@go-to-k/cdkd 0.280.31 → 0.280.33

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-DKMfEz_h.js";
+import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-Dn60Zkq5.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DNSNrDqX.js";
+import { t as ASGProvider } from "./asg-provider-DrM2HEGB.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -11930,6 +11930,55 @@ function hasUsableTableCapacity(value) {
 	return true;
 }
 /**
+* A capacity member, or `undefined` when the value is not a usable number.
+*
+* `Number()` coercion is NOT good enough here and the first draft of this
+* helper shipped that bug: `Number(null)`, `Number('')`, `Number([])` and
+* `Number(false)` are all **0**, not `NaN` — so a live `0` would have compared
+* EQUAL to a desired `null` / `''` / `[]` / `false` and suppressed the call.
+* The blast radius on DynamoDB is small (a PROVISIONED index's capacity is
+* always >= 1), but the rule this encodes is copied to other providers, so it
+* is spelled correctly rather than relying on the type that happens to be
+* unreachable today.
+*
+* A YAML-borne numeric STRING is still accepted, because that is a real
+* template shape and `'5'` genuinely means 5.
+*/
+function capacityNumber(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string" && value.trim() !== "") {
+		const n = Number(value);
+		return Number.isFinite(n) ? n : void 0;
+	}
+}
+/**
+* Does the capacity AWS currently holds for a GSI already equal the pair the
+* template requests? (issue #1630)
+*
+* Compared member by member, deliberately not with `deepEqual` /
+* `JSON.stringify`: `DescribeTable` returns a `ProvisionedThroughputDescription`
+* carrying `NumberOfDecreasesToday` / `LastIncreaseDateTime` /
+* `LastDecreaseDateTime` alongside the two capacities, so a structural compare
+* against the two-member desired object could never match and the suppression
+* would be dead code that only LOOKED safe.
+*
+* Anything that is not a usable number on EITHER side fails OPEN (the
+* `UpdateTable` is still issued): an absent live entry, a malformed template
+* value, an unresolved intrinsic. That is the correct direction — the worst
+* case is the pre-fix behavior, whereas a false MATCH would silently drop a
+* capacity change the user asked for.
+*/
+function liveCapacityAlreadyMatches(live, requested) {
+	if (live === void 0) return false;
+	const liveRead = capacityNumber(live.ReadCapacityUnits);
+	const liveWrite = capacityNumber(live.WriteCapacityUnits);
+	const wantRead = capacityNumber(requested.ReadCapacityUnits);
+	const wantWrite = capacityNumber(requested.WriteCapacityUnits);
+	if (liveRead === void 0 || liveWrite === void 0) return false;
+	if (wantRead === void 0 || wantWrite === void 0) return false;
+	return liveRead === wantRead && liveWrite === wantWrite;
+}
+/**
 * `DescribeTable` poll budget (seconds, 1 poll/s) after an ordinary
 * `UpdateTable` — capacity, TTL, tags, table class. Calibrated on those and
 * sufficient for them.
@@ -12105,6 +12154,8 @@ var DynamoDBTableProvider = class {
 				}
 			}
 			const currentLiveIndexNames = table ? new Set(liveIndexes.map((live) => live.IndexName).filter((name) => typeof name === "string").filter((name) => !preFlipDeletedIndexNames.has(name))) : void 0;
+			const currentLiveIndexByName = table ? new Map(liveIndexes.filter((live) => typeof live.IndexName === "string").filter((live) => !preFlipDeletedIndexNames.has(live.IndexName)).map((live) => [live.IndexName, live])) : void 0;
+			const liveCapacityComparable = liveBillingMode === "PROVISIONED";
 			const gsiHandledByBillingFlip = /* @__PURE__ */ new Set();
 			if (billingOrThroughputChanged || tableClassChanged) {
 				const updateInput = { TableName: physicalId };
@@ -12219,7 +12270,7 @@ var DynamoDBTableProvider = class {
 					this.logger.debug(`Disabled DynamoDB Stream on table ${physicalId}`);
 				}
 			}
-			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames);
+			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable);
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"]);
 			if (JSON.stringify(properties["TimeToLiveSpecification"]) !== JSON.stringify(previousProperties["TimeToLiveSpecification"])) {
 				this.assertNoActiveTtlAttributeNameChange(logicalId, resourceType, physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
@@ -12657,7 +12708,7 @@ var DynamoDBTableProvider = class {
 	*    a remove-then-add pair, so this method throws on such a change rather than
 	*    silently dropping it.
