@go-to-k/cdkd 0.281.18 → 0.281.20

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as replayWarn, $t as findLargeInlineResources, A as green, At as buildDockerImage, B as slowCcOperationTimeoutMs, Bt as getLegacyStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceTimeoutError, Ct as BOOTSTRAP_MARKER_PREFIX, D as bold, Dt as validateAssetBucketName, E as formatResourceLine, En as StackTerminationProtectionError, Et as parseBootstrapMarker, F as clearOnUpdateRemoval, Ft as AssetManifestLoader, G as getAccountInfo, Gt as resolveStateBucketWithDefault, H as isTerminationProtectionPropagationError, Ht as resolveAutoAssetStorage, I as ProviderRegistry, It as getDockerImageBySourceHash, J as normalizeAwsTagsToCfn, Jt as stateBucketExistenceConfirmed, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefaultAndSource, L as findActionableSilentDrops, Lt as Synthesizer, M as yellow, Mn as withErrorHandling, Mt as getDockerCmd, N as IAMRoleProvider, Nt as runDockerForeground, O as cyan, Ot as validateContainerRepoName, P as collectInlinePolicyNamesManagedBySiblings, Pt as runDockerStreaming, Q as readConfigString, Qt as MIGRATE_TMP_PREFIX, R as findSilentDropProperties, Rt as synthesisStatusMessage, S as extractDeploymentEventError, Sn as ProvisioningError, St as AssetModeResolver, T as renderStatefulReason, Tn as StackHasActiveImportsError, Tt as getBootstrapMarkerKey, U as IntrinsicFunctionResolver, Ut as resolveCaptureObservedState, V as disableInstanceApiTermination, Vt as resolveApp, W as cfnRefValueFromPhysicalId, Wt as resolveSkipPrefix, X as assertRegionMatch, Xt as CFN_TEMPLATE_BODY_LIMIT, Y as resolveExplicitPhysicalId, Yt as warnDeprecatedNoPrefixCliFlag, Z as configStringRefusal, Zt as CFN_TEMPLATE_URL_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalStartServiceError, _t as WorkGraph, a as DeploymentEventsStore, an as resolveBucketRegion, at as describeTypeWithThrottleRetry, b as unsupportedFinalSnapshotError, bn as NestedStackChildDirectDestroyError, bt as loadPublishableAssetManifest, c as replayFailedOperations, cn as resetAwsClients, ct as isThrottlingError, d as IMPLICIT_DELETE_DEPENDENCIES, dn as CdkdError, dt as LockManager, en as uploadCfnTemplate, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as S3StateBackend, g as ccRoutedFinalSnapshotError, gn as LocalMigrateError, gt as stringifyValue, h as buildFinalSnapshotIdentifier, hn as LocalInvokeBuildError$1, ht as AssetPublisher, i as DeploymentEventsReader, it as DiffCalculator, j as red, jn as normalizeAwsError, jt as formatDockerLoginError, k as gray, kt as derivePartitionAndUrlSuffix, l as replayRollback, ln as setAwsClients, lt as DagBuilder, m as PRE_DELETE_SNAPSHOT_TYPES, mn as DeployCancelledError, mt as shouldRetainResource, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AssemblyReader, nt as requireConfigString, o as planFailedOps, on as AwsClients, ot as withRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as rebuildClientForBucketRegion, q as WAFv2WebACLProvider, qt as resolveUseCdkBootstrapAssets, r as DeployEngine, rn as processStackMessages, rt as applyRoleArnIfSet, s as planRollback, sn as getAwsClients, st as isRetryableTransientError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as expectedOwnerParam, tt as requireConfigObject, u as withResourceDeadline, ut as TemplateParser, v as isFinalSnapshotError, vt as buildAssetRedirectMap, w as isStatefulRecreateTargetSync, wn as ResourceUpdateNotSupportedError, wt as ensureAssetStorage, x as makeCanonicalizePropertiesFn, xn as PartialFailureError, xt as rewriteTemplateAssetReferences, y as refusesFinalSnapshot, yn as MissingCdkCliError, yt as createAssetRedirectResolver, z as CloudControlProvider, zt as getDefaultStateBucketName } from "./deploy-engine-D-0t_IlI.js";
