@go-to-k/cdkd 0.281.22 → 0.281.24

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as MIGRATE_TMP_PREFIX, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as getDefaultStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerStreaming, G as getAccountInfo, Gt as resolveSkipPrefix, H as isTerminationProtectionPropagationError, Ht as resolveApp, I as ProviderRegistry, It as AssetManifestLoader, J as normalizeAwsTagsToCfn, Jt as resolveUseCdkBootstrapAssets, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefault, L as findActionableSilentDrops, Lt as getDockerImageBySourceHash, M as yellow, Mt as formatDockerLoginError, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as getDockerCmd, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as runDockerForeground, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_URL_LIMIT, R as findSilentDropProperties, Rt as Synthesizer, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveAutoAssetStorage, V as disableInstanceApiTermination, Vt as getLegacyStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveCaptureObservedState, X as assertRegionMatch, Xt as warnDeprecatedNoPrefixCliFlag, Y as resolveExplicitPhysicalId, Yt as stateBucketExistenceConfirmed, Z as coerceCfnBoolean, Zt as CFN_TEMPLATE_BODY_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as findLargeInlineResources, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as buildDockerImage, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as expectedOwnerParam, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefaultAndSource, r as DeployEngine, rn as derivePartitionAndUrlSuffix, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as uploadCfnTemplate, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as synthesisStatusMessage } from "./deploy-engine-DQd1PUUv.js";
+import { $ as configStringRefusal, $t as MIGRATE_TMP_PREFIX, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as getDefaultStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerStreaming, G as getAccountInfo, Gt as resolveSkipPrefix, H as isTerminationProtectionPropagationError, Ht as resolveApp, I as ProviderRegistry, It as AssetManifestLoader, J as normalizeAwsTagsToCfn, Jt as resolveUseCdkBootstrapAssets, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefault, L as findActionableSilentDrops, Lt as getDockerImageBySourceHash, M as yellow, Mt as formatDockerLoginError, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as getDockerCmd, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as runDockerForeground, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_URL_LIMIT, R as findSilentDropProperties, Rt as Synthesizer, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveAutoAssetStorage, V as disableInstanceApiTermination, Vt as getLegacyStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveCaptureObservedState, X as assertRegionMatch, Xt as warnDeprecatedNoPrefixCliFlag, Y as resolveExplicitPhysicalId, Yt as stateBucketExistenceConfirmed, Z as coerceCfnBoolean, Zt as CFN_TEMPLATE_BODY_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as findLargeInlineResources, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as buildDockerImage, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as expectedOwnerParam, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefaultAndSource, r as DeployEngine, rn as derivePartitionAndUrlSuffix, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as uploadCfnTemplate, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as synthesisStatusMessage } from "./deploy-engine-BkXNtI7L.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-pvAc9MXZ.js";
+import { t as ASGProvider } from "./asg-provider-CxK7d3pH.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12455,16 +12455,57 @@ function formatShape(segments) {
 * ## The `skipping` variant
 *
 * On the DELETE path the established policy is warn-and-continue, so a
-* malformed record leaves the AWS resource ALIVE while `cdkd destroy` reports
-* success. That policy is not changed here — but the warning now says what the
-* skip costs, because an orphan the user is never told about is one they cannot
-* go and delete.
+* malformed record leaves the AWS resource ALIVE. That policy is unchanged —
+* the warning says what the skip costs, because an orphan the user is never
+* told about is one they cannot go and delete.
+*
+* Since issue [#1752](https://github.com/go-to-k/cdkd/issues/1752) the ACCOUNTING
+* around it is no longer a lie: an arm emitting this message must also return
+* `{ outcome: 'skipped', reason: COMPOSITE_ID_SKIP_REASON }` so `cdkd destroy`
+* prints a `⚠ … skipped` line instead of `✓ … deleted`, reports
+* `N deleted, 1 skipped`, KEEPS the state record, and exits non-zero. The
+* wording here changed accordingly — it used to promise unconditionally that
+* cdkd "will report this delete as successful", which is no longer true on the
+* destroy path. It is STILL true for the deploy engine's replacement / rollback
+* deletes, which discard the return value (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)), so the message names
+* both callers rather than describing only the fixed one — a remedy of
+* "drop the record with 'cdkd state orphan'" is impossible on a path that has
+* already dropped it.
 */
 function compositeIdFormatMessage(format, logicalId, physicalId, options) {
 	const accepted = format.alsoAccepts ? `"${formatShape(format.segments)}" or ${format.alsoAccepts}` : `"${formatShape(format.segments)}"`;
 	const head = `Invalid physicalId format for ${format.label} ${logicalId}: expected ${accepted}, got "${physicalId}"`;
 	if (!options?.skipping) return head;
-	return `${head}. Skipping the delete — the AWS resource is LEFT IN PLACE and cdkd will report this delete as successful, so delete it by hand (or repair the id in state.json and re-run) if it still exists. NOTE this arm is reached from cdkd destroy AND from the deploy engine's replacement / rollback deletes.`;
+	return `${head}. Skipping the delete — no AWS call is issued, so the resource is LEFT IN PLACE. On 'cdkd destroy' / 'cdkd state destroy' the state record is KEPT and the run exits non-zero, so repair the id in state.json and re-run (or delete the resource by hand and drop the record with 'cdkd state orphan'). NOTE this arm is ALSO reached from cdkd deploy — the plain DELETE of a resource removed from the template (the most common one), plus the replacement and rollback deletes — all of which still DROP the record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, delete it by hand.`;
+}
+/**
+* The short `ResourceDeleteResult.reason` every malformed-composite-id DELETE
+* skip reports (issue [#1752](https://github.com/go-to-k/cdkd/issues/1752)).
+*
+* Deliberately short and IDENTICAL across the five arms: it is rendered inline
+* on the per-resource status line (`⚠ MyTable (AWS::Glue::Table) skipped
+* (malformed physicalId in state — no delete issued)`), where the full
+* remediation sentence built by {@link compositeIdFormatMessage} would not fit.