 	*/
-	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip = /* @__PURE__ */ new Set(), liveIndexNames) {
+	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions, handledByBillingFlip = /* @__PURE__ */ new Set(), liveIndexNames, liveIndexByName, liveCapacityComparable = false) {
 		const prev = previousGsis ?? [];
 		const desired = desiredGsis ?? [];
 		const prevByName = new Map(prev.filter((g) => g.IndexName).map((g) => [g.IndexName, g]));
@@ -12672,7 +12723,17 @@ var DynamoDBTableProvider = class {
 			ops.push({ Delete: { IndexName: name } });
 		}
 		for (const [name, gsi] of desiredByName) if (!prevByName.has(name)) {
+			const live = liveIndexByName?.get(name);
 			if (!gsi.KeySchema) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} is missing KeySchema`, resourceType, logicalId, physicalId);
+			if (live !== void 0 && live.IndexStatus !== "DELETING") {
+				this.logger.warn(`GSI ${name} on DynamoDB table ${physicalId} already exists in AWS but is absent from cdkd's recorded previous state, so its Create is being skipped. This usually means an earlier deploy created the index and then failed before state was written.`);
+				if (liveCapacityComparable && gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && !liveCapacityAlreadyMatches(live.ProvisionedThroughput, gsi.ProvisionedThroughput)) ops.push({ Update: {
+					IndexName: name,
+					ProvisionedThroughput: gsi.ProvisionedThroughput
+				} });
+				this.logger.warn(`GSI ${name} was adopted from AWS rather than created, so cdkd could not verify its KeySchema / Projection match the template. Run \`cdkd drift ${physicalId}\` to confirm, and \`cdkd drift --accept\` if AWS is the source of truth.`);
+				continue;
+			}
 			ops.push({ Create: {
 				IndexName: name,
 				KeySchema: gsi.KeySchema,
@@ -12683,7 +12744,8 @@ var DynamoDBTableProvider = class {
 		} else {
 			const before = prevByName.get(name);
 			if (JSON.stringify(before.KeySchema) !== JSON.stringify(gsi.KeySchema) || JSON.stringify(before.Projection) !== JSON.stringify(gsi.Projection)) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} changed its KeySchema or Projection, which DynamoDB cannot modify in place. Rename the index (so it is dropped and re-created) or replace the table.`, resourceType, logicalId, physicalId);
-			if (gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) ops.push({ Update: {
+			if (gsi.ProvisionedThroughput && !handledByBillingFlip.has(name) && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) if (liveCapacityComparable && liveCapacityAlreadyMatches(liveIndexByName?.get(name)?.ProvisionedThroughput, gsi.ProvisionedThroughput)) this.logger.debug(`GSI ${name} on DynamoDB table ${physicalId} already carries the requested capacity in AWS; skipping its throughput Update`);
+			else ops.push({ Update: {
 				IndexName: name,
 				ProvisionedThroughput: gsi.ProvisionedThroughput
 			} });
@@ -52990,7 +53052,7 @@ async function driftCommand(stacks, options) {
 			return;
 		}
 		if (options.accept) await runAccept(reports, stateBackend, stateConfig, awsClients, options);
-		else await runRevert(reports, providerRegistry, stateConfig, awsClients, options);
+		else await runRevert(reports, providerRegistry, stateBackend, stateConfig, awsClients, options);
 	} finally {
 		awsClients.destroy();
 	}
@@ -53716,6 +53778,69 @@ function buildRevertNewProperties(drifts, desiredProperties, awsProperties, opti
 	return result;
 }
 /**
+* The top-level keys a provider NARROWED on the revert path (issue #1644).
