@go-to-k/cdkd 0.281.14 → 0.281.16

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as replayWarn, $t as findLargeInlineResources, A as green, At as buildDockerImage, B as slowCcOperationTimeoutMs, Bt as getLegacyStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceTimeoutError, Ct as AssetModeResolver, D as bold, Dt as parseBootstrapMarker, E as formatResourceLine, En as StackTerminationProtectionError, Et as getBootstrapMarkerKey, F as clearOnUpdateRemoval, Ft as AssetManifestLoader, G as getAccountInfo, Gt as resolveStateBucketWithDefault, H as isTerminationProtectionPropagationError, Ht as resolveAutoAssetStorage, I as ProviderRegistry, It as getDockerImageBySourceHash, J as normalizeAwsTagsToCfn, Jt as stateBucketExistenceConfirmed, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefaultAndSource, L as findActionableSilentDrops, Lt as Synthesizer, M as yellow, Mn as withErrorHandling, Mt as getDockerCmd, N as IAMRoleProvider, Nt as runDockerForeground, O as cyan, Ot as validateAssetBucketName, P as collectInlinePolicyNamesManagedBySiblings, Pt as runDockerStreaming, Q as readConfigString, Qt as MIGRATE_TMP_PREFIX, R as findSilentDropProperties, Rt as synthesisStatusMessage, S as extractDeploymentEventError, Sn as ProvisioningError, St as rewriteTemplateAssetReferences, T as renderStatefulReason, Tn as StackHasActiveImportsError, Tt as ensureAssetStorage, U as IntrinsicFunctionResolver, Ut as resolveCaptureObservedState, V as disableInstanceApiTermination, Vt as resolveApp, W as cfnRefValueFromPhysicalId, Wt as resolveSkipPrefix, X as assertRegionMatch, Xt as CFN_TEMPLATE_BODY_LIMIT, Y as resolveExplicitPhysicalId, Yt as warnDeprecatedNoPrefixCliFlag, Z as configStringRefusal, Zt as CFN_TEMPLATE_URL_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalStartServiceError, _t as stringifyValue, a as DeploymentEventsStore, an as resolveBucketRegion, at as DiffCalculator, b as unsupportedFinalSnapshotError, bn as NestedStackChildDirectDestroyError, bt as createAssetRedirectResolver, c as replayFailedOperations, cn as resetAwsClients, ct as isRetryableTransientError, d as IMPLICIT_DELETE_DEPENDENCIES, dn as CdkdError, dt as TemplateParser, en as uploadCfnTemplate, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as LockManager, g as ccRoutedFinalSnapshotError, gn as LocalMigrateError, gt as AssetPublisher, h as buildFinalSnapshotIdentifier, hn as LocalInvokeBuildError$1, ht as shouldRetainResource, i as DeploymentEventsReader, it as applyRoleArnIfSet, j as red, jn as normalizeAwsError, jt as formatDockerLoginError, k as gray, kt as validateContainerRepoName, l as replayRollback, ln as setAwsClients, lt as isThrottlingError, m as PRE_DELETE_SNAPSHOT_TYPES, mn as DeployCancelledError, mt as rebuildClientForBucketRegion, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AssemblyReader, nt as requireConfigString, o as planFailedOps, on as AwsClients, ot as describeTypeWithThrottleRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as S3StateBackend, q as WAFv2WebACLProvider, qt as resolveUseCdkBootstrapAssets, r as DeployEngine, rn as processStackMessages, rt as derivePartitionAndUrlSuffix, s as planRollback, sn as getAwsClients, st as withRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as expectedOwnerParam, tt as requireConfigObject, u as withResourceDeadline, ut as DagBuilder, v as isFinalSnapshotError, vt as WorkGraph, w as isStatefulRecreateTargetSync, wn as ResourceUpdateNotSupportedError, wt as BOOTSTRAP_MARKER_PREFIX, x as makeCanonicalizePropertiesFn, xn as PartialFailureError, xt as loadPublishableAssetManifest, y as refusesFinalSnapshot, yn as MissingCdkCliError, yt as buildAssetRedirectMap, z as CloudControlProvider, zt as getDefaultStateBucketName } from "./deploy-engine-3BZtmJqZ.js";
+import { $ as replayWarn, $t as findLargeInlineResources, A as green, At as buildDockerImage, B as slowCcOperationTimeoutMs, Bt as getLegacyStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceTimeoutError, Ct as AssetModeResolver, D as bold, Dt as parseBootstrapMarker, E as formatResourceLine, En as StackTerminationProtectionError, Et as getBootstrapMarkerKey, F as clearOnUpdateRemoval, Ft as AssetManifestLoader, G as getAccountInfo, Gt as resolveStateBucketWithDefault, H as isTerminationProtectionPropagationError, Ht as resolveAutoAssetStorage, I as ProviderRegistry, It as getDockerImageBySourceHash, J as normalizeAwsTagsToCfn, Jt as stateBucketExistenceConfirmed, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefaultAndSource, L as findActionableSilentDrops, Lt as Synthesizer, M as yellow, Mn as withErrorHandling, Mt as getDockerCmd, N as IAMRoleProvider, Nt as runDockerForeground, O as cyan, Ot as validateAssetBucketName, P as collectInlinePolicyNamesManagedBySiblings, Pt as runDockerStreaming, Q as readConfigString, Qt as MIGRATE_TMP_PREFIX, R as findSilentDropProperties, Rt as synthesisStatusMessage, S as extractDeploymentEventError, Sn as ProvisioningError, St as rewriteTemplateAssetReferences, T as renderStatefulReason, Tn as StackHasActiveImportsError, Tt as ensureAssetStorage, U as IntrinsicFunctionResolver, Ut as resolveCaptureObservedState, V as disableInstanceApiTermination, Vt as resolveApp, W as cfnRefValueFromPhysicalId, Wt as resolveSkipPrefix, X as assertRegionMatch, Xt as CFN_TEMPLATE_BODY_LIMIT, Y as resolveExplicitPhysicalId, Yt as warnDeprecatedNoPrefixCliFlag, Z as configStringRefusal, Zt as CFN_TEMPLATE_URL_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalStartServiceError, _t as stringifyValue, a as DeploymentEventsStore, an as resolveBucketRegion, at as DiffCalculator, b as unsupportedFinalSnapshotError, bn as NestedStackChildDirectDestroyError, bt as createAssetRedirectResolver, c as replayFailedOperations, cn as resetAwsClients, ct as isRetryableTransientError, d as IMPLICIT_DELETE_DEPENDENCIES, dn as CdkdError, dt as TemplateParser, en as uploadCfnTemplate, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as LockManager, g as ccRoutedFinalSnapshotError, gn as LocalMigrateError, gt as AssetPublisher, h as buildFinalSnapshotIdentifier, hn as LocalInvokeBuildError$1, ht as shouldRetainResource, i as DeploymentEventsReader, it as applyRoleArnIfSet, j as red, jn as normalizeAwsError, jt as formatDockerLoginError, k as gray, kt as validateContainerRepoName, l as replayRollback, ln as setAwsClients, lt as isThrottlingError, m as PRE_DELETE_SNAPSHOT_TYPES, mn as DeployCancelledError, mt as rebuildClientForBucketRegion, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AssemblyReader, nt as requireConfigString, o as planFailedOps, on as AwsClients, ot as describeTypeWithThrottleRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as S3StateBackend, q as WAFv2WebACLProvider, qt as resolveUseCdkBootstrapAssets, r as DeployEngine, rn as processStackMessages, rt as derivePartitionAndUrlSuffix, s as planRollback, sn as getAwsClients, st as withRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as expectedOwnerParam, tt as requireConfigObject, u as withResourceDeadline, ut as DagBuilder, v as isFinalSnapshotError, vt as WorkGraph, w as isStatefulRecreateTargetSync, wn as ResourceUpdateNotSupportedError, wt as BOOTSTRAP_MARKER_PREFIX, x as makeCanonicalizePropertiesFn, xn as PartialFailureError, xt as loadPublishableAssetManifest, y as refusesFinalSnapshot, yn as MissingCdkCliError, yt as buildAssetRedirectMap, z as CloudControlProvider, zt as getDefaultStateBucketName } from "./deploy-engine-CfnMSwyx.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-C1WbHit9.js";
+import { t as ASGProvider } from "./asg-provider-B1pHGT_X.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4892,18 +4892,270 @@ function s3BucketDestinationPath(dest, destinationPath) {
 	return isPlainObject$1(dest) && isFlattenedDestination(dest) ? destinationPath : `${destinationPath}.S3BucketDestination`;
 }
 /**
-* The structural path segments — relative to the enclosing `Destination` block —
-* of the bag `resolveS3BucketDestination` PICKED, so a substituted value can be
-* written back at the key the template actually declared (issue #1670).