+* The full text is still emitted, as the `logger.warn` right beside it.
+*
+* A shared constant rather than five literals so the five arms cannot drift and
+* a grep for the wording finds all of them.
+*/
+const COMPOSITE_ID_SKIP_REASON = "malformed physicalId in state — no delete issued";
+/**
+* The `ResourceDeleteResult` a malformed-composite-id DELETE arm returns.
+*
+* Pairs with the `{ skipping: true }` warning: emit the warning, return this.
+* Providers call it as `return compositeIdSkipResult();` so the arm reads as
+* the deliberate skip it is rather than as the bare `return;` that made issue
+* #1752's mis-accounting possible.
+*/
+function compositeIdSkipResult() {
+	return {
+		outcome: "skipped",
+		reason: COMPOSITE_ID_SKIP_REASON
+	};
 }
 
 //#endregion
@@ -21890,7 +21931,7 @@ var EC2Provider = class {
 		const parts = physicalId.split("|");
 		if (parts.length < 3) {
 			this.logger.warn(compositeIdFormatMessage(EC2_NETWORK_ACL_ENTRY_ID_FORMAT, logicalId, physicalId, { skipping: true }));
-			return;
+			return compositeIdSkipResult();
 		}
 		const networkAclId = parts[0];
 		const ruleNumber = parseInt(parts[1], 10);
@@ -39028,7 +39069,7 @@ var AppSyncProvider = class {
 		const [apiId, name] = physicalId.split("|");
 		if (!apiId || !name) {
 			this.logger.warn(compositeIdFormatMessage(APPSYNC_DATASOURCE_ID_FORMAT, logicalId, physicalId, { skipping: true }));
-			return;
+			return compositeIdSkipResult();
 		}
 		try {
 			await this.getClient().send(new DeleteDataSourceCommand({
@@ -39091,7 +39132,7 @@ var AppSyncProvider = class {
 		const parts = physicalId.split("|");
 		if (parts.length < 3) {
 			this.logger.warn(compositeIdFormatMessage(APPSYNC_RESOLVER_ID_FORMAT, logicalId, physicalId, { skipping: true }));
-			return;
+			return compositeIdSkipResult();
 		}
 		const [apiId, typeName, fieldName] = parts;
 		try {
@@ -39147,7 +39188,7 @@ var AppSyncProvider = class {
 		const [apiId, apiKeyId] = physicalId.split("|");
 		if (!apiId || !apiKeyId) {
 			this.logger.warn(compositeIdFormatMessage(APPSYNC_APIKEY_ID_FORMAT, logicalId, physicalId, { skipping: true }));
-			return;
+			return compositeIdSkipResult();
 		}
 		try {
 			await this.getClient().send(new DeleteApiKeyCommand({
@@ -39873,7 +39914,7 @@ var GlueProvider = class {
 		const [databaseName, tableName] = physicalId.split("|");
 		if (!databaseName || !tableName) {
 			this.logger.warn(compositeIdFormatMessage(GLUE_TABLE_ID_FORMAT, logicalId, physicalId, { skipping: true }));
-			return;
+			return compositeIdSkipResult();
 		}
 		const target = deleteCatalogId(properties);
 		if (target.declaredButUnusable) this.logger.debug(`Glue Table ${logicalId}: CatalogId is not a usable value (likely an unresolved intrinsic), so DeleteTable targets ${describeCatalog(target.catalogId)}.`);
@@ -52076,6 +52117,12 @@ var ECRProvider = class {
 *
 * Exported for unit-test coverage of `countProtectedResources`.
 */
+/**
+* The nested-stack resource type. A skipped row of this type means the CHILD
+* stack was not destroyed, and the record a user must repair lives in the
+* child's own state file (`<parent>~<logicalId>`) — see `skippedStateTargets`.
+*/
+const NESTED_STACK_TYPE = "AWS::CloudFormation::Stack";
 const PROTECTION_PROPERTY_BY_TYPE = {
 	"AWS::Logs::LogGroup": "DeletionProtectionEnabled",
 	"AWS::RDS::DBInstance": "DeletionProtection",
@@ -52179,6 +52226,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 		skippedEmpty: false,
 		deletedCount: 0,
 		retainedCount: 0,
+		skippedCount: 0,
 		errorCount: 0,
 		interrupted: false
 	};
@@ -52285,6 +52333,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 		}
 	}
 	const remainingResources = { ...state.resources };
+	const skippedStateTargets = /* @__PURE__ */ new Set();
 	const buildDestroySnapshot = () => {
 		const { imports: _imports, outputReads: _outputReads, ...rest } = state;
 		return {
@@ -52412,15 +52461,16 @@ async function runDestroyForStack(stackName, state, ctx) {
 					const globalTimeoutMs = ctx.resourceTimeoutMs ?? 18e5;
 					const slowTypeMinTimeoutMs = slowCcOperationTimeoutMs(resource.resourceType, "DELETE");
 					const timeoutMs = ctx.resourceTimeoutByType?.[resource.resourceType] ?? Math.max(providerMinTimeoutMs, slowTypeMinTimeoutMs, globalTimeoutMs);
+					let deleteResult;
 					await withResourceDeadline(async () => {
 						const maxAttempts = provider.disableOuterRetry ? 0 : 3;
 						let lastDeleteError;
 						for (let attempt = 0; attempt <= maxAttempts; attempt++) try {
-							await provider.delete(logicalId, resource.physicalId, resource.resourceType, resource.properties, {
+							deleteResult = await provider.delete(logicalId, resource.physicalId, resource.resourceType, resource.properties, {
 								...state.region !== void 0 && { expectedRegion: state.region },
 								...ctx.removeProtection === true && { removeProtection: true },
 								...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
-							});
+							}) ?? void 0;
 							lastDeleteError = null;
 							break;
 						} catch (retryError) {
@@ -52445,6 +52495,23 @@ async function runDestroyForStack(stackName, state, ctx) {
 						onTimeout: (elapsedMs) => new ResourceTimeoutError(logicalId, resource.resourceType, stackRegion, elapsedMs, "DELETE", timeoutMs)
 					});
 					renderer.removeTask(logicalId);
+					if (deleteResult?.outcome === "skipped") {
+						logger.info(`  ${formatResourceLine("skipped", logicalId, resource.resourceType, `skipped (${deleteResult.reason})`)}`);
+						result.skippedCount++;
+						skippedStateTargets.add(resource.resourceType === NESTED_STACK_TYPE ? `${stackName}~${logicalId}` : stackName);
+						ctx.eventRecorder?.record({
+							eventType: "RESOURCE_SKIPPED",
+							stackName,
+							operation: "DELETE",
+							logicalId,
+							resourceType: resource.resourceType,
+							...resource.provisionedBy && { provisionedBy: resource.provisionedBy },
+							...resource.physicalId && { physicalId: resource.physicalId },
+							reason: deleteResult.reason,
+							durationMs: Date.now() - resourceStartedAt
+						});
+						return;
+					}
 					logger.info(`  ${formatResourceLine("deleted", logicalId, resource.resourceType)}`);
 					result.deletedCount++;
 					ctx.eventRecorder?.record({
@@ -52513,7 +52580,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 		}
 		result.interrupted = draining;
 		await saveChain;
-		const preserveState = result.errorCount > 0 || result.interrupted;
+		const preserveState = result.errorCount > 0 || result.interrupted || result.skippedCount > 0;
