@go-to-k/cdkd 0.280.46 → 0.280.47

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-E_JV4UqE.js";
+import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-fs0W4o1b.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DGHuyUA8.js";
+import { t as ASGProvider } from "./asg-provider-CemPPnK2.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4875,6 +4875,20 @@ function s3BucketDestinationPath(dest, destinationPath) {
 	return isPlainObject$1(dest) && isFlattenedDestination(dest) ? destinationPath : `${destinationPath}.S3BucketDestination`;
 }
 /**
+* The structural path segments — relative to the enclosing `Destination` block —
+* of the bag `resolveS3BucketDestination` PICKED, so a substituted value can be
+* written back at the key the template actually declared (issue #1670).
+*
+* The value-side twin of {@link s3BucketDestinationPath}, which names the same
+* branch for MESSAGES. Derived from the picked bag's IDENTITY rather than by
+* re-running {@link isFlattenedDestination}: a third copy of that branch
+* condition is exactly what the predicate's own header warns about, and identity
+* cannot drift from the resolver at all.
+*/
+function s3BucketDestinationSegments(declared, picked) {
+	return picked === declared ? [] : ["S3BucketDestination"];
+}
+/**
 * Name a malformed value in a refusal message, the way `config-shape.ts`'s
 * private `describe` does for the string-reading guards. Kept local rather than
 * exported from there because `resolveS3BucketDestination` is S3-specific
@@ -5129,6 +5143,35 @@ var S3BucketProvider = class S3BucketProvider {
 		return true;
 	}
 	/**
+	* A string read whose replay downgrade is a warn-and-SUBSTITUTE, reporting
+	* the substitution so the caller can record what was SENT (issue #1670).
+	*
+	* The third shape beside {@link skipOnUnusableConfigString}'s SKIP and the
+	* plain strict read, for the sites where the fallback IS the right value to
+	* send. The deploy then succeeds with the default on the wire, so recording
+	* the declared value describes a configuration AWS does not hold, and
+	* `readCurrentState` reads all of these back — the permanent phantom drift
+	* `.claude/rules/providers.md` records for the #1633 warn-and-default arm.
+	* That file also carries the full rationale, including why these sites take
+	* NO `canonicalizeDesiredProperties` twin; do not re-derive it here.
+	*
+	* Three details are load-bearing:
+	*
+	* - `onSubstituted` receives the value this call RETURNS, not the `fallback`
+	*   argument, so "what is recorded" and "what is sent" stay one expression.
+	* - `options` is forwarded to BOTH the probe and the read, so a site that
+	*   ever needs `coerceNumber` cannot make the two disagree.
+	* - Without `options.onUnusable` there is no probe: the read still THROWS,
+	*   and recording a value the provider merely failed to send is what the
+	*   "already ANNOUNCED" condition on `effectiveProperties` forbids.
+	*/
+	readSubstitutedConfigString(container, key, fallback, containerPath, options, onSubstituted) {
+		const refused = options.onUnusable !== void 0 && configStringRefusal(container, key, fallback, containerPath, options) !== void 0;
+		const value = readConfigString(container, key, fallback, containerPath, options);
+		if (refused) onSubstituted(value);
+		return value;
+	}
+	/**
 	* Apply lifecycle configuration
 	*
 	* CFn property: LifecycleConfiguration.Rules[]
@@ -5457,8 +5500,11 @@ var S3BucketProvider = class S3BucketProvider {
 	* CFn property: MetricsConfigurations[] (array of configurations)
 	* SDK: PutBucketMetricsConfiguration (one per configuration, keyed by Id)
 	*
-	* @returns the indexes (into `configs`) of the items a replay downgrade
-	*   SKIPPED — the per-item unit of `effectiveProperties` (issue #1612).
+	* @returns what happened to each item, as {@link PerItemApplyOutcome} — the
+	*   per-item unit of `effectiveProperties` (issue #1612). This applier has no
+	*   warn-and-SUBSTITUTE read, so its `substituted` map is always empty; the
+	*   shape is shared with its three siblings so the two call-site recorders
+	*   stay uniform and a future substitution here cannot go unrecorded.
