@go-to-k/cdkd 0.280.28 → 0.280.29

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-Dkep5i7x.js";
+import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-wfKhhyCg.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-C3rBE_Ni.js";
+import { t as ASGProvider } from "./asg-provider-CcomwF89.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -53260,7 +53260,7 @@ function isServiceManagedTagKey(key) {
 * provider binds it, and that tag is REQUIRED for managed scaling. Because any
 * CDK ASG declares at least a `Name` tag, `Tags` is template-DECLARED, so the
 * #1498 carve-out (undeclared + captured-empty) correctly does not apply — and
-* the tag list is an ARRAY, which {@link findRevertDroppedAwsKeys}'s walk
+* the tag list is an ARRAY, which {@link findRevertUnbaselinedAwsKeys}'s walk
 * compares wholesale and never descends into. Post-revert the ASG kept the
 * capacity provider with its managed scaling silently broken (verified live
 * 2026-08-10).
@@ -53332,43 +53332,48 @@ function findRevertPreservedTagKeys(drifts, desiredProperties, awsProperties) {
 	return [...preserved].sort();
 }
 /**
-* The AWS-authored property paths a `--revert` is about to DROP, for a
-* resource whose state predates observed-capture (issue #1478).
+* The AWS-authored property paths a `--revert` LEAVES UNTOUCHED, for a
+* resource whose state predates observed-capture (issue #1478, semantics
+* settled by issue #1626).
 *
-* The mechanism, and why this is not a Glue fix: `runRevert` picks the revert
-* baseline as `observedProperties ?? properties`. When `observedProperties` is
-* absent, the desired side is the raw TEMPLATE while the previous side is the
-* AWS-CURRENT snapshot — so {@link buildRevertNewProperties}, which overwrites
-* each drifted top-level key with the desired sub-shape wholesale, replaces
-* every AWS-authored key inside that subtree with the template's version. For
-* a Glue Iceberg table that silently wipes `table_type` /
-* `metadata_location`, the same outcome as issue #1461 reached by a different
-* trigger. The exposure is general: ANY resource where AWS writes into a bag
-* the template does not fully declare, on state written before
+* The mechanism: `runRevert` picks the revert baseline as
+* `observedProperties ?? properties`. When `observedProperties` is absent, the
+* desired side is the raw TEMPLATE while the previous side is the AWS-CURRENT
+* snapshot — so {@link buildRevertNewProperties}, which overwrites each drifted
+* top-level key with the desired sub-shape wholesale, has no value to carry for
+* any AWS-authored key inside that subtree. For a Glue Iceberg table that
+* reaches `table_type` / `metadata_location`, the same exposure as issue #1461
+* by a different trigger; the general case is ANY resource where AWS writes
+* into a bag the template does not fully declare, on state written before
 * observed-capture.
 *
-* The user DID ask to push state over AWS, so this is not silent-wrong the way
-* #1461 was — but it is almost certainly not what they meant, and nothing told
-* them. So the chosen semantic is **warn and proceed**: it is the cheapest
-* honest step, preserves today's behavior, and does not foreclose the stricter
-* options (refuse outright, or treat "no observedProperties" as "previous is
-* unknown" so the merge preserves).
+* #1478 shipped the **warn and proceed** semantic — the values were still
+* erased, the user was merely told first — while explicitly leaving the door
+* open to "treat 'no observedProperties' as 'previous is unknown' so the merge
+* preserves". Issue #1626 walked through that door for the reasons in
+* {@link mergeUntemplatedValue}: on this baseline cdkd cannot tell an
+* AWS-authored value from an out-of-band change, and resetting on a coin flip
+* is the worse error. So the paths below are now REPORTED AS PRESERVED, and
+* `mergeUntemplatedValue` is what makes that true by merging them into the bag
+* `--revert` actually SENDS — which is the only side a wholesale-replace
+* provider consults. This function is unchanged in what it computes — only in
+* what the caller does about it.
 *
 * Scoped deliberately:
 *
 * - **Only drifted top-level keys.** Non-drifted keys keep their AWS-current
-*   value in `buildRevertNewProperties`, so nothing under them is dropped.
+*   value in `buildRevertNewProperties`, so nothing under them is at stake.
 * - **Only when `observedProperties` is absent.** With it present the desired
 *   side is the deploy-time AWS snapshot, which already carries AWS-authored
-*   fields — dropping one there is a legitimate revert of a real console
-*   change, and warning about it would be noise on every run.
+*   fields — removing one there is a legitimate revert of a real console
+*   change, and reporting it would be noise on every run.
