@go-to-k/cdkd 0.280.28 → 0.280.30

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-Dkep5i7x.js";
+import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-POCXyXPl.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-C3rBE_Ni.js";
+import { t as ASGProvider } from "./asg-provider-DZ05yRbJ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -17989,6 +17989,67 @@ function narrowRouteDestinations(properties) {
 		narrowed
 	};
 }
+/** The `AuthorizeSecurityGroupIngress` default protocol: "all protocols". */
+const SG_INGRESS_IP_PROTOCOL_DEFAULT = "-1";
+/** The refusal path both the create guard and the canonicalizer report under. */
+const SG_INGRESS_IP_PROTOCOL_PATH = "AWS::EC2::SecurityGroupIngress IpProtocol";
+/**
+* Resolve the `IpProtocol` an `AWS::EC2::SecurityGroupIngress` rule actually
+* SENDS, plus the bag that describes it (issue #1633).
+*
+* ONE source for a decision three call sites have to agree on, exactly as
+* `narrowRouteDestinations` is for the Route destinations: the create arm
+* (which authorizes the rule), the update arm (which revokes then re-creates
+* it), and the DIFF-side canonicalizer. If those disagreed, state and template
+* would each be normalized to a different protocol and the fix would become
+* the bug — the lesson `.claude/rules/providers.md` records from #1591.
+*
+* Two shapes reach the wire as something other than what the template wrote,
+* and BOTH have to be recorded or they become permanent phantom drift, because
+* `readSecurityGroupIngressCurrentState` can only ever return what AWS holds:
+*
+* - a MALFORMED value (`''` / `{}` / `true` / an explicit `null`), which
+*   `requireConfigString` refuses on the template-path create and — under
+*   `onUnusable` — warn-substitutes the default on the replay-reachable paths;
+* - a finite NUMBER, the accepted-by-design shape from an unquoted YAML
+*   `IpProtocol: -1` (issue #1513), which is stringified before it is sent.
+*
+* The second is not announced by a warning, and does not need to be: unlike a
+* dropped destination key it loses NOTHING — `-1` and `'-1'` name the same
+* protocol — so there is no silent loss for `effectiveProperties` to launder
+* into a clean record, which is the hazard the "already ANNOUNCED" clause of
+* the `effectiveProperties` contract exists to guard against. Recording the
+* string additionally fixes the delete path, which forwards the state record
+* to `buildIpPermission` and would otherwise hand the EC2 API a number.
+*
+* `narrowed` is a FRESH object only when the sent value differs from the
+* declared one, so an ordinary `IpProtocol: 'tcp'` bag is returned untouched
+* and compares byte-for-byte as before.
+*
+* @param onUnusable Passed straight through to `requireConfigString`: absent,
+*   a malformed value THROWS (the template-path create, where the user can fix
+*   the template); supplied, it warns and takes the default. The canonicalizer
+*   passes a no-op — a diff must never throw, and it must never warn either,
+*   since the provisioning path already announces the same substitution.
