagFilters = config["TagFilters"];
-			if (tagFilters != null && requireConfigArray(tagFilters, "AWS::S3::Bucket AnalyticsConfigurations[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) continue;
+			if (tagFilters != null && requireConfigArray(tagFilters, "AWS::S3::Bucket AnalyticsConfigurations[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) {
+				skipped.push(index);
+				continue;
+			}
 			const tagCount = tagFilters?.length ?? 0;
 			if ((prefix ? 1 : 0) + tagCount > 1) analyticsConfig.Filter = { And: {
 				Prefix: prefix,
@@ -5526,12 +5581,18 @@ var S3BucketProvider = class S3BucketProvider {
 			else if (tagFilters && tagFilters.length === 1) analyticsConfig.Filter = { Tag: tagFilters[0] };
 			if (storageClassAnalysis?.["DataExport"] != null) {
 				const rawDataExport = storageClassAnalysis["DataExport"];
-				if (requireConfigObject(rawDataExport, "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport", { ...onUnusable ? { onUnusable } : {} }) === void 0) continue;
+				if (requireConfigObject(rawDataExport, "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport", { ...onUnusable ? { onUnusable } : {} }) === void 0) {
+					skipped.push(index);
+					continue;
+				}
 				const dataExport = rawDataExport;
 				const analyticsDestPath = "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport.Destination";
 				const rawDest = dataExport["Destination"];
 				const s3Dest = this.resolveS3BucketDestination(rawDest, analyticsDestPath, onUnusable);
-				if (s3Dest === void 0 && rawDest != null) continue;
+				if (s3Dest === void 0 && rawDest != null) {
+					skipped.push(index);
+					continue;
+				}
 				const destPath = s3BucketDestinationPath(rawDest, analyticsDestPath);
 				analyticsConfig.StorageClassAnalysis = { DataExport: {
 					OutputSchemaVersion: readConfigString(dataExport, "OutputSchemaVersion", "V_1", "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport", { ...onUnusable ? { onUnusable } : {} }),
@@ -5549,18 +5610,28 @@ var S3BucketProvider = class S3BucketProvider {
 				AnalyticsConfiguration: analyticsConfig
 			}));
 		}
-		this.logger.debug(`Applied ${configs.length} analytics configuration(s) to bucket ${bucketName}`);
+		this.logger.debug(`Applied ${configs.length - skipped.length} analytics configuration(s) to bucket ${bucketName}`);
+		return skipped;
 	}
 	/**
 	* Apply intelligent tiering configurations
 	*
 	* CFn property: IntelligentTieringConfigurations[]
 	* SDK: PutBucketIntelligentTieringConfiguration (one per configuration, keyed by Id)
+	*
+	* @returns the indexes (into `configs`) of the items a replay downgrade
+	*   SKIPPED — the per-item unit of `effectiveProperties` (issue #1612).
 	*/
 	async applyIntelligentTieringConfigurations(bucketName, configs, onUnusable) {
+		const skipped = [];
+		let index = -1;
 		for (const config of configs) {
+			index += 1;
 			const id = config["Id"];
-			if (this.skipOnUnusableConfigString(config, "Status", "Enabled", "AWS::S3::Bucket IntelligentTieringConfigurations[]", "Skipping this intelligent tiering configuration", onUnusable)) continue;
+			if (this.skipOnUnusableConfigString(config, "Status", "Enabled", "AWS::S3::Bucket IntelligentTieringConfigurations[]", "Skipping this intelligent tiering configuration", onUnusable)) {
+				skipped.push(index);
+				continue;
+			}
 			const tierings = config["Tierings"];
 			const itConfig = {
 				Id: id,
@@ -5572,7 +5643,10 @@ var S3BucketProvider = class S3BucketProvider {
 			};
 			const prefix = config["Prefix"];
 			const tagFilters = config["TagFilters"];
-			if (tagFilters != null && requireConfigArray(tagFilters, "AWS::S3::Bucket IntelligentTieringConfigurations[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) continue;
+			if (tagFilters != null && requireConfigArray(tagFilters, "AWS::S3::Bucket IntelligentTieringConfigurations[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) {
+				skipped.push(index);
+				continue;
+			}
 			const tagCount = tagFilters?.length ?? 0;
 			if ((prefix ? 1 : 0) + tagCount > 1) itConfig.Filter = { And: {
 				Prefix: prefix,
@@ -5586,31 +5660,48 @@ var S3BucketProvider = class S3BucketProvider {
 				IntelligentTieringConfiguration: itConfig
 			}));
 		}
-		this.logger.debug(`Applied ${configs.length} intelligent tiering configuration(s) to bucket ${bucketName}`);
+		this.logger.debug(`Applied ${configs.length - skipped.length} intelligent tiering configuration(s) to bucket ${bucketName}`);
+		return skipped;
 	}
 	/**
 	* Apply inventory configurations
 	*
 	* CFn property: InventoryConfigurations[]
 	* SDK: PutBucketInventoryConfiguration (one per configuration, keyed by Id)
+	*
+	* @returns the indexes (into `configs`) of the items a replay downgrade
+	*   SKIPPED — the per-item unit of `effectiveProperties` (issue #1612).
