@go-to-k/cdkd 0.278.25 → 0.278.27

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-B65VTlrZ.js";
+import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-0SZS30V4.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BRlawK4H.js";
+import { t as ASGProvider } from "./asg-provider-C2V8DwC0.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -33105,10 +33105,10 @@ var GlueProvider = class {
 		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::Glue::Database": return this.createDatabase(logicalId, resourceType, properties);
-			case "AWS::Glue::Table": return this.createTable(logicalId, resourceType, properties);
+			case "AWS::Glue::Table": return this.createTable(logicalId, resourceType, properties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
@@ -33191,7 +33191,7 @@ var GlueProvider = class {
 			throw new ProvisioningError(`Failed to delete Glue Database ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createTable(logicalId, resourceType, properties) {
+	async createTable(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Glue Table ${logicalId}`);
 		const databaseName = properties["DatabaseName"];
 		if (!databaseName) throw new ProvisioningError(`DatabaseName is required for Glue Table ${logicalId}`, resourceType, logicalId);
@@ -33200,7 +33200,10 @@ var GlueProvider = class {
 		const tableName = tableInput["Name"] ?? properties["Name"];
 		if (!tableName) throw new ProvisioningError(`TableInput.Name or top-level Name is required for Glue Table ${logicalId}`, resourceType, logicalId);
 		const catalogId = properties["CatalogId"];
-		assertIcebergTableInputAbsent(logicalId, resourceType, properties);
+		enforceIcebergTableInputAbsent(logicalId, resourceType, properties, {
+			warn: (message) => this.logger.warn(message),
+			replayingState: context?.replayingState === true
+		});
 		const openTableFormatInput = properties["OpenTableFormatInput"];
 		try {
 			await this.getClient().send(new CreateTableCommand$1({
@@ -33990,15 +33993,35 @@ function findIcebergTableInputKey(properties) {
 * produce a late, cryptic AWS error. Failing fast with the working shape spelled
 * out is strictly more useful.
 *
-* **CREATE only — update WARNS instead.** See the comment at the `updateTable`
-* call site: rollback replays from cdkd STATE, and a table created by a
-* pre-#1390 build carries the key in its state record, so refusing on update
-* would make such a table unrollbackable with no template-side remedy. cdkd
-* does not wire Glue's update-only `UpdateOpenTableFormatInput` shape and
-* `buildTableInput` is an explicit allow-list, so warning there forwards
-* nothing and loses no protection. One rollback arm is still exposed — the
-* reverse-replacement re-create replays a state record through `create()`;
-* see issue #1463 and the note at the `updateTable` call site.
+* **TEMPLATE creates only — every STATE REPLAY warns instead.** The refusal is
+* conditioned on the ORIGIN of the properties, not on the operation name:
+*
+* - `update()` warns unconditionally. Rollback replays from cdkd STATE, and a
+*   table created by a pre-#1390 build carries the key in its state record, so
+*   refusing there would make such a table unrollbackable with no
+*   template-side remedy. cdkd does not wire Glue's update-only
+*   `UpdateOpenTableFormatInput` shape and `buildTableInput` is an explicit
+*   allow-list, so warning forwards nothing and loses no protection.
+* - `create()` warns when {@link CreateContext.replayingState} is set — the
+*   rollback executor's reverse-replacement arm, which revives the OLD
+*   resource from `previousState.properties` (issue #1463). Same reasoning:
+*   the user cannot edit a state record from the template. Unlike the update
+*   path this one DOES forward the value, so the re-created table is degraded
+*   in exactly the way the original was (the CFn spelling is dropped by the
+*   SDK serializer per #1390; the SDK spelling is sent and Glue rejects it) —
+*   the warning says so, and the fix-forward is a `cdkd deploy`.
+* - Every deploy-engine `create()` refuses: the CREATE branch, the
+*   property-driven replacement, the `--recreate-via-*` destroy-then-create,
+*   the `--replace` delete-first fallback, and the update-failure replacement.
+*   All are driven by freshly resolved TEMPLATE properties, so the user CAN
+*   fix the input and a fast, actionable refusal is strictly better.
+*
+* The asymmetry constrains where this provider may re-create. `GlueProvider`
+* must never call `this.create()` from inside its own `update()` the way ACM /
+* IAM / Lambda-permission / SNS-subscription do: those internal re-creates
+* forward `update()`'s `properties` — a STATE record during a rollback replay —
+* and `update()` has no context parameter to carry the flag, so this refusal
+* would fire on a replay with no way to detect it.
 *
 * **Known bypass: the sticky Cloud Control route.** This is a GlueProvider
 * pre-flight, so it only runs on the SDK route. When a table's state record
@@ -34019,19 +34042,23 @@ function findIcebergTableInputKey(properties) {
 * relaxed, the rename MUST be restored in the same change — otherwise the
 * silent-drop bug of #1390 comes straight back.