 		if (!preserveState) {
 			await ctx.stateBackend.deleteState(stackName, regionForState);
 			logger.debug("State deleted");
@@ -52525,12 +52592,19 @@ async function runDestroyForStack(stackName, state, ctx) {
 				logger.warn(`Failed to persist remaining state after partial destroy: ${error instanceof Error ? error.message : String(error)}. The state file may still list already-deleted resources; a re-run resolves them idempotently.`);
 			}
 			if (result.interrupted) logger.warn(`Destroy interrupted — ${Object.keys(remainingResources).length} resource(s) not deleted. State preserved.`);
-			else logger.warn(`${result.errorCount} resource(s) failed to delete. State preserved.`);
+			else if (result.errorCount > 0) logger.warn(`${result.errorCount} resource(s) failed to delete. State preserved.`);
+			else logger.warn(`${result.skippedCount} resource(s) skipped — cdkd could not address them, so no delete was issued and they may still exist in AWS. State preserved (the records are kept so the resources stay traceable).`);
 		}
 		const retainedSuffix = result.retainedCount > 0 ? `, ${result.retainedCount} retained` : "";
+		const skippedSuffix = result.skippedCount > 0 ? `, ${yellow(result.skippedCount)} skipped` : "";
 		if (!preserveState) logger.info(`\n${green("✓")} ${bold(`Stack ${stackName} destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}, ${result.errorCount} errors)`);
-		else if (result.interrupted && result.errorCount === 0) logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} destroy interrupted`)} (${green(result.deletedCount)} deleted${retainedSuffix}, ${result.errorCount} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to finish.`);
-		else logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. If the same resource keeps failing, 'cdkd state orphan ${stackName}' is the last resort: it removes the state record without deleting AWS resources.`);
+		else if (result.interrupted && result.errorCount === 0) logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} destroy interrupted`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}, ${result.errorCount} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to finish.`);
+		else if (result.errorCount === 0) {
+			const targets = [...skippedStateTargets];
+			const showHint = targets.map((t) => `'cdkd state show ${t}'`).join(" / ");
+			const orphanHint = targets.map((t) => `'cdkd state orphan ${t}'`).join(" / ");
+			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}, ${result.errorCount} errors). cdkd could not address the skipped resource(s), so they may still exist in AWS. Fix the physicalId in state.json (${showHint}) and re-run, or delete them by hand and drop the records with ${orphanHint}.`);
+		} else logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. If the same resource keeps failing, 'cdkd state orphan ${stackName}' is the last resort: it removes the state record without deleting AWS resources.`);
 	} finally {
 		process.removeListener("SIGINT", sigintHandler);
 		renderer.stop();
@@ -52749,7 +52823,7 @@ var NestedStackProvider = class {
 		}
 		const resourceCount = Object.keys(childStateData.state.resources).length;
 		this.logger.info(`Destroying nested stack ${childStackName} (logicalId=${logicalId}, ${resourceCount} resource(s))`);
-		await withNestedStackContext({
+		const childResult = await withNestedStackContext({
 			...ctx,
 			parentStackName: childStackName,
 			parentRegion: childRegion,
@@ -52771,6 +52845,15 @@ var NestedStackProvider = class {
 			...ctx.destroyOptions?.resourceWarnAfterByType && { resourceWarnAfterByType: ctx.destroyOptions.resourceWarnAfterByType },
 			...ctx.destroyOptions?.resourceTimeoutByType && { resourceTimeoutByType: ctx.destroyOptions.resourceTimeoutByType }
 		}));
+		if (childResult.skippedCount > 0 || childResult.interrupted) {
+			const causes = [];
+			if (childResult.skippedCount > 0) causes.push(`skipped ${childResult.skippedCount} resource(s)`);
+			if (childResult.interrupted) causes.push("was interrupted");
+			return {
+				outcome: "skipped",
+				reason: `nested stack ${childStackName} ${causes.join(" and ")}`
+			};
+		}
 	}
 	async getAttribute(_physicalId, _resourceType, attributeName) {
 		throw new Error(`AWS::CloudFormation::Stack: attribute '${attributeName}' is not in the recorded Outputs map. Only 'Outputs.<Key>' references to declared Output names on the child template are supported.`);
@@ -57689,6 +57772,7 @@ async function destroyCommand(stackArgs, options) {
 		} else throw new Error("Could not determine which stacks belong to this app. Specify stack names explicitly, use --all, or ensure --app / cdk.json is configured.");
 		const stackPatterns = stackArgs.length > 0 ? stackArgs : options.stack ? [options.stack] : [];
 		let totalErrors = 0;
+		let totalSkipped = 0;
 		let interrupted = false;
 		let stackNames;
 		if (options.all) stackNames = candidateStacks.map((s) => s.stackName);
@@ -57813,8 +57897,9 @@ async function destroyCommand(stackArgs, options) {
 					eventRecorder
 				}));
 				totalErrors += result.errorCount;
+				totalSkipped += result.skippedCount;
 				if (result.interrupted) interrupted = true;
-				destroyRunResult = result.errorCount > 0 ? "FAILED" : "SUCCEEDED";
+				destroyRunResult = result.errorCount > 0 || result.skippedCount > 0 ? "FAILED" : "SUCCEEDED";
 				eventRecorder.record({
 					eventType: "RUN_FINISHED",
 					stackName,
@@ -57823,7 +57908,8 @@ async function destroyCommand(stackArgs, options) {
 						created: 0,
 						updated: 0,
 						deleted: result.deletedCount,
-						...result.errorCount > 0 && { failed: result.errorCount }
+						...result.errorCount > 0 && { failed: result.errorCount },
+						...result.skippedCount > 0 && { skipped: result.skippedCount }
 					}
 				});
 			} catch (destroyError) {
@@ -57842,6 +57928,7 @@ async function destroyCommand(stackArgs, options) {
 		}
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
 		if (interrupted) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
+		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} cdkd could not address, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). Repair the physicalId in state.json and re-run 'cdkd destroy', or delete the resources by hand and drop the records with 'cdkd state orphan <stack>'.`);
 	} finally {
 		unforwardSigterm();
 		awsClients.destroy();
@@ -58251,9 +58338,17 @@ function stackTreeToJson(roots) {
 * PR B2 — until that lands, the orchestrator hard-errors at submission
 * time with a clear pointer.