 	*/
 	async applyInventoryConfigurations(bucketName, configs, onUnusable) {
+		const skipped = [];
+		let index = -1;
 		for (const config of configs) {
+			index += 1;
 			const id = config["Id"];
-			if (this.skipOnUnusableConfigString(config, "IncludedObjectVersions", "All", "AWS::S3::Bucket InventoryConfigurations[]", "Skipping this inventory configuration", onUnusable)) continue;
+			if (this.skipOnUnusableConfigString(config, "IncludedObjectVersions", "All", "AWS::S3::Bucket InventoryConfigurations[]", "Skipping this inventory configuration", onUnusable)) {
+				skipped.push(index);
+				continue;
+			}
 			const inventoryDestPath = "AWS::S3::Bucket InventoryConfigurations[].Destination";
 			const rawDest = config["Destination"];
 			const s3Dest = this.resolveS3BucketDestination(rawDest, inventoryDestPath, onUnusable);
-			if (s3Dest === void 0 && rawDest != null) continue;
+			if (s3Dest === void 0 && rawDest != null) {
+				skipped.push(index);
+				continue;
+			}
 			const destPath = s3BucketDestinationPath(rawDest, inventoryDestPath);
 			const scheduleFrequencyRefusal = onUnusable ? configStringRefusal(config, "ScheduleFrequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[]") : void 0;
 			if (scheduleFrequencyRefusal !== void 0 && config["Schedule"] == null) {
 				onUnusable?.(`${scheduleFrequencyRefusal}. Skipping this inventory configuration: there is no Schedule.Frequency to fall back to, and defaulting to Weekly would silently re-cadence a live inventory report; the same value is REFUSED on a template-path create`);
+				skipped.push(index);
 				continue;
 			}
 			if (scheduleFrequencyRefusal !== void 0) onUnusable?.(`${scheduleFrequencyRefusal}. Falling back to Schedule.Frequency; the same value is REFUSED on a template-path create`);
 			const useScheduleFrequency = config["ScheduleFrequency"] !== void 0 && scheduleFrequencyRefusal === void 0;
-			if (!useScheduleFrequency && this.skipOnUnusableConfigString(config["Schedule"], "Frequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[].Schedule", "Skipping this inventory configuration", onUnusable)) continue;
+			if (!useScheduleFrequency && this.skipOnUnusableConfigString(config["Schedule"], "Frequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[].Schedule", "Skipping this inventory configuration", onUnusable)) {
+				skipped.push(index);
+				continue;
+			}
 			const frequency = useScheduleFrequency ? requireConfigString(config["ScheduleFrequency"], "Weekly", "AWS::S3::Bucket InventoryConfigurations[].ScheduleFrequency") : readConfigString(config["Schedule"], "Frequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[].Schedule");
 			const inventoryConfig = {
 				Id: id,
@@ -5632,7 +5723,8 @@ var S3BucketProvider = class S3BucketProvider {
 				InventoryConfiguration: inventoryConfig
 			}));
 		}
-		this.logger.debug(`Applied ${configs.length} inventory configuration(s) to bucket ${bucketName}`);
+		this.logger.debug(`Applied ${configs.length - skipped.length} inventory configuration(s) to bucket ${bucketName}`);
+		return skipped;
 	}
 	/**
 	* Apply replication configuration
@@ -5690,12 +5782,16 @@ var S3BucketProvider = class S3BucketProvider {
 		}
 		return sdkDest;
 	}
+	/**
+	* @returns `true` when the Put was issued, `false` when a replay downgrade
+	*   SKIPPED the whole configuration (issue #1612).