+import { $ as configStringRefusal, $t as CFN_TEMPLATE_URL_LIMIT, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as synthesisStatusMessage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerForeground, G as getAccountInfo, Gt as resolveCaptureObservedState, H as isTerminationProtectionPropagationError, Ht as getLegacyStateBucketName, I as ProviderRegistry, It as runDockerStreaming, J as normalizeAwsTagsToCfn, Jt as resolveStateBucketWithDefaultAndSource, K as refStateLookupFromResource, Kt as resolveSkipPrefix, L as findActionableSilentDrops, Lt as AssetManifestLoader, M as yellow, Mt as buildDockerImage, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as formatDockerLoginError, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as getDockerCmd, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_BODY_LIMIT, R as findSilentDropProperties, Rt as getDockerImageBySourceHash, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveApp, V as disableInstanceApiTermination, Vt as getDefaultStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveAutoAssetStorage, X as assertRegionMatch, Xt as stateBucketExistenceConfirmed, Y as resolveExplicitPhysicalId, Yt as resolveUseCdkBootstrapAssets, Z as coerceCfnBoolean, Zt as warnDeprecatedNoPrefixCliFlag, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as MIGRATE_TMP_PREFIX, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as derivePartitionAndUrlSuffix, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as uploadCfnTemplate, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefault, r as DeployEngine, rn as expectedOwnerParam, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as findLargeInlineResources, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as Synthesizer } from "./deploy-engine-C3-CvvrB.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CRgl7pV6.js";
+import { t as ASGProvider } from "./asg-provider-Cv9YCLsx.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -5048,7 +5048,12 @@ const INVENTORY_DEFAULT_SCHEDULE_FREQUENCY = "Weekly";
 */
 function effectiveInventoryItem(item, sent) {
 	const patch = {};
-	if (item["Enabled"] === void 0) patch["Enabled"] = INVENTORY_DEFAULT_ENABLED;
+	const declaredEnabled = item["Enabled"];
+	if (declaredEnabled === void 0) patch["Enabled"] = INVENTORY_DEFAULT_ENABLED;
+	else {
+		const coercedEnabled = coerceCfnBoolean(declaredEnabled);
+		if (coercedEnabled !== void 0 && !Object.is(declaredEnabled, coercedEnabled)) patch["Enabled"] = coercedEnabled;
+	}
 	if (item["IncludedObjectVersions"] === void 0) patch["IncludedObjectVersions"] = INVENTORY_DEFAULT_INCLUDED_OBJECT_VERSIONS;
 	const declaredSchedule = item["Schedule"];
 	const declaresScheduleFrequency = item["ScheduleFrequency"] !== void 0;
@@ -5133,9 +5138,191 @@ function effectiveIntelligentTieringItem(item) {
 	};
 }
 /**
-* Apply a per-ITEM fold to one of the `Id`-keyed array properties on BOTH sides
-* of a diff — the `canonicalizeDesiredProperties` plumbing shared by the
-* inventory and analytics folds.
+* Normalize a bag's TOLERATED key spellings onto the ONE spelling the readback
+* emits — the shared core of the two #1748 folds.
+*
+* Each entry is `[emitted, tolerated]`: where the applier reads
+* `(bag['emitted'] ?? bag['tolerated'])`, this writes the SAME value under
+* `emitted` and REMOVES `tolerated`. The `??` is the licensed ALIAS form (the
+* one {@link declaredOrDefault} carves out): it supplies no DEFAULT, it picks
+* between two spellings of one declared value exactly as the applier's own read
+* does, so a nullish first spelling falls through to the second here for the
+* same reason it does on the wire.
+*
+* Keyed off the DECLARED shape, never off a refusal — the population that
+* matters carries no malformed value at all, so a condition riding a
+* substitution arm would miss it (issue #1686's first generalization).
+*
+* The tolerated key is REMOVED rather than set to `undefined`: `JSON.stringify`
+* drops an `undefined` member but the state record is written from this object
+* and a present-but-`undefined` key survives a `structuredClone`, so a consumer
+* walking `Object.keys` — the `unionWalkObjects` drift path does — would still
+* see two different key sets.
+*
+* @returns `bag` BY IDENTITY when no tolerated spelling is declared, so an
+*   ordinary CFn-spelled template records and diffs byte-for-byte as before.
