@go-to-k/cdkd 0.281.2 → 0.281.4

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-drWGPyTA.js";
+import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-Di4-1RJP.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-n21zWyH-.js";
+import { t as ASGProvider } from "./asg-provider-B1QR4dCd.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -11597,6 +11597,123 @@ var LambdaLayerVersionProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/composite-id.ts
+/**
+* Refuse a composite physicalId whose segments would make it ambiguous
+* (issue [#1672](https://github.com/go-to-k/cdkd/issues/1672)).
+*
+* ## Why a composite id exists at all
+*
+* `ResourceProvider` passes a SINGLE `physicalId: string` as a resource's
+* identity, while CloudFormation keeps the physical id and its containing
+* scope as separate values. So every provider whose type needs more than one
+* value to address the resource PACKS them into one string joined by
+* {@link COMPOSITE_ID_SEPARATOR} — `<databaseName>|<tableName>` for
+* `AWS::Glue::Table`, `<apiId>|<typeName>|<fieldName>` for
+* `AWS::AppSync::Resolver`, and so on.
+*
+* ## Why it has to be guarded
+*
+* The separator is NOT escaped, so a segment that itself contains a `|`
+* produces an id with the wrong arity. Every decode site splits the stored id
+* back apart and the extra segment shifts everything — for a Glue table named
+* `a|b` in database `mydb` the recorded id `mydb|a|b` decodes to database
+* `mydb`, table `a`. Both halves are non-empty, so every existing
+* "is this id well-formed?" guard passes and the deploy SUCCEEDS. What breaks
+* is everything afterwards: `cdkd destroy` deletes the WRONG resource if one
+* exists under the decoded pair (or warn-and-skips, reporting success while
+* the real resource stays alive and billing), and `cdkd drift` reads back
+* `undefined` forever.
+*
+* AWS itself accepts such a name — verified live us-east-1 2026-08-12,
+* `glue:CreateTable` with `TableInput.Name: 'a|b'` succeeds — and
+* CloudFormation manages the resource fine. The limitation is cdkd's own, so
+* the honest answer is to REFUSE at deploy time with a message that says so,
+* rather than to record an id that silently names something else. Escaping the
+* separator, or dropping the packing where the decode sites already receive
+* the properties bag, are the two real fixes and both remain open on #1672;
+* this guard is what closes the data-loss path in the meantime.
+*
+* ## Two entry points, mirroring `config-shape.ts`
+*
+* {@link packCompositeId} is the ACTION (throw, or warn-and-pack under the
+* replay downgrade) and {@link compositeIdSeparatorRefusal} is the bare
+* PREDICATE, for a caller whose response is neither — the `import()` paths
+* warn and return `null` (`skipped-not-found`), which is the idiom those
+* methods already use for every other unusable id. Both share one message
+* builder so the two can never drift.
+*
+* ## Where to place the call
+*
+* Prefer computing the id BEFORE the create call rather than after it. The
+* refusal is a pre-flight check, and a throw placed after the AWS mutation has
+* already committed would leave an orphan resource behind with no state
+* record. Only where a segment is derived from the create RESPONSE (an
+* AWS-generated id) does the call have to sit after it — and those segments
+* are structurally incapable of carrying a `|` anyway. A post-call site must
+* also sit OUTSIDE the `try` whose `catch` re-wraps as
+* `ProvisioningError('Failed to create …')`, or a refusal would be
+* mis-reported as an AWS creation failure.
+*
+* ## What this does NOT cover
+*
+* The claim is "every composite packer this change reaches", not "every `|`
+* join in the tree". Two deliberate exclusions, recorded so the scope is not
+* read as wider than it is:
+*
+* - **`route53-provider.ts`'s three packers** (`AWS::Route53::RecordSet` and
+*   its siblings) are NOT guarded — the file was owned by a parallel lane when
+*   this shipped. The exposure there is bounded rather than absent:
+*   `parseRecordSetCompositeId` requires EXACTLY three parts, so a four-part
+*   id is REJECTED rather than mis-decoded into a different record. That is
+*   the loud failure mode, not the silent-wrong-resource one this helper
+*   exists for — but the deploy still records an id nothing can decode, so the
+*   type belongs here whenever that lane lands. Tracked in issue
+*   [#1711](https://github.com/go-to-k/cdkd/issues/1711).
+* - **`intrinsic-function-resolver.ts`'s `|` joins** (the WAFv2 and
+*   `AWS::Events::Rule` arms) are out of scope by KIND, not by ownership: they
+*   build a `Ref` VALUE for the template resolver, never a physicalId cdkd
+*   records and later splits. Nothing decodes them, so an ambiguous join has
+*   no decode site to go wrong at.
+*/
+/** The character every composite physicalId in this codebase joins segments with. */
+const COMPOSITE_ID_SEPARATOR = "|";
+/** The issue tracking the real fix (escaping, or not packing at all). */
+const COMPOSITE_ID_ISSUE_URL = "https://github.com/go-to-k/cdkd/issues/1672";
+/** Render `<a>|<b>|<c>` from the segment names. */
+function idShape(segments) {
+	return segments.map((segment) => `<${segment.name}>`).join("|");
+}
+/**
+* The refusal sentence for a composite id whose segments carry the separator,
+* or `undefined` when the id is unambiguous.
+*
+* Every offending segment is named, not just the first: a template that
+* mis-names one value frequently mis-names its sibling too, and reporting them
+* one deploy at a time is the shape of remedy nobody finishes.
