@go-to-k/cdkd 0.281.23 → 0.281.24

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as MIGRATE_TMP_PREFIX, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as getDefaultStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerStreaming, G as getAccountInfo, Gt as resolveSkipPrefix, H as isTerminationProtectionPropagationError, Ht as resolveApp, I as ProviderRegistry, It as AssetManifestLoader, J as normalizeAwsTagsToCfn, Jt as resolveUseCdkBootstrapAssets, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefault, L as findActionableSilentDrops, Lt as getDockerImageBySourceHash, M as yellow, Mt as formatDockerLoginError, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as getDockerCmd, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as runDockerForeground, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_URL_LIMIT, R as findSilentDropProperties, Rt as Synthesizer, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveAutoAssetStorage, V as disableInstanceApiTermination, Vt as getLegacyStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveCaptureObservedState, X as assertRegionMatch, Xt as warnDeprecatedNoPrefixCliFlag, Y as resolveExplicitPhysicalId, Yt as stateBucketExistenceConfirmed, Z as coerceCfnBoolean, Zt as CFN_TEMPLATE_BODY_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as findLargeInlineResources, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as buildDockerImage, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as expectedOwnerParam, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefaultAndSource, r as DeployEngine, rn as derivePartitionAndUrlSuffix, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as uploadCfnTemplate, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as synthesisStatusMessage } from "./deploy-engine-uxo_FCje.js";
+import { $ as configStringRefusal, $t as MIGRATE_TMP_PREFIX, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as getDefaultStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as PartialFailureError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as StackHasActiveImportsError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceUpdateNotSupportedError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Ft as runDockerStreaming, G as getAccountInfo, Gt as resolveSkipPrefix, H as isTerminationProtectionPropagationError, Ht as resolveApp, I as ProviderRegistry, It as AssetManifestLoader, J as normalizeAwsTagsToCfn, Jt as resolveUseCdkBootstrapAssets, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefault, L as findActionableSilentDrops, Lt as getDockerImageBySourceHash, M as yellow, Mt as formatDockerLoginError, N as IAMRoleProvider, Nn as normalizeAwsError, Nt as getDockerCmd, O as cyan, On as StackTerminationProtectionError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as withErrorHandling, Pt as runDockerForeground, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_URL_LIMIT, R as findSilentDropProperties, Rt as Synthesizer, S as extractDeploymentEventError, Sn as NestedStackChildDirectDestroyError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ResourceTimeoutError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveAutoAssetStorage, V as disableInstanceApiTermination, Vt as getLegacyStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveCaptureObservedState, X as assertRegionMatch, Xt as warnDeprecatedNoPrefixCliFlag, Y as resolveExplicitPhysicalId, Yt as stateBucketExistenceConfirmed, Z as coerceCfnBoolean, Zt as CFN_TEMPLATE_BODY_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalInvokeBuildError$1, _t as AssetPublisher, a as DeploymentEventsStore, an as processStackMessages, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as AwsClients, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as setAwsClients, dt as DagBuilder, en as findLargeInlineResources, et as readConfigString, f as computeImplicitDeleteEdges, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gn as DeployCancelledError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as AssemblyReader, it as requireConfigString, j as red, jt as buildDockerImage, k as gray, kt as validateAssetBucketName, l as replayRollback, ln as getAwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as expectedOwnerParam, nt as requireConfigArray, o as planFailedOps, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as CdkdError, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefaultAndSource, r as DeployEngine, rn as derivePartitionAndUrlSuffix, rt as requireConfigObject, s as planRollback, sn as resolveBucketRegion, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as uploadCfnTemplate, tt as replayWarn, u as withResourceDeadline, un as resetAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalMigrateError, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as ProvisioningError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xn as MissingCdkCliError, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalStartServiceError, yt as WorkGraph, z as CloudControlProvider, zt as synthesisStatusMessage } from "./deploy-engine-BkXNtI7L.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CCSQkGwO.js";
+import { t as ASGProvider } from "./asg-provider-CxK7d3pH.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -58338,9 +58338,17 @@ function stackTreeToJson(roots) {
 * PR B2 — until that lands, the orchestrator hard-errors at submission
 * time with a clear pointer.