 	*/
 	async applyMetricsConfigurations(bucketName, configs, onUnusable) {
 		const skipped = [];
@@ -5490,7 +5536,10 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 		}
 		this.logger.debug(`Applied ${configs.length - skipped.length} metrics configuration(s) to bucket ${bucketName}`);
-		return skipped;
+		return {
+			skipped,
+			substituted: /* @__PURE__ */ new Map()
+		};
 	}
 	/**
 	* Pick the `S3BucketDestination` bag out of an analytics / inventory
@@ -5547,15 +5596,24 @@ var S3BucketProvider = class S3BucketProvider {
 	* CFn property: AnalyticsConfigurations[] (array of configurations)
 	* SDK: PutBucketAnalyticsConfiguration (one per configuration, keyed by Id)
 	*
-	* @returns the indexes (into `configs`) of the items a replay downgrade
-	*   SKIPPED — the per-item unit of `effectiveProperties` (issue #1612).
+	* @returns what happened to each item, as {@link PerItemApplyOutcome} — the
+	*   per-item unit of `effectiveProperties` (issues #1612 / #1670). Both arms
+	*   are reachable here: a container / destination guard SKIPS the item, while
+	*   the `OutputSchemaVersion` and destination `Format` reads warn and SEND a
+	*   substituted default, so the item is recorded as SENT rather than as
+	*   declared.
 	*/
 	async applyAnalyticsConfigurations(bucketName, configs, onUnusable) {
 		const skipped = [];
+		const substituted = /* @__PURE__ */ new Map();
 		let index = -1;
 		for (const config of configs) {
 			index += 1;
 			const id = config["Id"];
+			let sentItem;
+			const recordSubstitution = (path, sent) => {
+				sentItem = S3BucketProvider.withDeepValue(sentItem ?? config, path, sent);
+			};
 			const rawStorageClassAnalysis = config["StorageClassAnalysis"];
 			if (rawStorageClassAnalysis != null && requireConfigObject(rawStorageClassAnalysis, "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis", { ...onUnusable ? { onUnusable } : {} }) === void 0) {
 				skipped.push(index);
@@ -5594,12 +5652,23 @@ var S3BucketProvider = class S3BucketProvider {
 					continue;
 				}
 				const destPath = s3BucketDestinationPath(rawDest, analyticsDestPath);
+				const destSegments = s3Dest ? s3BucketDestinationSegments(rawDest, s3Dest) : [];
 				analyticsConfig.StorageClassAnalysis = { DataExport: {
-					OutputSchemaVersion: readConfigString(dataExport, "OutputSchemaVersion", "V_1", "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport", { ...onUnusable ? { onUnusable } : {} }),
+					OutputSchemaVersion: this.readSubstitutedConfigString(dataExport, "OutputSchemaVersion", "V_1", "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport", { ...onUnusable ? { onUnusable } : {} }, (sent) => recordSubstitution([
+						"StorageClassAnalysis",
+						"DataExport",
+						"OutputSchemaVersion"
+					], sent)),
 					Destination: s3Dest ? { S3BucketDestination: {
 						Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
 						BucketAccountId: s3Dest["BucketAccountId"],
-						Format: readConfigString(s3Dest, "Format", "CSV", destPath, { ...onUnusable ? { onUnusable } : {} }),
+						Format: this.readSubstitutedConfigString(s3Dest, "Format", "CSV", destPath, { ...onUnusable ? { onUnusable } : {} }, (sent) => recordSubstitution([
+							"StorageClassAnalysis",
+							"DataExport",
+							"Destination",
+							...destSegments,
+							"Format"
+						], sent)),
 						Prefix: s3Dest["Prefix"]
 					} } : void 0
 				} };
@@ -5609,9 +5678,13 @@ var S3BucketProvider = class S3BucketProvider {
 				Id: id,
 				AnalyticsConfiguration: analyticsConfig
 			}));
+			if (sentItem !== void 0) substituted.set(index, sentItem);
 		}
 		this.logger.debug(`Applied ${configs.length - skipped.length} analytics configuration(s) to bucket ${bucketName}`);
-		return skipped;
+		return {
+			skipped,
+			substituted
+		};
 	}
 	/**
 	* Apply intelligent tiering configurations
@@ -5619,8 +5692,11 @@ var S3BucketProvider = class S3BucketProvider {
 	* CFn property: IntelligentTieringConfigurations[]
 	* SDK: PutBucketIntelligentTieringConfiguration (one per configuration, keyed by Id)
 	*
-	* @returns the indexes (into `configs`) of the items a replay downgrade
-	*   SKIPPED — the per-item unit of `effectiveProperties` (issue #1612).