 *
-* The list is intentionally narrow. Other resource types CFn may not yet
-* support for import are surfaced as errors by the CreateChangeSet call
-* itself; we do not try to maintain a closed allowlist here.
+* The list is intentionally narrow, and stays hand-written because each member
+* is a cdkd / CDK construct rather than something the registry describes.
+*
+* It is NOT the only refusal, though — the "defer to the CreateChangeSet
+* error" note this comment used to end on was revisited in issue
+* [#1659](https://github.com/go-to-k/cdkd/issues/1659). Types AWS refuses for
+* IMPORT because their registry schema declares no `read` handler are now
+* caught by {@link buildImportPlan}'s pre-flight instead, which needs no
+* hand-maintained list (the signal is derived from the schema cdkd already
+* fetches for the identifier) and names every offender in one pass — AWS's own
+* error names only some of them.
 */
 const NEVER_IMPORTABLE_TYPES = /* @__PURE__ */ new Set(["AWS::CDK::Metadata"]);
 /**
@@ -58426,6 +58521,16 @@ const COMPOSITE_ID_SPLITTERS = {
 			propertiesOverlay: { ApiId: apiId }
 		};
 	},
+	"AWS::S3Tables::Namespace": (physicalId) => {
+		const parts = physicalId.split("|");
+		if (parts.length !== 2) throw new Error(`expected 2 parts ('<tableBucketARN>|<namespaceName>'), got ${parts.length}: '${physicalId}'`);
+		const [tableBucketARN, namespace] = parts;
+		if (!tableBucketARN || !namespace) throw new Error(`empty part in '<tableBucketARN>|<namespaceName>': '${physicalId}'`);
+		return { resourceIdentifier: {
+			TableBucketARN: tableBucketARN,
+			Namespace: namespace
+		} };
+	},
 	"AWS::Lambda::Permission": (physicalId, properties) => {
 		const functionName = readStringProperty(properties, "FunctionName", "AWS::Lambda::Permission");
 		return {
@@ -58511,6 +58616,144 @@ function readStringProperty(properties, key, resourceType) {
 	return v;
 }
 /**
+* Types whose cdkd physicalId is a COMPOSITE (`|`-joined) string while
+* CloudFormation's `primaryIdentifier` is a SINGLE field — so the physicalId is
+* NOT the identifier value, and it is not a SPLIT of the composite either
+* (issue [#1659](https://github.com/go-to-k/cdkd/issues/1659)).
+*
+* ## Why this table exists next to `COMPOSITE_ID_SPLITTERS`
+*
+* `resolveResourceIdentifier` used to conflate two independent questions: the
+* ARITY of the CFn identifier, and the FORMAT of cdkd's physical id. The
+* single-field branch assumed "the physicalId IS the identifier value", which
+* holds for every type whose id is a scalar and silently produces a wrong value
+* for a composite-id type whose CFn identifier happens to be single-field —
+* `{ TableARN: 'arn:aws:s3tables:...|analytics|events' }` for an
+* `AWS::S3Tables::Table`. `COMPOSITE_ID_SPLITTERS` cannot fix that: it is only
+* consulted on the multi-field branch, so registering a type there would add an
+* entry no code path reaches.
+*
+* This table is consulted BEFORE the arity branch, so the two concerns are
+* separated: a registered type never takes the "physicalId is the identifier"
+* assumption regardless of what the schema's field count says.
+*
+* ## Why a RESOLVE and not a split
+*
+* The correct identifier for each member is a different value entirely, not a
+* segment of the composite — an ARN AWS minted, or an `sgr-` rule id. So each
+* entry reads the value cdkd recorded in state (`attributes`), and refuses when
+* it is absent rather than guessing.
+*
+* ## Live measurement (us-east-1, 2026-08-13)
+*
+* Every field below is BOTH the type's single-field `primaryIdentifier` AND
+* `readOnlyProperties`, which is why each resolution returns an EMPTY
+* `propertiesOverlay`: writing a read-only property into the synth template's
+* `Properties` block is rejected by CFn at changeset-create.
