@go-to-k/cdkd 0.280.46 → 0.281.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-E_JV4UqE.js";
+import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-Bebl98bx.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DGHuyUA8.js";
+import { t as ASGProvider } from "./asg-provider-BSx4Vrth.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -591,6 +591,22 @@ const useCdkBootstrapAssetsOption = new Option("--use-cdk-bootstrap-assets", "Pu
 */
 const strictGetattOption = new Option("--strict-getatt", "Fail the deploy on ANY Fn::GetAtt that falls back to the physical ID because cdkd cannot construct the attribute (default: warn and use the physical ID, hard-failing only when the fallback is knowably wrong — an *Arn attribute with a non-ARN value or a *Url attribute with a non-http(s) value). Also fails the deploy when a stack Output cannot be resolved (default: warn and store no value).").default(false);
 /**
+* Issue #1697 — `--no-cfn-fallback` (deploy + diff). By default, a
+* cross-stack reference (`Fn::ImportValue` / `Fn::GetStackOutput`) that is
+* not found in cdkd state falls back to CloudFormation (`ListExports` /
+* `DescribeStacks` outputs) so a cdkd-deployed consumer can reference a
+* producer stack still managed by CloudFormation (`cdk deploy` / raw CFn).
+* The fallback fires only after a cdkd-state miss (cdkd-first precedence),
+* resolves as a WEAK reference (not recorded into `state.imports` /
+* `state.outputReads`; no destroy-time protection on either side), and
+* degrades gracefully when the caller lacks the CloudFormation read
+* permissions (warning + the original not-found error). This flag disables
+* the fallback entirely for users who want cdkd-state-only resolution —
+* e.g. to keep IAM minimal or to keep an export-name typo failing fast
+* instead of accidentally matching an unrelated CloudFormation export.
+*/
+const noCfnFallbackOption = new Option("--no-cfn-fallback", "Do not fall back to CloudFormation (ListExports / stack outputs) when an Fn::ImportValue / Fn::GetStackOutput reference is not found in cdkd state (default: fall back, so producers still managed by CloudFormation can be referenced)");
+/**
 * CDK annotation-message behavior flags (issue #1230, CDK CLI parity).
 * Shared by `cdkd synth` and `cdkd deploy` — the two commands that fail on
 * `Annotations.addError` (issue #1228). `--strict` additionally fails when
@@ -622,6 +638,7 @@ const deployOptions = [
 	replaceOption,
 	useCdkBootstrapAssetsOption,
 	strictGetattOption,
+	noCfnFallbackOption,
 	...resourceTimeoutOptions
 ];
 /**
@@ -4875,6 +4892,20 @@ function s3BucketDestinationPath(dest, destinationPath) {
 	return isPlainObject$1(dest) && isFlattenedDestination(dest) ? destinationPath : `${destinationPath}.S3BucketDestination`;
 }
 /**
+* The structural path segments — relative to the enclosing `Destination` block —
+* of the bag `resolveS3BucketDestination` PICKED, so a substituted value can be
+* written back at the key the template actually declared (issue #1670).
+*
+* The value-side twin of {@link s3BucketDestinationPath}, which names the same
+* branch for MESSAGES. Derived from the picked bag's IDENTITY rather than by
+* re-running {@link isFlattenedDestination}: a third copy of that branch
+* condition is exactly what the predicate's own header warns about, and identity
+* cannot drift from the resolver at all.
+*/
+function s3BucketDestinationSegments(declared, picked) {
+	return picked === declared ? [] : ["S3BucketDestination"];
+}
+/**
 * Name a malformed value in a refusal message, the way `config-shape.ts`'s
 * private `describe` does for the string-reading guards. Kept local rather than
 * exported from there because `resolveS3BucketDestination` is S3-specific
@@ -5129,6 +5160,35 @@ var S3BucketProvider = class S3BucketProvider {
 		return true;
 	}
 	/**
+	* A string read whose replay downgrade is a warn-and-SUBSTITUTE, reporting
+	* the substitution so the caller can record what was SENT (issue #1670).
+	*
+	* The third shape beside {@link skipOnUnusableConfigString}'s SKIP and the
+	* plain strict read, for the sites where the fallback IS the right value to
+	* send. The deploy then succeeds with the default on the wire, so recording
+	* the declared value describes a configuration AWS does not hold, and
+	* `readCurrentState` reads all of these back — the permanent phantom drift
+	* `.claude/rules/providers.md` records for the #1633 warn-and-default arm.
+	* That file also carries the full rationale, including why these sites take
+	* NO `canonicalizeDesiredProperties` twin; do not re-derive it here.
+	*
+	* Three details are load-bearing:
+	*
+	* - `onSubstituted` receives the value this call RETURNS, not the `fallback`
+	*   argument, so "what is recorded" and "what is sent" stay one expression.
+	* - `options` is forwarded to BOTH the probe and the read, so a site that
+	*   ever needs `coerceNumber` cannot make the two disagree.
+	* - Without `options.onUnusable` there is no probe: the read still THROWS,
+	*   and recording a value the provider merely failed to send is what the
+	*   "already ANNOUNCED" condition on `effectiveProperties` forbids.
+	*/
+	readSubstitutedConfigString(container, key, fallback, containerPath, options, onSubstituted) {
+		const refused = options.onUnusable !== void 0 && configStringRefusal(container, key, fallback, containerPath, options) !== void 0;
+		const value = readConfigString(container, key, fallback, containerPath, options);
+		if (refused) onSubstituted(value);
+		return value;
+	}
+	/**
 	* Apply lifecycle configuration
 	*
 	* CFn property: LifecycleConfiguration.Rules[]
@@ -5457,8 +5517,11 @@ var S3BucketProvider = class S3BucketProvider {
 	* CFn property: MetricsConfigurations[] (array of configurations)
 	* SDK: PutBucketMetricsConfiguration (one per configuration, keyed by Id)
 	*
-	* @returns the indexes (into `configs`) of the items a replay downgrade
-	*   SKIPPED — the per-item unit of `effectiveProperties` (issue #1612).