+*/
+function narrowIngressIpProtocol(properties, onUnusable) {
+	const declared = properties["IpProtocol"];
+	const ipProtocol = requireConfigString(declared, SG_INGRESS_IP_PROTOCOL_DEFAULT, SG_INGRESS_IP_PROTOCOL_PATH, {
+		coerceNumber: true,
+		...onUnusable && { onUnusable }
+	});
+	if (declared === void 0 || declared === ipProtocol) return {
+		ipProtocol,
+		narrowed: properties
+	};
+	return {
+		ipProtocol,
+		narrowed: {
+			...properties,
+			IpProtocol: ipProtocol
+		}
+	};
+}
 /**
 * AWS EC2 Networking Provider
 *
@@ -19170,10 +19231,8 @@ var EC2Provider = class {
 		this.logger.debug(`Creating SecurityGroupIngress ${logicalId}`);
 		const groupId = properties["GroupId"];
 		if (!groupId) throw new ProvisioningError(`GroupId is required for SecurityGroupIngress ${logicalId}`, resourceType, logicalId);
-		const ipProtocol = requireConfigString(properties["IpProtocol"], "-1", "AWS::EC2::SecurityGroupIngress IpProtocol", {
-			coerceNumber: true,
-			...onUnusableProtocol && { onUnusable: onUnusableProtocol }
-		});
+		const { ipProtocol, narrowed } = narrowIngressIpProtocol(properties, onUnusableProtocol);
+		const effectiveProperties = narrowed === properties ? void 0 : narrowed;
 		const fromPort = properties["FromPort"];
 		const toPort = properties["ToPort"];
 		try {
@@ -19188,7 +19247,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully created SecurityGroupIngress ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
-				attributes: {}
+				attributes: {},
+				...effectiveProperties && { effectiveProperties }
 			};
 		} catch (error) {
 			if (error instanceof Error && error.message.includes("already exists")) {
@@ -19196,7 +19256,8 @@ var EC2Provider = class {
 				this.logger.debug(`SecurityGroupIngress ${logicalId} already exists, treating as success`);
 				return {
 					physicalId,
-					attributes: {}
+					attributes: {},
+					...effectiveProperties && { effectiveProperties }
 				};
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -19215,7 +19276,8 @@ var EC2Provider = class {
 			return {
 				physicalId: createResult.physicalId,
 				wasReplaced: true,
-				...createResult.attributes && { attributes: createResult.attributes }
+				...createResult.attributes && { attributes: createResult.attributes },
+				...createResult.effectiveProperties && { effectiveProperties: createResult.effectiveProperties }
 			};
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
@@ -20293,7 +20355,9 @@ var EC2Provider = class {
 		}
 	}
 	/**
-	* The diff-side half of the Route multi-destination narrowing (issue #1591).
+	* The diff-side half of the two EC2 narrowings that report
+	* `effectiveProperties` — Route multi-destination (issue #1591) and
+	* SecurityGroupIngress `IpProtocol` (issue #1633).
 	*
 	* `createRoute` sends exactly one destination key and reports the narrowed
 	* bag via `effectiveProperties`, so state carries one key. Without the same
@@ -20306,8 +20370,21 @@ var EC2Provider = class {
 	*
 	* Shares `narrowRouteDestinations` with the provisioning path so the two
 	* cannot disagree about which key survives.
+	*
+	* The SecurityGroupIngress arm is the same shape and needs the same second
+	* half for the same reason: `IpProtocol` is create-only on that type in the
+	* registry schema, so normalizing state alone would make the template's
+	* original value read as a changed immutable property — a REPLACEMENT, whose
+	* create passes no context and so gets no `onUnusable` downgrade, turning a
+	* previously-green no-op deploy into a hard failure. Normalizing BOTH sides
+	* is also what keeps the fix correct for records written BEFORE it existed,
+	* which still carry the un-narrowed value.
 	*/
 	canonicalizeDesiredProperties(resourceType, properties) {
+		if (resourceType === "AWS::EC2::SecurityGroupIngress") {
+			const { narrowed } = narrowIngressIpProtocol(properties, () => {});
+			return narrowed;
+		}
 		if (resourceType !== "AWS::EC2::Route") return properties;
 		const { declared, narrowed } = narrowRouteDestinations(properties);
 		return declared.length > 1 ? narrowed : properties;
@@ -20789,12 +20866,33 @@ function flattenIpPermissions(perms, direction) {
 * Direction-sensitive: ingress uses `Source*` fields, egress uses
 * `Destination*`.
 */
+/**
+* The `IpProtocol` component of a security-group rule identity key.