+*/
+function compositeIdSeparatorRefusal(resourceType, logicalId, segments) {
+	const offending = segments.filter((segment) => String(segment.value).includes("|"));
+	if (offending.length === 0) return void 0;
+	return `${resourceType} ${logicalId}: ${offending.map((segment) => `${segment.name} '${String(segment.value)}'`).join(" and ")} contains '${"|"}', which cdkd uses as the separator in this type's physical id (${idShape(segments)}). Recording it would produce an id that decodes back to a DIFFERENT resource, so a later cdkd destroy / drift / update would target the wrong one — or silently skip it while the real resource stays alive. AWS accepts the name and CloudFormation manages such a resource fine; this is a cdkd limitation tracked in ${COMPOSITE_ID_ISSUE_URL}. Rename the resource so no segment contains '${"|"}', or manage it outside cdkd.`;
+}
+/**
+* Join the segments into a composite physicalId, REFUSING one that would be
+* ambiguous.
+*
+* @throws ProvisioningError when a segment contains {@link COMPOSITE_ID_SEPARATOR},
+*   unless `options.onRefusal` is supplied — under which the message is handed
+*   to the callback and the ambiguous id is returned, keeping the pre-guard
+*   behavior.
+*/
+function packCompositeId(resourceType, logicalId, segments, options) {
+	const refusal = compositeIdSeparatorRefusal(resourceType, logicalId, segments);
+	if (refusal !== void 0) if (options?.onRefusal) options.onRefusal(`${refusal} Continuing with the ambiguous id because the value comes from a cdkd state record, which no template edit can repair; the same value is REFUSED on a template-path create.`);
+	else throw new ProvisioningError(refusal, resourceType, logicalId);
+	return segments.map((segment) => String(segment.value)).join("|");
+}
+
 //#endregion
 //#region src/provisioning/providers/lambda-event-invoke-config-provider.ts
 /**
@@ -11640,8 +11757,14 @@ var LambdaEventInvokeConfigProvider = class {
 	/**
 	* Compose the Cloud-Control-compatible compound physical id.
 	*/
-	buildPhysicalId(functionName, qualifier) {
-		return `${functionName}|${qualifier}`;
+	buildPhysicalId(logicalId, functionName, qualifier, options) {
+		return packCompositeId("AWS::Lambda::EventInvokeConfig", logicalId, [{
+			name: "functionName",
+			value: functionName
+		}, {
+			name: "qualifier",
+			value: qualifier
+		}], options);
 	}
 	/**
 	* Split a `<FunctionName>|<Qualifier>` physical id back into its parts.
@@ -11699,9 +11822,9 @@ var LambdaEventInvokeConfigProvider = class {
 			coerceNumber: true,
 			...replayWarn(this.logger, context)
 		});
+		const physicalId = this.buildPhysicalId(logicalId, functionName, qualifier, context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
 		try {
 			await this.lambdaClient.send(new PutFunctionEventInvokeConfigCommand(this.buildPutInput(properties)));
-			const physicalId = this.buildPhysicalId(functionName, qualifier);
 			this.logger.debug(`Successfully created Lambda EventInvokeConfig ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
@@ -18860,7 +18983,7 @@ var EC2Provider = class {
 			case "AWS::EC2::Subnet": return this.createSubnet(logicalId, resourceType, properties);
 			case "AWS::EC2::InternetGateway": return this.createInternetGateway(logicalId, resourceType, properties);
 			case "AWS::EC2::EIP": return this.createEip(logicalId, resourceType, properties, context);
-			case "AWS::EC2::VPCGatewayAttachment": return this.createVpcGatewayAttachment(logicalId, resourceType, properties);
+			case "AWS::EC2::VPCGatewayAttachment": return this.createVpcGatewayAttachment(logicalId, resourceType, properties, context);
 			case "AWS::EC2::NatGateway": return this.createNatGateway(logicalId, resourceType, properties);
 			case "AWS::EC2::RouteTable": return this.createRouteTable(logicalId, resourceType, properties);
 			case "AWS::EC2::Route": return this.createRoute(logicalId, resourceType, properties, context?.replayingState === true ? (message) => this.logger.warn(message) : void 0);
@@ -18869,7 +18992,7 @@ var EC2Provider = class {
 			case "AWS::EC2::SecurityGroupIngress": return this.createSecurityGroupIngress(logicalId, resourceType, properties, context?.replayingState === true ? (message) => this.logger.warn(message) : void 0);
 			case "AWS::EC2::Instance": return this.createInstance(logicalId, resourceType, properties, context);
 			case "AWS::EC2::NetworkAcl": return this.createNetworkAcl(logicalId, resourceType, properties);
-			case "AWS::EC2::NetworkAclEntry": return this.createNetworkAclEntry(logicalId, resourceType, properties);
+			case "AWS::EC2::NetworkAclEntry": return this.createNetworkAclEntry(logicalId, resourceType, properties, context);
 			case "AWS::EC2::SubnetNetworkAclAssociation": return this.createSubnetNetworkAclAssociation(logicalId, resourceType, properties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
@@ -19301,8 +19424,24 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to delete InternetGateway ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	eipPhysicalId(publicIp, allocationId) {
-		return `${publicIp}|${allocationId}`;
+	/**
+	* Both segments are AWS-generated (a dotted-quad address and an
+	* `eipalloc-...` id), so neither can carry cdkd's `|` separator and the
+	* refusal below is a fence rather than a live guard (issue #1672). It is
+	* applied uniformly with the rest of the composite-packing sites so a future
+	* id-shape change cannot quietly reintroduce the ambiguity; for the same
+	* reason it is safe on BOTH callers — `createEip` (post-`AllocateAddress`)
+	* and `import()` (post-`DescribeAddresses`) — even though a throw on either
+	* would arrive after the AWS call.