+	* @returns what happened to each item, as {@link PerItemApplyOutcome} — the
+	*   per-item unit of `effectiveProperties` (issue #1612). This applier has no
+	*   warn-and-SUBSTITUTE read, so its `substituted` map is always empty; the
+	*   shape is shared with its three siblings so the two call-site recorders
+	*   stay uniform and a future substitution here cannot go unrecorded.
 	*/
 	async applyMetricsConfigurations(bucketName, configs, onUnusable) {
 		const skipped = [];
@@ -5490,7 +5553,10 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 		}
 		this.logger.debug(`Applied ${configs.length - skipped.length} metrics configuration(s) to bucket ${bucketName}`);
-		return skipped;
+		return {
+			skipped,
+			substituted: /* @__PURE__ */ new Map()
+		};
 	}
 	/**
 	* Pick the `S3BucketDestination` bag out of an analytics / inventory
@@ -5547,15 +5613,24 @@ var S3BucketProvider = class S3BucketProvider {
 	* CFn property: AnalyticsConfigurations[] (array of configurations)
 	* SDK: PutBucketAnalyticsConfiguration (one per configuration, keyed by Id)
 	*
-	* @returns the indexes (into `configs`) of the items a replay downgrade
-	*   SKIPPED — the per-item unit of `effectiveProperties` (issue #1612).
+	* @returns what happened to each item, as {@link PerItemApplyOutcome} — the
+	*   per-item unit of `effectiveProperties` (issues #1612 / #1670). Both arms
+	*   are reachable here: a container / destination guard SKIPS the item, while
+	*   the `OutputSchemaVersion` and destination `Format` reads warn and SEND a
+	*   substituted default, so the item is recorded as SENT rather than as
+	*   declared.
 	*/
 	async applyAnalyticsConfigurations(bucketName, configs, onUnusable) {
 		const skipped = [];
+		const substituted = /* @__PURE__ */ new Map();
 		let index = -1;
 		for (const config of configs) {
 			index += 1;
 			const id = config["Id"];
+			let sentItem;
+			const recordSubstitution = (path, sent) => {
+				sentItem = S3BucketProvider.withDeepValue(sentItem ?? config, path, sent);
+			};
 			const rawStorageClassAnalysis = config["StorageClassAnalysis"];
 			if (rawStorageClassAnalysis != null && requireConfigObject(rawStorageClassAnalysis, "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis", { ...onUnusable ? { onUnusable } : {} }) === void 0) {
 				skipped.push(index);
@@ -5594,12 +5669,23 @@ var S3BucketProvider = class S3BucketProvider {
 					continue;
 				}
 				const destPath = s3BucketDestinationPath(rawDest, analyticsDestPath);
+				const destSegments = s3Dest ? s3BucketDestinationSegments(rawDest, s3Dest) : [];
 				analyticsConfig.StorageClassAnalysis = { DataExport: {
-					OutputSchemaVersion: readConfigString(dataExport, "OutputSchemaVersion", "V_1", "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport", { ...onUnusable ? { onUnusable } : {} }),
+					OutputSchemaVersion: this.readSubstitutedConfigString(dataExport, "OutputSchemaVersion", "V_1", "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport", { ...onUnusable ? { onUnusable } : {} }, (sent) => recordSubstitution([
+						"StorageClassAnalysis",
+						"DataExport",
+						"OutputSchemaVersion"
+					], sent)),
 					Destination: s3Dest ? { S3BucketDestination: {
 						Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
 						BucketAccountId: s3Dest["BucketAccountId"],
-						Format: readConfigString(s3Dest, "Format", "CSV", destPath, { ...onUnusable ? { onUnusable } : {} }),
+						Format: this.readSubstitutedConfigString(s3Dest, "Format", "CSV", destPath, { ...onUnusable ? { onUnusable } : {} }, (sent) => recordSubstitution([
+							"StorageClassAnalysis",
+							"DataExport",
+							"Destination",
+							...destSegments,
+							"Format"
+						], sent)),
 						Prefix: s3Dest["Prefix"]
 					} } : void 0
 				} };
@@ -5609,9 +5695,13 @@ var S3BucketProvider = class S3BucketProvider {
 				Id: id,
 				AnalyticsConfiguration: analyticsConfig
 			}));
+			if (sentItem !== void 0) substituted.set(index, sentItem);
 		}
 		this.logger.debug(`Applied ${configs.length - skipped.length} analytics configuration(s) to bucket ${bucketName}`);
-		return skipped;
+		return {
+			skipped,
+			substituted
+		};
 	}
 	/**
 	* Apply intelligent tiering configurations
@@ -5619,8 +5709,11 @@ var S3BucketProvider = class S3BucketProvider {
 	* CFn property: IntelligentTieringConfigurations[]
 	* SDK: PutBucketIntelligentTieringConfiguration (one per configuration, keyed by Id)
 	*
-	* @returns the indexes (into `configs`) of the items a replay downgrade
-	*   SKIPPED — the per-item unit of `effectiveProperties` (issue #1612).
+	* @returns what happened to each item, as {@link PerItemApplyOutcome} — the
+	*   per-item unit of `effectiveProperties` (issue #1612). Its per-item
+	*   `Status` read takes the SKIP downgrade rather than a substitution (issue
+	*   #1595 — defaulting to `Enabled` would start archiving objects), so the
+	*   `substituted` map is always empty here.