 *
-* The list is intentionally narrow. Other resource types CFn may not yet
-* support for import are surfaced as errors by the CreateChangeSet call
-* itself; we do not try to maintain a closed allowlist here.
+* The list is intentionally narrow, and stays hand-written because each member
+* is a cdkd / CDK construct rather than something the registry describes.
+*
+* It is NOT the only refusal, though — the "defer to the CreateChangeSet
+* error" note this comment used to end on was revisited in issue
+* [#1659](https://github.com/go-to-k/cdkd/issues/1659). Types AWS refuses for
+* IMPORT because their registry schema declares no `read` handler are now
+* caught by {@link buildImportPlan}'s pre-flight instead, which needs no
+* hand-maintained list (the signal is derived from the schema cdkd already
+* fetches for the identifier) and names every offender in one pass — AWS's own
+* error names only some of them.
 */
 const NEVER_IMPORTABLE_TYPES = /* @__PURE__ */ new Set(["AWS::CDK::Metadata"]);
 /**
@@ -58513,6 +58521,16 @@ const COMPOSITE_ID_SPLITTERS = {
 			propertiesOverlay: { ApiId: apiId }
 		};
 	},
+	"AWS::S3Tables::Namespace": (physicalId) => {
+		const parts = physicalId.split("|");
+		if (parts.length !== 2) throw new Error(`expected 2 parts ('<tableBucketARN>|<namespaceName>'), got ${parts.length}: '${physicalId}'`);
+		const [tableBucketARN, namespace] = parts;
+		if (!tableBucketARN || !namespace) throw new Error(`empty part in '<tableBucketARN>|<namespaceName>': '${physicalId}'`);
+		return { resourceIdentifier: {
+			TableBucketARN: tableBucketARN,
+			Namespace: namespace
+		} };
+	},
 	"AWS::Lambda::Permission": (physicalId, properties) => {
 		const functionName = readStringProperty(properties, "FunctionName", "AWS::Lambda::Permission");
 		return {
@@ -58598,6 +58616,144 @@ function readStringProperty(properties, key, resourceType) {
 	return v;
 }
 /**
+* Types whose cdkd physicalId is a COMPOSITE (`|`-joined) string while
+* CloudFormation's `primaryIdentifier` is a SINGLE field — so the physicalId is
+* NOT the identifier value, and it is not a SPLIT of the composite either
+* (issue [#1659](https://github.com/go-to-k/cdkd/issues/1659)).
+*
+* ## Why this table exists next to `COMPOSITE_ID_SPLITTERS`
+*
+* `resolveResourceIdentifier` used to conflate two independent questions: the
+* ARITY of the CFn identifier, and the FORMAT of cdkd's physical id. The
+* single-field branch assumed "the physicalId IS the identifier value", which
+* holds for every type whose id is a scalar and silently produces a wrong value
+* for a composite-id type whose CFn identifier happens to be single-field —
+* `{ TableARN: 'arn:aws:s3tables:...|analytics|events' }` for an
+* `AWS::S3Tables::Table`. `COMPOSITE_ID_SPLITTERS` cannot fix that: it is only
+* consulted on the multi-field branch, so registering a type there would add an
+* entry no code path reaches.
+*
+* This table is consulted BEFORE the arity branch, so the two concerns are
+* separated: a registered type never takes the "physicalId is the identifier"
+* assumption regardless of what the schema's field count says.
+*
+* ## Why a RESOLVE and not a split
+*
+* The correct identifier for each member is a different value entirely, not a
+* segment of the composite — an ARN AWS minted, or an `sgr-` rule id. So each
+* entry reads the value cdkd recorded in state (`attributes`), and refuses when
+* it is absent rather than guessing.