 */
-function assertIcebergTableInputAbsent(logicalId, resourceType, properties, physicalId) {
+function enforceIcebergTableInputAbsent(logicalId, resourceType, properties, options) {
 	const key = findIcebergTableInputKey(properties);
 	if (key === void 0) return;
-	throw new ProvisioningError(icebergTableInputRefusalMessage(logicalId, key, "create"), resourceType, logicalId, physicalId);
+	if (options.replayingState) {
+		options.warn(icebergTableInputRefusalMessage(logicalId, key, "create-replay"));
+		return;
+	}
+	throw new ProvisioningError(icebergTableInputRefusalMessage(logicalId, key, "create"), resourceType, logicalId);
 }
 /**
-* The shared #1454 message body, so the CREATE refusal and the UPDATE warning
-* cannot drift apart. `mode` only changes the lead clause — everything after it
-* (the probe evidence and the working shape) is identical, because the user's
-* next action is the same either way.
+* The shared #1454 message body, so the CREATE refusal, the UPDATE warning and
+* the rollback-replay CREATE warning cannot drift apart. `mode` only changes
+* the lead clause — everything after it (the probe evidence and the working
+* shape) is identical, because the user's next action is the same either way.
 */
 function icebergTableInputRefusalMessage(logicalId, key, mode) {
-	return `AWS::Glue::Table ${logicalId}: OpenTableFormatInput.IcebergInput.${key} ${mode === "create" ? `cannot be deployed by AWS in any shape, so cdkd refuses it before calling Glue (issue #1454).` : "cannot be deployed by AWS in any shape and is IGNORED on update — cdkd does not wire Glue's update-only UpdateOpenTableFormatInput shape, so it forwards nothing here and only warns (issue #1454). A CREATE of this table would be refused outright."}\n  Live-probed 2026-08-09 in us-east-1 (issue #1408): glue:CreateTable — the API cdkd calls — rejects every Iceberg table spec ("Location information cannot be null while creating an iceberg table" without a TableInput.StorageDescriptor, "Table metadata information present at multiple parts of input request" with one), and CloudFormation rolls the same template back with "Table metadata is expected only via TableInput or via IcebergTableInputProperties inside OpenTableFormatInput" — a property name that exists in neither the CFn registry schema (IcebergInput.IcebergTableInput) nor @aws-sdk/client-glue (IcebergInput.CreateIcebergTableInput).\n  Working shape — put the table metadata in TableInput and leave IcebergInput carrying only the create-time directive:\n    TableInput: { Name, TableType: 'EXTERNAL_TABLE', StorageDescriptor: { Location: 's3://your-bucket/prefix/', Columns: [...] } }\n    OpenTableFormatInput: { IcebergInput: { MetadataOperation: 'CREATE' } }   // Version: '2' is also accepted\n  Glue then writes the Iceberg metadata itself — the created table comes back with Parameters.table_type = ICEBERG and a populated Parameters.metadata_location.`;
+	return `AWS::Glue::Table ${logicalId}: OpenTableFormatInput.IcebergInput.${key} ${mode === "create" ? `cannot be deployed by AWS in any shape, so cdkd refuses it before calling Glue (issue #1454).` : mode === "create-replay" ? "cannot be deployed by AWS in any shape, so cdkd normally refuses it before calling Glue (issue #1454) — but this create is REPLAYING a historical cdkd STATE record (a rollback reverse-replacement re-creating the OLD table), not your template, and refusing would leave that table unrestorable with no template-side remedy, only a hand-edit of state.json. cdkd therefore warns and proceeds (issue #1463). The re-created table is DEGRADED exactly as the original was: under the CFn spelling IcebergTableInput the AWS SDK serializer drops the unknown member (issue #1390), so the table comes back without its Iceberg metadata; under the SDK spelling CreateIcebergTableInput the value IS sent and Glue rejects the call, failing this one rollback operation. Either way, fix it forward with 'cdkd deploy' using the working shape below." : "cannot be deployed by AWS in any shape and is IGNORED on update — cdkd does not wire Glue's update-only UpdateOpenTableFormatInput shape, so it forwards nothing here and only warns (issue #1454). A CREATE of this table would be refused outright."}\n  Live-probed 2026-08-09 in us-east-1 (issue #1408): glue:CreateTable — the API cdkd calls — rejects every Iceberg table spec ("Location information cannot be null while creating an iceberg table" without a TableInput.StorageDescriptor, "Table metadata information present at multiple parts of input request" with one), and CloudFormation rolls the same template back with "Table metadata is expected only via TableInput or via IcebergTableInputProperties inside OpenTableFormatInput" — a property name that exists in neither the CFn registry schema (IcebergInput.IcebergTableInput) nor @aws-sdk/client-glue (IcebergInput.CreateIcebergTableInput).\n  Working shape — put the table metadata in TableInput and leave IcebergInput carrying only the create-time directive:\n    TableInput: { Name, TableType: 'EXTERNAL_TABLE', StorageDescriptor: { Location: 's3://your-bucket/prefix/', Columns: [...] } }\n    OpenTableFormatInput: { IcebergInput: { MetadataOperation: 'CREATE' } }   // Version: '2' is also accepted\n  Glue then writes the Iceberg metadata itself — the created table comes back with Parameters.table_type = ICEBERG and a populated Parameters.metadata_location.`;
 }
 /**
 * Build the SDK `EncryptionConfiguration` from the CFn-shape input
@@ -48774,6 +48801,82 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 * parent path — so `path.split('.', 1)` is always safe to extract the
 * top-level key.