+*/
+function foldToleratedAliases(bag, aliases) {
+	let out;
+	for (const [emitted, tolerated] of aliases) {
+		if (bag[tolerated] === void 0) continue;
+		out ??= { ...bag };
+		out[emitted] = bag[emitted] ?? bag[tolerated];
+		delete out[tolerated];
+	}
+	return out ?? bag;
+}
+/** The lifecycle `Transitions[]` aliases the applier accepts (issue #1748). */
+const TRANSITION_ALIASES = [["TransitionInDays", "Days"], ["TransitionDate", "Date"]];
+/** The lifecycle `NoncurrentVersionTransitions[]` alias (issue #1748). */
+const NONCURRENT_VERSION_TRANSITION_ALIASES = [["TransitionInDays", "NoncurrentDays"]];
+/** The `NotificationConfiguration` ARN aliases, per family (issue #1748). */
+const NOTIFICATION_ARN_ALIASES = [
+	["TopicConfigurations", [["Topic", "TopicArn"]]],
+	["QueueConfigurations", [["Queue", "QueueArn"]]],
+	["LambdaConfigurations", [["Function", "LambdaFunctionArn"]]]
+];
+/**
+* The `Event` / `Events` half of the same item (issue #1748).
+*
+* The ARN alias is not the only never-emitted spelling on a notification item,
+* and this one is the WIDER of the two: `TopicArn` is a cdkd-only tolerance
+* almost no template uses, while `Event` is the member the CFn registry schema
+* declares (`TopicConfiguration` is `{Event, Filter, Topic}` — there is no
+* `Events`) and therefore the one EVERY template carries. The applier accepts
+* both (`t['Event'] !== undefined ? [t['Event']] : t['Events']`).
+*
+* Unlike the ARN pair this is not a pure rename — the SDK member is a LIST — so
+* it folds by ARITY: a single-element list is the CFn `Event`, and a longer one
+* has no CFn spelling at all and is left as `Events`, which is what the readback
+* emits for it. That asymmetry is why it is a separate step rather than another
+* {@link foldToleratedAliases} entry.
+*
+* `readNotification` was emitting `Events` unconditionally, so the record and
+* the readback disagreed on every notification-configured bucket; it now
+* reverse-maps to the CFn spelling on the same arity rule, exactly as
+* `readLifecycle` already does for `TransitionInDays`. One-time drift on upgrade
+* for an already-deployed bucket, the same accepted cost the sibling reverse-map
+* changes in this file document, and it clears on the next deploy.
+*/
+function foldNotificationEvents(item) {
+	const events = item["Events"];
+	if (events === void 0) return item;
+	const out = { ...item };
+	if (item["Event"] === void 0) {
+		if (!Array.isArray(events) || events.length !== 1) return item;
+		out["Event"] = events[0];
+	}
+	delete out["Events"];
+	return out;
+}
+/**
+* The `NotificationConfiguration` cdkd ACTUALLY SENDS, in the spelling
+* `readNotification` emits (issue #1748) — the never-emitted-KEY class of issue
+* #1686 reached through the SHAPE rather than through a value.
+*
+* `applyNotificationConfiguration` accepts the SDK spelling of each destination
+* ARN alongside the CFn one (`t['Topic'] ?? t['TopicArn']`, and the two
+* siblings), while `readNotification` emits only `Topic` / `Queue` /
+* `Function` — the spellings the live CFn registry schema declares
+* (`TopicConfiguration` is `{Event, Filter, Topic}`, with no `TopicArn`
+* member at all, so the SDK spellings are cdkd-only tolerances). A record
+* written in the tolerated spelling therefore can never match the readback:
+* `cdkd drift` re-reports it forever and `--revert` re-issues the same Put,
+* with NO warning anywhere, because nothing is malformed and nothing is
+* substituted.
+*
+* This NORMALIZES rather than retracting the tolerance, per #1686's third
+* generalization: refusing the SDK spelling would break templates that deploy
+* today, and buys nothing the normalization does not.
+*
+* The Put is a FULL REPLACE with no skip arm, so there is no
+* previous-value-retained case to distinguish — whenever it succeeds, this is
+* what AWS holds.
+*
+* @returns `config` BY IDENTITY when no tolerated spelling is declared, or when
+*   it is not a shape this can fold at all (left for the applier's own
+*   handling).
