@go-to-k/cdkd 0.282.2 → 0.282.4

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as MIGRATE_TMP_PREFIX, A as green, At as validateContainerRepoName, B as slowCcOperationTimeoutMs, Bt as getDefaultStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as NestedStackChildDirectDestroyError, Ct as rewriteTemplateAssetReferences, D as bold, Dn as ResourceUpdateNotSupportedError, Dt as getBootstrapMarkerKey, E as formatResourceLine, En as ResourceTimeoutError, Et as ensureAssetStorage, F as clearOnUpdateRemoval, Fn as withErrorHandling, Ft as runDockerStreaming, G as getAccountInfo, Gt as resolveSkipPrefix, H as isTerminationProtectionPropagationError, Ht as resolveApp, I as ProviderRegistry, It as AssetManifestLoader, J as normalizeAwsTagsToCfn, Jt as resolveUseCdkBootstrapAssets, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefault, L as findActionableSilentDrops, Lt as getDockerImageBySourceHash, M as yellow, Mt as formatDockerLoginError, N as IAMRoleProvider, Nt as getDockerCmd, O as cyan, On as StackHasActiveImportsError, Ot as parseBootstrapMarker, P as collectInlinePolicyNamesManagedBySiblings, Pn as normalizeAwsError, Pt as runDockerForeground, Q as configBooleanRefusal, Qt as CFN_TEMPLATE_URL_LIMIT, R as findSilentDropProperties, Rt as Synthesizer, S as extractDeploymentEventError, Sn as MissingCdkCliError, St as loadPublishableAssetManifest, T as renderStatefulReason, Tn as ProvisioningError, Tt as BOOTSTRAP_MARKER_PREFIX, U as IntrinsicFunctionResolver, Ut as resolveAutoAssetStorage, V as disableInstanceApiTermination, Vt as getLegacyStateBucketName, W as cfnRefValueFromPhysicalId, Wt as resolveCaptureObservedState, X as assertRegionMatch, Xt as warnDeprecatedNoPrefixCliFlag, Y as resolveExplicitPhysicalId, Yt as stateBucketExistenceConfirmed, Z as coerceCfnBoolean, Zt as CFN_TEMPLATE_BODY_LIMIT, _ as createPreDeleteFinalSnapshot, _n as DeployCancelledError, _t as AssetPublisher, a as DeploymentEventsStore, an as AssemblyReader, at as applyRoleArnIfSet, b as unsupportedFinalSnapshotError, bn as LocalStartServiceError, bt as buildAssetRedirectMap, c as replayFailedOperations, cn as resolveBucketRegion, ct as withRetry, d as IMPLICIT_DELETE_DEPENDENCIES, dn as resetAwsClients, dt as DagBuilder, en as findLargeInlineResources, et as readConfigString, f as computeImplicitDeleteEdges, fn as setAwsClients, ft as TemplateParser, g as ccRoutedFinalSnapshotError, gt as shouldRetainResource, h as buildFinalSnapshotIdentifier, ht as rebuildClientForBucketRegion, i as DeploymentEventsReader, in as derivePartitionAndUrlSuffix, it as requireConfigString, j as red, jt as buildDockerImage, k as gray, kn as StackTerminationProtectionError, kt as validateAssetBucketName, l as replayRollback, ln as AwsClients, lt as isRetryableTransientError, m as PRE_DELETE_SNAPSHOT_TYPES, mn as CdkdError, mt as S3StateBackend, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as expectedOwnerParam, nt as requireConfigArray, o as planFailedOps, on as processStackMessages, ot as DiffCalculator, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as LockManager, q as WAFv2WebACLProvider, qt as resolveStateBucketWithDefaultAndSource, r as DeployEngine, rn as PARTITION_TABLE, rt as requireConfigObject, s as planRollback, st as describeTypeWithThrottleRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as uploadCfnTemplate, tt as replayWarn, u as withResourceDeadline, un as getAwsClients, ut as isThrottlingError, v as isFinalSnapshotError, vn as LocalInvokeBuildError$1, vt as stringifyValue, w as isStatefulRecreateTargetSync, wn as PartialFailureError, wt as AssetModeResolver, x as makeCanonicalizePropertiesFn, xt as createAssetRedirectResolver, y as refusesFinalSnapshot, yn as LocalMigrateError, yt as WorkGraph, z as CloudControlProvider, zt as synthesisStatusMessage } from "./deploy-engine-6sSRIhrN.js";
+import { $ as configStringRefusal, $t as resolveUseCdkBootstrapAssets, A as green, An as ProvisioningError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bn as withErrorHandling, Bt as runDockerStreaming, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as LocalInvokeBuildError$1, Ct as stringifyValue, D as bold, Dn as MissingCdkCliError, Dt as loadPublishableAssetManifest, E as formatResourceLine, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Ft as validateContainerRepoName, G as getAccountInfo, Gt as getDefaultStateBucketName, H as isTerminationProtectionPropagationError, Ht as getDockerImageBySourceHash, I as ProviderRegistry, It as buildDockerImage, J as normalizeAwsTagsToCfn, Jt as resolveAutoAssetStorage, K as refStateLookupFromResource, Kt as getLegacyStateBucketName, L as findActionableSilentDrops, Lt as formatDockerLoginError, M as yellow, Mn as ResourceUpdateNotSupportedError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as StackHasActiveImportsError, Nt as parseBootstrapMarker, O as cyan, On as NestedStackChildDirectDestroyError, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as StackTerminationProtectionError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefaultAndSource, R as findSilentDropProperties, Rt as getDockerCmd, S as extractDeploymentEventError, Sn as DeployCancelledError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalStartServiceError, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as Synthesizer, V as