+	* @returns what happened to each item, as {@link PerItemApplyOutcome} — the
+	*   per-item unit of `effectiveProperties` (issue #1612). Its per-item
+	*   `Status` read takes the SKIP downgrade rather than a substitution (issue
+	*   #1595 — defaulting to `Enabled` would start archiving objects), so the
+	*   `substituted` map is always empty here.
 	*/
 	async applyIntelligentTieringConfigurations(bucketName, configs, onUnusable) {
 		const skipped = [];
@@ -5661,7 +5737,10 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 		}
 		this.logger.debug(`Applied ${configs.length - skipped.length} intelligent tiering configuration(s) to bucket ${bucketName}`);
-		return skipped;
+		return {
+			skipped,
+			substituted: /* @__PURE__ */ new Map()
+		};
 	}
 	/**
 	* Apply inventory configurations
@@ -5669,11 +5748,15 @@ var S3BucketProvider = class S3BucketProvider {
 	* CFn property: InventoryConfigurations[]
 	* SDK: PutBucketInventoryConfiguration (one per configuration, keyed by Id)
 	*
-	* @returns the indexes (into `configs`) of the items a replay downgrade
-	*   SKIPPED — the per-item unit of `effectiveProperties` (issue #1612).
+	* @returns what happened to each item, as {@link PerItemApplyOutcome} — the
+	*   per-item unit of `effectiveProperties` (issues #1612 / #1670). Both arms
+	*   are reachable here: `IncludedObjectVersions` / the schedule frequency pair
+	*   / the destination guard SKIP the item, while the destination `Format` read
+	*   warns and SENDS a substituted default.
 	*/
 	async applyInventoryConfigurations(bucketName, configs, onUnusable) {
 		const skipped = [];
+		const substituted = /* @__PURE__ */ new Map();
 		let index = -1;
 		for (const config of configs) {
 			index += 1;
@@ -5690,6 +5773,11 @@ var S3BucketProvider = class S3BucketProvider {
 				continue;
 			}
 			const destPath = s3BucketDestinationPath(rawDest, inventoryDestPath);
+			const destSegments = s3Dest ? s3BucketDestinationSegments(rawDest, s3Dest) : [];
+			let sentItem;
+			const recordSubstitution = (path, sent) => {
+				sentItem = S3BucketProvider.withDeepValue(sentItem ?? config, path, sent);
+			};
 			const scheduleFrequencyRefusal = onUnusable ? configStringRefusal(config, "ScheduleFrequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[]") : void 0;
 			if (scheduleFrequencyRefusal !== void 0 && config["Schedule"] == null) {
 				onUnusable?.(`${scheduleFrequencyRefusal}. Skipping this inventory configuration: there is no Schedule.Frequency to fall back to, and defaulting to Weekly would silently re-cadence a live inventory report; the same value is REFUSED on a template-path create`);
@@ -5703,6 +5791,7 @@ var S3BucketProvider = class S3BucketProvider {
 				continue;
 			}
 			const frequency = useScheduleFrequency ? requireConfigString(config["ScheduleFrequency"], "Weekly", "AWS::S3::Bucket InventoryConfigurations[].ScheduleFrequency") : readConfigString(config["Schedule"], "Frequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[].Schedule");
+			if (scheduleFrequencyRefusal !== void 0) recordSubstitution(["ScheduleFrequency"], frequency);
 			const inventoryConfig = {
 				Id: id,
 				IsEnabled: config["Enabled"] ?? true,
@@ -5711,7 +5800,11 @@ var S3BucketProvider = class S3BucketProvider {
 				Destination: { S3BucketDestination: s3Dest ? {
 					Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
 					AccountId: s3Dest["BucketAccountId"],
-					Format: readConfigString(s3Dest, "Format", "CSV", destPath, { ...onUnusable ? { onUnusable } : {} }),
+					Format: this.readSubstitutedConfigString(s3Dest, "Format", "CSV", destPath, { ...onUnusable ? { onUnusable } : {} }, (sent) => recordSubstitution([
+						"Destination",
+						...destSegments,
+						"Format"
+					], sent)),
 					Prefix: s3Dest["Prefix"]
 				} : void 0 },
 				OptionalFields: config["OptionalFields"],
@@ -5722,9 +5815,13 @@ var S3BucketProvider = class S3BucketProvider {
 				Id: id,
 				InventoryConfiguration: inventoryConfig
 			}));
+			if (sentItem !== void 0) substituted.set(index, sentItem);
 		}
 		this.logger.debug(`Applied ${configs.length - skipped.length} inventory configuration(s) to bucket ${bucketName}`);
-		return skipped;
+		return {
+			skipped,
+			substituted
+		};
 	}
 	/**
 	* Apply replication configuration
@@ -5958,24 +6055,26 @@ var S3BucketProvider = class S3BucketProvider {
 		return config;
 	}
 	/**
-	* Turn a set of skipped-property overrides into the `effectiveProperties`
-	* bag the deploy engine records in place of the desired one (issue #1612).