+	*/
 	async applyReplicationConfiguration(bucketName, replConfig, onUnusable) {
 		const rules = replConfig["Rules"];
 		for (const rule of rules || []) {
 			const rawFilter = rule["Filter"];
-			if (rawFilter != null && requireConfigObject(rawFilter, "AWS::S3::Bucket ReplicationConfiguration.Rules[].Filter", { ...onUnusable ? { onUnusable } : {} }) === void 0) return;
-			if (this.skipOnUnusableConfigString(rule, "Status", "Enabled", "AWS::S3::Bucket ReplicationConfiguration.Rules[]", "Leaving the whole replication configuration unapplied here", onUnusable)) return;
+			if (rawFilter != null && requireConfigObject(rawFilter, "AWS::S3::Bucket ReplicationConfiguration.Rules[].Filter", { ...onUnusable ? { onUnusable } : {} }) === void 0) return false;
+			if (this.skipOnUnusableConfigString(rule, "Status", "Enabled", "AWS::S3::Bucket ReplicationConfiguration.Rules[]", "Leaving the whole replication configuration unapplied here", onUnusable)) return false;
 		}
 		await this.s3Client.send(new PutBucketReplicationCommand({
 			Bucket: bucketName,
@@ -5744,6 +5840,7 @@ var S3BucketProvider = class S3BucketProvider {
 			}
 		}));
 		this.logger.debug(`Applied replication configuration to bucket ${bucketName}`);
+		return true;
 	}
 	/**
 	* Apply object lock configuration
@@ -5786,9 +5883,12 @@ var S3BucketProvider = class S3BucketProvider {
 	*/
 	async applyConfiguration(bucketName, properties, options = {}) {
 		const { skipTags = false, skipDiffManaged = false, context } = options;
+		const overrides = /* @__PURE__ */ new Map();
 		const replayOnUnusable = replayWarn(this.logger, context).onUnusable;
 		const versioningConfig = properties["VersioningConfiguration"];
-		if (!skipDiffManaged && versioningConfig != null) await this.applyVersioning(bucketName, versioningConfig, replayOnUnusable);
+		if (!skipDiffManaged && versioningConfig != null) {
+			if (!await this.applyVersioning(bucketName, versioningConfig, replayOnUnusable)) overrides.set("VersioningConfiguration", void 0);
+		}
 		const tags = properties["Tags"];
 		if (!skipTags && tags && Array.isArray(tags) && tags.length > 0) await this.applyTags(bucketName, tags);
 		const ownershipControls = properties["OwnershipControls"];
@@ -5798,6 +5898,7 @@ var S3BucketProvider = class S3BucketProvider {
 		if (publicAccessBlock) await this.applyPublicAccessBlockConfiguration(bucketName, publicAccessBlock);
 		const normalizedEncryption = S3BucketProvider.emptyListConfigToUndefined(properties["BucketEncryption"], "ServerSideEncryptionConfiguration");
 		if (!skipDiffManaged && normalizedEncryption !== void 0) await this.applyBucketEncryption(bucketName, normalizedEncryption);
+		return overrides;
 	}
 	/**
 	* CFn property: OwnershipControls
@@ -5857,6 +5958,74 @@ var S3BucketProvider = class S3BucketProvider {
 		return config;
 	}
 	/**
+	* Turn a set of skipped-property overrides into the `effectiveProperties`
+	* bag the deploy engine records in place of the desired one (issue #1612).
+	*
+	* A warn-and-skip arm makes the deploy SUCCEED while a declared
+	* configuration never reaches AWS, so recording the desired bag verbatim
+	* writes a value AWS does not hold: `readCurrentState` can never match it,
+	* every later `cdkd drift` re-reports the difference, and `drift --revert`
+	* re-issues the same skipped call — the permanent phantom drift
+	* `.claude/rules/providers.md` records for the EC2 Route warn arm (#1591),
+	* reached here through a skip instead of a narrowing.
+	*
+	* A `undefined` override value means the key is ABSENT from the effective
+	* bag, which is why this walks the map rather than spreading it: spreading
+	* would leave an explicit `undefined` that `JSON.stringify` drops on one
+	* side of the next diff but not the other.
+	*
+	* @returns the complete replacement bag, or `undefined` when nothing was
+	*   skipped — the engine then records the desired properties unchanged.
+	*/
+	static applyEffectiveOverrides(properties, overrides) {
+		if (overrides.size === 0) return void 0;
+		const effective = { ...properties };
+		for (const [key, value] of overrides) if (value === void 0) delete effective[key];
+		else effective[key] = value;
+		return effective;
+	}
+	/**
+	* The effective value of a per-item array property some of whose items a
+	* replay downgrade SKIPPED (issue #1612).