+	*/
+	eipPhysicalId(logicalId, publicIp, allocationId, options) {
+		return packCompositeId("AWS::EC2::EIP", logicalId, [{
+			name: "publicIp",
+			value: publicIp
+		}, {
+			name: "allocationId",
+			value: allocationId
+		}], options);
 	}
 	parseEipPhysicalId(physicalId) {
 		if (physicalId.includes("|")) {
@@ -19317,14 +19456,16 @@ var EC2Provider = class {
 	}
 	async createEip(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating EIP ${logicalId}`);
+		let allocationId;
+		let publicIp;
 		try {
 			const response = await this.ec2Client.send(new AllocateAddressCommand({
 				Domain: requireConfigString(properties["Domain"], "vpc", "AWS::EC2::EIP Domain", replayWarn(this.logger, context)),
 				NetworkBorderGroup: properties["NetworkBorderGroup"],
 				PublicIpv4Pool: properties["PublicIpv4Pool"]
 			}));
-			const allocationId = response.AllocationId;
-			const publicIp = response.PublicIp;
+			allocationId = response.AllocationId;
+			publicIp = response.PublicIp;
 			await this.applyTags(allocationId, properties, logicalId);
 			const instanceId = properties["InstanceId"];
 			if (instanceId) if (process.env["CDKD_NO_WAIT"] === "true") this.logger.warn(`EIP ${logicalId} (${allocationId}) was NOT associated with ${instanceId}: --no-wait skips the instance running-state wait, and AssociateAddress rejects an instance that is not yet running. Verify and associate once the instance is running: aws ec2 describe-instances --instance-ids ${instanceId} --query 'Reservations[].Instances[].State.Name' && aws ec2 associate-address --allocation-id ${allocationId} --instance-id ${instanceId}`);
@@ -19336,17 +19477,17 @@ var EC2Provider = class {
 				this.logger.debug(`Associated EIP ${logicalId} (${allocationId}) to ${instanceId}`);
 			}
 			this.logger.debug(`Successfully created EIP ${logicalId}: ${allocationId} (${publicIp})`);
-			return {
-				physicalId: this.eipPhysicalId(publicIp, allocationId),
-				attributes: {
-					AllocationId: allocationId,
-					PublicIp: publicIp
-				}
-			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create EIP ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
+		return {
+			physicalId: this.eipPhysicalId(logicalId, publicIp, allocationId, context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0),
+			attributes: {
+				AllocationId: allocationId,
+				PublicIp: publicIp
+			}
+		};
 	}
 	async updateEip(logicalId, physicalId, properties, previousProperties) {
 		this.logger.debug(`Updating EIP ${logicalId}: ${physicalId}`);
@@ -19412,17 +19553,23 @@ var EC2Provider = class {
 			default: return;
 		}
 	}
-	async createVpcGatewayAttachment(logicalId, resourceType, properties) {
+	async createVpcGatewayAttachment(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating VPCGatewayAttachment ${logicalId}`);
 		const vpcId = properties["VpcId"];
 		const internetGatewayId = properties["InternetGatewayId"];
 		if (!vpcId || !internetGatewayId) throw new ProvisioningError(`VpcId and InternetGatewayId are required for VPCGatewayAttachment ${logicalId}`, resourceType, logicalId);
+		const physicalId = packCompositeId(resourceType, logicalId, [{
+			name: "internetGatewayId",
+			value: internetGatewayId
+		}, {
+			name: "vpcId",
+			value: vpcId
+		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
 		try {
 			await this.ec2Client.send(new AttachInternetGatewayCommand({
 				VpcId: vpcId,
 				InternetGatewayId: internetGatewayId
 			}));
-			const physicalId = `${internetGatewayId}|${vpcId}`;
 			this.logger.debug(`Successfully created VPCGatewayAttachment ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
@@ -19574,6 +19721,13 @@ var EC2Provider = class {
 				onMultipleDestinations(`${message} Continuing with ${usedKey} and ignoring the rest.`);
 			} else throw new ProvisioningError(message, resourceType, logicalId);
 		}
+		const physicalId = packCompositeId(resourceType, logicalId, [{
+			name: "routeTableId",
+			value: routeTableId
+		}, {
+			name: "destination",
+			value: destination
+		}], onMultipleDestinations ? { onRefusal: onMultipleDestinations } : void 0);
 		try {
 			await this.ec2Client.send(new CreateRouteCommand({
 				RouteTableId: routeTableId,
@@ -19590,7 +19744,6 @@ var EC2Provider = class {
 				VpcEndpointId: properties["VpcEndpointId"] ?? void 0,
 				VpcPeeringConnectionId: properties["VpcPeeringConnectionId"] ?? void 0
 			}));
-			const physicalId = `${routeTableId}|${destination}`;
 			this.logger.debug(`Successfully created Route ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
@@ -19901,6 +20054,24 @@ var EC2Provider = class {
 		const effectiveProperties = narrowed === properties ? void 0 : narrowed;
 		const fromPort = properties["FromPort"];
 		const toPort = properties["ToPort"];
+		const physicalId = packCompositeId(resourceType, logicalId, [
+			{
+				name: "groupId",
+				value: groupId
+			},
+			{
+				name: "ipProtocol",
+				value: ipProtocol
+			},
+			{
+				name: "fromPort",
+				value: fromPort ?? "-1"
+			},
+			{
+				name: "toPort",
+				value: toPort ?? "-1"
+			}
+		], onUnusableProtocol ? { onRefusal: onUnusableProtocol } : void 0);
 		try {
 			await this.ec2Client.send(new AuthorizeSecurityGroupIngressCommand({
 				GroupId: groupId,