+	* Turn a set of per-property overrides into the `effectiveProperties` bag the
+	* deploy engine records in place of the desired one (issues #1612 / #1670).
 	*
-	* A warn-and-skip arm makes the deploy SUCCEED while a declared
-	* configuration never reaches AWS, so recording the desired bag verbatim
-	* writes a value AWS does not hold: `readCurrentState` can never match it,
-	* every later `cdkd drift` re-reports the difference, and `drift --revert`
-	* re-issues the same skipped call — the permanent phantom drift
-	* `.claude/rules/providers.md` records for the EC2 Route warn arm (#1591),
-	* reached here through a skip instead of a narrowing.
+	* A warn-and-SKIP arm makes the deploy SUCCEED while a declared configuration
+	* never reaches AWS, and a warn-and-SUBSTITUTE read makes it succeed while a
+	* DIFFERENT value than the declared one reaches AWS. Either way, recording
+	* the desired bag verbatim writes something AWS does not hold:
+	* `readCurrentState` can never match it, every later `cdkd drift` re-reports
+	* the difference, and `drift --revert` re-issues the same call — the
+	* permanent phantom drift `.claude/rules/providers.md` records for the EC2
+	* Route warn arm (#1591), reached here through a skip or a substitution
+	* instead of a narrowing.
 	*
 	* A `undefined` override value means the key is ABSENT from the effective
 	* bag, which is why this walks the map rather than spreading it: spreading
 	* would leave an explicit `undefined` that `JSON.stringify` drops on one
 	* side of the next diff but not the other.
 	*
-	* @returns the complete replacement bag, or `undefined` when nothing was
-	*   skipped — the engine then records the desired properties unchanged.
+	* @returns the complete replacement bag, or `undefined` when there is nothing
+	*   to override — the engine then records the desired properties unchanged.
 	*/
 	static applyEffectiveOverrides(properties, overrides) {
 		if (overrides.size === 0) return void 0;
@@ -5999,14 +6098,22 @@ var S3BucketProvider = class S3BucketProvider {
 	* items would manufacture a fresh phantom drift while removing the one this
 	* exists to fix.
 	*
+	* An item that WAS applied but with a value a warn-and-SUBSTITUTE read
+	* replaced is the third arm (issue #1670): it keeps its position and its
+	* declared shape, and only the substituted field differs — `sentItem` is the
+	* item AS SENT, which is what AWS holds and therefore what state must
+	* describe.
+	*
 	* @param previous the previously-recorded array, or `undefined` on the
 	*   replay-CREATE path, where nothing was ever applied and there is no
 	*   previous item to substitute.
+	* @param sentItemOf the item as SENT for an APPLIED item whose declared value
+	*   was substituted, or `undefined` when declared == sent (the ordinary case).
 	* @returns the effective array, or `undefined` when the key should be ABSENT
 	*   from the effective bag (nothing survived AND the previous side declared
 	*   nothing, so the property was never applied at all).