+* The FLATTENED CFn `Destination` block cdkd actually SENDS for `declared`
+* (issue #1707) — the shared fold behind BOTH halves of the #1633 pair: the
+* per-item `effectiveProperties` record and
+* {@link S3BucketProvider.canonicalizeDesiredProperties}.
+*
+* The desired side accepts TWO spellings (`resolveS3BucketDestination` picks
+* either the flattened CFn block or the nested SDK `S3BucketDestination` one)
+* plus a `Bucket` / `BucketArn` alias inside either, while the readback
+* (`inventorySdkToCfn` / `analyticsSdkToCfn`) emits ONLY the flattened form with
+* `BucketArn`. So a record written in any other spelling can never match what
+* `readCurrentState` returns: `cdkd drift` re-reports it forever and `--revert`
+* re-issues the same Put — the never-emitted-KEY class of issue #1686, reached
+* through the SHAPE rather than through a value. The live CFn registry schema
+* agrees the flattened form is the only CFn spelling (`Destination` is
+* `{BucketArn, BucketAccountId, Format, Prefix}` with `additionalProperties:
+* false`), so `S3BucketDestination` and `Bucket` are cdkd-only tolerances.
+*
+* This NORMALIZES rather than retracting the tolerance, per the #1686 rule:
+* refusing the SDK spelling would break templates that deploy today. It also
+* supersedes #1670's write-back-at-the-DECLARED-branch decision, whose whole
+* reason was that writing at a hardcoded branch would leave the malformed value
+* alive at the other key and add a stray one — there is no other key left once
+* the block is normalized wholesale.
+*
+* `Format` is the one member a caller can override: the applier passes the
+* value it SENT, which differs from the declared one when the warn-and-
+* SUBSTITUTE read replaced it (#1670). Absent on BOTH sides it defaults to the
+* `'CSV'` the appliers send, so the record carries what AWS will report back
+* rather than one key fewer.
+*
+* @returns the flattened block, or `declared` BY IDENTITY when it already is
+*   one (so an ordinary template records byte-for-byte what it declared) or is
+*   not a shape this can fold at all (absent / malformed — left for the
+*   resolver's own refusal to report).
+*/
+function effectiveS3BucketDestination(declared, sentFormat) {
+	if (!isPlainObject$1(declared)) return declared;
+	const bag = isFlattenedDestination(declared) ? declared : declared["S3BucketDestination"];
+	if (!isPlainObject$1(bag)) return declared;
+	if (!bag["BucketArn"] && !bag["Bucket"]) return declared;
+	const out = {};
+	const bucketArn = bag["BucketArn"] ?? bag["Bucket"];
+	if (bucketArn !== void 0) out["BucketArn"] = bucketArn;
+	if (bag["BucketAccountId"] !== void 0) out["BucketAccountId"] = bag["BucketAccountId"];
+	out["Format"] = sentFormat ?? declaredOrDefault(bag, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT);
+	if (bag["Prefix"] !== void 0) out["Prefix"] = bag["Prefix"];
+	return sameScalarRecord(out, declared) ? declared : out;
+}
+/**
+* `container[key]` when the key is DECLARED, else `fallback` — presence-based,
+* NEVER `??`, and that distinction is the whole guard against issue #1670's
+* finding 3.
+*
+* The ONE licensed `??` in these folds is the ALIAS read
+* `bag['BucketArn'] ?? bag['Bucket']`, and it is not an exception to this rule —
+* it supplies no DEFAULT. It picks between two spellings of the same declared
+* value, exactly as the applier's own read does, so a nullish `BucketArn`
+* correctly falls through to the alias the wire would have used. When neither is
+* declared the key is simply absent from the fold's output, which is what makes
+* a bucket-less block identity-return rather than gain a phantom key.
+*
+* The default belongs to a key the template OMITTED: there the provider sends
+* it, the readback reports it, and folding both sides is what makes them agree.
+* A key DECLARED with a malformed value is a different case entirely — the
+* provider warns and substitutes, records what it SENT, and `cdkd diff` must go
+* on reporting the difference until the template is corrected, because that
+* report plus the warning are the user's only signal. A `??` chain cannot tell
+* the two apart: it treats a declared `null` as absent and quietly folds the
+* template side onto the substituted value, so the comparison comes out equal,
+* the provider is never called, and the warning STOPS — the exact concealment
+* #1670 refused a twin over. Measured on `Format: null` while reviewing this
+* change; a malformed value that is not nullish (a blank string, an array, an
+* unresolved intrinsic) never hit it, so the unit rows written first all passed.
+*/
+function declaredOrDefault(container, key, fallback) {
+	return key in container ? container[key] : fallback;
+}
+/**
+* The default `Destination.Format` both per-item appliers send when the block
+* declares none. Named rather than repeated so the wire value and the fold above
+* cannot drift apart.
+*/
+const INVENTORY_DESTINATION_DEFAULT_FORMAT = "CSV";
+/**
+* The default `Enabled` / `IncludedObjectVersions` an inventory item is SENT
+* with when it declares none — the same drift-apart concern as
+* {@link INVENTORY_DESTINATION_DEFAULT_FORMAT}.
+*/
+const INVENTORY_DEFAULT_ENABLED = true;
+const INVENTORY_DEFAULT_INCLUDED_OBJECT_VERSIONS = "All";
+/** The `OutputSchemaVersion` an analytics data export is SENT with by default. */
+const ANALYTICS_DEFAULT_OUTPUT_SCHEMA_VERSION = "V_1";
+/**
+* Are two records equal as SCALAR-valued bags? Used only to identity-return an
+* already-canonical block, so a fold that changes nothing cannot manufacture a
+* fresh object (and, through it, a fresh diff line on a template nobody edited).
+*
+* Scalar-only is sufficient here: every member of the CFn `Destination`
+* definition is a scalar (`{BucketArn, BucketAccountId, Format, Prefix}`).
+*
+* Precisely (review of #1707 corrected an over-claim): a nested value is
+* compared by REFERENCE like any other. On the flattened branch the fold copies
+* the caller's own references, so a nested value is `===` itself and identity IS
+* returned — which is correct, since nothing changed. It is only a
+* REBUILT nested value that compares different, and that falls back to recording
+* the folded block — the safe direction.
+*/
+function sameScalarRecord(a, b) {
+	const aKeys = Object.keys(a);
+	if (aKeys.length !== Object.keys(b).length) return false;
+	return aKeys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && Object.is(a[k], b[k]));
+}
+/** The `ScheduleFrequency` an inventory item is SENT with when it declares none. */
+const INVENTORY_DEFAULT_SCHEDULE_FREQUENCY = "Weekly";
+/**
+* The `InventoryConfigurations[]` ITEM cdkd actually SENDS for `item` — the ONE
+* helper behind both halves of the #1633 pair, per
+* `.claude/rules/providers.md`'s "share ONE helper with the provisioning path
+* rather than re-deriving the rule".