+*/
+function effectiveNotificationConfiguration(config) {
+	if (!isPlainObject$1(config)) return config;
+	let out = config;
+	for (const [listKey, aliases] of NOTIFICATION_ARN_ALIASES) out = canonicalizeItemList(out, listKey, (item) => foldNotificationEvents(foldToleratedAliases(item, aliases)));
+	return out;
+}
+/**
+* The `LifecycleConfiguration` cdkd ACTUALLY SENDS, in the spelling
+* `readLifecycle` emits (issue #1748) — the lifecycle half of the same class.
+*
+* `applyLifecycleConfiguration` accepts the SDK day/date spellings alongside the
+* CFn ones on both transition families (`t['TransitionInDays'] ?? t['Days']`,
+* `t['TransitionDate'] ?? t['Date']`, `nvt['TransitionInDays'] ??
+* nvt['NoncurrentDays']`) while `readLifecycle` emits only `TransitionInDays` /
+* `TransitionDate` — again the only spellings the registry schema declares
+* (`Transition` is `{StorageClass, TransitionDate, TransitionInDays}`,
+* `NoncurrentVersionTransition` is `{StorageClass, TransitionInDays,
+* NewerNoncurrentVersions}`).
+*
+* The issue named the `Date` alias; the mechanical audit it asks for (match the
+* `(a['X'] ?? a['Y'])` ALIAS form, not a plain bracket read) found all THREE in
+* the same two item shapes, so fixing only the reported one would have left its
+* siblings broken — the "diff the WHOLE blob, not the reported key" rule.
+*
+* Two things deliberately NOT folded here, tracked rather than left unstated:
+* the legacy SINGULAR `Transition` / `NoncurrentVersionTransition` objects,
+* which `mergeLegacySingular` folds into the plural on the wire so the readback
+* can never emit them either — a MERGE with a collision arm that WARNS, not an
+* alias rename, so it needs its own decision (issue #1754); and the RULE-level
+* divergences the round-trip fence measured beside these
+* (`ExpirationInDays` / `NoncurrentVersionExpirationInDays` recorded against an
+* `Expiration` / `NoncurrentVersionExpiration` readback, and the sent-but-
+* unrecorded `Filter: {Prefix: ''}`), which are reshapes belonging on the
+* READBACK side and are wider than this class (issue #1755). So a rule using
+* these aliases converges on the aliases and still differs on those keys until
+* #1755 lands — which is the honest state, not a claim this makes lifecycle
+* whole.
+*
+* @returns `config` BY IDENTITY when no tolerated spelling is declared.
+*/
+function effectiveLifecycleConfiguration(config) {
+	if (!isPlainObject$1(config)) return config;
+	return canonicalizeItemList(config, "Rules", (rule) => {
+		let out = canonicalizeItemList(rule, "Transitions", (t) => foldToleratedAliases(t, TRANSITION_ALIASES));
+		out = canonicalizeItemList(out, "NoncurrentVersionTransitions", (nvt) => foldToleratedAliases(nvt, NONCURRENT_VERSION_TRANSITION_ALIASES));
+		return out;
+	});
+}
+/**
+* Apply a WHOLE-BLOCK fold to one top-level property on BOTH sides of a diff —
+* the {@link canonicalizeItemList} sibling for the two #1748 folds, whose unit
+* is the block rather than an item of a list.
+*
+* The COMPUTED `[key]:` write is load-bearing and must not be "tidied" into a
+* named-member spread (`{ ...out, LifecycleConfiguration: folded }`), which is
+* how this was first written. `gen-nested-key-coverage`'s write-evidence walk
+* recognizes a bag-derived spread-and-patch literal as a whole-blob HAND-OFF
+* (its #1475 recognizer) and credits everything beneath the named path as
+* delivered — so naming the member here made a DIFF-side pure function vouch for
+* the forward mapper and retired three reviewed `AWS::S3::Bucket` allow-list
+* entries (`LifecycleConfiguration.TransitionDefaultMinimumObjectSize`,
+* `…Rules.TagFilters.Key` / `.Value`), i.e. it silently switched the write pass
+* off for that whole subtree. Measured both ways via the critic's
+* `--providers-dir=` seam. A computed key names no member, which is exactly why
+* the pre-existing folds in this file are spelled that way.
+*/
+function canonicalizeBlock(properties, key, fold) {
+	const folded = fold(properties[key]);
+	return folded === properties[key] ? properties : {
+		...properties,
+		[key]: folded
+	};
+}
+/**
+* Apply a per-ITEM fold to an array-valued member on BOTH sides of a diff — the
+* `canonicalizeDesiredProperties` plumbing every fold in this file shares, from
+* the top-level `Id`-keyed properties down to the nested `Rules[].Transitions[]`
+* list (the bag is the containing OBJECT, which at the top level is the property
+* bag and one level down is the rule).