@@ -19909,7 +20080,6 @@ var EC2Provider = class {
 					IpProtocol: ipProtocol
 				}]
 			}));
-			const physicalId = `${groupId}|${ipProtocol}|${fromPort ?? "-1"}|${toPort ?? "-1"}`;
 			this.logger.debug(`Successfully created SecurityGroupIngress ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
@@ -19918,7 +20088,6 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			if (error instanceof Error && error.message.includes("already exists")) {
-				const physicalId = `${groupId}|${ipProtocol}|${fromPort ?? "-1"}|${toPort ?? "-1"}`;
 				this.logger.debug(`SecurityGroupIngress ${logicalId} already exists, treating as success`);
 				return {
 					physicalId,
@@ -20586,7 +20755,7 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to delete NetworkAcl ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createNetworkAclEntry(logicalId, resourceType, properties) {
+	async createNetworkAclEntry(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating NetworkAclEntry ${logicalId}`);
 		const networkAclId = properties["NetworkAclId"];
 		const ruleNumber = properties["RuleNumber"];
@@ -20594,6 +20763,20 @@ var EC2Provider = class {
 		const ruleAction = properties["RuleAction"];
 		const egress = properties["Egress"] ?? false;
 		if (!networkAclId || ruleNumber === void 0 || protocol === void 0 || !ruleAction) throw new ProvisioningError(`NetworkAclId, RuleNumber, Protocol, and RuleAction are required for NetworkAclEntry ${logicalId}`, resourceType, logicalId);
+		const physicalId = packCompositeId(resourceType, logicalId, [
+			{
+				name: "networkAclId",
+				value: networkAclId
+			},
+			{
+				name: "ruleNumber",
+				value: ruleNumber
+			},
+			{
+				name: "egress",
+				value: egress
+			}
+		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
 		try {
 			const cidrBlock = properties["CidrBlock"];
 			const ipv6CidrBlock = properties["Ipv6CidrBlock"];
@@ -20616,7 +20799,6 @@ var EC2Provider = class {
 					Type: icmpTypeCode["Type"]
 				} : void 0
 			}));
-			const physicalId = `${networkAclId}|${ruleNumber}|${egress}`;
 			this.logger.debug(`Successfully created NetworkAclEntry ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
@@ -20875,7 +21057,7 @@ var EC2Provider = class {
 	* physical-name property instead.
 	*/
 	async import(input) {
-		if (input.knownPhysicalId) return this.verifyExplicit(input.resourceType, input.knownPhysicalId);
+		if (input.knownPhysicalId) return this.verifyExplicit(input.logicalId, input.resourceType, input.knownPhysicalId);
 		return null;
 	}
 	/**
@@ -21436,7 +21618,7 @@ var EC2Provider = class {
 			}
 		}
 	}
-	async verifyExplicit(resourceType, physicalId) {
+	async verifyExplicit(logicalId, resourceType, physicalId) {
 		try {
 			switch (resourceType) {
 				case "AWS::EC2::VPC": return (await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0] ? {
@@ -21460,8 +21642,19 @@ var EC2Provider = class {
 					const filter = allocationId ? { AllocationIds: [allocationId] } : { PublicIps: publicIp ? [publicIp] : [] };
 					const addr = (await this.ec2Client.send(new DescribeAddressesCommand(filter))).Addresses?.[0];
 					if (!addr?.AllocationId || !addr.PublicIp) return null;
+					const eipRefusal = compositeIdSeparatorRefusal("AWS::EC2::EIP", logicalId, [{
+						name: "publicIp",
+						value: addr.PublicIp
+					}, {
+						name: "allocationId",
+						value: addr.AllocationId
+					}]);
+					if (eipRefusal !== void 0) {
+						this.logger.warn(`${eipRefusal} Skipping import.`);
+						return null;
+					}
 					return {
-						physicalId: this.eipPhysicalId(addr.PublicIp, addr.AllocationId),
+						physicalId: this.eipPhysicalId(logicalId, addr.PublicIp, addr.AllocationId),
 						attributes: {
 							AllocationId: addr.AllocationId,
 							PublicIp: addr.PublicIp
@@ -22468,6 +22661,20 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 		const requestValidatorId = properties["RequestValidatorId"];
 		const authorizationScopes = properties["AuthorizationScopes"];
 		if (!restApiId || !resourceId || !httpMethod) throw new ProvisioningError(`RestApiId, ResourceId, and HttpMethod are required for API Gateway Method ${logicalId}`, resourceType, logicalId);
+		const physicalId = packCompositeId(resourceType, logicalId, [
+			{
+				name: "restApiId",
+				value: restApiId
+			},
+			{
+				name: "resourceId",
+				value: resourceId
+			},
+			{
+				name: "httpMethod",
+				value: httpMethod
+			}
+		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
 		try {
 			await this.apiGatewayClient.send(new PutMethodCommand({
 				restApiId,
@@ -22545,7 +22752,6 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				}
 				throw innerError;
 			}
-			const physicalId = `${restApiId}|${resourceId}|${httpMethod}`;
 			this.logger.debug(`Successfully created API Gateway Method ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
@@ -33306,6 +33512,47 @@ function normalizeRecordName(name) {
 	return lowered.endsWith(".") ? lowered : `${lowered}.`;
 }
 /**
+* Is this value ONLY an unresolved intrinsic — `{Ref: …}` / `{Fn::If: […]}` —
+* rather than a real object with members?
+*
+* `import.ts` substitutes only single-key `{Ref}` before calling a provider,
+* so an element behind a condition reaches `import()` in this shape.