+*
+* `provider.update()` may answer with `effectiveProperties` — the bag it
+* ACTUALLY delivered, which is what AWS now holds. `DeployEngine` records that
+* in place of the desired bag (`propertiesToRecord`), and `--revert` used to
+* throw the return value away: state kept the un-narrowed value, so the very
+* next `cdkd drift` reported the same difference and `--revert` re-issued the
+* same call — the loop `effectiveProperties` exists to break, still live on
+* this one command.
+*
+* Returns a per-key DELTA rather than the whole bag, and that is the load-
+* bearing part. The bag handed to `update()` here is
+* {@link buildRevertNewProperties}'s output — AWS-current values for every
+* non-drifted key merged with the state baseline for the drifted ones — so
+* writing it back wholesale would import AWS-authored values into state for
+* keys nobody reverted, quietly turning `--revert` into `--accept`. Only the
+* keys the PROVIDER changed between what it was handed and what it delivered
+* belong in state.
+*
+* A key present in `sent` but absent from `effective` is a DROP: the provider
+* did not deliver it, so AWS does not hold it, and the baseline must lose it
+* too. That is represented by an explicit `undefined` value, which the caller
+* turns into a `delete` — a plain `{...baseline, ...delta}` spread would leave
+* an `undefined`-valued key in the JSON instead. Presence is decided by
+* `key in effective`, NOT by comparing against `undefined`: a provider that
+* delivers an explicit `undefined` and one that omits the key both mean "AWS
+* does not hold it", while a key whose value genuinely IS `null` on both sides
+* must not read as a drop.
+*
+* The comparison is a key-order-INDEPENDENT deep equality rather than
+* `JSON.stringify`. A provider that rebuilds a nested object while delivering
+* the same members would otherwise register as a change, and the value written
+* back for such a key is the one that was SENT — for a non-drifted key that is
+* the AWS-current value, i.e. the `--accept` behavior this delta exists to
+* prevent.
+*/
+function collectNarrowedTopLevelKeys(sent, effective) {
+	const delta = {};
+	for (const key of /* @__PURE__ */ new Set([...Object.keys(sent), ...Object.keys(effective)])) {
+		const inSent = key in sent;
+		const inEffective = key in effective;
+		if (inSent && inEffective && deepEqualUnordered(sent[key], effective[key])) continue;
+		if (!inSent && !inEffective) continue;
+		delta[key] = inEffective ? effective[key] : void 0;
+	}
+	return delta;
+}
+/** Deep equality that does not depend on object key ORDER. */
+function deepEqualUnordered(a, b) {
+	if (a === b) return true;
+	if (a == null || b == null) return a === b;
+	if (typeof a !== "object" || typeof b !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => deepEqualUnordered(v, b[i]));
+	}
+	const ao = a;
+	const bo = b;
+	const ak = Object.keys(ao);
+	if (ak.length !== Object.keys(bo).length) return false;
+	return ak.every((k) => Object.prototype.hasOwnProperty.call(bo, k) && deepEqualUnordered(ao[k], bo[k]));
+}
+/**
 * `--revert`: AWS ← state.
 *
 * For each drifted resource, call `provider.update(logicalId, physicalId,
@@ -53731,13 +53856,15 @@ function buildRevertNewProperties(drifts, desiredProperties, awsProperties, opti
 *     truth, captured during the drift read so we don't re-issue it).
 *
 * Per-resource failures are collected and surface as `PartialFailureError`
-* (exit 2) at the end. State is NOT updated by `--revert` — once the
-* update succeeds, AWS values match state by definition.
+* (exit 2) at the end. State is otherwise NOT updated by `--revert` — once the
+* update succeeds, AWS values match state by definition. The ONE exception is
+* a provider-reported NARROWING (issue #1644): see
+* {@link collectNarrowedTopLevelKeys}.
 *
 * The per-stack lock is acquired before any update so a concurrent
 * `cdkd deploy` cannot race the in-flight property changes.