 *
 * Identity-returns at every level (untouched item -> untouched array ->
 * untouched bag), and leaves a non-array property or a non-object element ALONE
@@ -5201,15 +5388,6 @@ function mergeLegacySingular(plural, singular, onCollision) {
 	}
 	return [...out, singular];
 }
-/** Coerce a CFn boolean, which may arrive as the string `"true"` / `"false"`. */
-function coerceCfnBoolean(value) {
-	if (typeof value === "boolean") return value;
-	if (typeof value === "string") {
-		const lowered = value.toLowerCase();
-		if (lowered === "true") return true;
-		if (lowered === "false") return false;
-	}
-}
 /**
 * SDK Provider for AWS::S3::Bucket
 *
@@ -6047,6 +6225,13 @@ var S3BucketProvider = class S3BucketProvider {
 				skipped.push(index);
 				continue;
 			}
+			const enabledRefusal = configBooleanRefusal(config, "Enabled", "AWS::S3::Bucket InventoryConfigurations[]");
+			if (enabledRefusal !== void 0) {
+				if (!onUnusable) throw new Error(`${enabledRefusal}. Omit the field entirely to use the default (${INVENTORY_DEFAULT_ENABLED})`);
+				onUnusable(`${enabledRefusal}. Skipping this inventory configuration: defaulting to ${INVENTORY_DEFAULT_ENABLED} would ENABLE an inventory report the template may have been disabling; the same value is REFUSED on a template-path create`);
+				skipped.push(index);
+				continue;
+			}
 			const inventoryDestPath = "AWS::S3::Bucket InventoryConfigurations[].Destination";
 			const rawDest = config["Destination"];
 			const s3Dest = this.resolveS3BucketDestination(rawDest, inventoryDestPath, onUnusable);
@@ -6071,7 +6256,7 @@ var S3BucketProvider = class S3BucketProvider {
 			const frequency = useScheduleFrequency ? requireConfigString(config["ScheduleFrequency"], "Weekly", "AWS::S3::Bucket InventoryConfigurations[].ScheduleFrequency") : readConfigString(config["Schedule"], "Frequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[].Schedule");
 			const inventoryConfig = {
 				Id: id,
-				IsEnabled: config["Enabled"] ?? INVENTORY_DEFAULT_ENABLED,
+				IsEnabled: coerceCfnBoolean(config["Enabled"]) ?? INVENTORY_DEFAULT_ENABLED,
 				IncludedObjectVersions: readConfigString(config, "IncludedObjectVersions", INVENTORY_DEFAULT_INCLUDED_OBJECT_VERSIONS, "AWS::S3::Bucket InventoryConfigurations[]"),
 				Schedule: { Frequency: frequency },
 				Destination: { S3BucketDestination: s3Dest ? {
@@ -6647,6 +6832,17 @@ var S3BucketProvider = class S3BucketProvider {
 			overrides.set(key, previousProperties[key]);
 		};
 		/**
+		* Record a WHOLE-BLOCK fold: the effective value is what was SENT.
+		*
+		* Identity means the declared bag IS what went on the wire, so no override
+		* is set at all and the engine records the desired properties unchanged —
+		* which is what keeps an ordinary CFn-spelled template byte-for-byte
+		* unaffected by the #1748 folds.
+		*/
+		const recordEffectiveFold = (key, sent) => {
+			if (sent !== properties[key]) overrides.set(key, sent);
+		};
+		/**
 		* Per-property accumulator for one of the four `Id`-keyed appliers.