+*/
+function isIntrinsicOnly(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && (keys[0] === "Ref" || (keys[0] ?? "").startsWith("Fn::"));
+}
+/**
+* Read a hosted zone's PUBLIC-vs-PRIVATE visibility off its own template
+* properties (issue #1702), for the `import()` name lookup's zone filter.
+*
+* CloudFormation has no `PrivateZone` property — visibility is implied by
+* `VPCs`: a zone associated with at least one VPC is private, one with none is
+* public. So:
+*
+* - `VPCs` ABSENT -> `false` (public). This is the CDK `PublicHostedZone`
+*   shape and by far the common one.
+* - an array carrying at least one element that is NOT purely an unresolved
+*   intrinsic -> `true` (private). Such an element proves the template
+*   attaches a VPC unconditionally, even when the `VPCId` inside it is itself
+*   a `Ref` this provider cannot resolve.
+* - anything else -> `undefined` (do not narrow), and the caller's ambiguity
+*   guard then refuses rather than adopting the wrong zone. Three shapes land
+*   here and each would otherwise be a GUESS: a non-array (an unresolved
+*   intrinsic is a truthy OBJECT); an EMPTY array (more likely a
+*   condition-collapsed value than a deliberate "public"); and — the one that
+*   is easy to miss — an array whose every element is intrinsic-only
+*   (`[{Ref: 'AWS::NoValue'}]`, the CFn spelling of a conditionally-absent
+*   element), which is non-empty yet may resolve to a PUBLIC zone.
+*/
+function templateZoneVisibility(properties) {
+	const vpcs = properties["VPCs"];
+	if (vpcs == null) return false;
+	if (!Array.isArray(vpcs)) return void 0;
+	return vpcs.some((v) => typeof v === "object" && v !== null && !Array.isArray(v) && !isIntrinsicOnly(v)) ? true : void 0;
+}
+/**
 * Canonicalize a name for the QUERY side of a Route 53 list call.
 *
 * `normalizeRecordName` above is the COMPARE-side canonicalizer, and the two
@@ -34025,12 +34272,33 @@ var Route53Provider = class {
 	* Resolve HostedZoneId from properties.
 	* If HostedZoneId is provided, use it directly.
 	* If HostedZoneName is provided, resolve it to a HostedZoneId via ListHostedZonesByName.
+	*
+	* `options.requirePrivateZone` narrows the name match to PRIVATE (`true`) or
+	* PUBLIC (`false`) zones before the ambiguity decision below; leave it
+	* undefined to match either. Split-horizon DNS is exactly a public and a
+	* private zone sharing one name, so a caller that already knows which side
+	* it wants resolves cleanly where the ambiguity guard would otherwise
+	* refuse. `importHostedZone` is the one caller today, deriving the answer
+	* from the template's own `VPCs` (declared = private, absent = public);
+	* every RecordSet caller leaves it undefined, since a record set's template
+	* says nothing about the zone's visibility.
+	*
+	* `options.subject` names what is being resolved FOR in the errors this
+	* raises, and what remedy to point at. It exists because the messages are
+	* user-facing and this helper is no longer RecordSet-only: telling someone
+	* adopting a hosted zone to "pass the '<zoneId>|<name>|<type>' composite"
+	* names a physicalId shape their resource does not have.
 	*/
 	async resolveHostedZoneId(properties, logicalId, resourceType, physicalId, options) {
+		const subject = options?.subject ?? {
+			noun: "record set",
+			remedy: "set HostedZoneId explicitly, or pass the '<zoneId>|<name>|<type>' composite via --resource"
+		};
 		const hostedZoneId = properties["HostedZoneId"];
 		if (typeof hostedZoneId === "string" && hostedZoneId) return hostedZoneId;
 		let lookupErrorMessage;
 		let lookupErrorCause;
+		const narrowing = options?.requirePrivateZone !== void 0;
 		const hostedZoneName = properties["HostedZoneName"];
 		if (typeof hostedZoneName === "string" && hostedZoneName) {
 			let matched = [];
@@ -34043,18 +34311,26 @@ var Route53Provider = class {
 				const zones = response.HostedZones ?? [];
 				const normalizedName = normalizeRecordName(hostedZoneName);
 				matched = zones.filter((z) => normalizeRecordName(z.Name ?? "") === normalizedName);
-				absenceIsSound = !hostedZoneName.includes("\\") && (zones.length > 0 || response.IsTruncated !== true);
+				if (narrowing) matched = matched.filter((z) => (z.Config?.PrivateZone ?? false) === options?.requirePrivateZone);
+				const sawLaterName = zones.some((z) => normalizeRecordName(z.Name ?? "") !== normalizedName);
+				absenceIsSound = !hostedZoneName.includes("\\") && (narrowing ? sawLaterName || response.IsTruncated !== true : zones.length > 0 || response.IsTruncated !== true);
 			} catch (error) {
 				lookupErrorMessage = error instanceof Error ? error.message : String(error);
 				lookupErrorCause = error instanceof Error ? error : void 0;