+*
+* ## Live measurement (us-east-1, 2026-08-13)
+*
+* Every field below is BOTH the type's single-field `primaryIdentifier` AND
+* `readOnlyProperties`, which is why each resolution returns an EMPTY
+* `propertiesOverlay`: writing a read-only property into the synth template's
+* `Properties` block is rejected by CFn at changeset-create.
+*
+* | Type | `primaryIdentifier` | recorded as |
+* |---|---|---|
+* | `AWS::AppSync::DataSource` | `DataSourceArn` | `attributes.DataSourceArn` |
+* | `AWS::AppSync::Resolver` | `ResolverArn` | `attributes.ResolverArn` |
+* | `AWS::S3Tables::Table` | `TableARN` | `attributes.TableARN` |
+* | `AWS::EC2::SecurityGroupIngress` | `Id` | NOTHING (issue #1761) |
+*
+* All four declare a `read` handler, so CFn genuinely does accept them for
+* IMPORT — unlike `AWS::Glue::Table`, the type issue #1659's title names, which
+* CFn rejects outright (see {@link typeIsImportUnsupported}).
+*/
+const COMPOSITE_PHYSICAL_ID_IDENTIFIERS = {
+	"AWS::AppSync::DataSource": recordedArnIdentifier({
+		resourceType: "AWS::AppSync::DataSource",
+		field: "DataSourceArn",
+		physicalIdShape: "<apiId>|<name>",
+		arnServiceSegment: "appsync"
+	}),
+	"AWS::AppSync::Resolver": recordedArnIdentifier({
+		resourceType: "AWS::AppSync::Resolver",
+		field: "ResolverArn",
+		physicalIdShape: "<apiId>|<typeName>|<fieldName>",
+		arnServiceSegment: "appsync"
+	}),
+	"AWS::S3Tables::Table": recordedArnIdentifier({
+		resourceType: "AWS::S3Tables::Table",
+		field: "TableARN",
+		physicalIdShape: "<tableBucketARN>|<namespace>|<name>",
+		arnServiceSegment: "s3tables"
+	}),
+	"AWS::EC2::SecurityGroupIngress": {
+		field: "Id",
+		resolve: ({ logicalId }) => {
+			throw new Error(`cdkd's physical id for AWS::EC2::SecurityGroupIngress is the composite '<groupId>|<ipProtocol>|<fromPort>|<toPort>', but CloudFormation IMPORT identifies the rule by the 'sgr-...' security-group rule id AWS assigns, which cdkd does not record in state (tracked in https://github.com/go-to-k/cdkd/issues/1761). Remove '${logicalId}' from the stack before exporting (the rule stays in AWS and can be re-declared in CloudFormation afterwards), or destroy it first and let CloudFormation create it fresh.`);
+		}
+	}
+};
+/**
+* Build the {@link CompositePhysicalIdIdentifier} for a type whose CFn
+* identifier is an ARN cdkd records in `attributes` under the SAME name as the
+* `primaryIdentifier` field.
+*
+* Two accepted sources, mirroring the splitter family's "both shapes exist in
+* state in the wild" contract:
+*
+* 1. the recorded attribute, which is what a fresh deploy and a cdkd `import`
+*    both write; and
+* 2. a physicalId that is ALREADY the bare ARN. Two live producers:
+*    `S3TablesProvider.importTable` records it for a Cloud-Control-routed
+*    table (CC's identifier for the type IS the ARN), and an AppSync child
+*    adopted through `cdkd import --migrate-from-cloudformation` records
+*    CloudFormation's `PhysicalResourceId` verbatim, which is likewise the
+*    ARN.
+*
+* **Both sources are validated by the SAME predicate.** An earlier cut checked
+* the ARN's shape only on source 2 — the rare one — while source 1, which
+* fires on essentially every export, accepted any non-blank string verbatim.