 	*/
-	static buildEffectiveItemArray(desired, previous, isSkipped) {
+	static buildEffectiveItemArray(desired, previous, isSkipped, sentItemOf) {
 		const previousById = /* @__PURE__ */ new Map();
 		for (const item of previous ?? []) {
 			const id = configItemId(item);
@@ -6015,7 +6122,7 @@ var S3BucketProvider = class S3BucketProvider {
 		const effective = [];
 		desired.forEach((item, index) => {
 			if (!isSkipped(item, index)) {
-				effective.push(item);
+				effective.push(sentItemOf?.(item, index) ?? item);
 				return;
 			}
 			const id = configItemId(item);
@@ -6026,6 +6133,34 @@ var S3BucketProvider = class S3BucketProvider {
 		return effective;
 	}
 	/**
+	* A COPY of `container` with `path` set to `value` (issue #1670).
+	*
+	* Copying rather than mutating is load-bearing, not hygiene: the container is
+	* an item of the caller's DESIRED property bag, which `DiffCalculator` and the
+	* engine still read afterwards — writing the substituted value into it would
+	* silently rewrite the template side of the next comparison, which is exactly
+	* the `canonicalizeDesiredProperties` behavior this fix must NOT have. Only
+	* the objects ALONG the path are cloned; every sibling subtree is shared,
+	* which is safe because nothing here mutates them.
+	*
+	* A non-object intermediate is rebuilt as an EMPTY block, which is not a
+	* defensive shrug but the accurate record: it is what `readConfigString`
+	* itself did on the way in — its container arm says "Treating the block as
+	* empty, so <path>.<key> takes its default" — so `{}` plus the substituted
+	* leaf IS what was sent. No call site can reach it today (every intermediate
+	* has already been validated by `requireConfigObject` /
+	* `resolveS3BucketDestination`, which SKIP the item on a malformed one).
+	*/
+	static withDeepValue(container, path, value) {
+		const [head, ...rest] = path;
+		if (head === void 0) return container;
+		const child = container[head];
+		return {
+			...container,
+			[head]: rest.length === 0 ? value : S3BucketProvider.withDeepValue(isPlainObject$1(child) ? child : {}, rest, value)
+		};
+	}
+	/**
 	* Diff CFn-shape sub-config values between previous and new state.
 	*
 	* Four transitions:
@@ -6100,18 +6235,42 @@ var S3BucketProvider = class S3BucketProvider {
 		const retainPrevious = (key) => {
 			overrides.set(key, previousProperties[key]);
 		};
-		/** Record a PER-ITEM skip set against the desired / previous arrays. */
-		const retainPreviousItems = (key, skippedIds) => {
-			if (skippedIds.size === 0) return;
+		/**
+		* Per-property accumulator for one of the four `Id`-keyed appliers.
+		*
+		* Keyed by `Id` rather than by index because on THIS path the diff loop
+		* hands the applier exactly one item per call (so every outcome index is
+		* 0) and the id is all the loop knows about it.
+		*/
+		const itemOutcomes = () => {
+			const skipped = /* @__PURE__ */ new Set();
+			const sentItems = /* @__PURE__ */ new Map();
+			return {
+				skipped,
+				sentItems,
+				record: (id, outcome) => {
+					if (outcome.skipped.length > 0) skipped.add(id);
+					const sent = outcome.substituted.get(0);
+					if (sent !== void 0) sentItems.set(id, sent);
+				}
+			};
+		};
+		/** Record a PER-ITEM skip / substitution set against the desired / previous arrays. */
+		const retainPreviousItems = (key, collected) => {
+			const { skipped: skippedIds, sentItems } = collected;
+			if (skippedIds.size === 0 && sentItems.size === 0) return;
 			const desired = properties[key];
 			if (!Array.isArray(desired)) {
-				this.logger.debug(`Bucket ${bucketName}: ${skippedIds.size} skipped ${key} item(s) could not be recorded — the desired value is not an array`);