+	*
+	* The Put for these four properties is per-`Id`, so the skip unit is one
+	* configuration ITEM and the array must be rebuilt member by member: a
+	* skipped CHANGE keeps the previously-applied item (that IS what AWS still
+	* holds), a skipped ADD is dropped (AWS holds nothing for that `Id`), and
+	* every unskipped item stays as declared.
+	*
+	* The DESIRED order is preserved deliberately — `DiffCalculator` compares
+	* arrays positionally, so an effective array that merely reorders the same
+	* items would manufacture a fresh phantom drift while removing the one this
+	* exists to fix.
+	*
+	* @param previous the previously-recorded array, or `undefined` on the
+	*   replay-CREATE path, where nothing was ever applied and there is no
+	*   previous item to substitute.
+	* @returns the effective array, or `undefined` when the key should be ABSENT
+	*   from the effective bag (nothing survived AND the previous side declared
+	*   nothing, so the property was never applied at all).
+	*/
+	static buildEffectiveItemArray(desired, previous, isSkipped) {
+		const previousById = /* @__PURE__ */ new Map();
+		for (const item of previous ?? []) {
+			const id = configItemId(item);
+			if (id !== void 0) previousById.set(id, item);
+		}
+		const effective = [];
+		desired.forEach((item, index) => {
+			if (!isSkipped(item, index)) {
+				effective.push(item);
+				return;
+			}
+			const id = configItemId(item);
+			const retained = id !== void 0 ? previousById.get(id) : void 0;
+			if (retained !== void 0) effective.push(retained);
+		});
+		if (effective.length === 0 && previous === void 0) return void 0;
+		return effective;
+	}
+	/**
 	* Diff CFn-shape sub-config values between previous and new state.
 	*
 	* Four transitions:
@@ -5916,15 +6085,47 @@ var S3BucketProvider = class S3BucketProvider {
 	* silent no-op (issue #1466): the same A/B showed CFn suspends versioning,
 	* deletes ownership controls, and resets encryption to the SSE-S3 default.
 	* They are now diffed here like every other Put/Delete pair.
+	*
+	* @returns the per-property overrides for `effectiveProperties` (issue
+	*   #1612): on THIS path a skipped Put means AWS still holds the
+	*   previously-applied configuration, so the override is the PREVIOUS value —
+	*   `undefined` when the previous side declared none, which removes the key.
+	*   Dropping the key unconditionally instead would be wrong in the other
+	*   direction: a later template that REMOVES the block would then derive no
+	*   removal and the live configuration would survive forever.
 	*/
 	async applySubConfigDiffs(bucketName, properties, previousProperties) {
+		const overrides = /* @__PURE__ */ new Map();
+		/** Record a WHOLE-BLOCK skip: the effective value is the previous one. */
+		const retainPrevious = (key) => {
+			overrides.set(key, previousProperties[key]);
+		};
+		/** Record a PER-ITEM skip set against the desired / previous arrays. */
+		const retainPreviousItems = (key, skippedIds) => {
+			if (skippedIds.size === 0) return;
+			const desired = properties[key];
+			if (!Array.isArray(desired)) {
+				this.logger.debug(`Bucket ${bucketName}: ${skippedIds.size} skipped ${key} item(s) could not be recorded — the desired value is not an array`);
+				return;
+			}
+			const previous = previousProperties[key];
+			overrides.set(key, S3BucketProvider.buildEffectiveItemArray(desired, Array.isArray(previous) ? previous : void 0, (item) => {
+				const id = configItemId(item);
+				return id !== void 0 && skippedIds.has(id);
+			}));
+		};
 		const previousVersioning = previousProperties["VersioningConfiguration"];
 		const nextVersioning = properties["VersioningConfiguration"];
 		const versioningChanged = JSON.stringify(previousVersioning ?? null) !== JSON.stringify(nextVersioning ?? null);
 		const versioningRefusal = configStringRefusal(nextVersioning, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration");
-		if (versioningRefusal !== void 0 && versioningChanged) this.logger.warn(`Bucket ${bucketName}: ${versioningRefusal}. Leaving the bucket's LIVE versioning state unchanged — neither enabling nor suspending it; the same value is REFUSED on a template-path create`);
+		if (versioningRefusal !== void 0 && versioningChanged) {
+			this.logger.warn(`Bucket ${bucketName}: ${versioningRefusal}. Leaving the bucket's LIVE versioning state unchanged — neither enabling nor suspending it; the same value is REFUSED on a template-path create`);
+			retainPrevious("VersioningConfiguration");
+		}