 	*/
 	async applyIntelligentTieringConfigurations(bucketName, configs, onUnusable) {
 		const skipped = [];
@@ -5661,7 +5754,10 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 		}
 		this.logger.debug(`Applied ${configs.length - skipped.length} intelligent tiering configuration(s) to bucket ${bucketName}`);
-		return skipped;
+		return {
+			skipped,
+			substituted: /* @__PURE__ */ new Map()
+		};
 	}
 	/**
 	* Apply inventory configurations
@@ -5669,11 +5765,15 @@ var S3BucketProvider = class S3BucketProvider {
 	* CFn property: InventoryConfigurations[]
 	* SDK: PutBucketInventoryConfiguration (one per configuration, keyed by Id)
 	*
-	* @returns the indexes (into `configs`) of the items a replay downgrade
-	*   SKIPPED — the per-item unit of `effectiveProperties` (issue #1612).
+	* @returns what happened to each item, as {@link PerItemApplyOutcome} — the
+	*   per-item unit of `effectiveProperties` (issues #1612 / #1670). Both arms
+	*   are reachable here: `IncludedObjectVersions` / the schedule frequency pair
+	*   / the destination guard SKIP the item, while the destination `Format` read
+	*   warns and SENDS a substituted default.
 	*/
 	async applyInventoryConfigurations(bucketName, configs, onUnusable) {
 		const skipped = [];
+		const substituted = /* @__PURE__ */ new Map();
 		let index = -1;
 		for (const config of configs) {
 			index += 1;
@@ -5690,6 +5790,11 @@ var S3BucketProvider = class S3BucketProvider {
 				continue;
 			}
 			const destPath = s3BucketDestinationPath(rawDest, inventoryDestPath);
+			const destSegments = s3Dest ? s3BucketDestinationSegments(rawDest, s3Dest) : [];
+			let sentItem;
+			const recordSubstitution = (path, sent) => {
+				sentItem = S3BucketProvider.withDeepValue(sentItem ?? config, path, sent);
+			};
 			const scheduleFrequencyRefusal = onUnusable ? configStringRefusal(config, "ScheduleFrequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[]") : void 0;
 			if (scheduleFrequencyRefusal !== void 0 && config["Schedule"] == null) {
 				onUnusable?.(`${scheduleFrequencyRefusal}. Skipping this inventory configuration: there is no Schedule.Frequency to fall back to, and defaulting to Weekly would silently re-cadence a live inventory report; the same value is REFUSED on a template-path create`);
@@ -5703,6 +5808,7 @@ var S3BucketProvider = class S3BucketProvider {
 				continue;
 			}
 			const frequency = useScheduleFrequency ? requireConfigString(config["ScheduleFrequency"], "Weekly", "AWS::S3::Bucket InventoryConfigurations[].ScheduleFrequency") : readConfigString(config["Schedule"], "Frequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[].Schedule");
+			if (scheduleFrequencyRefusal !== void 0) recordSubstitution(["ScheduleFrequency"], frequency);
 			const inventoryConfig = {
 				Id: id,
 				IsEnabled: config["Enabled"] ?? true,
@@ -5711,7 +5817,11 @@ var S3BucketProvider = class S3BucketProvider {
 				Destination: { S3BucketDestination: s3Dest ? {
 					Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
 					AccountId: s3Dest["BucketAccountId"],
-					Format: readConfigString(s3Dest, "Format", "CSV", destPath, { ...onUnusable ? { onUnusable } : {} }),
+					Format: this.readSubstitutedConfigString(s3Dest, "Format", "CSV", destPath, { ...onUnusable ? { onUnusable } : {} }, (sent) => recordSubstitution([
+						"Destination",
+						...destSegments,
+						"Format"
+					], sent)),
 					Prefix: s3Dest["Prefix"]
 				} : void 0 },
 				OptionalFields: config["OptionalFields"],
@@ -5722,9 +5832,13 @@ var S3BucketProvider = class S3BucketProvider {
 				Id: id,
 				InventoryConfiguration: inventoryConfig
 			}));
+			if (sentItem !== void 0) substituted.set(index, sentItem);
 		}
 		this.logger.debug(`Applied ${configs.length - skipped.length} inventory configuration(s) to bucket ${bucketName}`);
-		return skipped;
+		return {
+			skipped,
+			substituted
+		};
 	}
 	/**
 	* Apply replication configuration
@@ -5958,24 +6072,26 @@ var S3BucketProvider = class S3BucketProvider {
 		return config;
 	}
 	/**
-	* Turn a set of skipped-property overrides into the `effectiveProperties`
-	* bag the deploy engine records in place of the desired one (issue #1612).
+	* Turn a set of per-property overrides into the `effectiveProperties` bag the
+	* deploy engine records in place of the desired one (issues #1612 / #1670).
 	*
-	* A warn-and-skip arm makes the deploy SUCCEED while a declared
-	* configuration never reaches AWS, so recording the desired bag verbatim
-	* writes a value AWS does not hold: `readCurrentState` can never match it,
-	* every later `cdkd drift` re-reports the difference, and `drift --revert`
-	* re-issues the same skipped call — the permanent phantom drift
-	* `.claude/rules/providers.md` records for the EC2 Route warn arm (#1591),
-	* reached here through a skip instead of a narrowing.
+	* A warn-and-SKIP arm makes the deploy SUCCEED while a declared configuration
+	* never reaches AWS, and a warn-and-SUBSTITUTE read makes it succeed while a
+	* DIFFERENT value than the declared one reaches AWS. Either way, recording
+	* the desired bag verbatim writes something AWS does not hold:
+	* `readCurrentState` can never match it, every later `cdkd drift` re-reports
+	* the difference, and `drift --revert` re-issues the same call — the
+	* permanent phantom drift `.claude/rules/providers.md` records for the EC2
+	* Route warn arm (#1591), reached here through a skip or a substitution
+	* instead of a narrowing.