+*
+* A NUMBER is stringified so a record written BEFORE issue #1633 still matches:
+* AWS always reports the protocol as a string, so a legacy record holding the
+* number `-1` keyed as `{"p":-1}` against AWS's `{"p":"-1"}` and matched
+* nothing — `readSecurityGroupIngressCurrentState` returned `undefined` and
+* `cdkd drift` reported the rule as GONE, forever. The canonicalizer makes such
+* a record's diff NO_CHANGE, so no deploy ever rewrites it either; normalizing
+* at the KEY is what heals the existing population with no migration.
+*
+* Anything that is neither a string nor a number is passed through UNCHANGED
+* rather than blanket-`String()`-ed: a malformed object would otherwise key as
+* the useless `'[object Object]'`, silently collapsing every malformed record
+* onto one bucket. Such a rule matches nothing either way — this keeps the
+* non-match honest instead of manufacturing a fake identity.
+*/
+function sgProtocolKey(value) {
+	if (typeof value === "number") return String(value);
+	return value ?? "-1";
+}
 function sgRuleKey(rule, direction) {
 	const peerKey = direction === "egress" ? rule["DestinationSecurityGroupId"] : rule["SourceSecurityGroupId"];
 	const prefixKey = direction === "egress" ? rule["DestinationPrefixListId"] : rule["SourcePrefixListId"];
 	const peerOwner = direction === "ingress" ? rule["SourceSecurityGroupOwnerId"] : void 0;
 	return JSON.stringify({
-		p: rule["IpProtocol"] ?? "-1",
+		p: sgProtocolKey(rule["IpProtocol"]),
 		f: rule["FromPort"] ?? null,
 		t: rule["ToPort"] ?? null,
 		c4: rule["CidrIp"] ?? null,
@@ -53260,7 +53358,7 @@ function isServiceManagedTagKey(key) {
 * provider binds it, and that tag is REQUIRED for managed scaling. Because any
 * CDK ASG declares at least a `Name` tag, `Tags` is template-DECLARED, so the
 * #1498 carve-out (undeclared + captured-empty) correctly does not apply — and
-* the tag list is an ARRAY, which {@link findRevertDroppedAwsKeys}'s walk
+* the tag list is an ARRAY, which {@link findRevertUnbaselinedAwsKeys}'s walk
 * compares wholesale and never descends into. Post-revert the ASG kept the
 * capacity provider with its managed scaling silently broken (verified live
 * 2026-08-10).
@@ -53332,43 +53430,48 @@ function findRevertPreservedTagKeys(drifts, desiredProperties, awsProperties) {
 	return [...preserved].sort();
 }
 /**
-* The AWS-authored property paths a `--revert` is about to DROP, for a
-* resource whose state predates observed-capture (issue #1478).
+* The AWS-authored property paths a `--revert` LEAVES UNTOUCHED, for a
+* resource whose state predates observed-capture (issue #1478, semantics
+* settled by issue #1626).
 *
-* The mechanism, and why this is not a Glue fix: `runRevert` picks the revert
-* baseline as `observedProperties ?? properties`. When `observedProperties` is
-* absent, the desired side is the raw TEMPLATE while the previous side is the
-* AWS-CURRENT snapshot — so {@link buildRevertNewProperties}, which overwrites
-* each drifted top-level key with the desired sub-shape wholesale, replaces
-* every AWS-authored key inside that subtree with the template's version. For
-* a Glue Iceberg table that silently wipes `table_type` /
-* `metadata_location`, the same outcome as issue #1461 reached by a different
-* trigger. The exposure is general: ANY resource where AWS writes into a bag
-* the template does not fully declare, on state written before
+* The mechanism: `runRevert` picks the revert baseline as
+* `observedProperties ?? properties`. When `observedProperties` is absent, the
+* desired side is the raw TEMPLATE while the previous side is the AWS-CURRENT
+* snapshot — so {@link buildRevertNewProperties}, which overwrites each drifted
+* top-level key with the desired sub-shape wholesale, has no value to carry for
+* any AWS-authored key inside that subtree. For a Glue Iceberg table that
+* reaches `table_type` / `metadata_location`, the same exposure as issue #1461
+* by a different trigger; the general case is ANY resource where AWS writes
+* into a bag the template does not fully declare, on state written before
 * observed-capture.