 		*
 		* Keyed by `Id` rather than by index because on THIS path the diff loop
@@ -6725,6 +6921,7 @@ var S3BucketProvider = class S3BucketProvider {
 				return;
 			}
 			if (!await this.applyLifecycleConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("LifecycleConfiguration");
+			else recordEffectiveFold("LifecycleConfiguration", effectiveLifecycleConfiguration(cfg));
 		}, async () => {
 			await this.s3Client.send(new DeleteBucketLifecycleCommand({ Bucket: bucketName }));
 			this.logger.debug(`Deleted lifecycle configuration on bucket ${bucketName}`);
@@ -6753,7 +6950,10 @@ var S3BucketProvider = class S3BucketProvider {
 		}, async () => {
 			await this.applyLoggingConfiguration(bucketName, void 0);
 		});
-		await this.diffSubConfig(bucketName, previousProperties["NotificationConfiguration"], properties["NotificationConfiguration"], async (cfg) => this.applyNotificationConfiguration(bucketName, cfg), async () => this.applyNotificationConfiguration(bucketName, void 0));
+		await this.diffSubConfig(bucketName, previousProperties["NotificationConfiguration"], properties["NotificationConfiguration"], async (cfg) => {
+			await this.applyNotificationConfiguration(bucketName, cfg);
+			recordEffectiveFold("NotificationConfiguration", effectiveNotificationConfiguration(cfg));
+		}, async () => this.applyNotificationConfiguration(bucketName, void 0));
 		await this.diffSubConfig(bucketName, previousProperties["ReplicationConfiguration"], properties["ReplicationConfiguration"], async (cfg) => {
 			if (!await this.applyReplicationConfiguration(bucketName, cfg, (m) => this.logger.warn(m))) retainPrevious("ReplicationConfiguration");
 		}, async () => {
@@ -6843,6 +7043,15 @@ var S3BucketProvider = class S3BucketProvider {
 	async applyAllSubConfigsForCreate(bucketName, properties, context) {
 		const overrides = /* @__PURE__ */ new Map();
 		/**
+		* Record a WHOLE-BLOCK fold: the effective value is what was SENT (issue
+		* #1748). The create-path twin of `applySubConfigDiffs`'s helper of the same
+		* name; identity sets no override, so an ordinary CFn-spelled template is
+		* byte-for-byte unaffected.
+		*/
+		const recordEffectiveFold = (key, sent) => {
+			if (sent !== properties[key]) overrides.set(key, sent);
+		};
+		/**
 		* Record a per-ITEM applier outcome.
 		*
 		* A SKIPPED item is DROPPED — there is no previously-applied item to
@@ -6858,14 +7067,17 @@ var S3BucketProvider = class S3BucketProvider {
 		};
 		const replayOnUnusable = replayWarn(this.logger, context).onUnusable;
 		const notifConfig = properties["NotificationConfiguration"];
-		if (notifConfig) await this.applyNotificationConfiguration(bucketName, notifConfig);
+		if (notifConfig) {
+			await this.applyNotificationConfiguration(bucketName, notifConfig);
+			recordEffectiveFold("NotificationConfiguration", effectiveNotificationConfiguration(notifConfig));
+		}
 		const corsConfig = properties["CorsConfiguration"];
 		if (corsConfig?.CorsRules && Array.isArray(corsConfig.CorsRules) && corsConfig.CorsRules.length > 0) await this.applyCorsConfiguration(bucketName, corsConfig);
 		else if (corsConfig != null) this.announceCreateEmptyCollectionSkip("CorsConfiguration", "CorsConfiguration.CorsRules");
 		const lifecycleConfig = properties["LifecycleConfiguration"];
-		if (lifecycleConfig?.Rules && Array.isArray(lifecycleConfig.Rules) && lifecycleConfig.Rules.length > 0) {
-			if (!await this.applyLifecycleConfiguration(bucketName, lifecycleConfig, replayOnUnusable)) overrides.set("LifecycleConfiguration", void 0);
-		} else if (lifecycleConfig != null) this.announceCreateEmptyCollectionSkip("LifecycleConfiguration", "LifecycleConfiguration.Rules");
+		if (lifecycleConfig?.Rules && Array.isArray(lifecycleConfig.Rules) && lifecycleConfig.Rules.length > 0) if (!await this.applyLifecycleConfiguration(bucketName, lifecycleConfig, replayOnUnusable)) overrides.set("LifecycleConfiguration", void 0);
+		else recordEffectiveFold("LifecycleConfiguration", effectiveLifecycleConfiguration(lifecycleConfig));
+		else if (lifecycleConfig != null) this.announceCreateEmptyCollectionSkip("LifecycleConfiguration", "LifecycleConfiguration.Rules");
 		const loggingConfig = properties["LoggingConfiguration"];
 		const loggingRefusal = replayOnUnusable ? configStringRefusal(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") : void 0;
 		if (loggingRefusal !== void 0) {
@@ -7051,6 +7263,8 @@ var S3BucketProvider = class S3BucketProvider {
 		let out = canonicalizeItemList(properties, "InventoryConfigurations", (item) => effectiveInventoryItem(item));
 		out = canonicalizeItemList(out, "AnalyticsConfigurations", (item) => effectiveAnalyticsItem(item));
 		out = canonicalizeItemList(out, "IntelligentTieringConfigurations", effectiveIntelligentTieringItem);
+		out = canonicalizeBlock(out, "NotificationConfiguration", effectiveNotificationConfiguration);
+		out = canonicalizeBlock(out, "LifecycleConfiguration", effectiveLifecycleConfiguration);
 		return out;
 	}
 	/**
@@ -7333,6 +7547,27 @@ var S3BucketProvider = class S3BucketProvider {
 		}
 		return out;
 	}
+	/**
+	* Emit a notification item's event list in the CFn spelling (issue #1748).