+*
+* | Type | `primaryIdentifier` | recorded as |
+* |---|---|---|
+* | `AWS::AppSync::DataSource` | `DataSourceArn` | `attributes.DataSourceArn` |
+* | `AWS::AppSync::Resolver` | `ResolverArn` | `attributes.ResolverArn` |
+* | `AWS::S3Tables::Table` | `TableARN` | `attributes.TableARN` |
+* | `AWS::EC2::SecurityGroupIngress` | `Id` | NOTHING (issue #1761) |
+*
+* All four declare a `read` handler, so CFn genuinely does accept them for
+* IMPORT — unlike `AWS::Glue::Table`, the type issue #1659's title names, which
+* CFn rejects outright (see {@link typeIsImportUnsupported}).
+*/
+const COMPOSITE_PHYSICAL_ID_IDENTIFIERS = {
+	"AWS::AppSync::DataSource": recordedArnIdentifier({
+		resourceType: "AWS::AppSync::DataSource",
+		field: "DataSourceArn",
+		physicalIdShape: "<apiId>|<name>",
+		arnServiceSegment: "appsync"
+	}),
+	"AWS::AppSync::Resolver": recordedArnIdentifier({
+		resourceType: "AWS::AppSync::Resolver",
+		field: "ResolverArn",
+		physicalIdShape: "<apiId>|<typeName>|<fieldName>",
+		arnServiceSegment: "appsync"
+	}),
+	"AWS::S3Tables::Table": recordedArnIdentifier({
+		resourceType: "AWS::S3Tables::Table",
+		field: "TableARN",
+		physicalIdShape: "<tableBucketARN>|<namespace>|<name>",
+		arnServiceSegment: "s3tables"
+	}),
+	"AWS::EC2::SecurityGroupIngress": {
+		field: "Id",
+		resolve: ({ logicalId }) => {
+			throw new Error(`cdkd's physical id for AWS::EC2::SecurityGroupIngress is the composite '<groupId>|<ipProtocol>|<fromPort>|<toPort>', but CloudFormation IMPORT identifies the rule by the 'sgr-...' security-group rule id AWS assigns, which cdkd does not record in state (tracked in https://github.com/go-to-k/cdkd/issues/1761). Remove '${logicalId}' from the stack before exporting (the rule stays in AWS and can be re-declared in CloudFormation afterwards), or destroy it first and let CloudFormation create it fresh.`);
+		}
+	}
+};
+/**
+* Build the {@link CompositePhysicalIdIdentifier} for a type whose CFn
+* identifier is an ARN cdkd records in `attributes` under the SAME name as the
+* `primaryIdentifier` field.
+*
+* Two accepted sources, mirroring the splitter family's "both shapes exist in
+* state in the wild" contract:
+*
+* 1. the recorded attribute, which is what a fresh deploy and a cdkd `import`
+*    both write; and
+* 2. a physicalId that is ALREADY the bare ARN. Two live producers:
+*    `S3TablesProvider.importTable` records it for a Cloud-Control-routed
+*    table (CC's identifier for the type IS the ARN), and an AppSync child
+*    adopted through `cdkd import --migrate-from-cloudformation` records
+*    CloudFormation's `PhysicalResourceId` verbatim, which is likewise the
+*    ARN.
+*
+* **Both sources are validated by the SAME predicate.** An earlier cut checked
+* the ARN's shape only on source 2 — the rare one — while source 1, which
+* fires on essentially every export, accepted any non-blank string verbatim.
+* That is the wrong way round: a hand-edited state row, a row written by an
+* older binary that recorded the composite under the attribute name, or an ARN
+* for a different service sitting under `attributes.<field>` would each have
+* been shipped as the IMPORT identifier and silently adopted the WRONG
+* resource, which is precisely what this table exists to prevent.
+*
+* Anything failing both sources is refused. That covers the degraded record
+* `docs/state-management.md` describes — written by a cdkd older than the fix
+* that started recording the ARN, or by an import that could not reach STS —
+* and the remedy is the one that doc already gives.
+*/
+function recordedArnIdentifier(options) {
+	const { resourceType, field, physicalIdShape, arnServiceSegment } = options;
+	/**
+	* Is this value usable AS the type's CFn identifier?
+	*
+	* - `arn:` prefix and the type's own SERVICE segment: an ARN naming another
+	*   service is a different value entirely. Partition-agnostic by
+	*   construction, so `arn:aws-cn:s3tables:...` matches.
+	* - no `|`: cdkd's composite for `AWS::S3Tables::Table` is built FROM the
+	*   bucket ARN, so it satisfies both checks above — the separator test is
+	*   what distinguishes the composite from the identifier, on BOTH sources.
+	*/
+	const isUsableIdentifier = (value) => {
+		const trimmed = value.trim();
+		return trimmed.startsWith("arn:") && trimmed.includes(`:${arnServiceSegment}:`) && !trimmed.includes("|");
+	};
+	return {
+		field,
+		resolve: ({ logicalId, physicalId, attributes }) => {
+			const recorded = attributes[field];
+			if (typeof recorded === "string" && isUsableIdentifier(recorded)) return recorded.trim();
+			if (isUsableIdentifier(physicalId)) return physicalId.trim();
+			const recordedNote = typeof recorded === "string" && recorded.trim() ? `attributes.${field} is recorded as '${recorded.trim()}', which is not a ${arnServiceSegment} ARN` : `attributes.${field} is missing or empty`;
+			throw new Error(`cdkd's physical id for ${resourceType} is the composite '${physicalIdShape}', but CloudFormation IMPORT identifies the resource by its ${field}, which cdkd state does not record usably for '${logicalId}' (${recordedNote}). Re-deploy the stack once so cdkd records ${field}, then re-run cdkd export.`);
+		}
+	};
+}
+/**
+* Every type registered in {@link COMPOSITE_PHYSICAL_ID_IDENTIFIERS}. Exported
+* so a test can assert the table's SIZE, not just membership — a new entry
+* needs a measurement row in the table's doc comment, and a size-blind test
+* would let one land silently.