 	*
 	* A `undefined` override value means the key is ABSENT from the effective
 	* bag, which is why this walks the map rather than spreading it: spreading
 	* would leave an explicit `undefined` that `JSON.stringify` drops on one
 	* side of the next diff but not the other.
 	*
-	* @returns the complete replacement bag, or `undefined` when nothing was
-	*   skipped — the engine then records the desired properties unchanged.
+	* @returns the complete replacement bag, or `undefined` when there is nothing
+	*   to override — the engine then records the desired properties unchanged.
 	*/
 	static applyEffectiveOverrides(properties, overrides) {
 		if (overrides.size === 0) return void 0;
@@ -5999,14 +6115,22 @@ var S3BucketProvider = class S3BucketProvider {
 	* items would manufacture a fresh phantom drift while removing the one this
 	* exists to fix.
 	*
+	* An item that WAS applied but with a value a warn-and-SUBSTITUTE read
+	* replaced is the third arm (issue #1670): it keeps its position and its
+	* declared shape, and only the substituted field differs — `sentItem` is the
+	* item AS SENT, which is what AWS holds and therefore what state must
+	* describe.
+	*
 	* @param previous the previously-recorded array, or `undefined` on the
 	*   replay-CREATE path, where nothing was ever applied and there is no
 	*   previous item to substitute.
+	* @param sentItemOf the item as SENT for an APPLIED item whose declared value
+	*   was substituted, or `undefined` when declared == sent (the ordinary case).
 	* @returns the effective array, or `undefined` when the key should be ABSENT
 	*   from the effective bag (nothing survived AND the previous side declared
 	*   nothing, so the property was never applied at all).
 	*/
-	static buildEffectiveItemArray(desired, previous, isSkipped) {
+	static buildEffectiveItemArray(desired, previous, isSkipped, sentItemOf) {
 		const previousById = /* @__PURE__ */ new Map();
 		for (const item of previous ?? []) {
 			const id = configItemId(item);
@@ -6015,7 +6139,7 @@ var S3BucketProvider = class S3BucketProvider {
 		const effective = [];
 		desired.forEach((item, index) => {
 			if (!isSkipped(item, index)) {
-				effective.push(item);
+				effective.push(sentItemOf?.(item, index) ?? item);
 				return;
 			}
 			const id = configItemId(item);
@@ -6026,6 +6150,34 @@ var S3BucketProvider = class S3BucketProvider {
 		return effective;
 	}
 	/**
+	* A COPY of `container` with `path` set to `value` (issue #1670).
+	*
+	* Copying rather than mutating is load-bearing, not hygiene: the container is
+	* an item of the caller's DESIRED property bag, which `DiffCalculator` and the
+	* engine still read afterwards — writing the substituted value into it would
+	* silently rewrite the template side of the next comparison, which is exactly
+	* the `canonicalizeDesiredProperties` behavior this fix must NOT have. Only
+	* the objects ALONG the path are cloned; every sibling subtree is shared,
+	* which is safe because nothing here mutates them.
+	*
+	* A non-object intermediate is rebuilt as an EMPTY block, which is not a
+	* defensive shrug but the accurate record: it is what `readConfigString`
+	* itself did on the way in — its container arm says "Treating the block as
+	* empty, so <path>.<key> takes its default" — so `{}` plus the substituted
+	* leaf IS what was sent. No call site can reach it today (every intermediate
+	* has already been validated by `requireConfigObject` /
+	* `resolveS3BucketDestination`, which SKIP the item on a malformed one).
+	*/
+	static withDeepValue(container, path, value) {
+		const [head, ...rest] = path;
+		if (head === void 0) return container;
+		const child = container[head];
+		return {
+			...container,
+			[head]: rest.length === 0 ? value : S3BucketProvider.withDeepValue(isPlainObject$1(child) ? child : {}, rest, value)
+		};
+	}
+	/**
 	* Diff CFn-shape sub-config values between previous and new state.
 	*
 	* Four transitions:
@@ -6100,18 +6252,42 @@ var S3BucketProvider = class S3BucketProvider {
 		const retainPrevious = (key) => {
 			overrides.set(key, previousProperties[key]);
 		};
-		/** Record a PER-ITEM skip set against the desired / previous arrays. */
-		const retainPreviousItems = (key, skippedIds) => {
-			if (skippedIds.size === 0) return;
+		/**
+		* Per-property accumulator for one of the four `Id`-keyed appliers.
+		*
+		* Keyed by `Id` rather than by index because on THIS path the diff loop
+		* hands the applier exactly one item per call (so every outcome index is
+		* 0) and the id is all the loop knows about it.