 * - **Only keys that vanish.** A key present on both sides with a different
-*   VALUE is the drift the user asked to revert, not a silent loss.
+*   VALUE is the drift the user asked to revert, and it reverts normally.
 *
 * @returns dotted paths, sorted, e.g. `['Parameters.metadata_location']`.
 */
-function findRevertDroppedAwsKeys(drifts, desiredProperties, awsProperties) {
-	const dropped = /* @__PURE__ */ new Set();
+function findRevertUnbaselinedAwsKeys(drifts, desiredProperties, awsProperties) {
+	const missing = /* @__PURE__ */ new Set();
 	const driftedTopLevelKeys = /* @__PURE__ */ new Set();
 	for (const d of drifts) {
 		const topLevelKey = d.path.split(".", 1)[0];
@@ -53376,9 +53381,9 @@ function findRevertDroppedAwsKeys(drifts, desiredProperties, awsProperties) {
 	}
 	for (const key of driftedTopLevelKeys) {
 		if (!(key in desiredProperties)) continue;
-		collectMissingPaths(awsProperties[key], desiredProperties[key], key, dropped, isTagListKey(key) ? isServiceManagedTagKey : void 0);
+		collectMissingPaths(awsProperties[key], desiredProperties[key], key, missing, isTagListKey(key) ? isServiceManagedTagKey : void 0);
 	}
-	return [...dropped].sort();
+	return [...missing].sort();
 }
 /**
 * Walk the AWS-side value against the desired-side value, recording every path
@@ -53412,11 +53417,12 @@ function findRevertDroppedAwsKeys(drifts, desiredProperties, awsProperties) {
 */
 function collectMissingPaths(awsValue, desiredValue, path, out, isPreservedKey) {
 	if (isKeyedList(awsValue)) {
-		if (!isKeyedList(desiredValue)) {
+		const desiredIsEmptyArray = Array.isArray(desiredValue) && desiredValue.length === 0;
+		if (!isKeyedList(desiredValue) && !desiredIsEmptyArray) {
 			if (desiredValue === void 0) out.add(path);
 			return;
 		}
-		const desiredKeys = new Set(desiredValue.map((e) => e.Key));
+		const desiredKeys = new Set(isKeyedList(desiredValue) ? desiredValue.map((e) => e.Key) : []);
 		for (const entry of awsValue) {
 			if (desiredKeys.has(entry.Key)) continue;
 			if (isPreservedKey?.(entry.Key)) continue;
@@ -53441,10 +53447,12 @@ function collectMissingPaths(awsValue, desiredValue, path, out, isPreservedKey)
 /**
 * A NON-EMPTY array whose every element is an object carrying a string `Key`.
 *
-* Emptiness is deliberately excluded: `[]` carries no identities, so treating
-* it as keyed would report nothing on the AWS side and — as the DESIRED side —
-* would claim every AWS entry is dropped, which is already what the
-* whole-list arm reports more legibly.
+* Emptiness is excluded on the AWS side: `[]` carries no identities, so there
+* is nothing to report. It is NOT excluded on the DESIRED side any more
+* (issue #1626) — an empty baseline list means every AWS entry is unbaselined,
+* and since the only caller runs on the template-only baseline where
+* {@link mergeUntemplatedValue} PRESERVES all of them, reporting nothing would
+* leave the plan under-claiming what survives.
 */
 function isKeyedList(value) {
 	return Array.isArray(value) && value.length > 0 && value.every((e) => typeof e === "object" && e !== null && typeof e.Key === "string");
@@ -53453,6 +53461,95 @@ function isPlainRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
+* Merge the AWS-current value with the revert baseline, KEEPING every path the
+* baseline does not declare (issue
+* [#1626](https://github.com/go-to-k/cdkd/issues/1626) items 2 + 3).
+*
+* ## The contract this settles
+*
+* `provider.update(logicalId, physicalId, type, newProperties,
+* previousProperties)` has ONE parameter list and TWO callers:
+*
+* - the deploy engine passes the state-recorded `properties` — the
+*   LAST-DEPLOYED TEMPLATE — so a path present on the previous side and absent
+*   from the desired side means exactly one thing: **the user removed it from
+*   the template**;
+* - `runRevert` passes the FULL `readCurrentState` snapshot, so the same
+*   absence ALSO covers **a path the template never declared at all**.