+*
+* Called from `applyInventoryConfigurations` with the values that went on the
+* wire (`sent`), and from
+* {@link S3BucketProvider.canonicalizeDesiredProperties} with none — where the
+* declared value IS what would be sent for every item the appliers do not warn
+* about, which is the whole population the twin exists for. On a MALFORMED value
+* the two deliberately disagree (the applier records the substituted value, the
+* fold keeps the declared one), so `cdkd diff` keeps reporting the field until
+* the template is corrected — the #1670 finding-3 outcome, preserved rather than
+* concealed.
+*
+* Three folds, all of them the never-emitted-KEY class (issue #1686) rather than
+* a narrowing:
+*
+* - `Schedule: { Frequency }` -> `ScheduleFrequency`. cdkd accepts the SDK
+*   spelling (the #1605 fall-through) while `inventorySdkToCfn` emits only the
+*   CFn one, which the registry schema declares REQUIRED and whose `Schedule`
+*   sibling it does not declare at all.
+* - `Destination` -> the flattened CFn block (see
+*   {@link effectiveS3BucketDestination}).
+* - `Enabled` / `IncludedObjectVersions` DEFAULTS. Both are always sent
+*   (`IsEnabled: … ?? true`, `readConfigString(…, 'All')`) and always read back,
+*   so an item omitting them recorded one key FEWER than the readback produces
+*   and the comparator saw a key-count mismatch on the whole array — the
+*   defaulted-but-SENT class of issue #1670, one property over (issue #1718).
+*
+* COPYING rather than mutating is load-bearing, not hygiene: `item` is an
+* element of the caller's DESIRED property bag, which `DiffCalculator` and the
+* engine still read afterwards — and the diff is now one of the two callers, so
+* mutating in place would rewrite the template side of a comparison the other
+* caller is in the middle of.
+*
+* @returns `item` BY IDENTITY when every fold is a no-op, so an ordinary
+*   fully-declared CFn template records and diffs byte-for-byte as before.
+*/
+function effectiveInventoryItem(item, sent) {
+	const patch = {};
+	if (item["Enabled"] === void 0) patch["Enabled"] = INVENTORY_DEFAULT_ENABLED;
+	if (item["IncludedObjectVersions"] === void 0) patch["IncludedObjectVersions"] = INVENTORY_DEFAULT_INCLUDED_OBJECT_VERSIONS;
+	const declaredSchedule = item["Schedule"];
+	const declaresScheduleFrequency = item["ScheduleFrequency"] !== void 0;
+	const scheduleFrequencyUsable = declaresScheduleFrequency && configStringRefusal(item, "ScheduleFrequency", INVENTORY_DEFAULT_SCHEDULE_FREQUENCY, "AWS::S3::Bucket InventoryConfigurations[]") === void 0;
+	const scheduleContainerUsable = configStringRefusal(declaredSchedule, "Frequency", INVENTORY_DEFAULT_SCHEDULE_FREQUENCY, "AWS::S3::Bucket InventoryConfigurations[].Schedule") === void 0;
+	const canFoldSchedule = sent?.frequency !== void 0 || scheduleFrequencyUsable || !declaresScheduleFrequency && scheduleContainerUsable;
+	if (canFoldSchedule) {
+		const declaredFrequency = declaresScheduleFrequency ? item["ScheduleFrequency"] : isPlainObject$1(declaredSchedule) && declaredSchedule["Frequency"] !== void 0 ? declaredSchedule["Frequency"] : INVENTORY_DEFAULT_SCHEDULE_FREQUENCY;
+		const frequency = sent?.frequency ?? declaredFrequency;
+		if (!Object.is(item["ScheduleFrequency"], frequency)) patch["ScheduleFrequency"] = frequency;
+	}
+	const destination = effectiveS3BucketDestination(item["Destination"], sent?.format);
+	if (destination !== item["Destination"]) patch["Destination"] = destination;
+	const dropsSchedule = declaredSchedule !== void 0 && canFoldSchedule;
+	if (!dropsSchedule && Object.keys(patch).length === 0) return item;
+	const out = {
+		...item,
+		...patch
+	};
+	if (dropsSchedule) delete out["Schedule"];
+	return out;
+}
+/**
+* The `AnalyticsConfigurations[]` ITEM twin of {@link effectiveInventoryItem}.
+*
+* Only the data-export block diverges: the destination takes the same flattening
+* (`analyticsSdkToCfn` emits the flattened CFn spelling too — note it spells the
+* account `BucketAccountId` on BOTH sides here, unlike the inventory reverse
+* mapper), and `OutputSchemaVersion` is a defaulted-but-SENT member of the same
+* class as inventory's `Enabled`.
+*
+* A non-object `StorageClassAnalysis` / `DataExport` is left ALONE rather than
+* rebuilt: those are exactly the shapes `requireConfigObject` refuses, so the
+* item is SKIPPED on the wire and folding it here would describe a call that
+* never went out.
+*/
+function effectiveAnalyticsItem(item, sent) {
+	const storageClassAnalysis = item["StorageClassAnalysis"];
+	if (!isPlainObject$1(storageClassAnalysis)) return item;
+	const dataExport = storageClassAnalysis["DataExport"];
+	if (!isPlainObject$1(dataExport)) return item;
+	const patch = {};
+	const outputSchemaVersion = sent?.outputSchemaVersion ?? declaredOrDefault(dataExport, "OutputSchemaVersion", ANALYTICS_DEFAULT_OUTPUT_SCHEMA_VERSION);
+	if (!Object.is(dataExport["OutputSchemaVersion"], outputSchemaVersion)) patch["OutputSchemaVersion"] = outputSchemaVersion;
+	const destination = effectiveS3BucketDestination(dataExport["Destination"], sent?.format);
+	if (destination !== dataExport["Destination"]) patch["Destination"] = destination;
+	if (Object.keys(patch).length === 0) return item;
+	return {
+		...item,
+		StorageClassAnalysis: {
+			...storageClassAnalysis,
+			DataExport: {
+				...dataExport,
+				...patch
+			}
+		}
+	};
+}
+/** The `Status` an intelligent-tiering item is SENT with when it declares none. */
+const INTELLIGENT_TIERING_DEFAULT_STATUS = "Enabled";
+/**
+* The `IntelligentTieringConfigurations[]` ITEM twin of
+* {@link effectiveInventoryItem} — the third applier of the #1718 audit.
+*
+* It has no never-emitted KEY or SHAPE (its destination-less block is spelled
+* identically on both sides), so the ONLY fold is the defaulted-but-SENT
+* `Status`: the Put always carries one and `intelligentTieringSdkToCfn` always
+* reads it back, so an item omitting it recorded one key fewer than the readback
+* produces. There is no `sent` parameter because this applier has no
+* warn-and-SUBSTITUTE arm at all — a malformed `Status` SKIPS the item (issue
+* #1595: defaulting to `Enabled` would start moving objects into archive
+* tiers), so the only value the fold can ever supply is the create-path default.
+*
+* The fourth applier, metrics, needs no fold: it sends `Id` plus a `Filter`
+* derived from the declared predicates and defaults no scalar member.
+*/
+function effectiveIntelligentTieringItem(item) {
+	if (item["Status"] !== void 0) return item;
+	return {
+		...item,
+		Status: INTELLIGENT_TIERING_DEFAULT_STATUS
+	};
+}
+/**
+* Apply a per-ITEM fold to one of the `Id`-keyed array properties on BOTH sides
+* of a diff — the `canonicalizeDesiredProperties` plumbing shared by the
+* inventory and analytics folds.
 *
-* The value-side twin of {@link s3BucketDestinationPath}, which names the same
-* branch for MESSAGES. Derived from the picked bag's IDENTITY rather than by
-* re-running {@link isFlattenedDestination}: a third copy of that branch
-* condition is exactly what the predicate's own header warns about, and identity
-* cannot drift from the resolver at all.
+* Identity-returns at every level (untouched item -> untouched array ->
+* untouched bag), and leaves a non-array property or a non-object element ALONE
+* so a malformed template still reaches the provider's own refusal rather than
+* being reshaped into something that looks valid.