+* That is the wrong way round: a hand-edited state row, a row written by an
+* older binary that recorded the composite under the attribute name, or an ARN
+* for a different service sitting under `attributes.<field>` would each have
+* been shipped as the IMPORT identifier and silently adopted the WRONG
+* resource, which is precisely what this table exists to prevent.
+*
+* Anything failing both sources is refused. That covers the degraded record
+* `docs/state-management.md` describes — written by a cdkd older than the fix
+* that started recording the ARN, or by an import that could not reach STS —
+* and the remedy is the one that doc already gives.
+*/
+function recordedArnIdentifier(options) {
+	const { resourceType, field, physicalIdShape, arnServiceSegment } = options;
+	/**
+	* Is this value usable AS the type's CFn identifier?
+	*
+	* - `arn:` prefix and the type's own SERVICE segment: an ARN naming another
+	*   service is a different value entirely. Partition-agnostic by
+	*   construction, so `arn:aws-cn:s3tables:...` matches.
+	* - no `|`: cdkd's composite for `AWS::S3Tables::Table` is built FROM the
+	*   bucket ARN, so it satisfies both checks above — the separator test is
+	*   what distinguishes the composite from the identifier, on BOTH sources.
+	*/
+	const isUsableIdentifier = (value) => {
+		const trimmed = value.trim();
+		return trimmed.startsWith("arn:") && trimmed.includes(`:${arnServiceSegment}:`) && !trimmed.includes("|");
+	};
+	return {
+		field,
+		resolve: ({ logicalId, physicalId, attributes }) => {
+			const recorded = attributes[field];
+			if (typeof recorded === "string" && isUsableIdentifier(recorded)) return recorded.trim();
+			if (isUsableIdentifier(physicalId)) return physicalId.trim();
+			const recordedNote = typeof recorded === "string" && recorded.trim() ? `attributes.${field} is recorded as '${recorded.trim()}', which is not a ${arnServiceSegment} ARN` : `attributes.${field} is missing or empty`;
+			throw new Error(`cdkd's physical id for ${resourceType} is the composite '${physicalIdShape}', but CloudFormation IMPORT identifies the resource by its ${field}, which cdkd state does not record usably for '${logicalId}' (${recordedNote}). Re-deploy the stack once so cdkd records ${field}, then re-run cdkd export.`);
+		}
+	};
+}
+/**
+* Every type registered in {@link COMPOSITE_PHYSICAL_ID_IDENTIFIERS}. Exported
+* so a test can assert the table's SIZE, not just membership — a new entry
+* needs a measurement row in the table's doc comment, and a size-blind test
+* would let one land silently.
+*/
+const COMPOSITE_PHYSICAL_ID_IDENTIFIER_TYPES = Object.keys(COMPOSITE_PHYSICAL_ID_IDENTIFIERS);
+/**
 * Resource types AWS does NOT support in IMPORT changesets but DOES
 * support normal CREATE for. cdkd handles these via a pre-delete + phase-2
 * CREATE dance (see {@link RecreateBeforePhase2Entry}). When the user
@@ -58751,17 +58907,20 @@ async function exportCommand(stackArg, options) {
 				}
 			}
 		}
+		const { phase1Imports, phase2Creates, recreateBeforePhase2, nestedStackRows, blocked } = await buildImportPlan(state, template, awsClients.cloudFormation, resolvedStackName, {
+			recreateImportUnsupported: options.recreateImportUnsupported,
+			skipImportSupportPreflight: options.skipImportSupportPreflight
+		});
+		if (blocked.length > 0) {
+			logger.error("The following resources block migration:");
+			for (const b of blocked) logger.error(`  - ${b.logicalId} (${b.resourceType}): ${b.reason}`);
+			throw new Error(`${blocked.length} resource(s) block migration. Either destroy them first (cdkd destroy / cdkd state destroy cherry-picked), or remove them from the CDK app and re-synthesize.`);
+		}
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
 		if (!options.dryRun) {