+*/
+const COMPOSITE_PHYSICAL_ID_IDENTIFIER_TYPES = Object.keys(COMPOSITE_PHYSICAL_ID_IDENTIFIERS);
+/**
 * Resource types AWS does NOT support in IMPORT changesets but DOES
 * support normal CREATE for. cdkd handles these via a pre-delete + phase-2
 * CREATE dance (see {@link RecreateBeforePhase2Entry}). When the user
@@ -58664,17 +58907,20 @@ async function exportCommand(stackArg, options) {
 				}
 			}
 		}
+		const { phase1Imports, phase2Creates, recreateBeforePhase2, nestedStackRows, blocked } = await buildImportPlan(state, template, awsClients.cloudFormation, resolvedStackName, {
+			recreateImportUnsupported: options.recreateImportUnsupported,
+			skipImportSupportPreflight: options.skipImportSupportPreflight
+		});
+		if (blocked.length > 0) {
+			logger.error("The following resources block migration:");
+			for (const b of blocked) logger.error(`  - ${b.logicalId} (${b.resourceType}): ${b.reason}`);
+			throw new Error(`${blocked.length} resource(s) block migration. Either destroy them first (cdkd destroy / cdkd state destroy cherry-picked), or remove them from the CDK app and re-synthesize.`);
+		}
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
 		if (!options.dryRun) {
 			if (!await lockManager.acquireLock(resolvedStackName, targetRegion, owner, "export")) throw new Error(`Could not acquire lock for stack '${resolvedStackName}' (${targetRegion}) — another cdkd process holds it. Wait for it to finish, or run 'cdkd force-unlock ${resolvedStackName}' if you are certain no other process is active.`);
 		}
 		try {
-			const { phase1Imports, phase2Creates, recreateBeforePhase2, nestedStackRows, blocked } = await buildImportPlan(state, template, awsClients.cloudFormation, resolvedStackName, { recreateImportUnsupported: options.recreateImportUnsupported });
-			if (blocked.length > 0) {
-				logger.error("The following resources block migration:");
-				for (const b of blocked) logger.error(`  - ${b.logicalId} (${b.resourceType}): ${b.reason}`);
-				throw new Error(`${blocked.length} resource(s) block migration. Either destroy them first (cdkd destroy / cdkd state destroy cherry-picked), or remove them from the CDK app and re-synthesize.`);
-			}
 			if (nestedStackRows.length > 0) {
 				const nestedStackTree = await buildCdkdStateStackTree(resolvedStackName, targetRegion, stateBackend, state);
 				reportDriftBaselineGaps(state, logger);
@@ -58717,7 +58963,8 @@ async function exportCommand(stackArg, options) {
 						dryRun: options.dryRun,
 						yes: options.yes,
 						includeNonImportable: options.includeNonImportable,
-						recreateImportUnsupported: options.recreateImportUnsupported
+						recreateImportUnsupported: options.recreateImportUnsupported,
+						skipImportSupportPreflight: options.skipImportSupportPreflight
 					}
 				})).outcome === "success") printNextSteps({
 					cfnStackName: options.cfnStackName ?? cdkd2cfnStackName(resolvedStackName),
@@ -59256,7 +59503,16 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 		}
 		let resolved;
 		try {
-			resolved = await resolveResourceIdentifier(resourceType, stateEntry.physicalId, stateEntry.properties ?? {}, cfnClient, identifierCache);
+			const schemaInfo = await cachedTypeSchemaInfo(resourceType, cfnClient, identifierCache);
+			if (!options.skipImportSupportPreflight && typeIsImportUnsupported(schemaInfo)) {
+				blocked.push({
+					logicalId,
+					resourceType,
+					reason: `AWS CloudFormation does not support ${resourceType} in IMPORT changesets: its CloudFormation registry schema declares no 'read' handler (and reports the type as NON_PROVISIONABLE), and IMPORT needs that handler to look the resource up by identifier. CreateChangeSet would reject the whole export with "ResourceTypes [${resourceType}] are not supported for Import". Remove the resource from the stack before exporting (it stays in AWS and can be re-declared in CloudFormation afterwards), or destroy it first and let CloudFormation create it fresh. If AWS has since added IMPORT support for this type, please open a cdkd issue.`
+				});
+				continue;
+			}
+			resolved = resolveResourceIdentifier(resourceType, logicalId, stateEntry.physicalId, stateEntry.properties ?? {}, stateEntry.attributes ?? {}, schemaInfo);
 		} catch (err) {
 			blocked.push({
 				logicalId,
@@ -59286,6 +59542,11 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 * `ResourcesToImport[].ResourceIdentifier` for the given resource type
 * and cdkd state's physical ID.
 *
+* Types whose cdkd physicalId is COMPOSITE while the CFn identifier is a
+* single field (`COMPOSITE_PHYSICAL_ID_IDENTIFIERS`): resolved from cdkd
+* state's recorded attributes, BEFORE the field-count branch below — the
+* physicalId is neither the identifier nor a source to split (issue #1659).
+*
 * Single-key types: the map has a single entry keyed by the schema's
 * primaryIdentifier field name (e.g. `{ BucketName: 'my-bucket' }`).
 *
@@ -59295,16 +59556,27 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 * into one entry per field. Composite types without a registered
 * splitter surface a clear error pointing at where to add one.
 *
-* Prefers `DescribeType` (the authoritative AWS-internal registry) and
-* falls back to a hardcoded single-key table when DescribeType fails
-* (insufficient permissions, throttling, obscure type without a registry
-* entry).
-*/
-async function resolveResourceIdentifier(resourceType, physicalId, properties, cfnClient, cache) {
-	let entry = cache.get(resourceType);
-	if (entry === void 0) {
-		entry = await fetchPrimaryIdentifier(resourceType, cfnClient);
-		cache.set(resourceType, entry);
+* `entry` is the caller's already-resolved registry-schema info — see
+* {@link cachedTypeSchemaInfo}, which prefers `DescribeType` (the authoritative
+* AWS-internal registry) and falls back to a hardcoded single-key table when
+* DescribeType fails (insufficient permissions, throttling, obscure type
+* without a registry entry). Taking it as a parameter rather than fetching is
+* what keeps `buildImportPlan` to ONE DescribeType per type across both the
+* IMPORT pre-flight and this resolution.