+				this.logger.debug(`Bucket ${bucketName}: ${skippedIds.size + sentItems.size} skipped or substituted ${key} item(s) could not be recorded — the desired value is not an array`);
 				return;
 			}
 			const previous = previousProperties[key];
 			overrides.set(key, S3BucketProvider.buildEffectiveItemArray(desired, Array.isArray(previous) ? previous : void 0, (item) => {
 				const id = configItemId(item);
 				return id !== void 0 && skippedIds.has(id);
+			}, (item) => {
+				const id = configItemId(item);
+				return id !== void 0 ? sentItems.get(id) : void 0;
 			}));
 		};
 		const previousVersioning = previousProperties["VersioningConfiguration"];
@@ -6172,9 +6331,10 @@ var S3BucketProvider = class S3BucketProvider {
 			this.logger.debug(`Cleared object lock rule on bucket ${bucketName}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["AccelerateConfiguration"], properties["AccelerateConfiguration"], async (cfg) => this.applyAccelerateConfiguration(bucketName, cfg), async () => this.applyAccelerateConfiguration(bucketName, { AccelerationStatus: "Suspended" }));
-		const skippedMetricsIds = /* @__PURE__ */ new Set();
+		const metricsOutcomes = itemOutcomes();
 		await this.diffArrayConfigById(bucketName, previousProperties["MetricsConfigurations"], properties["MetricsConfigurations"], async (id, cfg) => {
-			if ((await this.applyMetricsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m))).length > 0) skippedMetricsIds.add(String(id));
+			const outcome = await this.applyMetricsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m));
+			metricsOutcomes.record(String(id), outcome);
 		}, async (id) => {
 			await this.s3Client.send(new DeleteBucketMetricsConfigurationCommand({
 				Bucket: bucketName,
@@ -6182,10 +6342,11 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 			this.logger.debug(`Deleted metrics configuration ${id} on bucket ${bucketName}`);
 		});
-		retainPreviousItems("MetricsConfigurations", skippedMetricsIds);
-		const skippedAnalyticsIds = /* @__PURE__ */ new Set();
+		retainPreviousItems("MetricsConfigurations", metricsOutcomes);
+		const analyticsOutcomes = itemOutcomes();
 		await this.diffArrayConfigById(bucketName, previousProperties["AnalyticsConfigurations"], properties["AnalyticsConfigurations"], async (id, cfg) => {
-			if ((await this.applyAnalyticsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m))).length > 0) skippedAnalyticsIds.add(String(id));
+			const outcome = await this.applyAnalyticsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m));
+			analyticsOutcomes.record(String(id), outcome);
 		}, async (id) => {
 			await this.s3Client.send(new DeleteBucketAnalyticsConfigurationCommand({
 				Bucket: bucketName,
@@ -6193,10 +6354,11 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 			this.logger.debug(`Deleted analytics configuration ${id} on bucket ${bucketName}`);
 		});
-		retainPreviousItems("AnalyticsConfigurations", skippedAnalyticsIds);
-		const skippedIntelligentTieringIds = /* @__PURE__ */ new Set();
+		retainPreviousItems("AnalyticsConfigurations", analyticsOutcomes);
+		const intelligentTieringOutcomes = itemOutcomes();
 		await this.diffArrayConfigById(bucketName, previousProperties["IntelligentTieringConfigurations"], properties["IntelligentTieringConfigurations"], async (id, cfg) => {
-			if ((await this.applyIntelligentTieringConfigurations(bucketName, [cfg], (m) => this.logger.warn(m))).length > 0) skippedIntelligentTieringIds.add(String(id));
+			const outcome = await this.applyIntelligentTieringConfigurations(bucketName, [cfg], (m) => this.logger.warn(m));
+			intelligentTieringOutcomes.record(String(id), outcome);
 		}, async (id) => {