 			if (!await lockManager.acquireLock(resolvedStackName, targetRegion, owner, "export")) throw new Error(`Could not acquire lock for stack '${resolvedStackName}' (${targetRegion}) — another cdkd process holds it. Wait for it to finish, or run 'cdkd force-unlock ${resolvedStackName}' if you are certain no other process is active.`);
 		}
 		try {
-			const { phase1Imports, phase2Creates, recreateBeforePhase2, nestedStackRows, blocked } = await buildImportPlan(state, template, awsClients.cloudFormation, resolvedStackName, { recreateImportUnsupported: options.recreateImportUnsupported });
-			if (blocked.length > 0) {
-				logger.error("The following resources block migration:");
-				for (const b of blocked) logger.error(`  - ${b.logicalId} (${b.resourceType}): ${b.reason}`);
-				throw new Error(`${blocked.length} resource(s) block migration. Either destroy them first (cdkd destroy / cdkd state destroy cherry-picked), or remove them from the CDK app and re-synthesize.`);
-			}
 			if (nestedStackRows.length > 0) {
 				const nestedStackTree = await buildCdkdStateStackTree(resolvedStackName, targetRegion, stateBackend, state);
 				reportDriftBaselineGaps(state, logger);
@@ -58804,7 +58963,8 @@ async function exportCommand(stackArg, options) {
 						dryRun: options.dryRun,
 						yes: options.yes,
 						includeNonImportable: options.includeNonImportable,
-						recreateImportUnsupported: options.recreateImportUnsupported
+						recreateImportUnsupported: options.recreateImportUnsupported,
+						skipImportSupportPreflight: options.skipImportSupportPreflight
 					}
 				})).outcome === "success") printNextSteps({
 					cfnStackName: options.cfnStackName ?? cdkd2cfnStackName(resolvedStackName),
@@ -59343,7 +59503,16 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 		}
 		let resolved;
 		try {
-			resolved = await resolveResourceIdentifier(resourceType, stateEntry.physicalId, stateEntry.properties ?? {}, cfnClient, identifierCache);
+			const schemaInfo = await cachedTypeSchemaInfo(resourceType, cfnClient, identifierCache);
+			if (!options.skipImportSupportPreflight && typeIsImportUnsupported(schemaInfo)) {
+				blocked.push({
+					logicalId,
+					resourceType,
+					reason: `AWS CloudFormation does not support ${resourceType} in IMPORT changesets: its CloudFormation registry schema declares no 'read' handler (and reports the type as NON_PROVISIONABLE), and IMPORT needs that handler to look the resource up by identifier. CreateChangeSet would reject the whole export with "ResourceTypes [${resourceType}] are not supported for Import". Remove the resource from the stack before exporting (it stays in AWS and can be re-declared in CloudFormation afterwards), or destroy it first and let CloudFormation create it fresh. If AWS has since added IMPORT support for this type, please open a cdkd issue.`
+				});
+				continue;
+			}
+			resolved = resolveResourceIdentifier(resourceType, logicalId, stateEntry.physicalId, stateEntry.properties ?? {}, stateEntry.attributes ?? {}, schemaInfo);
 		} catch (err) {
 			blocked.push({
 				logicalId,
@@ -59373,6 +59542,11 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 * `ResourcesToImport[].ResourceIdentifier` for the given resource type
 * and cdkd state's physical ID.
 *
+* Types whose cdkd physicalId is COMPOSITE while the CFn identifier is a
+* single field (`COMPOSITE_PHYSICAL_ID_IDENTIFIERS`): resolved from cdkd
+* state's recorded attributes, BEFORE the field-count branch below — the
+* physicalId is neither the identifier nor a source to split (issue #1659).
+*
 * Single-key types: the map has a single entry keyed by the schema's
 * primaryIdentifier field name (e.g. `{ BucketName: 'my-bucket' }`).
 *
@@ -59382,16 +59556,27 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 * into one entry per field. Composite types without a registered
 * splitter surface a clear error pointing at where to add one.