+	*
+	* The SDK member is the LIST `Events`; CFn declares only the scalar `Event`
+	* (`TopicConfiguration` is `{Event, Filter, Topic}`), which is what every
+	* template — and therefore every state record written from one — carries. So
+	* emitting `Events` unconditionally made the record and the readback disagree
+	* on EVERY notification-configured bucket: `cdkd drift` re-reported it forever
+	* and `--revert` re-issued the same Put, with nothing malformed to warn about.
+	*
+	* Reverse-mapping to the CFn spelling is the same answer the `Transitions`
+	* sibling in `readLifecycle` already takes for `TransitionInDays`. The arity
+	* rule is what keeps it lossless: a longer list has no CFn spelling, so it
+	* stays `Events` — which is also what {@link foldNotificationEvents} leaves on
+	* the desired side, so the two still meet.
+	*/
+	emitNotificationEvents(target, events) {
+		if (events === void 0) return;
+		if (events.length === 1) target["Event"] = events[0];
+		else target["Events"] = events;
+	}
 	async readNotification(bucket) {
 		const resp = await this.s3Client.send(new GetBucketNotificationConfigurationCommand({ Bucket: bucket }));
 		const out = {};
@@ -7340,7 +7575,7 @@ var S3BucketProvider = class S3BucketProvider {
 			const e = {};
 			if (t.Id !== void 0) e["Id"] = t.Id;
 			if (t.TopicArn !== void 0) e["Topic"] = t.TopicArn;
-			if (t.Events !== void 0) e["Events"] = t.Events;
+			this.emitNotificationEvents(e, t.Events);
 			if (t.Filter) e["Filter"] = this.sdkNotifFilterToCfn(t.Filter);
 			return e;
 		});
@@ -7348,7 +7583,7 @@ var S3BucketProvider = class S3BucketProvider {
 			const e = {};
 			if (q.Id !== void 0) e["Id"] = q.Id;
 			if (q.QueueArn !== void 0) e["Queue"] = q.QueueArn;
-			if (q.Events !== void 0) e["Events"] = q.Events;
+			this.emitNotificationEvents(e, q.Events);
 			if (q.Filter) e["Filter"] = this.sdkNotifFilterToCfn(q.Filter);
 			return e;
 		});
@@ -7356,7 +7591,7 @@ var S3BucketProvider = class S3BucketProvider {
 			const e = {};
 			if (l.Id !== void 0) e["Id"] = l.Id;
 			if (l.LambdaFunctionArn !== void 0) e["Function"] = l.LambdaFunctionArn;
-			if (l.Events !== void 0) e["Events"] = l.Events;
+			this.emitNotificationEvents(e, l.Events);
 			if (l.Filter) e["Filter"] = this.sdkNotifFilterToCfn(l.Filter);
 			return e;
 		});
@@ -14337,6 +14572,18 @@ var DynamoDBGlobalTableProvider = class {
 				delete copy["GlobalSecondaryIndexes"];
 				return copy;
 			});
+			const keptKeyAttributes = collectDesiredKeyAttributeNames(properties, { indexListKeys: ["LocalSecondaryIndexes"] });
+			if (keptKeyAttributes.size > 0 && Array.isArray(attributeDefinitions)) {
+				const prunedAttributeDefinitions = attributeDefinitions.filter((definition) => {
+					const name = asRecord$1(definition)?.["AttributeName"];
+					if (typeof name !== "string") return true;
+					return keptKeyAttributes.has(name);
+				});
+				if (prunedAttributeDefinitions.length !== attributeDefinitions.length) {
+					createParams.AttributeDefinitions = prunedAttributeDefinitions;
+					effectiveProperties["AttributeDefinitions"] = [...prunedAttributeDefinitions];
+				}
+			}
 		}
 		if (sdkIndexes.length > 0) createParams.GlobalSecondaryIndexes = sdkIndexes;
 		if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
@@ -15710,6 +15957,31 @@ var DynamoDBGlobalTableProvider = class {
 		return [];
 	}
 	/**
+	* `AttributeDefinitions` is an unordered SET, and the comparator compares
+	* arrays positionally (issue #1742).