 		const desiredVersioningStatus = versioningRefusal === void 0 ? readConfigString(nextVersioning, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration") : void 0;
-		if (versioningRefusal === void 0 && versioningChanged && nextVersioning != null && desiredVersioningStatus !== "Suspended") await this.applyVersioning(bucketName, nextVersioning, (m) => this.logger.warn(m));
+		if (versioningRefusal === void 0 && versioningChanged && nextVersioning != null && desiredVersioningStatus !== "Suspended") {
+			if (!await this.applyVersioning(bucketName, nextVersioning, (m) => this.logger.warn(m))) retainPrevious("VersioningConfiguration");
+		}
 		await this.diffSubConfig(bucketName, S3BucketProvider.emptyListConfigToUndefined(previousProperties["OwnershipControls"], "Rules"), S3BucketProvider.emptyListConfigToUndefined(properties["OwnershipControls"], "Rules"), async (cfg) => this.applyOwnershipControls(bucketName, cfg), async () => {
 			await this.s3Client.send(new DeleteBucketOwnershipControlsCommand({ Bucket: bucketName }));
 			this.logger.debug(`Deleted ownership controls on bucket ${bucketName}`);
@@ -5935,7 +6136,7 @@ var S3BucketProvider = class S3BucketProvider {
 		});
 		await this.diffSubConfig(bucketName, previousProperties["LifecycleConfiguration"], properties["LifecycleConfiguration"], async (cfg) => {
 			if (!cfg.Rules || !Array.isArray(cfg.Rules) || cfg.Rules.length === 0) return;
-			await this.applyLifecycleConfiguration(bucketName, cfg, (m) => this.logger.warn(m));
+			if (!await this.applyLifecycleConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("LifecycleConfiguration");
 		}, async () => {
 			await this.s3Client.send(new DeleteBucketLifecycleCommand({ Bucket: bucketName }));
 			this.logger.debug(`Deleted lifecycle configuration on bucket ${bucketName}`);
@@ -5951,9 +6152,15 @@ var S3BucketProvider = class S3BucketProvider {
 			await this.s3Client.send(new DeleteBucketWebsiteCommand({ Bucket: bucketName }));
 			this.logger.debug(`Deleted website configuration on bucket ${bucketName}`);
 		});
-		await this.diffSubConfig(bucketName, previousProperties["LoggingConfiguration"], properties["LoggingConfiguration"], async (cfg) => this.applyLoggingConfiguration(bucketName, cfg, (m) => this.logger.warn(m)), async () => this.applyLoggingConfiguration(bucketName, void 0));
+		await this.diffSubConfig(bucketName, previousProperties["LoggingConfiguration"], properties["LoggingConfiguration"], async (cfg) => {
+			if (!await this.applyLoggingConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("LoggingConfiguration");
+		}, async () => {
+			await this.applyLoggingConfiguration(bucketName, void 0);
+		});
 		await this.diffSubConfig(bucketName, previousProperties["NotificationConfiguration"], properties["NotificationConfiguration"], async (cfg) => this.applyNotificationConfiguration(bucketName, cfg), async () => this.applyNotificationConfiguration(bucketName, void 0));
-		await this.diffSubConfig(bucketName, previousProperties["ReplicationConfiguration"], properties["ReplicationConfiguration"], async (cfg) => this.applyReplicationConfiguration(bucketName, cfg, (m) => this.logger.warn(m)), async () => {
+		await this.diffSubConfig(bucketName, previousProperties["ReplicationConfiguration"], properties["ReplicationConfiguration"], async (cfg) => {
+			if (!await this.applyReplicationConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("ReplicationConfiguration");
+		}, async () => {
 			await this.s3Client.send(new DeleteBucketReplicationCommand({ Bucket: bucketName }));
 			this.logger.debug(`Deleted replication configuration on bucket ${bucketName}`);
 		});
@@ -5965,75 +6172,117 @@ var S3BucketProvider = class S3BucketProvider {
 			this.logger.debug(`Cleared object lock rule on bucket ${bucketName}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["AccelerateConfiguration"], properties["AccelerateConfiguration"], async (cfg) => this.applyAccelerateConfiguration(bucketName, cfg), async () => this.applyAccelerateConfiguration(bucketName, { AccelerationStatus: "Suspended" }));
-		await this.diffArrayConfigById(bucketName, previousProperties["MetricsConfigurations"], properties["MetricsConfigurations"], async (_id, cfg) => this.applyMetricsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m)), async (id) => {
+		const skippedMetricsIds = /* @__PURE__ */ new Set();
+		await this.diffArrayConfigById(bucketName, previousProperties["MetricsConfigurations"], properties["MetricsConfigurations"], async (id, cfg) => {