 *
-* Prefers `DescribeType` (the authoritative AWS-internal registry) and
-* falls back to a hardcoded single-key table when DescribeType fails
-* (insufficient permissions, throttling, obscure type without a registry
-* entry).
-*/
-async function resolveResourceIdentifier(resourceType, physicalId, properties, cfnClient, cache) {
-	let entry = cache.get(resourceType);
-	if (entry === void 0) {
-		entry = await fetchPrimaryIdentifier(resourceType, cfnClient);
-		cache.set(resourceType, entry);
+* `entry` is the caller's already-resolved registry-schema info — see
+* {@link cachedTypeSchemaInfo}, which prefers `DescribeType` (the authoritative
+* AWS-internal registry) and falls back to a hardcoded single-key table when
+* DescribeType fails (insufficient permissions, throttling, obscure type
+* without a registry entry). Taking it as a parameter rather than fetching is
+* what keeps `buildImportPlan` to ONE DescribeType per type across both the
+* IMPORT pre-flight and this resolution.
+*/
+function resolveResourceIdentifier(resourceType, logicalId, physicalId, properties, attributes, entry) {
+	const compositeIdentifier = COMPOSITE_PHYSICAL_ID_IDENTIFIERS[resourceType];
+	if (compositeIdentifier) {
+		if (entry.fields.length !== 1 || entry.fields[0] !== compositeIdentifier.field) throw new Error(`${resourceType} is registered in COMPOSITE_PHYSICAL_ID_IDENTIFIERS as identified by '${compositeIdentifier.field}', but CloudFormation now reports primaryIdentifier [${entry.fields.join(", ")}]. The registry schema changed under cdkd — update the entry in src/cli/commands/export.ts (or move the type to COMPOSITE_ID_SPLITTERS if its identifier is now composite too)`);
+		const value = compositeIdentifier.resolve({
+			logicalId,
+			physicalId,
+			attributes
+		});
+		return {
+			resourceIdentifier: { [compositeIdentifier.field]: value },
+			propertiesOverlay: {}
+		};
 	}
 	if (entry.fields.length === 1) return { resourceIdentifier: { [entry.fields[0]]: physicalId } };
 	const splitter = COMPOSITE_ID_SPLITTERS[resourceType];
@@ -59406,6 +59591,53 @@ async function resolveResourceIdentifier(resourceType, physicalId, properties, c
 	return result;
 }
 /**
+* Cache-consulting wrapper around {@link fetchPrimaryIdentifier}. Shared by
+* `resolveResourceIdentifier` and `buildImportPlan`'s pre-flight so one
+* DescribeType per type answers both questions.
+*/
+async function cachedTypeSchemaInfo(resourceType, cfnClient, cache) {
+	const cached = cache.get(resourceType);
+	if (cached !== void 0) return cached;
+	const entry = await fetchPrimaryIdentifier(resourceType, cfnClient);
+	cache.set(resourceType, entry);
+	return entry;
+}
+/**
+* True when the registry schema says CloudFormation will refuse the type in an
+* IMPORT changeset (`ValidationError: ResourceTypes [<T>] are not supported
+* for Import`) — IMPORT looks the resource up by identifier through the type's
+* `read` handler, so a type without one cannot be adopted.
+*
+* Live-measured (us-east-1, 2026-08-13) against `CreateChangeSet
+* --change-set-type IMPORT`: `AWS::Glue::Table` / `AWS::Route53::RecordSet` /
+* `AWS::AppSync::ApiKey` / `AWS::EC2::NetworkAclEntry` /
+* `AWS::Route53::RecordSetGroup` / `AWS::SQS::QueuePolicy` /
+* `AWS::SNS::TopicPolicy` all lack a `read` handler, are all
+* `NON_PROVISIONABLE`, and were all rejected; `AWS::S3::Bucket`
+* (`FULLY_MUTABLE`, read handler present) passed the type check. Both shapes
+* of "no read handler" occur and both count: NO `handlers` block at all (the
+* legacy types) and a `handlers` block whose keys are only create / update /
+* delete (`AWS::EC2::NetworkAclEntry`).