+	*
+	* `DescribeTable` returns the definitions in an order matching neither the
+	* request nor alphabetical — measured us-east-1 2026-08-13 on the
+	* `rollback-replay-effective-props` fixture, where a table declaring
+	* `[pk, gsipk]` read back as `[gsipk, pk]` — so an UNTOUCHED table drifted
+	* forever. Sorting cannot hide a real change here because the list is a
+	* genuine set: members are keyed by `AttributeName`, so adding, removing or
+	* retyping one still changes the canonicalized form.
+	*
+	* Reachable whenever the drift baseline is `properties` rather than
+	* `observedProperties` — i.e. after any reverse-replacement rollback, which
+	* `rollback-executor.ts` strips `observedProperties` on. That is also why it
+	* went unseen: on the ordinary path both sides come from the same readback.
+	*
+	* `KeySchema` is deliberately NOT declared, at the table level or per index:
+	* it is order-SIGNIFICANT (HASH before RANGE), so sorting it would silently
+	* hide a real key change — the failure direction this file's sibling rules
+	* call the worse one.
+	*/
+	getDriftUnorderedPaths(_resourceType) {
+		return ["AttributeDefinitions"];
+	}
+	/**
 	* Adopt an existing DynamoDB GlobalTable into cdkd state.
 	*
 	* Lookup order:
@@ -16058,12 +16330,21 @@ function collectAutoScalingTargets(properties, localRegion) {
 * redefine-in-place (replacement required); one outside it is the normal
 * bookkeeping of a GSI deletion and must NOT force a replacement.
 *
-* Malformed / intrinsic-valued entries contribute nothing, which errs on the
-* PERMISSIVE side of the guard — correct here, because the guard's failure
-* mode is a forced replacement of a live table, and AWS itself still rejects
-* a genuinely-bad `UpdateTable` loudly.
-*/
-function collectDesiredKeyAttributeNames(properties) {
+* Malformed / intrinsic-valued entries contribute nothing. For the `update()`
+* guard that errs on the PERMISSIVE side — correct there, because that guard's
+* failure mode is a forced replacement of a live table, and AWS still rejects a
+* genuinely-bad `UpdateTable` loudly. For the create-path prune below it errs
+* the other way (an unreadable LSI key schema prunes MORE), which is only
+* reachable on a bag AWS would reject anyway.
+*
+* `options.indexListKeys` narrows which index lists contribute, for the ONE
+* caller whose question is not "what does the template reference" but "what
+* will this call actually key on" — `create()`'s replay-CREATE GSI omit arm
+* (issue #1741), which sends NO indexes and therefore must not count the
+* omitted block's key attributes as still-referenced. It defaults to BOTH
+* lists, so the `update()` guard above reads exactly as it did before.
+*/
+function collectDesiredKeyAttributeNames(properties, options) {
 	const names = /* @__PURE__ */ new Set();
 	const addKeySchema = (value) => {
 		if (!Array.isArray(value)) return;
@@ -16073,7 +16354,8 @@ function collectDesiredKeyAttributeNames(properties) {
 		}
 	};
 	addKeySchema(properties["KeySchema"]);
-	for (const indexListKey of ["GlobalSecondaryIndexes", "LocalSecondaryIndexes"]) {
+	const indexListKeys = options?.indexListKeys ?? ["GlobalSecondaryIndexes", "LocalSecondaryIndexes"];
+	for (const indexListKey of indexListKeys) {
 		const indexes = properties[indexListKey];
 		if (!Array.isArray(indexes)) continue;
 		for (const index of indexes) addKeySchema(asRecord$1(index)?.["KeySchema"]);
@@ -74064,7 +74346,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.18");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.20");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;