 */
-function s3BucketDestinationSegments(declared, picked) {
-	return picked === declared ? [] : ["S3BucketDestination"];
+function canonicalizeItemList(properties, key, fold) {
+	const list = properties[key];
+	if (!Array.isArray(list)) return properties;
+	let changed = false;
+	const mapped = list.map((element) => {
+		if (!isPlainObject$1(element)) return element;
+		const next = fold(element);
+		if (next !== element) changed = true;
+		return next;
+	});
+	return changed ? {
+		...properties,
+		[key]: mapped
+	} : properties;
 }
 /**
 * Name a malformed value in a refusal message, the way `config-shape.ts`'s
@@ -5169,24 +5421,37 @@ var S3BucketProvider = class S3BucketProvider {
 	* the declared value describes a configuration AWS does not hold, and
 	* `readCurrentState` reads all of these back — the permanent phantom drift
 	* `.claude/rules/providers.md` records for the #1633 warn-and-default arm.
-	* That file also carries the full rationale, including why these sites take
-	* NO `canonicalizeDesiredProperties` twin; do not re-derive it here.
-	*
-	* Three details are load-bearing:
-	*
-	* - `onSubstituted` receives the value this call RETURNS, not the `fallback`
-	*   argument, so "what is recorded" and "what is sent" stay one expression.
-	* - `options` is forwarded to BOTH the probe and the read, so a site that
-	*   ever needs `coerceNumber` cannot make the two disagree.
-	* - Without `options.onUnusable` there is no probe: the read still THROWS,
-	*   and recording a value the provider merely failed to send is what the
-	*   "already ANNOUNCED" condition on `effectiveProperties` forbids.
-	*/
-	readSubstitutedConfigString(container, key, fallback, containerPath, options, onSubstituted) {
-		const refused = options.onUnusable !== void 0 && configStringRefusal(container, key, fallback, containerPath, options) !== void 0;
-		const value = readConfigString(container, key, fallback, containerPath, options);
-		if (refused) onSubstituted(value);
-		return value;
+	*
+	* These sites DO take a `canonicalizeDesiredProperties` twin as of issues
+	* #1707 / #1717, and this paragraph said the opposite until then — it is
+	* restated rather than deleted because the earlier answer was not wrong, it
+	* was answering a different question. #1670 asked it about the SUBSTITUTED
+	* VALUE and said no, because canonicalizing there would conceal a malformed
+	* value whose warning is the user's only signal. The twin that shipped folds
+	* the never-emitted KEY and SHAPE at the same sites, which have no fault to
+	* conceal and emit no warning at all, and it is keyed off the DECLARED shape
+	* so the substituted value stays visible exactly as before. See
+	* {@link S3BucketProvider.canonicalizeDesiredProperties} and
+	* {@link declaredOrDefault}.
+	*
+	* **It is now a verbatim alias of `readConfigString`**, and the bullets that
+	* used to sit here described a probe that no longer exists — the same stale
+	* -rationale class this round fixed one paragraph up, so it is named rather
+	* than quietly rewritten. The `onSubstituted` callback it used to take is GONE
+	* (review of #1707): recording is the per-item fold's job now, and all three
+	* call sites had been left passing a comment-only no-op, so the probe ran a
+	* second `configStringRefusal` per read purely to invoke nothing.
+	*
+	* It is kept rather than inlined for ONE reason, which is worth stating so the
+	* next reader can weigh it: the name marks these three reads as the
+	* warn-and-SUBSTITUTE sites, distinguishing them at a glance from the
+	* SKIP-guarded ones (`skipOnUnusableConfigString`) and the plain strict reads.
+	* The behavior is `readConfigString`'s, unchanged — `options.onUnusable`
+	* carries the WARNING the "already ANNOUNCED" condition on
+	* `effectiveProperties` needs, and without it the read still THROWS.
+	*/
+	readSubstitutedConfigString(container, key, fallback, containerPath, options) {
+		return readConfigString(container, key, fallback, containerPath, options);
 	}
 	/**
 	* Apply lifecycle configuration
@@ -5627,10 +5892,8 @@ var S3BucketProvider = class S3BucketProvider {
 		for (const config of configs) {
 			index += 1;
 			const id = config["Id"];
-			let sentItem;
-			const recordSubstitution = (path, sent) => {
-				sentItem = S3BucketProvider.withDeepValue(sentItem ?? config, path, sent);
-			};
+			let sentOutputSchemaVersion;
+			let sentFormat;
 			const rawStorageClassAnalysis = config["StorageClassAnalysis"];
 			if (rawStorageClassAnalysis != null && requireConfigObject(rawStorageClassAnalysis, "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis", { ...onUnusable ? { onUnusable } : {} }) === void 0) {
 				skipped.push(index);
@@ -5669,23 +5932,12 @@ var S3BucketProvider = class S3BucketProvider {
 					continue;
 				}
 				const destPath = s3BucketDestinationPath(rawDest, analyticsDestPath);
-				const destSegments = s3Dest ? s3BucketDestinationSegments(rawDest, s3Dest) : [];
 				analyticsConfig.StorageClassAnalysis = { DataExport: {
-					OutputSchemaVersion: this.readSubstitutedConfigString(dataExport, "OutputSchemaVersion", "V_1", "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport", { ...onUnusable ? { onUnusable } : {} }, (sent) => recordSubstitution([
-						"StorageClassAnalysis",
-						"DataExport",
-						"OutputSchemaVersion"
-					], sent)),
+					OutputSchemaVersion: sentOutputSchemaVersion = this.readSubstitutedConfigString(dataExport, "OutputSchemaVersion", ANALYTICS_DEFAULT_OUTPUT_SCHEMA_VERSION, "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport", { ...onUnusable ? { onUnusable } : {} }),
 					Destination: s3Dest ? { S3BucketDestination: {
 						Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
 						BucketAccountId: s3Dest["BucketAccountId"],
-						Format: this.readSubstitutedConfigString(s3Dest, "Format", "CSV", destPath, { ...onUnusable ? { onUnusable } : {} }, (sent) => recordSubstitution([
-							"StorageClassAnalysis",
-							"DataExport",
-							"Destination",
-							...destSegments,
-							"Format"
-						], sent)),
+						Format: sentFormat = this.readSubstitutedConfigString(s3Dest, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT, destPath, { ...onUnusable ? { onUnusable } : {} }),
 						Prefix: s3Dest["Prefix"]
 					} } : void 0
 				} };
@@ -5695,7 +5947,11 @@ var S3BucketProvider = class S3BucketProvider {
 				Id: id,
 				AnalyticsConfiguration: analyticsConfig
 			}));
-			if (sentItem !== void 0) substituted.set(index, sentItem);
+			const sentItem = effectiveAnalyticsItem(config, {
+				...sentOutputSchemaVersion !== void 0 ? { outputSchemaVersion: sentOutputSchemaVersion } : {},
+				...sentFormat !== void 0 ? { format: sentFormat } : {}
+			});
+			if (sentItem !== config) substituted.set(index, sentItem);
 		}
 		this.logger.debug(`Applied ${configs.length - skipped.length} analytics configuration(s) to bucket ${bucketName}`);
 		return {
@@ -5712,11 +5968,18 @@ var S3BucketProvider = class S3BucketProvider {
 	* @returns what happened to each item, as {@link PerItemApplyOutcome} — the
 	*   per-item unit of `effectiveProperties` (issue #1612). Its per-item
 	*   `Status` read takes the SKIP downgrade rather than a substitution (issue
-	*   #1595 — defaulting to `Enabled` would start archiving objects), so the
-	*   `substituted` map is always empty here.
+	*   #1595 — defaulting to `Enabled` would start archiving objects), so no
+	*   MALFORMED value is ever recorded here. The `substituted` map is still
+	*   populated for the defaulted-but-SENT arm (issue #1718): an item that
+	*   simply OMITS `Status` is sent `Enabled` and read back with it, so a record
+	*   without the key compares unequal to the readback for the whole array.