+*
+* **Why the verdict needs TWO agreeing fields.** Reading "the `handlers` key is
+* missing" as a refusal on its own makes any partial or unusual response block
+* an export that works today — the one regression this pre-flight could cause,
+* and strictly worse than the status quo of letting AWS answer. So the refusal
+* also requires `ProvisioningType: NON_PROVISIONABLE`; a response satisfying
+* only one of the two resolves to `unknown` and is left to CreateChangeSet.
+*
+* The two were perfectly CORRELATED across the 21 types sampled on 2026-08-13
+* (every no-read-handler type was NON_PROVISIONABLE and vice versa), so on
+* today's registry the conjunction's real work is requiring a COMPLETE
+* DescribeType response before refusing. The `read` handler stays the primary
+* signal because it is the mechanistic reason CFn accepts a type for IMPORT —
+* refusing on `ProvisioningType` alone would reject a NON_PROVISIONABLE type
+* that does declare one, should AWS ever publish that combination.
+*/
+function typeIsImportUnsupported(entry) {
+	return entry.importSupport === "unsupported";
+}
+/**
 * Fetch the primary identifier field names for a resource type, with a
 * hardcoded single-key fallback when DescribeType is unavailable.
 */
@@ -59413,15 +59645,26 @@ async function fetchPrimaryIdentifier(resourceType, cfnClient) {
 	try {
 		const resp = await describeTypeWithThrottleRetry(resourceType, cfnClient);
 		if (resp.Schema) {
-			const primary = JSON.parse(resp.Schema).primaryIdentifier;
-			if (Array.isArray(primary) && primary.length > 0 && primary.every((p) => typeof p === "string")) return { fields: primary.map((p) => p.replace(/^\/properties\//, "")) };
+			const parsed = JSON.parse(resp.Schema);
+			const primary = parsed.primaryIdentifier;
+			if (Array.isArray(primary) && primary.length > 0 && primary.every((p) => typeof p === "string")) {
+				const fields = primary.map((p) => p.replace(/^\/properties\//, ""));
+				const handlers = parsed.handlers;
+				return {
+					fields,
+					importSupport: typeof handlers === "object" && handlers !== null && Object.prototype.hasOwnProperty.call(handlers, "read") ? "importable" : resp.ProvisioningType === "NON_PROVISIONABLE" ? "unsupported" : "unknown"
+				};
+			}
 		}
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
 		getLogger().debug(`DescribeType failed for ${resourceType}: ${msg} — using fallback`);
 	}
 	const fallback = PRIMARY_IDENTIFIER_FALLBACK[resourceType];
-	if (fallback) return { fields: [fallback] };
+	if (fallback) return {
+		fields: [fallback],
+		importSupport: "unknown"
+	};
 	throw new Error(`primary identifier unknown (DescribeType returned no usable schema and no fallback is registered). Add ${resourceType} to PRIMARY_IDENTIFIER_FALLBACK in export.ts, or open an issue.`);
 }
 /**
@@ -60347,7 +60590,10 @@ async function runPerStackImportLoop(args) {
 	const perStackPlans = [];
 	for (const node of leafFirst) {
 		const meta = nodesByCdkdName.get(node.stackName);
-		const plan = await buildImportPlan(meta.state, meta.template, deps.cfnClient, meta.cdkdStackName, { recreateImportUnsupported: options.recreateImportUnsupported });
+		const plan = await buildImportPlan(meta.state, meta.template, deps.cfnClient, meta.cdkdStackName, {
+			recreateImportUnsupported: options.recreateImportUnsupported,
+			skipImportSupportPreflight: options.skipImportSupportPreflight === true
+		});
 		if (plan.blocked.length > 0) {
 			const lines = plan.blocked.map((b) => `  - ${b.logicalId} (${b.resourceType}): ${b.reason}`);
 			throw new Error(`Stack '${meta.cdkdStackName}' has ${plan.blocked.length} resource(s) that block migration:\n${lines.join("\n")}`);
@@ -60763,7 +61009,7 @@ async function confirmPrompt$3(prompt) {
 	}
 }
 function createExportCommand() {
-	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.").option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (currently only AWS::ApiGatewayV2::Stage, emitted by CDK HttpApi). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