+		*/
+		const itemOutcomes = () => {
+			const skipped = /* @__PURE__ */ new Set();
+			const sentItems = /* @__PURE__ */ new Map();
+			return {
+				skipped,
+				sentItems,
+				record: (id, outcome) => {
+					if (outcome.skipped.length > 0) skipped.add(id);
+					const sent = outcome.substituted.get(0);
+					if (sent !== void 0) sentItems.set(id, sent);
+				}
+			};
+		};
+		/** Record a PER-ITEM skip / substitution set against the desired / previous arrays. */
+		const retainPreviousItems = (key, collected) => {
+			const { skipped: skippedIds, sentItems } = collected;
+			if (skippedIds.size === 0 && sentItems.size === 0) return;
 			const desired = properties[key];
 			if (!Array.isArray(desired)) {
-				this.logger.debug(`Bucket ${bucketName}: ${skippedIds.size} skipped ${key} item(s) could not be recorded — the desired value is not an array`);
+				this.logger.debug(`Bucket ${bucketName}: ${skippedIds.size + sentItems.size} skipped or substituted ${key} item(s) could not be recorded — the desired value is not an array`);
 				return;
 			}
 			const previous = previousProperties[key];
 			overrides.set(key, S3BucketProvider.buildEffectiveItemArray(desired, Array.isArray(previous) ? previous : void 0, (item) => {
 				const id = configItemId(item);
 				return id !== void 0 && skippedIds.has(id);
+			}, (item) => {
+				const id = configItemId(item);
+				return id !== void 0 ? sentItems.get(id) : void 0;
 			}));
 		};
 		const previousVersioning = previousProperties["VersioningConfiguration"];
@@ -6172,9 +6348,10 @@ var S3BucketProvider = class S3BucketProvider {
 			this.logger.debug(`Cleared object lock rule on bucket ${bucketName}`);
 		});
 		await this.diffSubConfig(bucketName, previousProperties["AccelerateConfiguration"], properties["AccelerateConfiguration"], async (cfg) => this.applyAccelerateConfiguration(bucketName, cfg), async () => this.applyAccelerateConfiguration(bucketName, { AccelerationStatus: "Suspended" }));
-		const skippedMetricsIds = /* @__PURE__ */ new Set();
+		const metricsOutcomes = itemOutcomes();
 		await this.diffArrayConfigById(bucketName, previousProperties["MetricsConfigurations"], properties["MetricsConfigurations"], async (id, cfg) => {
-			if ((await this.applyMetricsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m))).length > 0) skippedMetricsIds.add(String(id));
+			const outcome = await this.applyMetricsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m));
+			metricsOutcomes.record(String(id), outcome);
 		}, async (id) => {
 			await this.s3Client.send(new DeleteBucketMetricsConfigurationCommand({
 				Bucket: bucketName,
@@ -6182,10 +6359,11 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 			this.logger.debug(`Deleted metrics configuration ${id} on bucket ${bucketName}`);
 		});
-		retainPreviousItems("MetricsConfigurations", skippedMetricsIds);
-		const skippedAnalyticsIds = /* @__PURE__ */ new Set();
+		retainPreviousItems("MetricsConfigurations", metricsOutcomes);
+		const analyticsOutcomes = itemOutcomes();
 		await this.diffArrayConfigById(bucketName, previousProperties["AnalyticsConfigurations"], properties["AnalyticsConfigurations"], async (id, cfg) => {
-			if ((await this.applyAnalyticsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m))).length > 0) skippedAnalyticsIds.add(String(id));
+			const outcome = await this.applyAnalyticsConfigurations(bucketName, [cfg], (m) => this.logger.warn(m));
+			analyticsOutcomes.record(String(id), outcome);
 		}, async (id) => {
 			await this.s3Client.send(new DeleteBucketAnalyticsConfigurationCommand({
 				Bucket: bucketName,
@@ -6193,10 +6371,11 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 			this.logger.debug(`Deleted analytics configuration ${id} on bucket ${bucketName}`);
 		});
-		retainPreviousItems("AnalyticsConfigurations", skippedAnalyticsIds);
-		const skippedIntelligentTieringIds = /* @__PURE__ */ new Set();
+		retainPreviousItems("AnalyticsConfigurations", analyticsOutcomes);
+		const intelligentTieringOutcomes = itemOutcomes();
 		await this.diffArrayConfigById(bucketName, previousProperties["IntelligentTieringConfigurations"], properties["IntelligentTieringConfigurations"], async (id, cfg) => {
-			if ((await this.applyIntelligentTieringConfigurations(bucketName, [cfg], (m) => this.logger.warn(m))).length > 0) skippedIntelligentTieringIds.add(String(id));
+			const outcome = await this.applyIntelligentTieringConfigurations(bucketName, [cfg], (m) => this.logger.warn(m));
+			intelligentTieringOutcomes.record(String(id), outcome);
 		}, async (id) => {
 			await this.s3Client.send(new DeleteBucketIntelligentTieringConfigurationCommand({
 				Bucket: bucketName,
@@ -6204,10 +6383,11 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 			this.logger.debug(`Deleted intelligent tiering configuration ${id} on bucket ${bucketName}`);
 		});
-		retainPreviousItems("IntelligentTieringConfigurations", skippedIntelligentTieringIds);
-		const skippedInventoryIds = /* @__PURE__ */ new Set();
+		retainPreviousItems("IntelligentTieringConfigurations", intelligentTieringOutcomes);
+		const inventoryOutcomes = itemOutcomes();
 		await this.diffArrayConfigById(bucketName, previousProperties["InventoryConfigurations"], properties["InventoryConfigurations"], async (id, cfg) => {
-			if ((await this.applyInventoryConfigurations(bucketName, [cfg], (m) => this.logger.warn(m))).length > 0) skippedInventoryIds.add(String(id));
+			const outcome = await this.applyInventoryConfigurations(bucketName, [cfg], (m) => this.logger.warn(m));
+			inventoryOutcomes.record(String(id), outcome);
 		}, async (id) => {
 			await this.s3Client.send(new DeleteBucketInventoryConfigurationCommand({
 				Bucket: bucketName,
@@ -6215,7 +6395,7 @@ var S3BucketProvider = class S3BucketProvider {
 			}));
 			this.logger.debug(`Deleted inventory configuration ${id} on bucket ${bucketName}`);
 		});
-		retainPreviousItems("InventoryConfigurations", skippedInventoryIds);
+		retainPreviousItems("InventoryConfigurations", inventoryOutcomes);
 		if (versioningChanged && desiredVersioningStatus === "Suspended") {
 			const hasObjectLock = (p) => {
 				if (p["ObjectLockEnabled"] === true || p["ObjectLockEnabled"] === "true") return true;
@@ -6232,20 +6412,29 @@ var S3BucketProvider = class S3BucketProvider {
 	* Apply ALL sub-configs unconditionally on initial create. Used by
 	* `create()` so the bucket starts out matching the template.