+	*   That is the audit #1718 asks for on the sibling appliers — `metrics` has
+	*   no defaulted scalar member at all (it sends only `Id` plus a `Filter`
+	*   derived from the declared predicates), so it needs no fold.
 	*/
 	async applyIntelligentTieringConfigurations(bucketName, configs, onUnusable) {
 		const skipped = [];
+		const substituted = /* @__PURE__ */ new Map();
 		let index = -1;
 		for (const config of configs) {
 			index += 1;
@@ -5752,11 +6015,13 @@ var S3BucketProvider = class S3BucketProvider {
 				Id: id,
 				IntelligentTieringConfiguration: itConfig
 			}));
+			const sentItem = effectiveIntelligentTieringItem(config);
+			if (sentItem !== config) substituted.set(index, sentItem);
 		}
 		this.logger.debug(`Applied ${configs.length - skipped.length} intelligent tiering configuration(s) to bucket ${bucketName}`);
 		return {
 			skipped,
-			substituted: /* @__PURE__ */ new Map()
+			substituted
 		};
 	}
 	/**
@@ -5790,11 +6055,7 @@ var S3BucketProvider = class S3BucketProvider {
 				continue;
 			}
 			const destPath = s3BucketDestinationPath(rawDest, inventoryDestPath);
-			const destSegments = s3Dest ? s3BucketDestinationSegments(rawDest, s3Dest) : [];
-			let sentItem;
-			const recordSubstitution = (path, sent) => {
-				sentItem = S3BucketProvider.withDeepValue(sentItem ?? config, path, sent);
-			};
+			let sentFormat;
 			const scheduleFrequencyRefusal = onUnusable ? configStringRefusal(config, "ScheduleFrequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[]") : void 0;
 			if (scheduleFrequencyRefusal !== void 0 && config["Schedule"] == null) {
 				onUnusable?.(`${scheduleFrequencyRefusal}. Skipping this inventory configuration: there is no Schedule.Frequency to fall back to, and defaulting to Weekly would silently re-cadence a live inventory report; the same value is REFUSED on a template-path create`);
@@ -5808,22 +6069,15 @@ var S3BucketProvider = class S3BucketProvider {
 				continue;
 			}
 			const frequency = useScheduleFrequency ? requireConfigString(config["ScheduleFrequency"], "Weekly", "AWS::S3::Bucket InventoryConfigurations[].ScheduleFrequency") : readConfigString(config["Schedule"], "Frequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[].Schedule");
-			const declaresSdkSchedule = config["Schedule"] !== void 0;
-			if (scheduleFrequencyRefusal !== void 0 || declaresSdkSchedule) recordSubstitution(["ScheduleFrequency"], frequency);
-			if (declaresSdkSchedule) sentItem = S3BucketProvider.withoutKey(sentItem ?? config, "Schedule");
 			const inventoryConfig = {
 				Id: id,
-				IsEnabled: config["Enabled"] ?? true,
-				IncludedObjectVersions: readConfigString(config, "IncludedObjectVersions", "All", "AWS::S3::Bucket InventoryConfigurations[]"),
+				IsEnabled: config["Enabled"] ?? INVENTORY_DEFAULT_ENABLED,
+				IncludedObjectVersions: readConfigString(config, "IncludedObjectVersions", INVENTORY_DEFAULT_INCLUDED_OBJECT_VERSIONS, "AWS::S3::Bucket InventoryConfigurations[]"),
 				Schedule: { Frequency: frequency },
 				Destination: { S3BucketDestination: s3Dest ? {
 					Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
 					AccountId: s3Dest["BucketAccountId"],
-					Format: this.readSubstitutedConfigString(s3Dest, "Format", "CSV", destPath, { ...onUnusable ? { onUnusable } : {} }, (sent) => recordSubstitution([
-						"Destination",
-						...destSegments,
-						"Format"
-					], sent)),
+					Format: sentFormat = this.readSubstitutedConfigString(s3Dest, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT, destPath, { ...onUnusable ? { onUnusable } : {} }),
 					Prefix: s3Dest["Prefix"]
 				} : void 0 },
 				OptionalFields: config["OptionalFields"],
@@ -5834,7 +6088,11 @@ var S3BucketProvider = class S3BucketProvider {
 				Id: id,
 				InventoryConfiguration: inventoryConfig
 			}));
-			if (sentItem !== void 0) substituted.set(index, sentItem);
+			const sentItem = effectiveInventoryItem(config, {
+				frequency,
+				...sentFormat !== void 0 ? { format: sentFormat } : {}
+			});
+			if (sentItem !== config) substituted.set(index, sentItem);
 		}
 		this.logger.debug(`Applied ${configs.length - skipped.length} inventory configuration(s) to bucket ${bucketName}`);
 		return {
@@ -6209,53 +6467,6 @@ var S3BucketProvider = class S3BucketProvider {
 		return effective;
 	}
 	/**
-	* A COPY of `container` with `path` set to `value` (issue #1670).
-	*
-	* Copying rather than mutating is load-bearing, not hygiene: the container is
-	* an item of the caller's DESIRED property bag, which `DiffCalculator` and the
-	* engine still read afterwards — writing the substituted value into it would
-	* silently rewrite the template side of the next comparison, which is exactly
-	* the `canonicalizeDesiredProperties` behavior this fix must NOT have. Only
-	* the objects ALONG the path are cloned; every sibling subtree is shared,
-	* which is safe because nothing here mutates them.
-	*
-	* A non-object intermediate is rebuilt as an EMPTY block, which is not a
-	* defensive shrug but the accurate record: it is what `readConfigString`
-	* itself did on the way in — its container arm says "Treating the block as
-	* empty, so <path>.<key> takes its default" — so `{}` plus the substituted
-	* leaf IS what was sent. No call site can reach it today (every intermediate
-	* has already been validated by `requireConfigObject` /
-	* `resolveS3BucketDestination`, which SKIP the item on a malformed one).
-	*/
-	static withDeepValue(container, path, value) {
-		const [head, ...rest] = path;
-		if (head === void 0) return container;
-		const child = container[head];
-		return {
-			...container,
-			[head]: rest.length === 0 ? value : S3BucketProvider.withDeepValue(isPlainObject$1(child) ? child : {}, rest, value)
-		};
-	}
-	/**
-	* The REMOVAL twin of {@link withDeepValue}: a copy of `container` without
-	* `key`, sharing every surviving subtree and never mutating the input (same
-	* reason — the input is an item of the caller's DESIRED bag).
-	*
-	* A substitution answers "the value we sent differs from the declared one";
-	* this answers "the KEY we sent does not exist on the readback at all", which
-	* is the shape-mismatch half of the same phantom-drift class (issue #1686).
-	* Setting the key to `undefined` instead would NOT do: `deepEqual` is
-	* `JSON.stringify`, which drops an `undefined` member — but the state record
-	* is written from this object and a present-but-`undefined` key survives a
-	* `structuredClone`, so the two sides would disagree on key COUNT for any
-	* consumer that walks `Object.keys` (the `unionWalkObjects` drift path does).
-	*/
-	static withoutKey(container, key) {
-		if (!(key in container)) return container;
-		const { [key]: _dropped, ...rest } = container;
-		return rest;
-	}
-	/**
 	* The empty-collection placeholder arm of {@link applySubConfigDiffs}: the
 	* Put is SKIPPED, so AWS still holds the previously-applied configuration and
 	* the record must say so (issue #1671).
@@ -6316,6 +6527,51 @@ var S3BucketProvider = class S3BucketProvider {
 		retainPrevious(key);
 	}
 	/**
+	* The CREATE-path sibling of {@link emptyCollectionSkip} (issue #1718).