+	const cmd = new Command("export").description("Hand a cdkd-managed stack over to CloudFormation via CFn IMPORT (changeset). AWS resources are unchanged; cdkd state for the stack is deleted on success. Mirror of `cdkd import` (AWS → cdkd) in the reverse direction (cdkd → CFn). Accepts JSON and YAML templates (YAML via a CFn-aware codec that preserves !Ref / !GetAtt / !Sub shorthand). Aborts if any resource is not CFn-importable.").argument("[stack]", "Stack name to export (auto-detected for single-stack apps)").option("--cfn-stack-name <name>", "Name of the destination CloudFormation stack for the root stack. Defaults to the cdkd stack name (or the cdkd2cfnStackName mapping when the name contains '~'). For per-nested-child overrides, use --cfn-child-stack-name.").option("--cfn-child-stack-name <pair...>", "Per-nested-child CFn stack-name override. Repeatable. Format: '<cdkdName>=<cfnName>' (e.g. --cfn-child-stack-name 'MyApp~Database=my-app-db'). The cdkd stack name for a nested child is '<parent>~<childLogicalId>' (v6 state-key form). Without an override the CFn name is derived by replacing '~' with '-'. Only consulted when the exported stack tree contains nested children; ignored for flat stacks.").option("--template <path>", "Path to a pre-rendered CloudFormation template (JSON or YAML — format auto-detected). Skips synth.").option("--stack-region <region>", "Region of the cdkd state record to operate on. Required when the same stack name has state in multiple regions.").option("--dry-run", "Print the import plan without creating a changeset.", false).option("--accept-transient-context", "Allow CLI -c key=value overrides at export time even though they are not persisted to cdk.json / cdk.context.json (default: refuse). When set, the user is responsible for passing the same -c flags to every future cdk deploy.", false).option("--include-non-importable", "Run a 2-phase migration when the stack contains non-importable resources (Custom::*). Phase 1 imports the importable resources; phase 2 CFn-CREATEs the non-importable ones, which re-invokes each Custom Resource's onCreate handler. Make sure onCreate is idempotent before enabling.", false).option("--parameter <key=value...>", "CFn template Parameter override, repeatable. Required when the synthesized template has Parameters without Default values; otherwise overrides the template's default value. Format: --parameter Key=Value.").option("--strict-cross-stack", "Refuse to export when sibling cdkd stacks in the same CDK app reference the exporting stack via Fn::GetStackOutput. Without the flag, cdkd warns and proceeds — the consumers keep resolving via the CloudFormation fallback (weak reference) unless they deploy with --no-cfn-fallback.", false).option("--skip-import-support-preflight", "Skip the pre-flight that refuses resource types whose CloudFormation registry schema says CFn cannot IMPORT them (no read handler AND NON_PROVISIONABLE), and let CreateChangeSet answer instead. The pre-flight is a registry HEURISTIC, not AWS's supported-for-import list, so this is the escape hatch for a type AWS has since made importable. Expect the changeset to be rejected if the heuristic was right.", false).option("--no-recreate-import-unsupported", "Block instead of auto-handling resource types AWS does NOT support in IMPORT changesets (currently only AWS::ApiGatewayV2::Stage, emitted by CDK HttpApi). Default behavior: cdkd skips these from phase 1, deletes the AWS-side resource between phases, and lets CFn re-CREATE in phase 2 (brief unavailability window). With this flag, the export aborts with a clear error instead.").action(withErrorHandling(exportCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -74608,7 +74854,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.23");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.24");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;