+			if ((await this.applyMetricsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m))).length > 0) skippedMetricsIds.add(String(id));
+		}, async (id) => {
 			await this.s3Client.send(new DeleteBucketMetricsConfigurationCommand({
 				Bucket: bucketName,
 				Id: id
 			}));
 			this.logger.debug(`Deleted metrics configuration ${id} on bucket ${bucketName}`);
 		});
-		await this.diffArrayConfigById(bucketName, previousProperties["AnalyticsConfigurations"], properties["AnalyticsConfigurations"], async (_id, cfg) => this.applyAnalyticsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m)), async (id) => {
+		retainPreviousItems("MetricsConfigurations", skippedMetricsIds);
+		const skippedAnalyticsIds = /* @__PURE__ */ new Set();
+		await this.diffArrayConfigById(bucketName, previousProperties["AnalyticsConfigurations"], properties["AnalyticsConfigurations"], async (id, cfg) => {
+			if ((await this.applyAnalyticsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m))).length > 0) skippedAnalyticsIds.add(String(id));
+		}, async (id) => {
 			await this.s3Client.send(new DeleteBucketAnalyticsConfigurationCommand({
 				Bucket: bucketName,
 				Id: id
 			}));
 			this.logger.debug(`Deleted analytics configuration ${id} on bucket ${bucketName}`);
 		});
-		await this.diffArrayConfigById(bucketName, previousProperties["IntelligentTieringConfigurations"], properties["IntelligentTieringConfigurations"], async (_id, cfg) => this.applyIntelligentTieringConfigurations(bucketName, [cfg], (m) => this.logger.warn(m)), async (id) => {
+		retainPreviousItems("AnalyticsConfigurations", skippedAnalyticsIds);
+		const skippedIntelligentTieringIds = /* @__PURE__ */ new Set();
+		await this.diffArrayConfigById(bucketName, previousProperties["IntelligentTieringConfigurations"], properties["IntelligentTieringConfigurations"], async (id, cfg) => {
+			if ((await this.applyIntelligentTieringConfigurations(bucketName, [cfg], (m) => this.logger.warn(m))).length > 0) skippedIntelligentTieringIds.add(String(id));
+		}, async (id) => {
 			await this.s3Client.send(new DeleteBucketIntelligentTieringConfigurationCommand({
 				Bucket: bucketName,
 				Id: id
 			}));
 			this.logger.debug(`Deleted intelligent tiering configuration ${id} on bucket ${bucketName}`);
 		});
-		await this.diffArrayConfigById(bucketName, previousProperties["InventoryConfigurations"], properties["InventoryConfigurations"], async (_id, cfg) => this.applyInventoryConfigurations(bucketName, [cfg], (m) => this.logger.warn(m)), async (id) => {
+		retainPreviousItems("IntelligentTieringConfigurations", skippedIntelligentTieringIds);
+		const skippedInventoryIds = /* @__PURE__ */ new Set();
+		await this.diffArrayConfigById(bucketName, previousProperties["InventoryConfigurations"], properties["InventoryConfigurations"], async (id, cfg) => {
+			if ((await this.applyInventoryConfigurations(bucketName, [cfg], (m) => this.logger.warn(m))).length > 0) skippedInventoryIds.add(String(id));
+		}, async (id) => {
 			await this.s3Client.send(new DeleteBucketInventoryConfigurationCommand({
 				Bucket: bucketName,
 				Id: id
 			}));
 			this.logger.debug(`Deleted inventory configuration ${id} on bucket ${bucketName}`);
 		});
+		retainPreviousItems("InventoryConfigurations", skippedInventoryIds);
 		if (versioningChanged && desiredVersioningStatus === "Suspended") {
 			const hasObjectLock = (p) => {
 				if (p["ObjectLockEnabled"] === true || p["ObjectLockEnabled"] === "true") return true;
 				return p["ObjectLockConfiguration"]?.["ObjectLockEnabled"] === "Enabled";
 			};
-			if (hasObjectLock(properties) || hasObjectLock(previousProperties)) this.logger.warn(`Bucket ${bucketName}: versioning would be suspended (VersioningConfiguration removed or set to Suspended), but the bucket has Object Lock enabled and S3 does not allow suspending versioning on it. Leaving versioning enabled.`);
-			else await this.applyVersioning(bucketName, { Status: "Suspended" });
+			if (hasObjectLock(properties) || hasObjectLock(previousProperties)) {
+				this.logger.warn(`Bucket ${bucketName}: versioning would be suspended (VersioningConfiguration removed or set to Suspended), but the bucket has Object Lock enabled and S3 does not allow suspending versioning on it. Leaving versioning enabled.`);
+				retainPrevious("VersioningConfiguration");
+			} else await this.applyVersioning(bucketName, { Status: "Suspended" });
 		}
+		return overrides;
 	}
 	/**
 	* Apply ALL sub-configs unconditionally on initial create. Used by
 	* `create()` so the bucket starts out matching the template.