+	*
+	* `applyAllSubConfigsForCreate` carries the same empty-collection guard the
+	* update path does and skipped in SILENCE, so a fresh bucket came up with a
+	* declared lifecycle / CORS configuration that was never applied and nothing
+	* said so. The template shape that motivated #1671 — a condition-pruned or
+	* intrinsic-collapsed empty array — is equally reachable on a create, and the
+	* live A/B recorded on {@link emptyCollectionSkip} measured CloudFormation
+	* REFUSING it there too, so the skip stands and only the silence was the
+	* defect.
+	*
+	* WHAT IT RECORDS is where the two paths differ, and the answer here is
+	* NOTHING — deliberately, not by omission. The update path retains the
+	* PREVIOUS value because AWS still holds it; on a create there is no previous
+	* value, and the rule's replay-CREATE line ("DROP the key") would be the
+	* obvious import. It is the wrong one at this site: `readLifecycle` /
+	* `readCors` ALWAYS emit the empty placeholder for an unconfigured bucket
+	* (`{Rules: []}` on `NoSuchLifecycleConfiguration`, `{CorsRules: []}` on an
+	* absent CORS config), so the declared empty collection is ALREADY exactly
+	* what `readCurrentState` returns — the two agree with no override at all,
+	* while dropping the key would leave the template declaring one the record
+	* does not and churn a no-op UPDATE on every deploy. The rule's drop answer is
+	* scoped to a skip whose declared value AWS cannot report; this one it can.
+	*
+	* Known bound, stated because the guard is wider than the shape that was
+	* measured. It fires for every DECLARED collection the apply gate rejects, not
+	* only the `{Rules: []}` the live A/B covered:
+	*
+	* - a MALFORMED non-array collection (an unresolved intrinsic), where the
+	*   record keeps a value the readback can never match — narrowing the record
+	*   there is the #1612 malformed-value class rather than this one;
+	* - an EMPTY block (`{}`), where the message is literally true (it declares no
+	*   rules) and nothing is lost.
+	*
+	* The wording says "declares no rules" rather than asserting an empty ARRAY
+	* for exactly that reason — the same hedge {@link emptyCollectionSkip} carries
+	* on the update path, whose guard is equally wide. The gate is `!= null` and
+	* not `!== undefined` (review of #1718): a property explicitly set to `null`
+	* declares no configuration to lose, so warning about it would be noise, and
+	* `!= null` is the convention the rest of this file's container gates use.
+	*/
+	announceCreateEmptyCollectionSkip(key, collectionPath) {
+		this.logger.warn(`AWS::S3::Bucket ${collectionPath} declares no rules, which CloudFormation rejects outright (the collection is a required property, and an empty one is not a removal intent). Creating the bucket WITHOUT the declared ${key}; remove the whole ${key} property if that is what you meant, or check for a condition-pruned or intrinsic-collapsed rules array.`);
+	}
+	/**
 	* Diff CFn-shape sub-config values between previous and new state.
 	*
 	* Four transitions:
@@ -6605,10 +6861,11 @@ var S3BucketProvider = class S3BucketProvider {
 		if (notifConfig) await this.applyNotificationConfiguration(bucketName, notifConfig);
 		const corsConfig = properties["CorsConfiguration"];
 		if (corsConfig?.CorsRules && Array.isArray(corsConfig.CorsRules) && corsConfig.CorsRules.length > 0) await this.applyCorsConfiguration(bucketName, corsConfig);
+		else if (corsConfig != null) this.announceCreateEmptyCollectionSkip("CorsConfiguration", "CorsConfiguration.CorsRules");
 		const lifecycleConfig = properties["LifecycleConfiguration"];
 		if (lifecycleConfig?.Rules && Array.isArray(lifecycleConfig.Rules) && lifecycleConfig.Rules.length > 0) {
 			if (!await this.applyLifecycleConfiguration(bucketName, lifecycleConfig, replayOnUnusable)) overrides.set("LifecycleConfiguration", void 0);
-		}
+		} else if (lifecycleConfig != null) this.announceCreateEmptyCollectionSkip("LifecycleConfiguration", "LifecycleConfiguration.Rules");
 		const loggingConfig = properties["LoggingConfiguration"];
 		const loggingRefusal = replayOnUnusable ? configStringRefusal(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") : void 0;
 		if (loggingRefusal !== void 0) {
@@ -6742,6 +6999,61 @@ var S3BucketProvider = class S3BucketProvider {
 		}
 	}
 	/**
+	* The `effectiveProperties` TWIN required by `.claude/rules/providers.md`
+	* ("`effectiveProperties` alone BREAKS the next deploy") for the per-item
+	* folds the inventory and analytics appliers record — issue #1717 for the
+	* inventory `Schedule` -> `ScheduleFrequency` half (#1686), issue #1707 for
+	* the destination-shape half, issue #1718 for the defaulted-but-SENT members.
+	*
+	* Applied by `DiffCalculator` to BOTH comparison sides through
+	* `makeCanonicalizePropertiesFn`, so the record's folded spelling and the
+	* template's declared one compare EQUAL and an unchanged template stops
+	* redeploying as `1 to update` forever. Folding both sides is also what heals
+	* the already-deployed population: an item whose value never changes is never
+	* re-Put, so the recording side alone can never reach a record written before
+	* the fold.
+	*
+	* The rule's OTHER requirement — share ONE helper with the provisioning path
+	* rather than re-deriving the rule — is met by
+	* {@link effectiveInventoryItem} / {@link effectiveAnalyticsItem}, which the
+	* appliers call with the values they actually sent and this calls with none.
+	*
+	* Note the twin question is re-asked per site rather than inherited: the #1670
+	* sites next door answered NO because canonicalizing there would CONCEAL a
+	* malformed value whose warning tells the user what to fix. These folds have
+	* no fault to conceal — an item declaring only the SDK spelling is perfectly
+	* valid input that emits no warning at all — so the twin's absence bought
+	* nothing and cost a permanent `cdkd diff` line plus a redundant per-`Id` Put
+	* on every deploy.
+	*
+	* Identity-returns an untouched bag, so every other `AWS::S3::Bucket` template
+	* and every other resource type is byte-for-byte unaffected.
+	*
+	* THE #1717 OBSTACLE DID NOT REPRODUCE, and that is worth stating rather than
+	* quietly omitting: the issue measured a `canonicalizeDesiredProperties`
+	* folding this key making `gen-nested-key-coverage` report the still-correct
+	* plural->singular `segmentRenames` entry for `InventoryConfigurations` STALE,
+	* and warned that each piece is inert alone so only the combination trips it.
+	* With the fold implemented as a MODULE-level pure function over an item
+	* parameter, the shipped critic is green end to end — `vp run
+	* audit:nested-key-coverage:check` reports 0 divergences in all three passes,
+	* the committed matrix does not drift by a byte, and
+	* `InventoryConfigurations` is still listed in the target's
+	* `usedSegmentRenames`, i.e. the entry is doing work and the fence is not
+	* masking anything. So no `segmentRenames` entry was removed and no staleness
+	* check was widened; the issue's "resolve the interaction WITHOUT deleting the
+	* entry" requirement is met by there being no interaction to resolve. What is
+	* NOT claimed is a mechanism for why the issue's attempt tripped it — that
+	* attempt is not in the tree to bisect against.
+	*/
+	canonicalizeDesiredProperties(resourceType, properties) {
+		if (resourceType !== "AWS::S3::Bucket") return properties;
+		let out = canonicalizeItemList(properties, "InventoryConfigurations", (item) => effectiveInventoryItem(item));
+		out = canonicalizeItemList(out, "AnalyticsConfigurations", (item) => effectiveAnalyticsItem(item));
+		out = canonicalizeItemList(out, "IntelligentTieringConfigurations", effectiveIntelligentTieringItem);
+		return out;
+	}
+	/**
 	* Read the AWS-current S3 bucket configuration in CFn-property shape.