+*/
+function resolveResourceIdentifier(resourceType, logicalId, physicalId, properties, attributes, entry) {
+	const compositeIdentifier = COMPOSITE_PHYSICAL_ID_IDENTIFIERS[resourceType];
+	if (compositeIdentifier) {
+		if (entry.fields.length !== 1 || entry.fields[0] !== compositeIdentifier.field) throw new Error(`${resourceType} is registered in COMPOSITE_PHYSICAL_ID_IDENTIFIERS as identified by '${compositeIdentifier.field}', but CloudFormation now reports primaryIdentifier [${entry.fields.join(", ")}]. The registry schema changed under cdkd — update the entry in src/cli/commands/export.ts (or move the type to COMPOSITE_ID_SPLITTERS if its identifier is now composite too)`);
+		const value = compositeIdentifier.resolve({
+			logicalId,
+			physicalId,
+			attributes
+		});
+		return {
+			resourceIdentifier: { [compositeIdentifier.field]: value },
+			propertiesOverlay: {}
+		};
 	}
 	if (entry.fields.length === 1) return { resourceIdentifier: { [entry.fields[0]]: physicalId } };
 	const splitter = COMPOSITE_ID_SPLITTERS[resourceType];
@@ -59319,6 +59591,53 @@ async function resolveResourceIdentifier(resourceType, physicalId, properties, c
 	return result;
 }
 /**
+* Cache-consulting wrapper around {@link fetchPrimaryIdentifier}. Shared by
+* `resolveResourceIdentifier` and `buildImportPlan`'s pre-flight so one
+* DescribeType per type answers both questions.
+*/
+async function cachedTypeSchemaInfo(resourceType, cfnClient, cache) {
+	const cached = cache.get(resourceType);
+	if (cached !== void 0) return cached;
+	const entry = await fetchPrimaryIdentifier(resourceType, cfnClient);
+	cache.set(resourceType, entry);
+	return entry;
+}
+/**
+* True when the registry schema says CloudFormation will refuse the type in an
+* IMPORT changeset (`ValidationError: ResourceTypes [<T>] are not supported
+* for Import`) — IMPORT looks the resource up by identifier through the type's
+* `read` handler, so a type without one cannot be adopted.
+*
+* Live-measured (us-east-1, 2026-08-13) against `CreateChangeSet
+* --change-set-type IMPORT`: `AWS::Glue::Table` / `AWS::Route53::RecordSet` /
+* `AWS::AppSync::ApiKey` / `AWS::EC2::NetworkAclEntry` /
+* `AWS::Route53::RecordSetGroup` / `AWS::SQS::QueuePolicy` /
+* `AWS::SNS::TopicPolicy` all lack a `read` handler, are all
+* `NON_PROVISIONABLE`, and were all rejected; `AWS::S3::Bucket`
+* (`FULLY_MUTABLE`, read handler present) passed the type check. Both shapes
+* of "no read handler" occur and both count: NO `handlers` block at all (the
+* legacy types) and a `handlers` block whose keys are only create / update /
+* delete (`AWS::EC2::NetworkAclEntry`).
+*
+* **Why the verdict needs TWO agreeing fields.** Reading "the `handlers` key is
+* missing" as a refusal on its own makes any partial or unusual response block
+* an export that works today — the one regression this pre-flight could cause,
+* and strictly worse than the status quo of letting AWS answer. So the refusal
+* also requires `ProvisioningType: NON_PROVISIONABLE`; a response satisfying
+* only one of the two resolves to `unknown` and is left to CreateChangeSet.
+*
+* The two were perfectly CORRELATED across the 21 types sampled on 2026-08-13
+* (every no-read-handler type was NON_PROVISIONABLE and vice versa), so on
+* today's registry the conjunction's real work is requiring a COMPLETE
+* DescribeType response before refusing. The `read` handler stays the primary
+* signal because it is the mechanistic reason CFn accepts a type for IMPORT —
+* refusing on `ProvisioningType` alone would reject a NON_PROVISIONABLE type
+* that does declare one, should AWS ever publish that combination.
+*/
+function typeIsImportUnsupported(entry) {
+	return entry.importSupport === "unsupported";
+}
+/**
 * Fetch the primary identifier field names for a resource type, with a
 * hardcoded single-key fallback when DescribeType is unavailable.