+	*
+	* @returns the per-property overrides for `effectiveProperties` (issue
+	*   #1612). Every skip reachable here is on the REPLAY-create path (the
+	*   rollback executor's reverse-replacement arm), where the bucket is brand
+	*   new and nothing was applied — so the override DROPS the key rather than
+	*   retaining a previous value, because there is no previous value to keep.
+	*   The per-item arrays keep the items that DID apply.
 	*/
 	async applyAllSubConfigsForCreate(bucketName, properties, context) {
+		const overrides = /* @__PURE__ */ new Map();
+		/** Record a per-ITEM skip set: nothing to substitute on a fresh bucket. */
+		const dropSkippedItems = (key, configs, skippedIndexes) => {
+			if (skippedIndexes.length === 0) return;
+			const skipped = new Set(skippedIndexes);
+			overrides.set(key, S3BucketProvider.buildEffectiveItemArray(configs, void 0, (_item, index) => skipped.has(index)));
+		};
 		const replayOnUnusable = replayWarn(this.logger, context).onUnusable;
 		const notifConfig = properties["NotificationConfiguration"];
 		if (notifConfig) await this.applyNotificationConfiguration(bucketName, notifConfig);
 		const corsConfig = properties["CorsConfiguration"];
 		if (corsConfig?.CorsRules && Array.isArray(corsConfig.CorsRules) && corsConfig.CorsRules.length > 0) await this.applyCorsConfiguration(bucketName, corsConfig);
 		const lifecycleConfig = properties["LifecycleConfiguration"];
-		if (lifecycleConfig?.Rules && Array.isArray(lifecycleConfig.Rules) && lifecycleConfig.Rules.length > 0) await this.applyLifecycleConfiguration(bucketName, lifecycleConfig, replayOnUnusable);
+		if (lifecycleConfig?.Rules && Array.isArray(lifecycleConfig.Rules) && lifecycleConfig.Rules.length > 0) {
+			if (!await this.applyLifecycleConfiguration(bucketName, lifecycleConfig, replayOnUnusable)) overrides.set("LifecycleConfiguration", void 0);
+		}
 		const loggingConfig = properties["LoggingConfiguration"];
 		const loggingRefusal = replayOnUnusable ? configStringRefusal(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") : void 0;
-		if (loggingRefusal !== void 0) replayOnUnusable?.(`${loggingRefusal}. Skipping the logging configuration; the same value is REFUSED on a template-path create`);
-		else if (readConfigString(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") !== "") await this.applyLoggingConfiguration(bucketName, loggingConfig, replayOnUnusable);
+		if (loggingRefusal !== void 0) {
+			replayOnUnusable?.(`${loggingRefusal}. Skipping the logging configuration; the same value is REFUSED on a template-path create`);
+			overrides.set("LoggingConfiguration", void 0);
+		} else if (readConfigString(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") !== "") {
+			if (!await this.applyLoggingConfiguration(bucketName, loggingConfig, replayOnUnusable)) overrides.set("LoggingConfiguration", void 0);
+		}
 		const websiteConfig = properties["WebsiteConfiguration"];
 		if (websiteConfig) await this.applyWebsiteConfiguration(bucketName, websiteConfig);
 		const accelerateConfig = properties["AccelerateConfiguration"];
 		if (accelerateConfig) await this.applyAccelerateConfiguration(bucketName, accelerateConfig);
 		const metricsConfigs = properties["MetricsConfigurations"];
-		if (metricsConfigs && Array.isArray(metricsConfigs) && metricsConfigs.length > 0) await this.applyMetricsConfigurations(bucketName, metricsConfigs, replayOnUnusable);
+		if (metricsConfigs && Array.isArray(metricsConfigs) && metricsConfigs.length > 0) dropSkippedItems("MetricsConfigurations", metricsConfigs, await this.applyMetricsConfigurations(bucketName, metricsConfigs, replayOnUnusable));
 		const analyticsConfigs = properties["AnalyticsConfigurations"];
-		if (analyticsConfigs && Array.isArray(analyticsConfigs) && analyticsConfigs.length > 0) await this.applyAnalyticsConfigurations(bucketName, analyticsConfigs, replayOnUnusable);
+		if (analyticsConfigs && Array.isArray(analyticsConfigs) && analyticsConfigs.length > 0) dropSkippedItems("AnalyticsConfigurations", analyticsConfigs, await this.applyAnalyticsConfigurations(bucketName, analyticsConfigs, replayOnUnusable));