+*
+* Both provider shapes then destroy that path, by different routes. One that
+* KEY-DIFFS a collection reads the absence as a REMOVAL — ELBv2's
+* `LoadBalancerAttributes`, where `readCurrentState` deliberately emits every
+* attribute AWS reports, puts ~18 untemplated attributes on the removal path
+* against a template declaring one or two. One that REPLACES a bag wholesale
+* (`PutBucketTagging` is documented full-replace; the same holds for every
+* `Put*Configuration`) never consults the previous side at all and simply
+* sends a bag the untemplated path is missing from.
+*
+* That second shape is why the fix lands on the DESIRED side rather than by
+* trimming `previousProperties`: trimming stops the key-diffing removal but
+* leaves the wholesale-replace drop untouched, so half the reported paths
+* would still be erased while the plan claimed otherwise. Merging into the bag
+* cdkd actually SENDS covers both, and is what makes the plan's "left
+* untouched" line true rather than aspirational.
+*
+* ## Scoped to the baseline that cannot tell the two apart
+*
+* Applied ONLY when `observedProperties` is absent — the same gate as
+* {@link findRevertUnbaselinedAwsKeys}'s notice, and for the same reason. With
+* observed-capture present the baseline IS a deploy-time AWS snapshot, so a
+* path AWS reports and the baseline lacks was genuinely added out-of-band and
+* removing it is the revert the user asked for (the `drift-revert` integ
+* fixture requires exactly that for an injected tag). Without it the baseline
+* is the raw TEMPLATE, and "AWS has it, the template does not" is
+* indistinguishable from "AWS authored it" — so the honest answer is to leave
+* it alone. `findRevertUnbaselinedAwsKeys`'s docstring already named this as
+* one of the stricter options #1478 did not foreclose ("treat 'no
+* observedProperties' as 'previous is unknown' so the merge preserves"); this
+* is that option.
+*
+* The structural rules mirror {@link collectMissingPaths} case for case —
+* plain records descend, KEYED `[{Key, Value}]` lists merge by `Key`,
+* positional arrays and scalars are taken from the baseline wholesale — so
+* every path the plan names as preserved IS kept, and a unit test pins that
+* correspondence by diffing the flag-on and flag-off outputs.
+*
+* A service-authored tag is absent from both sides of that comparison and
+* stays consistent: `findRevertUnbaselinedAwsKeys` omits it
+* (`isServiceManagedTagKey`) because the #1501 carve-out already preserves it
+* on the DEFAULT path, so it is not something this flag rescues and reporting
+* it would warn about a loss that cannot happen. The test pins that it
+* survives under BOTH settings.
+*
+* A path the baseline DOES declare always wins, which is what keeps the revert
+* a revert: a drifted value is reset, and one AWS dropped is re-added.
+*/
+function mergeUntemplatedValue(awsValue, desiredValue) {
+	const desiredIsEmptyArray = Array.isArray(desiredValue) && desiredValue.length === 0;
+	if (isKeyedList(awsValue) && (isKeyedList(desiredValue) || desiredIsEmptyArray)) {
+		const desiredEntries = isKeyedList(desiredValue) ? desiredValue : [];
+		const desiredByKey = new Map(desiredEntries.map((e) => [e.Key, e]));
+		const merged = [];
+		const emitted = /* @__PURE__ */ new Set();
+		for (const entry of awsValue) {
+			if (emitted.has(entry.Key)) continue;
+			emitted.add(entry.Key);
+			merged.push(desiredByKey.get(entry.Key) ?? entry);
+		}
+		for (const entry of desiredEntries) {
+			if (emitted.has(entry.Key)) continue;
+			emitted.add(entry.Key);
+			merged.push(entry);
+		}
+		return merged;
+	}
+	if (!isPlainRecord(awsValue) || !isPlainRecord(desiredValue)) return desiredValue;
+	const merged = {};
+	for (const [key, value] of Object.entries(awsValue)) merged[key] = key in desiredValue ? mergeUntemplatedValue(value, desiredValue[key]) : value;
+	for (const [key, value] of Object.entries(desiredValue)) if (!(key in awsValue)) merged[key] = value;
+	return merged;
+}
+/**
 * Build the `newProperties` object passed to `provider.update` during
 * `--revert`. Strategy:
 *
@@ -53494,8 +53591,16 @@ function isPlainRecord(value) {
 * (`Tags[0].Value`) — array drifts surface as a single entry on the
 * parent path — so `path.split('.', 1)` is always safe to extract the
 * top-level key.