 *
-* The user DID ask to push state over AWS, so this is not silent-wrong the way
-* #1461 was — but it is almost certainly not what they meant, and nothing told
-* them. So the chosen semantic is **warn and proceed**: it is the cheapest
-* honest step, preserves today's behavior, and does not foreclose the stricter
-* options (refuse outright, or treat "no observedProperties" as "previous is
-* unknown" so the merge preserves).
+* #1478 shipped the **warn and proceed** semantic — the values were still
+* erased, the user was merely told first — while explicitly leaving the door
+* open to "treat 'no observedProperties' as 'previous is unknown' so the merge
+* preserves". Issue #1626 walked through that door for the reasons in
+* {@link mergeUntemplatedValue}: on this baseline cdkd cannot tell an
+* AWS-authored value from an out-of-band change, and resetting on a coin flip
+* is the worse error. So the paths below are now REPORTED AS PRESERVED, and
+* `mergeUntemplatedValue` is what makes that true by merging them into the bag
+* `--revert` actually SENDS — which is the only side a wholesale-replace
+* provider consults. This function is unchanged in what it computes — only in
+* what the caller does about it.
 *
 * Scoped deliberately:
 *
 * - **Only drifted top-level keys.** Non-drifted keys keep their AWS-current
-*   value in `buildRevertNewProperties`, so nothing under them is dropped.
+*   value in `buildRevertNewProperties`, so nothing under them is at stake.
 * - **Only when `observedProperties` is absent.** With it present the desired
 *   side is the deploy-time AWS snapshot, which already carries AWS-authored
-*   fields — dropping one there is a legitimate revert of a real console
-*   change, and warning about it would be noise on every run.
+*   fields — removing one there is a legitimate revert of a real console
+*   change, and reporting it would be noise on every run.
 * - **Only keys that vanish.** A key present on both sides with a different
-*   VALUE is the drift the user asked to revert, not a silent loss.
+*   VALUE is the drift the user asked to revert, and it reverts normally.
 *
 * @returns dotted paths, sorted, e.g. `['Parameters.metadata_location']`.
 */
-function findRevertDroppedAwsKeys(drifts, desiredProperties, awsProperties) {
-	const dropped = /* @__PURE__ */ new Set();
+function findRevertUnbaselinedAwsKeys(drifts, desiredProperties, awsProperties) {
+	const missing = /* @__PURE__ */ new Set();
 	const driftedTopLevelKeys = /* @__PURE__ */ new Set();
 	for (const d of drifts) {
 		const topLevelKey = d.path.split(".", 1)[0];
@@ -53376,9 +53479,9 @@ function findRevertDroppedAwsKeys(drifts, desiredProperties, awsProperties) {
 	}
 	for (const key of driftedTopLevelKeys) {
 		if (!(key in desiredProperties)) continue;
-		collectMissingPaths(awsProperties[key], desiredProperties[key], key, dropped, isTagListKey(key) ? isServiceManagedTagKey : void 0);
+		collectMissingPaths(awsProperties[key], desiredProperties[key], key, missing, isTagListKey(key) ? isServiceManagedTagKey : void 0);
 	}
-	return [...dropped].sort();
+	return [...missing].sort();
 }
 /**
 * Walk the AWS-side value against the desired-side value, recording every path
@@ -53412,11 +53515,12 @@ function findRevertDroppedAwsKeys(drifts, desiredProperties, awsProperties) {
 */
 function collectMissingPaths(awsValue, desiredValue, path, out, isPreservedKey) {
 	if (isKeyedList(awsValue)) {
-		if (!isKeyedList(desiredValue)) {
+		const desiredIsEmptyArray = Array.isArray(desiredValue) && desiredValue.length === 0;
+		if (!isKeyedList(desiredValue) && !desiredIsEmptyArray) {
 			if (desiredValue === void 0) out.add(path);
 			return;
 		}
-		const desiredKeys = new Set(desiredValue.map((e) => e.Key));
+		const desiredKeys = new Set(isKeyedList(desiredValue) ? desiredValue.map((e) => e.Key) : []);
 		for (const entry of awsValue) {
 			if (desiredKeys.has(entry.Key)) continue;
 			if (isPreservedKey?.(entry.Key)) continue;
@@ -53441,10 +53545,12 @@ function collectMissingPaths(awsValue, desiredValue, path, out, isPreservedKey)
 /**
 * A NON-EMPTY array whose every element is an object carrying a string `Key`.