 				this.logger.warn(`Failed to resolve HostedZoneName "${hostedZoneName}" for ${logicalId}: ${lookupErrorMessage}`);
 			}
-			if (matched.length > 1 && options?.requireUnambiguousZoneName) throw new ProvisioningError(`HostedZoneName "${hostedZoneName}" matches ${matched.length} hosted zones for ${logicalId} (split-horizon public/private DNS). Refusing to guess which one this record belongs to — set HostedZoneId explicitly, or pass the '<zoneId>|<name>|<type>' composite via --resource.`, resourceType, logicalId, physicalId);
+			if (matched.length > 1 && options?.requireUnambiguousZoneName) {
+				const cause = narrowing ? "" : " (split-horizon public/private DNS)";
+				throw new ProvisioningError(`HostedZoneName "${hostedZoneName}" matches ${matched.length} hosted zones for ${logicalId}${cause}. Refusing to guess which one is meant — ${subject.remedy}.`, resourceType, logicalId, physicalId);
+			}
 			const matchedZone = matched[0];
 			if (matchedZone?.Id) return matchedZone.Id.replace("/hostedzone/", "");
-			if (absenceIsSound) throw new HostedZoneNameNotFoundError(`HostedZoneName "${hostedZoneName}" matches no hosted zone in this account/region for ${logicalId}`, resourceType, logicalId, physicalId);
+			if (absenceIsSound) {
+				const visibility = options?.requirePrivateZone === void 0 ? "" : options.requirePrivateZone ? "private " : "public ";
+				throw new HostedZoneNameNotFoundError(`HostedZoneName "${hostedZoneName}" matches no ${visibility}hosted zone in this account/region for ${logicalId}`, resourceType, logicalId, physicalId);
+			}
 		}
-		throw new ProvisioningError(lookupErrorMessage ? `Could not resolve HostedZoneName "${String(hostedZoneName)}" for record set ${logicalId}: ${lookupErrorMessage}` : `Either HostedZoneId or HostedZoneName is required for record set ${logicalId}`, resourceType, logicalId, physicalId, lookupErrorCause);
+		throw new ProvisioningError(lookupErrorMessage ? `Could not resolve HostedZoneName "${String(hostedZoneName)}" for ${subject.noun} ${logicalId}: ${lookupErrorMessage}` : typeof hostedZoneName === "string" && hostedZoneName ? `Could not determine whether HostedZoneName "${hostedZoneName}" exists for ${subject.noun} ${logicalId} — the hosted-zone listing ended before the name could be resolved either way, so cdkd will not assume it is absent. ${subject.remedy}.` : `Either HostedZoneId or HostedZoneName is required for ${subject.noun} ${logicalId}`, resourceType, logicalId, physicalId, lookupErrorCause);
 	}
 	/**
 	* Recover `(hostedZoneId, name, type)` for a record set from EITHER shape of
@@ -34232,8 +34508,10 @@ var Route53Provider = class {
 	/**
 	* Adopt an existing Route 53 resource into cdkd state.
 	*
-	* Supported types: `AWS::Route53::HostedZone` (override-only);
-	* `AWS::Route53::RecordSet` (override-only too — the supplied id is
+	* Supported types: `AWS::Route53::HostedZone` (AUTO-RESOLVED from the
+	* template's `Name` since issue #1702, with an explicit `--resource`
+	* override still taking precedence);
+	* `AWS::Route53::RecordSet` (override-only — the supplied id is
 	* CANONICALIZED rather than trusted, using the template's
 	* `HostedZoneId` / `HostedZoneName` + `Name` + `Type` and verified
 	* against AWS, but an import with no override still declines because
@@ -34315,6 +34593,29 @@ var Route53Provider = class {
 			attributes: {}
 		};
 	}
+	/**
+	* Adopt an existing hosted zone (issue #1702).
+	*
+	* An explicit `--resource` id is ground truth and is only VERIFIED. With no
+	* override, the zone is resolved from the template's `Name` via
+	* `ListHostedZonesByName` — the physical-name route docs/import.md's
+	* Auto-resolved section documents, which this method declined to take until
+	* now, so a type the table listed as auto-resolved silently reported
+	* `skipped-not-found` and (under `--migrate-from-cloudformation`) was left
+	* out of state after the CloudFormation stack had already been retired.
+	*
+	* Three properties of the lookup matter and none of them is incidental:
+	* the query name is canonicalized to AWS's ordering key
+	* (`canonicalizeQueryName`) so a bounded page cannot skip past the zone; a
+	* name matching MORE than one zone is REFUSED rather than guessed at
+	* (split-horizon DNS), except that the template's own `VPCs` first narrows
+	* the match to the public or private side (`templateZoneVisibility`), which
+	* is what makes the ordinary split-horizon pair resolve cleanly; and the
+	* two ways of failing are kept DISTINCT — a proven absence returns `null`
+	* (`skipped-not-found`, the next deploy creates the zone) while an
+	* ambiguous name or a failed lookup throws, which `importOne` records as
+	* `failed` for this row alone.