 			await this.s3Client.send(new DeleteBucketIntelligentTieringConfigurationCommand({
 				Bucket: bucketName,
@@ -6204,10 +6366,11 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 			this.logger.debug(`Deleted intelligent tiering configuration ${id} on bucket ${bucketName}`);
 		});
-		retainPreviousItems("IntelligentTieringConfigurations", skippedIntelligentTieringIds);
-		const skippedInventoryIds = /* @__PURE__ */ new Set();
+		retainPreviousItems("IntelligentTieringConfigurations", intelligentTieringOutcomes);
+		const inventoryOutcomes = itemOutcomes();
 		await this.diffArrayConfigById(bucketName, previousProperties["InventoryConfigurations"], properties["InventoryConfigurations"], async (id, cfg) => {
-			if ((await this.applyInventoryConfigurations(bucketName, [cfg], (m) => this.logger.warn(m))).length > 0) skippedInventoryIds.add(String(id));
+			const outcome = await this.applyInventoryConfigurations(bucketName, [cfg], (m) => this.logger.warn(m));
+			inventoryOutcomes.record(String(id), outcome);
 		}, async (id) => {
 			await this.s3Client.send(new DeleteBucketInventoryConfigurationCommand({
 				Bucket: bucketName,
@@ -6215,7 +6378,7 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 			this.logger.debug(`Deleted inventory configuration ${id} on bucket ${bucketName}`);
 		});
-		retainPreviousItems("InventoryConfigurations", skippedInventoryIds);
+		retainPreviousItems("InventoryConfigurations", inventoryOutcomes);
 		if (versioningChanged && desiredVersioningStatus === "Suspended") {
 			const hasObjectLock = (p) => {
 				if (p["ObjectLockEnabled"] === true || p["ObjectLockEnabled"] === "true") return true;
@@ -6232,20 +6395,29 @@ var S3BucketProvider = class S3BucketProvider {
 	* Apply ALL sub-configs unconditionally on initial create. Used by
 	* `create()` so the bucket starts out matching the template.
 	*
-	* @returns the per-property overrides for `effectiveProperties` (issue
-	*   #1612). Every skip reachable here is on the REPLAY-create path (the
-	*   rollback executor's reverse-replacement arm), where the bucket is brand
-	*   new and nothing was applied — so the override DROPS the key rather than
-	*   retaining a previous value, because there is no previous value to keep.
-	*   The per-item arrays keep the items that DID apply.
+	* @returns the per-property overrides for `effectiveProperties` (issues
+	*   #1612 / #1670). Every downgrade reachable here is on the REPLAY-create
+	*   path (the rollback executor's reverse-replacement arm), where the bucket
+	*   is brand new and nothing was applied — so a SKIP drops the key rather
+	*   than retaining a previous value, because there is no previous value to
+	*   keep. The per-item arrays keep the items that DID apply, including an
+	*   item applied with a SUBSTITUTED value, recorded as it was sent.
 	*/
 	async applyAllSubConfigsForCreate(bucketName, properties, context) {
 		const overrides = /* @__PURE__ */ new Map();
-		/** Record a per-ITEM skip set: nothing to substitute on a fresh bucket. */
-		const dropSkippedItems = (key, configs, skippedIndexes) => {
-			if (skippedIndexes.length === 0) return;
-			const skipped = new Set(skippedIndexes);
-			overrides.set(key, S3BucketProvider.buildEffectiveItemArray(configs, void 0, (_item, index) => skipped.has(index)));
+		/**
+		* Record a per-ITEM applier outcome.
+		*
+		* A SKIPPED item is DROPPED — there is no previously-applied item to
+		* substitute on a fresh bucket. An item applied with a SUBSTITUTED value
+		* (issue #1670) is kept in place as SENT, which is a decision the create
+		* path makes for the same reason the update path does: the Put SUCCEEDED,
+		* so AWS holds the substituted value and state must say so.