 *
-* Emptiness is deliberately excluded: `[]` carries no identities, so treating
-* it as keyed would report nothing on the AWS side and — as the DESIRED side —
-* would claim every AWS entry is dropped, which is already what the
-* whole-list arm reports more legibly.
+* Emptiness is excluded on the AWS side: `[]` carries no identities, so there
+* is nothing to report. It is NOT excluded on the DESIRED side any more
+* (issue #1626) — an empty baseline list means every AWS entry is unbaselined,
+* and since the only caller runs on the template-only baseline where
+* {@link mergeUntemplatedValue} PRESERVES all of them, reporting nothing would
+* leave the plan under-claiming what survives.
 */
 function isKeyedList(value) {
 	return Array.isArray(value) && value.length > 0 && value.every((e) => typeof e === "object" && e !== null && typeof e.Key === "string");
@@ -53453,6 +53559,95 @@ function isPlainRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
+* Merge the AWS-current value with the revert baseline, KEEPING every path the
+* baseline does not declare (issue
+* [#1626](https://github.com/go-to-k/cdkd/issues/1626) items 2 + 3).
+*
+* ## The contract this settles
+*
+* `provider.update(logicalId, physicalId, type, newProperties,
+* previousProperties)` has ONE parameter list and TWO callers:
+*
+* - the deploy engine passes the state-recorded `properties` — the
+*   LAST-DEPLOYED TEMPLATE — so a path present on the previous side and absent
+*   from the desired side means exactly one thing: **the user removed it from
+*   the template**;
+* - `runRevert` passes the FULL `readCurrentState` snapshot, so the same
+*   absence ALSO covers **a path the template never declared at all**.
+*
+* Both provider shapes then destroy that path, by different routes. One that
+* KEY-DIFFS a collection reads the absence as a REMOVAL — ELBv2's
+* `LoadBalancerAttributes`, where `readCurrentState` deliberately emits every
+* attribute AWS reports, puts ~18 untemplated attributes on the removal path
+* against a template declaring one or two. One that REPLACES a bag wholesale
+* (`PutBucketTagging` is documented full-replace; the same holds for every
+* `Put*Configuration`) never consults the previous side at all and simply
+* sends a bag the untemplated path is missing from.
+*
+* That second shape is why the fix lands on the DESIRED side rather than by
+* trimming `previousProperties`: trimming stops the key-diffing removal but
+* leaves the wholesale-replace drop untouched, so half the reported paths
+* would still be erased while the plan claimed otherwise. Merging into the bag
+* cdkd actually SENDS covers both, and is what makes the plan's "left
+* untouched" line true rather than aspirational.