+	*/
 	async importHostedZone(input) {
 		if (input.knownPhysicalId) try {
 			await this.getClient().send(new GetHostedZoneCommand({ Id: input.knownPhysicalId }));
@@ -34326,7 +34627,24 @@ var Route53Provider = class {
 			if (err instanceof Error && err.name === "NoSuchHostedZone") return null;
 			throw err;
 		}
-		return null;
+		const zoneName = input.properties["Name"];
+		if (typeof zoneName !== "string" || !zoneName) return null;
+		try {
+			return {
+				physicalId: await this.resolveHostedZoneId({ HostedZoneName: zoneName }, input.logicalId, input.resourceType, void 0, {
+					requireUnambiguousZoneName: true,
+					requirePrivateZone: templateZoneVisibility(input.properties),
+					subject: {
+						noun: "hosted zone",
+						remedy: `pass --resource ${input.logicalId}=<hostedZoneId> to adopt it explicitly`
+					}
+				}),
+				attributes: {}
+			};
+		} catch (error) {
+			if (error instanceof HostedZoneNameNotFoundError) return null;
+			throw error;
+		}
 	}
 };
 
@@ -36399,9 +36717,9 @@ var AppSyncProvider = class {
 		switch (resourceType) {
 			case "AWS::AppSync::GraphQLApi": return this.createGraphQLApi(logicalId, resourceType, properties, context);
 			case "AWS::AppSync::GraphQLSchema": return this.createGraphQLSchema(logicalId, resourceType, properties);
-			case "AWS::AppSync::DataSource": return this.createDataSource(logicalId, resourceType, properties);
-			case "AWS::AppSync::Resolver": return this.createResolver(logicalId, resourceType, properties);
-			case "AWS::AppSync::ApiKey": return this.createApiKey(logicalId, resourceType, properties);
+			case "AWS::AppSync::DataSource": return this.createDataSource(logicalId, resourceType, properties, context);
+			case "AWS::AppSync::Resolver": return this.createResolver(logicalId, resourceType, properties, context);
+			case "AWS::AppSync::ApiKey": return this.createApiKey(logicalId, resourceType, properties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
@@ -37315,12 +37633,19 @@ var AppSyncProvider = class {
 			throw new ProvisioningError(`Failed to create GraphQL Schema ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async createDataSource(logicalId, resourceType, properties) {
+	async createDataSource(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating DataSource ${logicalId}`);
 		const apiId = properties["ApiId"];
 		const name = properties["Name"];
 		const type = properties["Type"];
 		if (!apiId || !name || !type) throw new ProvisioningError(`ApiId, Name, and Type are required for DataSource ${logicalId}`, resourceType, logicalId);
+		const physicalId = packCompositeId(resourceType, logicalId, [{
+			name: "apiId",
+			value: apiId
+		}, {
+			name: "name",
+			value: name
+		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
 		try {
 			const input = {
 				apiId,
@@ -37329,7 +37654,6 @@ var AppSyncProvider = class {
 			};
 			this.applyDataSourceConfig(input, resourceType, logicalId, properties);
 			await this.getClient().send(new CreateDataSourceCommand(input));
-			const physicalId = `${apiId}|${name}`;
 			this.logger.debug(`Successfully created DataSource ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
@@ -37366,12 +37690,26 @@ var AppSyncProvider = class {
 			throw new ProvisioningError(`Failed to delete DataSource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createResolver(logicalId, resourceType, properties) {
+	async createResolver(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Resolver ${logicalId}`);
 		const apiId = properties["ApiId"];
 		const typeName = properties["TypeName"];
 		const fieldName = properties["FieldName"];
 		if (!apiId || !typeName || !fieldName) throw new ProvisioningError(`ApiId, TypeName, and FieldName are required for Resolver ${logicalId}`, resourceType, logicalId);
+		const physicalId = packCompositeId(resourceType, logicalId, [
+			{
+				name: "apiId",
+				value: apiId
+			},
+			{
+				name: "typeName",
+				value: typeName
+			},
+			{
+				name: "fieldName",
+				value: fieldName
+			}
+		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
 		try {
 			const input = {
 				apiId,
@@ -37380,7 +37718,6 @@ var AppSyncProvider = class {
 			};
 			await this.applyResolverConfig(input, resourceType, logicalId, properties);
 			await this.getClient().send(new CreateResolverCommand(input));
-			const physicalId = `${apiId}|${typeName}|${fieldName}`;
 			this.logger.debug(`Successfully created Resolver ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
@@ -37416,28 +37753,34 @@ var AppSyncProvider = class {
 			throw new ProvisioningError(`Failed to delete Resolver ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createApiKey(logicalId, resourceType, properties) {
+	async createApiKey(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating ApiKey ${logicalId}`);
 		const apiId = properties["ApiId"];
 		if (!apiId) throw new ProvisioningError(`ApiId is required for ApiKey ${logicalId}`, resourceType, logicalId);
+		let apiKeyId;
 		try {
 			const input = { apiId };
 			if (properties["Description"]) input.description = properties["Description"];
 			if (properties["Expires"]) input.expires = properties["Expires"];
-			const response = await this.getClient().send(new CreateApiKeyCommand(input));
-			const apiKeyId = response.apiKey.id;
+			apiKeyId = (await this.getClient().send(new CreateApiKeyCommand(input))).apiKey.id;
 			this.logger.debug(`Successfully created ApiKey ${logicalId}: ${apiKeyId}`);
-			return {
-				physicalId: `${apiId}|${apiKeyId}`,
-				attributes: {
-					ApiKey: response.apiKey.id,
-					Arn: `arn:aws:appsync:*:*:apis/${apiId}/apikeys/${apiKeyId}`
-				}
-			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create ApiKey ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
+		return {
+			physicalId: packCompositeId(resourceType, logicalId, [{
+				name: "apiId",
+				value: apiId
+			}, {
+				name: "apiKeyId",
+				value: apiKeyId
+			}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0),
+			attributes: {
+				ApiKey: apiKeyId,
+				Arn: `arn:aws:appsync:*:*:apis/${apiId}/apikeys/${apiKeyId}`
+			}
+		};
 	}
 	async deleteApiKey(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting ApiKey ${logicalId}: ${physicalId}`);