 	*
-	* @returns the per-property overrides for `effectiveProperties` (issue
-	*   #1612). Every skip reachable here is on the REPLAY-create path (the
-	*   rollback executor's reverse-replacement arm), where the bucket is brand
-	*   new and nothing was applied — so the override DROPS the key rather than
-	*   retaining a previous value, because there is no previous value to keep.
-	*   The per-item arrays keep the items that DID apply.
+	* @returns the per-property overrides for `effectiveProperties` (issues
+	*   #1612 / #1670). Every downgrade reachable here is on the REPLAY-create
+	*   path (the rollback executor's reverse-replacement arm), where the bucket
+	*   is brand new and nothing was applied — so a SKIP drops the key rather
+	*   than retaining a previous value, because there is no previous value to
+	*   keep. The per-item arrays keep the items that DID apply, including an
+	*   item applied with a SUBSTITUTED value, recorded as it was sent.
 	*/
 	async applyAllSubConfigsForCreate(bucketName, properties, context) {
 		const overrides = /* @__PURE__ */ new Map();
-		/** Record a per-ITEM skip set: nothing to substitute on a fresh bucket. */
-		const dropSkippedItems = (key, configs, skippedIndexes) => {
-			if (skippedIndexes.length === 0) return;
-			const skipped = new Set(skippedIndexes);
-			overrides.set(key, S3BucketProvider.buildEffectiveItemArray(configs, void 0, (_item, index) => skipped.has(index)));
+		/**
+		* Record a per-ITEM applier outcome.
+		*
+		* A SKIPPED item is DROPPED — there is no previously-applied item to
+		* substitute on a fresh bucket. An item applied with a SUBSTITUTED value
+		* (issue #1670) is kept in place as SENT, which is a decision the create
+		* path makes for the same reason the update path does: the Put SUCCEEDED,
+		* so AWS holds the substituted value and state must say so.
+		*/
+		const recordItemOutcome = (key, configs, outcome) => {
+			if (outcome.skipped.length === 0 && outcome.substituted.size === 0) return;
+			const skipped = new Set(outcome.skipped);
+			overrides.set(key, S3BucketProvider.buildEffectiveItemArray(configs, void 0, (_item, index) => skipped.has(index), (_item, index) => outcome.substituted.get(index)));
 		};
 		const replayOnUnusable = replayWarn(this.logger, context).onUnusable;
 		const notifConfig = properties["NotificationConfiguration"];
@@ -6269,13 +6458,13 @@ var S3BucketProvider = class S3BucketProvider {
 		const accelerateConfig = properties["AccelerateConfiguration"];
 		if (accelerateConfig) await this.applyAccelerateConfiguration(bucketName, accelerateConfig);
 		const metricsConfigs = properties["MetricsConfigurations"];
-		if (metricsConfigs && Array.isArray(metricsConfigs) && metricsConfigs.length > 0) dropSkippedItems("MetricsConfigurations", metricsConfigs, await this.applyMetricsConfigurations(bucketName, metricsConfigs, replayOnUnusable));
+		if (metricsConfigs && Array.isArray(metricsConfigs) && metricsConfigs.length > 0) recordItemOutcome("MetricsConfigurations", metricsConfigs, await this.applyMetricsConfigurations(bucketName, metricsConfigs, replayOnUnusable));
 		const analyticsConfigs = properties["AnalyticsConfigurations"];
-		if (analyticsConfigs && Array.isArray(analyticsConfigs) && analyticsConfigs.length > 0) dropSkippedItems("AnalyticsConfigurations", analyticsConfigs, await this.applyAnalyticsConfigurations(bucketName, analyticsConfigs, replayOnUnusable));
+		if (analyticsConfigs && Array.isArray(analyticsConfigs) && analyticsConfigs.length > 0) recordItemOutcome("AnalyticsConfigurations", analyticsConfigs, await this.applyAnalyticsConfigurations(bucketName, analyticsConfigs, replayOnUnusable));
 		const itConfigs = properties["IntelligentTieringConfigurations"];
-		if (itConfigs && Array.isArray(itConfigs) && itConfigs.length > 0) dropSkippedItems("IntelligentTieringConfigurations", itConfigs, await this.applyIntelligentTieringConfigurations(bucketName, itConfigs, replayOnUnusable));
+		if (itConfigs && Array.isArray(itConfigs) && itConfigs.length > 0) recordItemOutcome("IntelligentTieringConfigurations", itConfigs, await this.applyIntelligentTieringConfigurations(bucketName, itConfigs, replayOnUnusable));
 		const inventoryConfigs = properties["InventoryConfigurations"];
-		if (inventoryConfigs && Array.isArray(inventoryConfigs) && inventoryConfigs.length > 0) dropSkippedItems("InventoryConfigurations", inventoryConfigs, await this.applyInventoryConfigurations(bucketName, inventoryConfigs, replayOnUnusable));
+		if (inventoryConfigs && Array.isArray(inventoryConfigs) && inventoryConfigs.length > 0) recordItemOutcome("InventoryConfigurations", inventoryConfigs, await this.applyInventoryConfigurations(bucketName, inventoryConfigs, replayOnUnusable));
 		const replConfig = properties["ReplicationConfiguration"];
 		if (replConfig) {
 			if (!await this.applyReplicationConfiguration(bucketName, replConfig, replayOnUnusable)) overrides.set("ReplicationConfiguration", void 0);
@@ -6866,15 +7055,17 @@ var S3BucketProvider = class S3BucketProvider {
 		if (sca?.["DataExport"]) {
 			const dataExport = sca["DataExport"];
 			const s3Dest = dataExport["Destination"]?.["S3BucketDestination"];
-			out["StorageClassAnalysis"] = { DataExport: {
-				OutputSchemaVersion: dataExport["OutputSchemaVersion"],
-				Destination: s3Dest ? { S3BucketDestination: {
-					BucketArn: s3Dest["Bucket"],
-					BucketAccountId: s3Dest["BucketAccountId"],
-					Format: s3Dest["Format"],
-					Prefix: s3Dest["Prefix"]
-				} } : void 0
-			} };
+			const dataExportCfn = {};
+			if (dataExport["OutputSchemaVersion"] !== void 0) dataExportCfn["OutputSchemaVersion"] = dataExport["OutputSchemaVersion"];
+			if (s3Dest) {
+				const cfnDest = {};
+				if (s3Dest["Bucket"] !== void 0) cfnDest["BucketArn"] = s3Dest["Bucket"];