 	*
 	* Issues a small handful of independent S3 GET calls and stitches them
@@ -11882,6 +12194,43 @@ function packCompositeId(resourceType, logicalId, segments, options) {
 	else throw new ProvisioningError(refusal, resourceType, logicalId);
 	return segments.map((segment) => String(segment.value)).join("|");
 }
+/** Render the expected id shape, e.g. `<databaseName>|<tableName>`. */
+function formatShape(segments) {
+	return segments.map((segment) => `<${segment}>`).join("|");
+}
+/**
+* The message EVERY malformed-composite-id decode site emits (issue
+* [#1657](https://github.com/go-to-k/cdkd/issues/1657)).
+*
+* ## Why one builder
+*
+* Roughly half the decode sites stated the expected shape and half only echoed
+* the value back, and the format is documented nowhere else — so on the silent
+* half the message was the user's only possible route to the answer and it did
+* not carry it. Routing the sites that already got it right through the same
+* builder is what stops them drifting back.
+*
+* ## This is a WORDING fix, not an acceptance change
+*
+* Each caller keeps its own split-and-guard exactly as it was. The arities
+* genuinely differ (some sites accept AT LEAST N segments, some destructure the
+* first N and tolerate extras — the #1672 ambiguity, tracked separately), and
+* folding them into one predicate here would silently change which ids deploy.
+*
+* ## The `skipping` variant
+*
+* On the DELETE path the established policy is warn-and-continue, so a
+* malformed record leaves the AWS resource ALIVE while `cdkd destroy` reports
+* success. That policy is not changed here — but the warning now says what the
+* skip costs, because an orphan the user is never told about is one they cannot
+* go and delete.
+*/
+function compositeIdFormatMessage(format, logicalId, physicalId, options) {
+	const accepted = format.alsoAccepts ? `"${formatShape(format.segments)}" or ${format.alsoAccepts}` : `"${formatShape(format.segments)}"`;
+	const head = `Invalid physicalId format for ${format.label} ${logicalId}: expected ${accepted}, got "${physicalId}"`;
+	if (!options?.skipping) return head;
+	return `${head}. Skipping the delete — the AWS resource is LEFT IN PLACE and cdkd will report this delete as successful, so delete it by hand (or repair the id in state.json and re-run) if it still exists. NOTE this arm is reached from cdkd destroy AND from the deploy engine's replacement / rollback deletes.`;
+}
 
 //#endregion
 //#region src/provisioning/providers/lambda-event-invoke-config-provider.ts
@@ -18888,6 +19237,32 @@ function canonicalizeIpProtocolValue(value) {
 
 //#endregion
 //#region src/provisioning/providers/ec2-provider.ts
+/** Shapes of the four `AWS::EC2::*` composite physicalIds (issue #1657). */
+const EC2_VPC_GATEWAY_ATTACHMENT_ID_FORMAT = {
+	label: "VPCGatewayAttachment",
+	segments: ["internetGatewayId", "vpcId"]
+};
+const EC2_ROUTE_ID_FORMAT = {
+	label: "Route",
+	segments: ["routeTableId", "destination"]
+};
+const EC2_SG_INGRESS_ID_FORMAT = {
+	label: "SecurityGroupIngress",
+	segments: [
+		"groupId",
+		"ipProtocol",
+		"fromPort",
+		"toPort"
+	]
+};
+const EC2_NETWORK_ACL_ENTRY_ID_FORMAT = {
+	label: "NetworkAclEntry",
+	segments: [
+		"networkAclId",
+		"ruleNumber",
+		"egress"
+	]
+};
 /**
 * The `AWS::EC2::Route` destination keys, in CloudFormation's own precedence
 * order — which is also the order `createRoute`'s
@@ -19780,7 +20155,7 @@ var EC2Provider = class {
 	async deleteVpcGatewayAttachment(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting VPCGatewayAttachment ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 2) throw new ProvisioningError(`Invalid physicalId format for VPCGatewayAttachment ${logicalId}: expected "IGW|VpcId", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 2) throw new ProvisioningError(compositeIdFormatMessage(EC2_VPC_GATEWAY_ATTACHMENT_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [internetGatewayId, vpcId] = parts;
 		try {
 			await this.withDependencyViolationRetry(() => this.ec2Client.send(new DetachInternetGatewayCommand({
@@ -19973,7 +20348,7 @@ var EC2Provider = class {
 	async deleteRoute(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting Route ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 2) throw new ProvisioningError(`Invalid physicalId format for Route ${logicalId}: expected "RouteTableId|Destination", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 2) throw new ProvisioningError(compositeIdFormatMessage(EC2_ROUTE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [routeTableId, destination] = parts;
 		try {
 			const destinationParam = destination?.includes(":") ? { DestinationIpv6CidrBlock: destination } : destination?.startsWith("pl-") ? { DestinationPrefixListId: destination } : { DestinationCidrBlock: destination };
@@ -20317,7 +20692,7 @@ var EC2Provider = class {
 	async deleteSecurityGroupIngress(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting SecurityGroupIngress ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 4) throw new ProvisioningError(`Invalid physicalId format for SecurityGroupIngress ${logicalId}: expected "GroupId|Protocol|FromPort|ToPort", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 4) throw new ProvisioningError(compositeIdFormatMessage(EC2_SG_INGRESS_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [groupId, ipProtocol, fromPortStr, toPortStr] = parts;
 		const ipPermission = properties ? this.buildIpPermission(properties) : {
 			IpProtocol: ipProtocol,
@@ -21007,7 +21382,7 @@ var EC2Provider = class {
 		this.logger.debug(`Deleting NetworkAclEntry ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
 		if (parts.length < 3) {
-			this.logger.warn(`Invalid NetworkAclEntry physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(EC2_NETWORK_ACL_ENTRY_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		const networkAclId = parts[0];
@@ -21317,7 +21692,7 @@ var EC2Provider = class {
 	* Skipped (return `undefined`, falls through to the comparator's
 	* "unsupported" outcome):
 	*  - **AWS::EC2::VPCGatewayAttachment**: physical id is
-	*    `IGW|VpcId`. The two ids are immutable inputs to the SDK call;
+	*    `<internetGatewayId>|<vpcId>`. The two ids are immutable inputs to the SDK call;
 	*    drift detection on this resource has no useful signal beyond
 	*    existence verification (which the user can do via the parent IGW
 	*    / VPC drift report).