@@ -38097,6 +38440,13 @@ var GlueProvider = class {
 			replayingState: context?.replayingState === true
 		});
 		const openTableFormatInput = properties["OpenTableFormatInput"];
+		const physicalId = packCompositeId(resourceType, logicalId, [{
+			name: "databaseName",
+			value: databaseName
+		}, {
+			name: "tableName",
+			value: tableName
+		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
 		try {
 			await this.getClient().send(new CreateTableCommand$1({
 				CatalogId: catalogId,
@@ -38104,7 +38454,6 @@ var GlueProvider = class {
 				TableInput: this.buildTableInput(tableInput, tableName),
 				...openTableFormatInput !== void 0 && { OpenTableFormatInput: openTableFormatInput }
 			}));
-			const physicalId = `${databaseName}|${tableName}`;
 			this.logger.debug(`Successfully created Glue Table ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
@@ -49210,11 +49559,11 @@ var S3TablesProvider = class {
 		if (!this.client) this.client = new S3TablesClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::S3Tables::TableBucket": return this.createTableBucket(logicalId, resourceType, properties);
-			case "AWS::S3Tables::Namespace": return this.createNamespace(logicalId, resourceType, properties);
-			case "AWS::S3Tables::Table": return this.createTable(logicalId, resourceType, properties);
+			case "AWS::S3Tables::Namespace": return this.createNamespace(logicalId, resourceType, properties, context);
+			case "AWS::S3Tables::Table": return this.createTable(logicalId, resourceType, properties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
@@ -49330,7 +49679,7 @@ var S3TablesProvider = class {
 			namespaceContinuationToken = namespacesResult.continuationToken;
 		} while (namespaceContinuationToken);
 	}
-	async createNamespace(logicalId, resourceType, properties) {
+	async createNamespace(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating S3 Tables Namespace ${logicalId}`);
 		const tableBucketARN = properties["TableBucketARN"];
 		if (!tableBucketARN) throw new ProvisioningError(`TableBucketARN is required for S3 Tables Namespace ${logicalId}`, resourceType, logicalId);
@@ -49339,12 +49688,18 @@ var S3TablesProvider = class {
 		if (Array.isArray(rawNs) && rawNs.length > 0 && typeof rawNs[0] === "string") namespaceName = rawNs[0];
 		else if (typeof rawNs === "string" && rawNs.length > 0) namespaceName = rawNs;
 		if (!namespaceName) throw new ProvisioningError(`Namespace is required for S3 Tables Namespace ${logicalId}`, resourceType, logicalId);
+		const physicalId = packCompositeId(resourceType, logicalId, [{
+			name: "tableBucketARN",
+			value: tableBucketARN
+		}, {
+			name: "namespace",
+			value: namespaceName
+		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
 		try {
 			await this.getClient().send(new CreateNamespaceCommand({
 				tableBucketARN,
 				namespace: [namespaceName]
 			}));
-			const physicalId = `${tableBucketARN}|${namespaceName}`;
 			this.logger.debug(`Successfully created S3 Tables Namespace ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
@@ -49375,7 +49730,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`Failed to delete S3 Tables Namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createTable(logicalId, resourceType, properties) {
+	async createTable(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating S3 Tables Table ${logicalId}`);
 		const tableBucketARN = properties["TableBucketARN"];
 		if (!tableBucketARN) throw new ProvisioningError(`TableBucketARN is required for S3 Tables Table ${logicalId}`, resourceType, logicalId);
@@ -49386,6 +49741,20 @@ var S3TablesProvider = class {
 		const format = properties["OpenTableFormat"] ?? properties["Format"];
 		if (!format) throw new ProvisioningError(`OpenTableFormat is required for S3 Tables Table ${logicalId}`, resourceType, logicalId);
 		const tags = this.cfnTagsToSdkMap(properties["Tags"]);
+		const physicalId = packCompositeId(resourceType, logicalId, [
+			{
+				name: "tableBucketARN",
+				value: tableBucketARN
+			},
+			{
+				name: "namespace",
+				value: namespace
+			},
+			{
+				name: "name",
+				value: name
+			}
+		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
 		try {
 			const response = await this.getClient().send(new CreateTableCommand$2({
 				tableBucketARN,
@@ -49394,7 +49763,6 @@ var S3TablesProvider = class {
 				format,
 				...tags !== void 0 && { tags }
 			}));
-			const physicalId = `${tableBucketARN}|${namespace}|${name}`;
 			if (!response.tableARN) throw new ProvisioningError(`CreateTable did not return a tableARN for ${logicalId} (${physicalId}) — refusing to record an empty TableARN attribute`, resourceType, logicalId, physicalId);
 			const tableARN = response.tableARN;
 			this.logger.debug(`Successfully created S3 Tables Table ${logicalId}: ${physicalId}`);
@@ -49614,6 +49982,17 @@ var S3TablesProvider = class {
 			if (err instanceof NotFoundException$6) return null;
 			throw err;
 		}
+		const namespaceRefusal = compositeIdSeparatorRefusal("AWS::S3Tables::Namespace", input.logicalId, [{
+			name: "tableBucketARN",
+			value: identity.tableBucketARN
+		}, {
+			name: "namespace",
+			value: identity.namespace
+		}]);
+		if (namespaceRefusal !== void 0) {
+			this.logger.warn(`${namespaceRefusal} Skipping import.`);
+			return null;
+		}
 		return {
 			physicalId: `${identity.tableBucketARN}|${identity.namespace}`,
 			attributes: {}
@@ -49711,6 +50090,24 @@ var S3TablesProvider = class {
 				attributes: { TableARN: tableARN }
 			};
 		}
+		const tableRefusal = compositeIdSeparatorRefusal("AWS::S3Tables::Table", input.logicalId, [
+			{
+				name: "tableBucketARN",
+				value: identity.tableBucketARN
+			},
+			{
+				name: "namespace",
+				value: identity.namespace
+			},
+			{
+				name: "name",
+				value: identity.name
+			}
+		]);
+		if (tableRefusal !== void 0) {
+			this.logger.warn(`${tableRefusal} Skipping import.`);
+			return null;
+		}
 		return {
 			physicalId: `${identity.tableBucketARN}|${identity.namespace}|${identity.name}`,
 			attributes: { TableARN: tableARN }
@@ -72620,7 +73017,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.2");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.4");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;