+				if (s3Dest["BucketAccountId"] !== void 0) cfnDest["BucketAccountId"] = s3Dest["BucketAccountId"];
+				if (s3Dest["Format"] !== void 0) cfnDest["Format"] = s3Dest["Format"];
+				if (s3Dest["Prefix"] !== void 0) cfnDest["Prefix"] = s3Dest["Prefix"];
+				dataExportCfn["Destination"] = cfnDest;
+			}
+			out["StorageClassAnalysis"] = { DataExport: dataExportCfn };
 		}
 		return out;
 	}
@@ -51641,6 +51832,7 @@ async function deployCommand(stacks, options) {
 					...options.skipFinalSnapshot && { skipFinalSnapshot: true },
 					finalSnapshotClients: stackAwsClients,
 					...options.strictGetatt && { strictGetAtt: true },
+					...options.cfnFallback === false && { cfnFallback: false },
 					captureObservedState: resolveCaptureObservedState(options.captureObservedState),
 					...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
 					...options.resourceTimeout?.globalMs !== void 0 && { resourceTimeoutMs: options.resourceTimeout.globalMs },
@@ -52702,8 +52894,8 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 * Pure with respect to AWS state mutation — only reads state (the resolver
 * may read producer state for `Fn::ImportValue` / `Fn::GetStackOutput`).
 */
-async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties) {
-	const intrinsicResolver = new IntrinsicFunctionResolver(region);
+async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties, cfnFallback) {
+	const intrinsicResolver = new IntrinsicFunctionResolver(region, { cfnFallback: cfnFallback ?? true });
 	let mergedParameters = parameters;
 	let parametersBound = false;
 	try {
@@ -52765,10 +52957,10 @@ async function computeStackDiff(currentState, template, region, stackName, state
 * unresolvable case), while resolvable parameters (the freshly-deployed tree)
 * get exact scalar values.
 */
-async function resolveChildStackParameters(parentStackRow, parentTemplate, parentState, region, parentStackName, stateBackend, parentParameters) {
+async function resolveChildStackParameters(parentStackRow, parentTemplate, parentState, region, parentStackName, stateBackend, parentParameters, cfnFallback) {
 	const rawParams = parentStackRow.Properties?.["Parameters"];
 	if (!rawParams || typeof rawParams !== "object" || Array.isArray(rawParams)) return {};
-	const resolver = new IntrinsicFunctionResolver(region);
+	const resolver = new IntrinsicFunctionResolver(region, { cfnFallback: cfnFallback ?? true });
 	const resolved = {};
 	for (const [name, value] of Object.entries(rawParams)) try {
 		resolved[name] = await resolver.resolve(value, {
@@ -52803,13 +52995,13 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 * fail at deploy time.
 */
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parameters, canonicalizeProperties, assetRedirect } = args;
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parameters, canonicalizeProperties, assetRedirect, cfnFallback } = args;
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
 	const node = {
 		stackName,
 		displayName,
 		region,
-		changes: await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties),
+		changes: await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties, cfnFallback),
 		ccApiRoutes: collectCcApiRoutes(template, state),
 		children: []
 	};
@@ -52824,7 +53016,7 @@ async function buildDiffTree(args) {
 		const childTemplate = readNestedTemplate(childTemplatePath);
 		if (assetRedirect) rewriteTemplateAssetReferences(childTemplate, assetRedirect);
 		const grandchildTemplates = indexNestedChildTemplates(childTemplate, childTemplatePath);
-		const childParameters = await resolveChildStackParameters(resource, template, state, region, stackName, stateBackend, parameters);
+		const childParameters = await resolveChildStackParameters(resource, template, state, region, stackName, stateBackend, parameters, cfnFallback);
 		node.children.push(await buildDiffTree({
 			stackName: childStackName,
 			displayName: childStackName,
@@ -52836,7 +53028,8 @@ async function buildDiffTree(args) {
 			diffCalculator,
 			parameters: childParameters,
 			...canonicalizeProperties && { canonicalizeProperties },
-			...assetRedirect && { assetRedirect }
+			...assetRedirect && { assetRedirect },
+			...cfnFallback !== void 0 && { cfnFallback }
 		}));
 	}
 	for (const [logicalId, resource] of Object.entries(state.resources)) {
@@ -53223,7 +53416,8 @@ async function diffCommand(stacks, options) {
 				stateBackend,
 				diffCalculator,
 				canonicalizeProperties,
-				...assetRedirect && { assetRedirect }
+				...assetRedirect && { assetRedirect },
+				...options.cfnFallback === false && { cfnFallback: false }
 			}));
 		}
 		if (options.json) process.stdout.write(`${JSON.stringify(trees.map(diffTreeToJson), null, 2)}\n`);
@@ -53243,7 +53437,7 @@ async function diffCommand(stacks, options) {
 * Create diff command
 */
 function createDiffCommand() {
-	const cmd = new Command("diff").description("Show difference between current state and desired state").argument("[stacks...]", "Stack name(s) to diff. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*').").option("--all", "Diff all stacks", false).option("--recursive", "Recurse into each AWS::CloudFormation::Stack row and diff every nested-stack child against its own deployed state (DFS order). Default is non-recursive, matching cdk diff.", false).option("--fail", "Exit with code 1 when any change is detected (matches cdk diff --fail). With --recursive, considers the whole nested-stack tree.", false).option("--json", "Output the diff as JSON (nested tree shape when combined with --recursive)", false).addOption(useCdkBootstrapAssetsOption).action(withErrorHandling(diffCommand));