+*
+* ## Scoped to the baseline that cannot tell the two apart
+*
+* Applied ONLY when `observedProperties` is absent — the same gate as
+* {@link findRevertUnbaselinedAwsKeys}'s notice, and for the same reason. With
+* observed-capture present the baseline IS a deploy-time AWS snapshot, so a
+* path AWS reports and the baseline lacks was genuinely added out-of-band and
+* removing it is the revert the user asked for (the `drift-revert` integ
+* fixture requires exactly that for an injected tag). Without it the baseline
+* is the raw TEMPLATE, and "AWS has it, the template does not" is
+* indistinguishable from "AWS authored it" — so the honest answer is to leave
+* it alone. `findRevertUnbaselinedAwsKeys`'s docstring already named this as
+* one of the stricter options #1478 did not foreclose ("treat 'no
+* observedProperties' as 'previous is unknown' so the merge preserves"); this
+* is that option.
+*
+* The structural rules mirror {@link collectMissingPaths} case for case —
+* plain records descend, KEYED `[{Key, Value}]` lists merge by `Key`,
+* positional arrays and scalars are taken from the baseline wholesale — so
+* every path the plan names as preserved IS kept, and a unit test pins that
+* correspondence by diffing the flag-on and flag-off outputs.
+*
+* A service-authored tag is absent from both sides of that comparison and
+* stays consistent: `findRevertUnbaselinedAwsKeys` omits it
+* (`isServiceManagedTagKey`) because the #1501 carve-out already preserves it
+* on the DEFAULT path, so it is not something this flag rescues and reporting
+* it would warn about a loss that cannot happen. The test pins that it
+* survives under BOTH settings.
+*
+* A path the baseline DOES declare always wins, which is what keeps the revert
+* a revert: a drifted value is reset, and one AWS dropped is re-added.
+*/
+function mergeUntemplatedValue(awsValue, desiredValue) {
+	const desiredIsEmptyArray = Array.isArray(desiredValue) && desiredValue.length === 0;
+	if (isKeyedList(awsValue) && (isKeyedList(desiredValue) || desiredIsEmptyArray)) {
+		const desiredEntries = isKeyedList(desiredValue) ? desiredValue : [];
+		const desiredByKey = new Map(desiredEntries.map((e) => [e.Key, e]));
+		const merged = [];
+		const emitted = /* @__PURE__ */ new Set();
+		for (const entry of awsValue) {
+			if (emitted.has(entry.Key)) continue;
+			emitted.add(entry.Key);
+			merged.push(desiredByKey.get(entry.Key) ?? entry);
+		}
+		for (const entry of desiredEntries) {
+			if (emitted.has(entry.Key)) continue;
+			emitted.add(entry.Key);
+			merged.push(entry);
+		}
+		return merged;
+	}
+	if (!isPlainRecord(awsValue) || !isPlainRecord(desiredValue)) return desiredValue;
+	const merged = {};
+	for (const [key, value] of Object.entries(awsValue)) merged[key] = key in desiredValue ? mergeUntemplatedValue(value, desiredValue[key]) : value;
+	for (const [key, value] of Object.entries(desiredValue)) if (!(key in awsValue)) merged[key] = value;
+	return merged;
+}
+/**
 * Build the `newProperties` object passed to `provider.update` during
 * `--revert`. Strategy:
 *
@@ -53494,8 +53689,16 @@ function isPlainRecord(value) {
 * (`Tags[0].Value`) — array drifts surface as a single entry on the
 * parent path — so `path.split('.', 1)` is always safe to extract the
 * top-level key.
+*
+* `preserveUntemplated` (issue #1626) switches the overlay from WHOLESALE to a
+* deep merge for the drifted subtrees, keeping every path the baseline does
+* not declare. `runRevert` sets it exactly when the resource has no
+* `observedProperties` — see {@link mergeUntemplatedValue} for why that is the
+* only baseline on which it is correct, and why the fix has to live on this
+* side rather than on `previousProperties`.