 */
+/**
+* The AWS-authored property paths a `--revert` is about to DROP, for a
+* resource whose state predates observed-capture (issue #1478).
+*
+* The mechanism, and why this is not a Glue fix: `runRevert` picks the revert
+* baseline as `observedProperties ?? properties`. When `observedProperties` is
+* absent, the desired side is the raw TEMPLATE while the previous side is the
+* AWS-CURRENT snapshot — so {@link buildRevertNewProperties}, which overwrites
+* each drifted top-level key with the desired sub-shape wholesale, replaces
+* every AWS-authored key inside that subtree with the template's version. For
+* a Glue Iceberg table that silently wipes `table_type` /
+* `metadata_location`, the same outcome as issue #1461 reached by a different
+* trigger. The exposure is general: ANY resource where AWS writes into a bag
+* the template does not fully declare, on state written before
+* observed-capture.
+*
+* The user DID ask to push state over AWS, so this is not silent-wrong the way
+* #1461 was — but it is almost certainly not what they meant, and nothing told
+* them. So the chosen semantic is **warn and proceed**: it is the cheapest
+* honest step, preserves today's behavior, and does not foreclose the stricter
+* options (refuse outright, or treat "no observedProperties" as "previous is
+* unknown" so the merge preserves).
+*
+* Scoped deliberately:
+*
+* - **Only drifted top-level keys.** Non-drifted keys keep their AWS-current
+*   value in `buildRevertNewProperties`, so nothing under them is dropped.
+* - **Only when `observedProperties` is absent.** With it present the desired
+*   side is the deploy-time AWS snapshot, which already carries AWS-authored
+*   fields — dropping one there is a legitimate revert of a real console
+*   change, and warning about it would be noise on every run.
+* - **Only keys that vanish.** A key present on both sides with a different
+*   VALUE is the drift the user asked to revert, not a silent loss.
+*
+* @returns dotted paths, sorted, e.g. `['Parameters.metadata_location']`.
+*/
+function findRevertDroppedAwsKeys(drifts, desiredProperties, awsProperties) {
+	const dropped = /* @__PURE__ */ new Set();
+	const driftedTopLevelKeys = /* @__PURE__ */ new Set();
+	for (const d of drifts) {
+		const topLevelKey = d.path.split(".", 1)[0];
+		if (topLevelKey) driftedTopLevelKeys.add(topLevelKey);
+	}
+	for (const key of driftedTopLevelKeys) {
+		if (!(key in desiredProperties)) continue;
+		collectMissingPaths(awsProperties[key], desiredProperties[key], key, dropped);
+	}
+	return [...dropped].sort();
+}
+/**
+* Walk the AWS-side value against the desired-side value, recording every path
+* present on the AWS side and absent on the desired side.
+*
+* Only plain objects are descended into. An ARRAY is compared wholesale — the
+* drift comparator itself treats arrays as single values (its paths never
+* carry an index), so an element-wise walk here would report positions the
+* rest of the revert path cannot reason about.
+*/
+function collectMissingPaths(awsValue, desiredValue, path, out) {
+	if (!isPlainRecord(awsValue)) return;
+	if (!isPlainRecord(desiredValue)) {
+		if (desiredValue === void 0) out.add(path);
+		return;
+	}
+	for (const [key, value] of Object.entries(awsValue)) {
+		const childPath = `${path}.${key}`;
+		if (!(key in desiredValue)) {
+			out.add(childPath);
+			continue;
+		}
+		collectMissingPaths(value, desiredValue[key], childPath, out);
+	}
+}
+function isPlainRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function buildRevertNewProperties(drifts, desiredProperties, awsProperties) {
 	const result = { ...awsProperties };
 	for (const d of drifts) {
@@ -48901,6 +49004,16 @@ function printRevertPlan(reports) {
 			const word = o.changes.length === 1 ? "property path" : "property paths";
 			process.stdout.write(`  → provider.update on ${o.logicalId} (${o.resourceType}): revert ${o.changes.length} ${word}\n`);
 			for (const change of o.changes) process.stdout.write(`    ${change.path}: ${formatScalar(change.awsValue)} -> ${formatScalar(change.stateValue)}\n`);
+			const stateResource = report.state.resources[o.logicalId];
+			if (stateResource && stateResource.observedProperties === void 0) {
+				const dropped = findRevertDroppedAwsKeys(o.changes, stateResource.properties ?? {}, o.awsProperties);
+				if (dropped.length > 0) {
+					const word = dropped.length === 1 ? "value" : "values";
+					process.stdout.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and will DROP ${dropped.length} AWS-authored ${word}:\n`);
+					for (const path of dropped) process.stdout.write(`        ${path}\n`);
+					process.stdout.write("      Re-deploy the stack first to populate observedProperties if you want these preserved.\n");
+				}
+			}
 		}
 	}
 }
@@ -65850,7 +65963,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.25");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.27");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;