+	const cmd = new Command("diff").description("Show difference between current state and desired state").argument("[stacks...]", "Stack name(s) to diff. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*').").option("--all", "Diff all stacks", false).option("--recursive", "Recurse into each AWS::CloudFormation::Stack row and diff every nested-stack child against its own deployed state (DFS order). Default is non-recursive, matching cdk diff.", false).option("--fail", "Exit with code 1 when any change is detected (matches cdk diff --fail). With --recursive, considers the whole nested-stack tree.", false).option("--json", "Output the diff as JSON (nested tree shape when combined with --recursive)", false).addOption(useCdkBootstrapAssetsOption).addOption(noCfnFallbackOption).action(withErrorHandling(diffCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -56335,8 +56529,8 @@ async function exportCommand(stackArg, options) {
 					const crossRefs = scanCrossStackReferences(allSynthStacks, resolvedStackName);
 					if (crossRefs.length > 0) {
 						const lines = crossRefs.map((r) => `  ${r.consumerStackName} → ${resolvedStackName}.${r.outputName} at ${r.location}`);
-						if (options.strictCrossStack) throw new Error(`Refusing to export: ${crossRefs.length} cross-stack reference(s) to ${resolvedStackName} found in sibling stacks. After migration, those references will break (cdkd's Fn::GetStackOutput reads cdkd state; the migrated stack's outputs live in CFn). Migrate consumers first, or remove the references, or drop --strict-cross-stack to proceed with a warning:\n` + lines.join("\n"));
-						logger.warn(`${crossRefs.length} cross-stack reference(s) to '${resolvedStackName}' from sibling stacks. These will break the next time those stacks deploy via cdkd (cdkd's Fn::GetStackOutput resolver reads cdkd state; the migrated stack's outputs are now in CFn). Plan multi-stack migrations from the leaves up.`);
+						if (options.strictCrossStack) throw new Error(`Refusing to export: ${crossRefs.length} cross-stack reference(s) to ${resolvedStackName} found in sibling stacks. After migration, those references depend on the CloudFormation fallback (the migrated stack's outputs live in CFn; cdkd resolves them via DescribeStacks after the cdkd-state miss), and consumers deployed with --no-cfn-fallback break. Migrate consumers first, or remove the references, or drop --strict-cross-stack to proceed with a warning:\n` + lines.join("\n"));
+						logger.warn(`${crossRefs.length} cross-stack reference(s) to '${resolvedStackName}' from sibling stacks. After the migration those consumers resolve this stack's outputs via the CloudFormation fallback (weak reference; the outputs now live in CFn) — they break only when deployed with --no-cfn-fallback. Migrate consumers from the leaves up if you rely on cdkd-state-only resolution.`);
 						for (const line of lines) logger.warn(line);
 					}
 				}
@@ -56420,8 +56614,8 @@ async function exportCommand(stackArg, options) {
 				const crossRefs = scanCrossStackReferences(allSynthStacks, resolvedStackName);
 				if (crossRefs.length > 0) {
 					const lines = crossRefs.map((r) => `  ${r.consumerStackName} → ${resolvedStackName}.${r.outputName} at ${r.location}`);
-					if (options.strictCrossStack) throw new Error(`Refusing to export: ${crossRefs.length} cross-stack reference(s) to ${resolvedStackName} found in sibling stacks. After migration, those references will break (cdkd's Fn::GetStackOutput reads cdkd state; the migrated stack's outputs live in CFn). Migrate consumers first, or remove the references, or drop --strict-cross-stack to proceed with a warning:\n` + lines.join("\n"));
-					logger.warn(`${crossRefs.length} cross-stack reference(s) to '${resolvedStackName}' from sibling stacks. These will break the next time those stacks deploy via cdkd (cdkd's Fn::GetStackOutput resolver reads cdkd state; the migrated stack's outputs are now in CFn). Plan multi-stack migrations from the leaves up.`);
+					if (options.strictCrossStack) throw new Error(`Refusing to export: ${crossRefs.length} cross-stack reference(s) to ${resolvedStackName} found in sibling stacks. After migration, those references depend on the CloudFormation fallback (the migrated stack's outputs live in CFn; cdkd resolves them via DescribeStacks after the cdkd-state miss), and consumers deployed with --no-cfn-fallback break. Migrate consumers first, or remove the references, or drop --strict-cross-stack to proceed with a warning:\n` + lines.join("\n"));
+					logger.warn(`${crossRefs.length} cross-stack reference(s) to '${resolvedStackName}' from sibling stacks. After the migration those consumers resolve this stack's outputs via the CloudFormation fallback (weak reference; the outputs now live in CFn) — they break only when deployed with --no-cfn-fallback. Migrate consumers from the leaves up if you rely on cdkd-state-only resolution.`);
 					for (const line of lines) logger.warn(line);
 				}
 			}
@@ -58329,7 +58523,7 @@ async function confirmPrompt$3(prompt) {
 	}
 }
 function createExportCommand() {
-	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.").option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns but proceeds — the user is expected to migrate the consumer stacks in a follow-up.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (currently only AWS::ApiGatewayV2::Stage, emitted by CDK HttpApi). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
+	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.").option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (currently only AWS::ApiGatewayV2::Stage, emitted by CDK HttpApi). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -72155,7 +72349,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.46");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.0");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;