+		*/
+		const recordItemOutcome = (key, configs, outcome) => {
+			if (outcome.skipped.length === 0 && outcome.substituted.size === 0) return;
+			const skipped = new Set(outcome.skipped);
+			overrides.set(key, S3BucketProvider.buildEffectiveItemArray(configs, void 0, (_item, index) => skipped.has(index), (_item, index) => outcome.substituted.get(index)));
 		};
 		const replayOnUnusable = replayWarn(this.logger, context).onUnusable;
 		const notifConfig = properties["NotificationConfiguration"];
@@ -6269,13 +6441,13 @@ var S3BucketProvider = class S3BucketProvider {
 		const accelerateConfig = properties["AccelerateConfiguration"];
 		if (accelerateConfig) await this.applyAccelerateConfiguration(bucketName, accelerateConfig);
 		const metricsConfigs = properties["MetricsConfigurations"];
-		if (metricsConfigs && Array.isArray(metricsConfigs) && metricsConfigs.length > 0) dropSkippedItems("MetricsConfigurations", metricsConfigs, await this.applyMetricsConfigurations(bucketName, metricsConfigs, replayOnUnusable));
+		if (metricsConfigs && Array.isArray(metricsConfigs) && metricsConfigs.length > 0) recordItemOutcome("MetricsConfigurations", metricsConfigs, await this.applyMetricsConfigurations(bucketName, metricsConfigs, replayOnUnusable));
 		const analyticsConfigs = properties["AnalyticsConfigurations"];
-		if (analyticsConfigs && Array.isArray(analyticsConfigs) && analyticsConfigs.length > 0) dropSkippedItems("AnalyticsConfigurations", analyticsConfigs, await this.applyAnalyticsConfigurations(bucketName, analyticsConfigs, replayOnUnusable));
+		if (analyticsConfigs && Array.isArray(analyticsConfigs) && analyticsConfigs.length > 0) recordItemOutcome("AnalyticsConfigurations", analyticsConfigs, await this.applyAnalyticsConfigurations(bucketName, analyticsConfigs, replayOnUnusable));
 		const itConfigs = properties["IntelligentTieringConfigurations"];
-		if (itConfigs && Array.isArray(itConfigs) && itConfigs.length > 0) dropSkippedItems("IntelligentTieringConfigurations", itConfigs, await this.applyIntelligentTieringConfigurations(bucketName, itConfigs, replayOnUnusable));
+		if (itConfigs && Array.isArray(itConfigs) && itConfigs.length > 0) recordItemOutcome("IntelligentTieringConfigurations", itConfigs, await this.applyIntelligentTieringConfigurations(bucketName, itConfigs, replayOnUnusable));
 		const inventoryConfigs = properties["InventoryConfigurations"];
-		if (inventoryConfigs && Array.isArray(inventoryConfigs) && inventoryConfigs.length > 0) dropSkippedItems("InventoryConfigurations", inventoryConfigs, await this.applyInventoryConfigurations(bucketName, inventoryConfigs, replayOnUnusable));
+		if (inventoryConfigs && Array.isArray(inventoryConfigs) && inventoryConfigs.length > 0) recordItemOutcome("InventoryConfigurations", inventoryConfigs, await this.applyInventoryConfigurations(bucketName, inventoryConfigs, replayOnUnusable));
 		const replConfig = properties["ReplicationConfiguration"];
 		if (replConfig) {
 			if (!await this.applyReplicationConfiguration(bucketName, replConfig, replayOnUnusable)) overrides.set("ReplicationConfiguration", void 0);
@@ -6866,15 +7038,17 @@ var S3BucketProvider = class S3BucketProvider {
 		if (sca?.["DataExport"]) {
 			const dataExport = sca["DataExport"];
 			const s3Dest = dataExport["Destination"]?.["S3BucketDestination"];
-			out["StorageClassAnalysis"] = { DataExport: {
-				OutputSchemaVersion: dataExport["OutputSchemaVersion"],
-				Destination: s3Dest ? { S3BucketDestination: {
-					BucketArn: s3Dest["Bucket"],
-					BucketAccountId: s3Dest["BucketAccountId"],
-					Format: s3Dest["Format"],
-					Prefix: s3Dest["Prefix"]
-				} } : void 0
-			} };
+			const dataExportCfn = {};
+			if (dataExport["OutputSchemaVersion"] !== void 0) dataExportCfn["OutputSchemaVersion"] = dataExport["OutputSchemaVersion"];
+			if (s3Dest) {
+				const cfnDest = {};
+				if (s3Dest["Bucket"] !== void 0) cfnDest["BucketArn"] = s3Dest["Bucket"];
+				if (s3Dest["BucketAccountId"] !== void 0) cfnDest["BucketAccountId"] = s3Dest["BucketAccountId"];
+				if (s3Dest["Format"] !== void 0) cfnDest["Format"] = s3Dest["Format"];
+				if (s3Dest["Prefix"] !== void 0) cfnDest["Prefix"] = s3Dest["Prefix"];
+				dataExportCfn["Destination"] = cfnDest;
+			}
+			out["StorageClassAnalysis"] = { DataExport: dataExportCfn };
 		}
 		return out;
 	}
@@ -72155,7 +72329,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.46");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.47");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;