 		const itConfigs = properties["IntelligentTieringConfigurations"];
-		if (itConfigs && Array.isArray(itConfigs) && itConfigs.length > 0) await this.applyIntelligentTieringConfigurations(bucketName, itConfigs, replayOnUnusable);
+		if (itConfigs && Array.isArray(itConfigs) && itConfigs.length > 0) dropSkippedItems("IntelligentTieringConfigurations", itConfigs, await this.applyIntelligentTieringConfigurations(bucketName, itConfigs, replayOnUnusable));
 		const inventoryConfigs = properties["InventoryConfigurations"];
-		if (inventoryConfigs && Array.isArray(inventoryConfigs) && inventoryConfigs.length > 0) await this.applyInventoryConfigurations(bucketName, inventoryConfigs, replayOnUnusable);
+		if (inventoryConfigs && Array.isArray(inventoryConfigs) && inventoryConfigs.length > 0) dropSkippedItems("InventoryConfigurations", inventoryConfigs, await this.applyInventoryConfigurations(bucketName, inventoryConfigs, replayOnUnusable));
 		const replConfig = properties["ReplicationConfiguration"];
-		if (replConfig) await this.applyReplicationConfiguration(bucketName, replConfig, replayOnUnusable);
+		if (replConfig) {
+			if (!await this.applyReplicationConfiguration(bucketName, replConfig, replayOnUnusable)) overrides.set("ReplicationConfiguration", void 0);
+		}
 		const objectLockConfig = properties["ObjectLockConfiguration"];
 		if (objectLockConfig) await this.applyObjectLockConfiguration(bucketName, objectLockConfig);
+		return overrides;
 	}
 	/**
 	* Create an S3 bucket
@@ -6059,9 +6308,10 @@ var S3BucketProvider = class S3BucketProvider {
 				if (createError instanceof Error && (createError.name === "BucketAlreadyOwnedByYou" || createError.message.includes("you already own it"))) this.logger.debug(`S3 bucket ${bucketName} already exists and is owned by you`);
 				else throw createError;
 			}
+			let effectiveOverrides;
 			try {
-				await this.applyConfiguration(bucketName, properties, { ...context ? { context } : {} });
-				await this.applyAllSubConfigsForCreate(bucketName, properties, context);
+				effectiveOverrides = await this.applyConfiguration(bucketName, properties, { ...context ? { context } : {} });
+				for (const [key, value] of await this.applyAllSubConfigsForCreate(bucketName, properties, context)) effectiveOverrides.set(key, value);
 			} catch (innerError) {
 				if (createdNewBucket) try {
 					await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
@@ -6073,9 +6323,11 @@ var S3BucketProvider = class S3BucketProvider {
 			}
 			const attributes = await this.buildAttributes(bucketName);
 			this.logger.debug(`Successfully created S3 bucket ${logicalId}: ${bucketName}`);
+			const effectiveProperties = S3BucketProvider.applyEffectiveOverrides(properties, effectiveOverrides);
 			return {
 				physicalId: bucketName,
-				attributes
+				attributes,
+				...effectiveProperties ? { effectiveProperties } : {}
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -6096,18 +6348,20 @@ var S3BucketProvider = class S3BucketProvider {
 			};
 		}
 		try {
-			await this.applyConfiguration(physicalId, properties, {
+			const effectiveOverrides = await this.applyConfiguration(physicalId, properties, {
 				skipTags: true,
 				skipDiffManaged: true
 			});
-			await this.applySubConfigDiffs(physicalId, properties, previousProperties);
+			for (const [key, value] of await this.applySubConfigDiffs(physicalId, properties, previousProperties)) effectiveOverrides.set(key, value);
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 			const attributes = await this.buildAttributes(physicalId);
 			this.logger.debug(`Successfully updated S3 bucket ${logicalId}`);
+			const effectiveProperties = S3BucketProvider.applyEffectiveOverrides(properties, effectiveOverrides);
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes
+				attributes,
+				...effectiveProperties ? { effectiveProperties } : {}
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -71263,7 +71517,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.35");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.36");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;