 */
@@ -59326,15 +59645,26 @@ async function fetchPrimaryIdentifier(resourceType, cfnClient) {
 	try {
 		const resp = await describeTypeWithThrottleRetry(resourceType, cfnClient);
 		if (resp.Schema) {
-			const primary = JSON.parse(resp.Schema).primaryIdentifier;
-			if (Array.isArray(primary) && primary.length > 0 && primary.every((p) => typeof p === "string")) return { fields: primary.map((p) => p.replace(/^\/properties\//, "")) };
+			const parsed = JSON.parse(resp.Schema);
+			const primary = parsed.primaryIdentifier;
+			if (Array.isArray(primary) && primary.length > 0 && primary.every((p) => typeof p === "string")) {
+				const fields = primary.map((p) => p.replace(/^\/properties\//, ""));
+				const handlers = parsed.handlers;
+				return {
+					fields,
+					importSupport: typeof handlers === "object" && handlers !== null && Object.prototype.hasOwnProperty.call(handlers, "read") ? "importable" : resp.ProvisioningType === "NON_PROVISIONABLE" ? "unsupported" : "unknown"
+				};
+			}
 		}
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
 		getLogger().debug(`DescribeType failed for ${resourceType}: ${msg} — using fallback`);
 	}
 	const fallback = PRIMARY_IDENTIFIER_FALLBACK[resourceType];
-	if (fallback) return { fields: [fallback] };
+	if (fallback) return {
+		fields: [fallback],
+		importSupport: "unknown"
+	};
 	throw new Error(`primary identifier unknown (DescribeType returned no usable schema and no fallback is registered). Add ${resourceType} to PRIMARY_IDENTIFIER_FALLBACK in export.ts, or open an issue.`);
 }
 /**
@@ -60260,7 +60590,10 @@ async function runPerStackImportLoop(args) {
 	const perStackPlans = [];
 	for (const node of leafFirst) {
 		const meta = nodesByCdkdName.get(node.stackName);
-		const plan = await buildImportPlan(meta.state, meta.template, deps.cfnClient, meta.cdkdStackName, { recreateImportUnsupported: options.recreateImportUnsupported });
+		const plan = await buildImportPlan(meta.state, meta.template, deps.cfnClient, meta.cdkdStackName, {
+			recreateImportUnsupported: options.recreateImportUnsupported,
+			skipImportSupportPreflight: options.skipImportSupportPreflight === true
+		});
 		if (plan.blocked.length > 0) {
 			const lines = plan.blocked.map((b) => `  - ${b.logicalId} (${b.resourceType}): ${b.reason}`);
 			throw new Error(`Stack '${meta.cdkdStackName}' has ${plan.blocked.length} resource(s) that block migration:\n${lines.join("\n")}`);
@@ -60676,7 +61009,7 @@ async function confirmPrompt$3(prompt) {
 	}
 }
 function createExportCommand() {
-	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.").option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (currently only AWS::ApiGatewayV2::Stage, emitted by CDK HttpApi). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
+	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.").option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--skip-import-support-preflight", "Skip the pre-flight that refuses resource types whose CloudFormation registry schema says CFn cannot IMPORT them (no read handler AND NON_PROVISIONABLE), and let CreateChangeSet answer instead. The pre-flight is a registry HEURISTIC, not AWS's supported-for-import list, so this is the escape hatch for a type AWS has since made importable. Expect the changeset to be rejected if the heuristic was right.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (currently only AWS::ApiGatewayV2::Stage, emitted by CDK HttpApi). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -61356,6 +61689,7 @@ async function stateDestroyCommand(stackArgs, options) {
 		}
 		logger.info(`Found ${stackNames.length} stack(s) to destroy: ${stackNames.join(", ")}`);
 		let totalErrors = 0;
+		let totalSkipped = 0;
 		let interrupted = false;
 		for (const stackName of stackNames) {
 			const refs = stateRefs.filter((r) => r.stackName === stackName);
@@ -61416,6 +61750,7 @@ async function stateDestroyCommand(stackArgs, options) {
 					...options.resourceTimeout?.perTypeMs && { resourceTimeoutByType: options.resourceTimeout.perTypeMs }
 				}));
 				totalErrors += result.errorCount;
+				totalSkipped += result.skippedCount;
 				if (result.interrupted) interrupted = true;
 				if (interrupted) break;
 			}
@@ -61423,6 +61758,7 @@ async function stateDestroyCommand(stackArgs, options) {
 		}
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd state destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
 		if (interrupted) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
+		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} cdkd could not address, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). Repair the physicalId in state.json and re-run 'cdkd state destroy', or delete the resources by hand and drop the records with 'cdkd state orphan <stack>'.`);
 	} finally {
 		unforwardSigterm();
 		setup.dispose();
@@ -62492,6 +62828,11 @@ function printRunList(stackName, region, runs) {
 	logger.info(gray(`\nUse 'cdkd events ${stackName} --run <runId>' to read one run's events.`));
 }
 /** Human-readable single-run event stream (in recorded order). */
+/**
+* Render one run's event stream. Exported for unit-test coverage — the
+* `counts.skipped` / `reason` rendering is the whole value of those fields
+* (issue #1752), so it needs a direct fence rather than only `--json` coverage.
+*/
 function printRunEvents(stackName, region, runId, events) {
 	const logger = getLogger();
 	logger.info(`${bold("Events for run")} ${cyan(runId)} ${gray(`(${stackName}, ${region})`)}`);
@@ -62509,8 +62850,9 @@ function printRunEvents(stackName, region, runId, events) {
 		if (e.cdkdVersion) parts.push(gray(`cdkd ${e.cdkdVersion}`));
 		if (e.result) parts.push(e.result === "SUCCEEDED" ? green(e.result) : red(e.result));
 		if (typeof e.durationMs === "number") parts.push(gray(`${e.durationMs}ms`));
-		if (e.counts) parts.push(gray(`+${e.counts.created}/~${e.counts.updated}/-${e.counts.deleted}` + (e.counts.failed ? ` !${e.counts.failed}` : "")));
+		if (e.counts) parts.push(gray(`+${e.counts.created}/~${e.counts.updated}/-${e.counts.deleted}` + (e.counts.failed ? ` !${e.counts.failed}` : "") + (e.counts.skipped ? ` ⚠${e.counts.skipped}` : "")));
 		logger.info(`  ${parts.join("  ")}`);
+		if (e.reason) logger.info(`      ${yellow(e.reason)}`);
 		if (e.error) {
 			const code = e.error.awsErrorCode ? ` (${e.error.awsErrorCode})` : "";
 			const reqId = e.error.requestId ? gray(` requestId=${e.error.requestId}`) : "";
@@ -62518,10 +62860,17 @@ function printRunEvents(stackName, region, runId, events) {
 		}
 	}
 }
-/** Color the event-type token by its lifecycle phase. */
+/**
+* Color the event-type token by its lifecycle phase.
+*
+* Exported for unit-test coverage (matching `destroy-runner.ts`'s
+* `PROTECTION_PROPERTY_BY_TYPE` convention) — it is pure, so testing it
+* directly beats driving it through the renderer's log output.
+*/
 function colorizeEventType(eventType) {
 	if (eventType.endsWith("FAILED")) return red(eventType);
 	if (eventType.endsWith("SUCCEEDED") || eventType === "RUN_FINISHED") return green(eventType);
+	if (eventType === "RESOURCE_SKIPPED") return yellow(eventType);
 	if (eventType.startsWith("ROLLBACK")) return yellow(eventType);
 	return cyan(eventType);
 }
@@ -74505,7 +74854,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.22");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.24");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;