 */
-function buildRevertNewProperties(drifts, desiredProperties, awsProperties) {
+function buildRevertNewProperties(drifts, desiredProperties, awsProperties, options = {}) {
+	const preserveUntemplated = options.preserveUntemplated === true;
 	const result = { ...awsProperties };
 	for (const d of drifts) {
 		const topLevelKey = d.path.split(".", 1)[0];
@@ -53503,8 +53706,11 @@ function buildRevertNewProperties(drifts, desiredProperties, awsProperties) {
 		if (topLevelKey in desiredProperties) {
 			const desiredValue = desiredProperties[topLevelKey];
 			const awsValue = awsProperties[topLevelKey];
-			const baselineIsTagList = isCfnTagList(desiredValue) || Array.isArray(desiredValue) && desiredValue.length === 0;
-			result[topLevelKey] = isTagListKey(topLevelKey) && baselineIsTagList && isCfnTagList(awsValue) ? mergeTagListForRevert(desiredValue, awsValue) : desiredValue;
+			if (preserveUntemplated) result[topLevelKey] = mergeUntemplatedValue(awsValue, desiredValue);
+			else {
+				const baselineIsTagList = isCfnTagList(desiredValue) || Array.isArray(desiredValue) && desiredValue.length === 0;
+				result[topLevelKey] = isTagListKey(topLevelKey) && baselineIsTagList && isCfnTagList(awsValue) ? mergeTagListForRevert(desiredValue, awsValue) : desiredValue;
+			}
 		}
 	}
 	return result;
@@ -53567,7 +53773,7 @@ async function runRevert(reports, providerRegistry, stateConfig, awsClients, opt
 					provisionedBy: stateResource.provisionedBy
 				}).provider;
 				const desiredProperties = stateResource.observedProperties ?? stateResource.properties ?? {};
-				const newProperties = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties);
+				const newProperties = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
 				try {
 					await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties), outcome.logicalId, { logger: { debug: (msg) => logger.debug(msg) } });
 					totalSucceeded++;
@@ -53634,16 +53840,17 @@ function printRevertPlan(reports) {
 					const tagWord = preserved.length === 1 ? "tag" : "tags";
 					process.stdout.write(`    ! reverting this tag list KEEPS ${preserved.length} AWS-authored ${tagWord} the baseline does not carry:\n`);
 					for (const path of preserved) process.stdout.write(`        ${path}\n`);
-					process.stdout.write("      Every other tag reverts normally. A service may require these (ECS needs AmazonECSManaged for managed scaling); 'aws:'-prefixed keys are AWS-reserved and cannot be removed by hand.\n");
+					const othersRevert = stateResource.observedProperties === void 0 ? "" : `Every other tag reverts normally. `;
+					process.stdout.write(`      ${othersRevert}A service may require these (ECS needs AmazonECSManaged for managed scaling); 'aws:'-prefixed keys are AWS-reserved and cannot be removed by hand.\n`);
 				}
 			}
 			if (stateResource && stateResource.observedProperties === void 0) {
-				const dropped = findRevertDroppedAwsKeys(o.changes, stateResource.properties ?? {}, o.awsProperties);
-				if (dropped.length > 0) {
-					const word = dropped.length === 1 ? "value" : "values";
-					process.stdout.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and will DROP ${dropped.length} AWS-authored ${word}:\n`);
-					for (const path of dropped) process.stdout.write(`        ${path}\n`);
-					process.stdout.write("      Re-deploy the stack first to populate observedProperties if you want these preserved.\n");
+				const unbaselined = findRevertUnbaselinedAwsKeys(o.changes, stateResource.properties ?? {}, o.awsProperties);
+				if (unbaselined.length > 0) {
+					const word = unbaselined.length === 1 ? "value" : "values";
+					process.stdout.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
+					for (const path of unbaselined) process.stdout.write(`        ${path}\n`);
+					process.stdout.write(`      The template does not declare these, so cdkd cannot tell an AWS-authored value from an out-of-band change and will not reset either (issue #1626). Run 'cdkd state refresh-observed ${report.stackName}' (or re-deploy) to populate observedProperties if you want them reverted too.\n`);
 				}
 			}
 		}
@@ -70595,7 +70802,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.28");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.30");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;