@@ -22009,6 +22384,15 @@ function isDefaultEgressRule(rule) {
 
 //#endregion
 //#region src/provisioning/providers/apigateway-provider.ts
+/** Shape of an `AWS::ApiGateway::Method` physicalId (issue #1657). */
+const APIGW_METHOD_ID_FORMAT = {
+	label: "API Gateway Method",
+	segments: [
+		"restApiId",
+		"resourceId",
+		"httpMethod"
+	]
+};
 /**
 * AWS API Gateway Provider
 *
@@ -22994,7 +23378,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	async updateMethod(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating API Gateway Method ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 3) throw new ProvisioningError(`Invalid physicalId format for API Gateway Method ${logicalId}: expected "restApiId|resourceId|httpMethod", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 3) throw new ProvisioningError(compositeIdFormatMessage(APIGW_METHOD_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [restApiId, resourceId, httpMethod] = parts;
 		const patchOperations = [];
 		for (const { key, path } of [
@@ -23068,7 +23452,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	async deleteMethod(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting API Gateway Method ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 3) throw new ProvisioningError(`Invalid physicalId format for API Gateway Method ${logicalId}: expected "restApiId|resourceId|httpMethod", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 3) throw new ProvisioningError(compositeIdFormatMessage(APIGW_METHOD_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [restApiId, resourceId, httpMethod] = parts;
 		try {
 			await this.apiGatewayClient.send(new DeleteMethodCommand({
@@ -36869,6 +37253,23 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 
 //#endregion
 //#region src/provisioning/providers/appsync-provider.ts
+/** Shapes of the three `AWS::AppSync::*` child composite physicalIds (issue #1657). */
+const APPSYNC_DATASOURCE_ID_FORMAT = {
+	label: "AppSync DataSource",
+	segments: ["apiId", "name"]
+};
+const APPSYNC_RESOLVER_ID_FORMAT = {
+	label: "AppSync Resolver",
+	segments: [
+		"apiId",
+		"typeName",
+		"fieldName"
+	]
+};
+const APPSYNC_APIKEY_ID_FORMAT = {
+	label: "AppSync ApiKey",
+	segments: ["apiId", "apiKeyId"]
+};
 const MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES = [
 	"UserPoolConfig",
 	"OpenIDConnectConfig",
@@ -37339,7 +37740,7 @@ var AppSyncProvider = class {
 			if (next !== void 0 && prev !== void 0 && next !== prev) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS AppSync DataSource.${field} is immutable — destroy + redeploy to change`);
 		}
 		const [apiId, name] = physicalId.split("|");
-		if (!apiId || !name) throw new ProvisioningError(`Invalid DataSource physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (!apiId || !name) throw new ProvisioningError(compositeIdFormatMessage(APPSYNC_DATASOURCE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const type = properties["Type"] ?? previousProperties["Type"];
 		if (![
 			"Description",
@@ -37377,7 +37778,7 @@ var AppSyncProvider = class {
 			if (next !== void 0 && prev !== void 0 && next !== prev) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS AppSync Resolver.${field} is immutable — destroy + redeploy to change`);
 		}
 		const parts = physicalId.split("|");
-		if (parts.length < 3) throw new ProvisioningError(`Invalid Resolver physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (parts.length < 3) throw new ProvisioningError(compositeIdFormatMessage(APPSYNC_RESOLVER_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [apiId, typeName, fieldName] = parts;
 		if (![
 			"DataSourceName",
@@ -37411,7 +37812,7 @@ var AppSyncProvider = class {
 	async updateApiKey(logicalId, physicalId, resourceType, properties, previousProperties) {
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS AppSync ApiKey.ApiId is immutable — destroy + redeploy to change");
 		const [apiId, apiKeyId] = physicalId.split("|");
-		if (!apiId || !apiKeyId) throw new ProvisioningError(`Invalid ApiKey physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (!apiId || !apiKeyId) throw new ProvisioningError(compositeIdFormatMessage(APPSYNC_APIKEY_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const newDesc = properties["Description"];
 		const oldDesc = previousProperties["Description"];
 		const newExp = properties["Expires"];
@@ -38117,7 +38518,7 @@ var AppSyncProvider = class {
 		this.logger.debug(`Deleting DataSource ${logicalId}: ${physicalId}`);
 		const [apiId, name] = physicalId.split("|");
 		if (!apiId || !name) {
-			this.logger.warn(`Invalid DataSource physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(APPSYNC_DATASOURCE_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		try {
@@ -38180,7 +38581,7 @@ var AppSyncProvider = class {
 		this.logger.debug(`Deleting Resolver ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
 		if (parts.length < 3) {
-			this.logger.warn(`Invalid Resolver physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(APPSYNC_RESOLVER_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		const [apiId, typeName, fieldName] = parts;
@@ -38236,7 +38637,7 @@ var AppSyncProvider = class {
 		this.logger.debug(`Deleting ApiKey ${logicalId}: ${physicalId}`);
 		const [apiId, apiKeyId] = physicalId.split("|");
 		if (!apiId || !apiKeyId) {
-			this.logger.warn(`Invalid ApiKey physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(APPSYNC_APIKEY_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		try {
@@ -38623,6 +39024,11 @@ var AppSyncProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/glue-provider.ts
+/** Shape of an `AWS::Glue::Table` physicalId, for every decode site (issue #1657). */
+const GLUE_TABLE_ID_FORMAT = {
+	label: "Glue Table",
+	segments: ["databaseName", "tableName"]
+};
 /**
 * Read a template-borne value that is about to be forwarded to a Glue read
 * API as a string.
@@ -38920,7 +39326,7 @@ var GlueProvider = class {
 	async updateTable(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Glue Table ${logicalId}: ${physicalId}`);
 		const [databaseName, tableName] = physicalId.split("|");
-		if (!databaseName || !tableName) throw new ProvisioningError(`Invalid Glue Table physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (!databaseName || !tableName) throw new ProvisioningError(compositeIdFormatMessage(GLUE_TABLE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const tableInput = properties["TableInput"];
 		if (!tableInput) throw new ProvisioningError(`TableInput is required for Glue Table update ${logicalId}`, resourceType, logicalId, physicalId);
 		const catalogId = properties["CatalogId"];
@@ -38957,7 +39363,7 @@ var GlueProvider = class {
 		this.logger.debug(`Deleting Glue Table ${logicalId}: ${physicalId}`);
 		const [databaseName, tableName] = physicalId.split("|");
 		if (!databaseName || !tableName) {
-			this.logger.warn(`Invalid Glue Table physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(GLUE_TABLE_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		const target = deleteCatalogId(properties);
@@ -49920,6 +50326,20 @@ var S3DirectoryBucketProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/s3-tables-provider.ts
+/** Shapes of the two `AWS::S3Tables::*` composite physicalIds (issue #1657). */
+const S3_TABLES_NAMESPACE_ID_FORMAT = {
+	label: "S3 Tables Namespace",
+	segments: ["tableBucketARN", "namespace"]
+};
+const S3_TABLES_TABLE_ID_FORMAT = {
+	label: "S3 Tables Table",
+	segments: [
+		"tableBucketARN",
+		"namespace",
+		"name"
+	],
+	alsoAccepts: "a table ARN"
+};
 /**
 * Parse cdkd's composite namespace physicalId `<tableBucketARN>|<namespace>`.
 *
@@ -50166,7 +50586,7 @@ var S3TablesProvider = class {
 	async deleteNamespace(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting S3 Tables Namespace ${logicalId}: ${physicalId}`);
 		const [tableBucketARN, namespaceName] = physicalId.split("|");
-		if (!tableBucketARN || !namespaceName) throw new ProvisioningError(`Invalid physical ID format for S3 Tables Namespace ${logicalId}: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (!tableBucketARN || !namespaceName) throw new ProvisioningError(compositeIdFormatMessage(S3_TABLES_NAMESPACE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		try {
 			await this.getClient().send(new DeleteNamespaceCommand$1({
 				tableBucketARN,
@@ -50580,7 +51000,7 @@ var S3TablesProvider = class {
 			this.logger.debug(`S3 Tables Table ${physicalId} does not exist, skipping deletion`);
 			return;
 		}
-		if (resolved === "unparseable") throw new ProvisioningError(`Invalid physical ID format for S3 Tables Table ${logicalId}: ${physicalId} (expected '<tableBucketARN>|<namespace>|<name>' or a table ARN)`, resourceType, logicalId, physicalId);
+		if (resolved === "unparseable") throw new ProvisioningError(compositeIdFormatMessage(S3_TABLES_TABLE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const { tableBucketARN, namespace, name } = resolved;
 		try {
 			await this.getClient().send(new DeleteTableCommand$2({
@@ -50701,7 +51121,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resolvedParts = await this.resolveTableParts(physicalId);
 		if (resolvedParts === "not-found") throw new ProvisioningError(`applyTableTagsDiff: table '${physicalId}' no longer exists (state is out of sync) — refusing to silently drop the tag update`, resourceType, logicalId, physicalId);
-		if (resolvedParts === "unparseable") throw new ProvisioningError(`applyTableTagsDiff: cannot derive table ARN from physicalId '${physicalId}' (expected '<bucketArn>|<namespace>|<name>' or a table ARN) — refusing to silently drop the tag update`, resourceType, logicalId, physicalId);
+		if (resolvedParts === "unparseable") throw new ProvisioningError(`applyTableTagsDiff: ${compositeIdFormatMessage(S3_TABLES_TABLE_ID_FORMAT, logicalId, physicalId)}. Cannot derive the table ARN for the tag update, and refusing to silently drop it.`, resourceType, logicalId, physicalId);
 		const { tableBucketARN, namespace, name } = resolvedParts;
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
@@ -73545,7 +73965,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.14");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.16");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;