 */
-async function runRevert(reports, providerRegistry, stateConfig, awsClients, options) {
+async function runRevert(reports, providerRegistry, stateBackend, stateConfig, awsClients, options) {
 	const logger = getLogger();
 	printRevertPlan(reports);
 	if (options.dryRun) {
@@ -53760,6 +53887,7 @@ async function runRevert(reports, providerRegistry, stateConfig, awsClients, opt
 		const driftedOutcomes = report.outcomes.filter((o) => o.kind === "drifted");
 		if (driftedOutcomes.length === 0) continue;
 		await lockManager.acquireLock(report.stackName, report.region, owner, "drift-revert");
+		const narrowedByLogicalId = /* @__PURE__ */ new Map();
 		try {
 			await runWithConcurrency(driftedOutcomes.map((outcome) => async () => {
 				const stateResource = report.state.resources[outcome.logicalId];
@@ -53775,9 +53903,17 @@ async function runRevert(reports, providerRegistry, stateConfig, awsClients, opt
 				const desiredProperties = stateResource.observedProperties ?? stateResource.properties ?? {};
 				const newProperties = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
 				try {
-					await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties), outcome.logicalId, { logger: { debug: (msg) => logger.debug(msg) } });
+					const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties), outcome.logicalId, { logger: { debug: (msg) => logger.debug(msg) } });
 					totalSucceeded++;
 					logger.info(`  ✓ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted.`);
+					try {
+						if (updateResult?.effectiveProperties) {
+							const delta = collectNarrowedTopLevelKeys(newProperties, updateResult.effectiveProperties);
+							if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, delta);
+						}
+					} catch (captureErr) {
+						logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${captureErr instanceof Error ? captureErr.message : String(captureErr)}`);
+					}
 				} catch (err) {
 					if (err instanceof ResourceUpdateNotSupportedError) {
 						totalUnsupported++;
@@ -53789,6 +53925,52 @@ async function runRevert(reports, providerRegistry, stateConfig, awsClients, opt
 					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): AWS update failed — ${msg}`);
 				}
 			}), concurrency);
+			if (narrowedByLogicalId.size > 0) {
+				const resources = { ...report.state.resources };
+				let recordedCount = 0;
+				for (const [logicalId, delta] of narrowedByLogicalId) {
+					const existing = resources[logicalId];
+					if (!existing) continue;
+					const hasObserved = existing.observedProperties !== void 0;
+					const baselineSource = hasObserved ? existing.observedProperties : existing.properties;
+					const newBaseline = JSON.parse(JSON.stringify(baselineSource ?? {}));
+					let changed = false;
+					for (const [key, value] of Object.entries(delta)) {
+						if (!Object.prototype.hasOwnProperty.call(newBaseline, key)) continue;
+						if (value === void 0) {
+							delete newBaseline[key];
+							changed = true;
+							continue;
+						}
+						if (!hasObserved) continue;
+						newBaseline[key] = value;
+						changed = true;
+					}
+					if (!changed) continue;
+					recordedCount++;
+					resources[logicalId] = hasObserved ? {
+						...existing,
+						observedProperties: newBaseline
+					} : {
+						...existing,
+						properties: newBaseline
+					};
+				}
+				if (recordedCount === 0) continue;
+				const newState = {
+					...report.state,
+					resources,
+					lastModified: Date.now()
+				};
+				const saveOptions = { expectedEtag: report.etag };
+				if (report.migrationPending) saveOptions.migrateLegacy = true;
+				try {
+					await stateBackend.saveState(report.stackName, report.region, newState, saveOptions);
+					logger.info(`✓ State updated for ${report.stackName} (${report.region}): recorded the value the provider actually applied on ${recordedCount} resource(s).`);
+				} catch (err) {
+					logger.warn(`Reverted ${report.stackName} (${report.region}), but could not record the value the provider actually applied: ${err instanceof Error ? err.message : String(err)}. The next 'cdkd drift' will report the same difference — re-run 'cdkd drift ${report.stackName} --revert' once the state write can succeed.`);
+				}
+			}
 		} finally {
 			await lockManager.releaseLock(report.stackName, report.region).catch((err) => {
 				logger.warn(`Failed to release lock for ${report.stackName} (${report.region}): ` + (err instanceof Error ? err.message : String(err)));
@@ -70802,7 +70984,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.31");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.33");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;