+*
+* `preserveUntemplated` (issue #1626) switches the overlay from WHOLESALE to a
+* deep merge for the drifted subtrees, keeping every path the baseline does
+* not declare. `runRevert` sets it exactly when the resource has no
+* `observedProperties` — see {@link mergeUntemplatedValue} for why that is the
+* only baseline on which it is correct, and why the fix has to live on this
+* side rather than on `previousProperties`.
 */
-function buildRevertNewProperties(drifts, desiredProperties, awsProperties) {
+function buildRevertNewProperties(drifts, desiredProperties, awsProperties, options = {}) {
+	const preserveUntemplated = options.preserveUntemplated === true;
 	const result = { ...awsProperties };
 	for (const d of drifts) {
 		const topLevelKey = d.path.split(".", 1)[0];
@@ -53503,8 +53608,11 @@ function buildRevertNewProperties(drifts, desiredProperties, awsProperties) {
 		if (topLevelKey in desiredProperties) {
 			const desiredValue = desiredProperties[topLevelKey];
 			const awsValue = awsProperties[topLevelKey];
-			const baselineIsTagList = isCfnTagList(desiredValue) || Array.isArray(desiredValue) && desiredValue.length === 0;
-			result[topLevelKey] = isTagListKey(topLevelKey) && baselineIsTagList && isCfnTagList(awsValue) ? mergeTagListForRevert(desiredValue, awsValue) : desiredValue;
+			if (preserveUntemplated) result[topLevelKey] = mergeUntemplatedValue(awsValue, desiredValue);
+			else {
+				const baselineIsTagList = isCfnTagList(desiredValue) || Array.isArray(desiredValue) && desiredValue.length === 0;
+				result[topLevelKey] = isTagListKey(topLevelKey) && baselineIsTagList && isCfnTagList(awsValue) ? mergeTagListForRevert(desiredValue, awsValue) : desiredValue;
+			}
 		}
 	}
 	return result;
@@ -53567,7 +53675,7 @@ async function runRevert(reports, providerRegistry, stateConfig, awsClients, opt
 					provisionedBy: stateResource.provisionedBy
 				}).provider;
 				const desiredProperties = stateResource.observedProperties ?? stateResource.properties ?? {};
-				const newProperties = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties);
+				const newProperties = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
 				try {
 					await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties), outcome.logicalId, { logger: { debug: (msg) => logger.debug(msg) } });
 					totalSucceeded++;
@@ -53634,16 +53742,17 @@ function printRevertPlan(reports) {
 					const tagWord = preserved.length === 1 ? "tag" : "tags";
 					process.stdout.write(`    ! reverting this tag list KEEPS ${preserved.length} AWS-authored ${tagWord} the baseline does not carry:\n`);
 					for (const path of preserved) process.stdout.write(`        ${path}\n`);
-					process.stdout.write("      Every other tag reverts normally. A service may require these (ECS needs AmazonECSManaged for managed scaling); 'aws:'-prefixed keys are AWS-reserved and cannot be removed by hand.\n");
+					const othersRevert = stateResource.observedProperties === void 0 ? "" : `Every other tag reverts normally. `;
+					process.stdout.write(`      ${othersRevert}A service may require these (ECS needs AmazonECSManaged for managed scaling); 'aws:'-prefixed keys are AWS-reserved and cannot be removed by hand.\n`);
 				}
 			}
 			if (stateResource && stateResource.observedProperties === void 0) {
-				const dropped = findRevertDroppedAwsKeys(o.changes, stateResource.properties ?? {}, o.awsProperties);
-				if (dropped.length > 0) {
-					const word = dropped.length === 1 ? "value" : "values";
-					process.stdout.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and will DROP ${dropped.length} AWS-authored ${word}:\n`);
-					for (const path of dropped) process.stdout.write(`        ${path}\n`);
-					process.stdout.write("      Re-deploy the stack first to populate observedProperties if you want these preserved.\n");
+				const unbaselined = findRevertUnbaselinedAwsKeys(o.changes, stateResource.properties ?? {}, o.awsProperties);
+				if (unbaselined.length > 0) {
+					const word = unbaselined.length === 1 ? "value" : "values";
+					process.stdout.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
+					for (const path of unbaselined) process.stdout.write(`        ${path}\n`);
+					process.stdout.write(`      The template does not declare these, so cdkd cannot tell an AWS-authored value from an out-of-band change and will not reset either (issue #1626). Run 'cdkd state refresh-observed ${report.stackName}' (or re-deploy) to populate observedProperties if you want them reverted too.\n`);
 				}
 			}
 		}
@@ -70595,7 +70704,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.28");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.29");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;