disableInstanceApiTermination, Vt as AssetManifestLoader, W as cfnRefValueFromPhysicalId, Wt as synthesisStatusMessage, X as assertRegionMatch, Xt as resolveSkipPrefix, Y as resolveExplicitPhysicalId, Yt as resolveCaptureObservedState, Z as coerceCfnBoolean, Zt as resolveStateBucketWithDefault, _ as createPreDeleteFinalSnapshot, _n as setAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as findLargeInlineResources, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as PARTITION_TABLE, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as processStackMessages, dt as DiffCalculator, en as stateBucketExistenceConfirmed, et as readConfigString, f as computeImplicitDeleteEdges, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as resetAwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as getAwsClients, ht as isThrottlingError, i as DeploymentEventsReader, in as MIGRATE_TMP_PREFIX, it as requireConfigString, j as red, jn as ResourceTimeoutError, jt as ensureAssetStorage, k as gray, kn as PartialFailureError, kt as AssetModeResolver, l as replayRollback, ln as derivePartitionAndUrlSuffix, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mn as AwsClients, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as CFN_TEMPLATE_BODY_LIMIT, nt as requireConfigArray, o as planFailedOps, on as uploadCfnTemplate, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as resolveBucketRegion, pt as withRetry, q as WAFv2WebACLProvider, qt as resolveApp, r as DeployEngine, rn as CFN_TEMPLATE_URL_LIMIT, rt as requireConfigObject, s as planRollback, sn as expectedOwnerParam, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as warnDeprecatedNoPrefixCliFlag, tt as replayWarn, u as withResourceDeadline, un as AssemblyReader, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vt as LockManager, w as isStatefulRecreateTargetSync, wn as LocalMigrateError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as CdkdError, yt as S3StateBackend, z as CloudControlProvider, zn as normalizeAwsError, zt as runDockerForeground } from "./deploy-engine-CnxJLy3Y.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-B5EgvcoP.js";
+import { t as ASGProvider } from "./asg-provider-D9VJTwn3.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -5981,11 +5981,11 @@ var S3BucketProvider = class S3BucketProvider {
 	async buildAttributes(bucketName) {
 		const region = await this.getRegion();
 		return {
-			Arn: `arn:aws:s3:::${bucketName}`,
-			DomainName: `${bucketName}.s3.amazonaws.com`,
-			DualStackDomainName: `${bucketName}.s3.dualstack.${region}.amazonaws.com`,
-			RegionalDomainName: `${bucketName}.s3.${region}.amazonaws.com`,
-			WebsiteURL: `http://${bucketName}.s3-website-${region}.amazonaws.com`
+			Arn: s3BucketArn(bucketName, region),
+			DomainName: s3BucketDomainName(bucketName, region),
+			DualStackDomainName: s3BucketDualStackDomainName(bucketName, region),
+			RegionalDomainName: s3BucketRegionalDomainName(bucketName, region),
+			WebsiteURL: s3BucketWebsiteUrl(bucketName, region)
 		};
 	}
 	/**
@@ -20350,7 +20350,7 @@ const EC2_NETWORK_ACL_ENTRY_ID_FORMAT = {
 * `DestinationCidrBlock || DestinationIpv6CidrBlock || DestinationPrefixListId`
 * chain resolves them.
 */
-const ROUTE_DESTINATION_KEYS = [
+const ROUTE_DESTINATION_KEYS$1 = [
 	"DestinationCidrBlock",
 	"DestinationIpv6CidrBlock",
 	"DestinationPrefixListId"
@@ -20377,7 +20377,7 @@ const ROUTE_DESTINATION_KEYS = [
 * `resolvedProps`, which it records for every resource that does NOT narrow.
 */
 function narrowRouteDestinations(properties) {
-	const declared = ROUTE_DESTINATION_KEYS.filter((key) => Boolean(properties[key]));
+	const declared = ROUTE_DESTINATION_KEYS$1.filter((key) => Boolean(properties[key]));
 	const narrowed = { ...properties };
 	for (const losingKey of declared.slice(1)) delete narrowed[losingKey];
 	return {
@@ -59107,6 +59107,36 @@ const COMPOSITE_ID_SPLITTERS = {
 			propertiesOverlay: { VpcId: vpcId }
 		};
 	},
+	"AWS::EC2::Route": (physicalId, properties) => {
+		const parts = physicalId.split("|");
+		if (parts.length !== 2) throw new Error(`expected 2 parts ('<routeTableId>|<destination>'), got ${parts.length}: '${physicalId}'`);
+		const [routeTableId, destination] = parts;
+		if (!routeTableId.trim() || !destination.trim()) throw new Error(`empty part in '<routeTableId>|<destination>': '${physicalId}'`);
+		return {
+			resourceIdentifier: {
+				RouteTableId: routeTableId,
+				CidrBlock: resolveRouteDestination(destination, properties)
+			},
+			propertiesOverlay: { RouteTableId: routeTableId }
+		};
+	},
+	"AWS::EC2::EIP": (physicalId) => {
+		const parts = physicalId.split("|");
+		if (parts.length !== 2) throw new Error(`expected 2 parts ('<publicIp>|<allocationId>'), got ${parts.length}: '${physicalId}'. CloudFormation identifies an AWS::EC2::EIP by BOTH fields, and neither can be recovered from the other; re-deploy the resource to refresh state`);
+		const [first, second] = parts;
+		if (!first.trim() || !second.trim()) throw new Error(`empty part in '<publicIp>|<allocationId>': '${physicalId}'`);
+		const allocationFirst = first.startsWith(EIP_ALLOCATION_ID_PREFIX);
+		const publicIp = allocationFirst ? second : first;
+		const allocationId = allocationFirst ? first : second;
+		if (!allocationId.startsWith(EIP_ALLOCATION_ID_PREFIX) || !EIP_PUBLIC_IP_PATTERN.test(publicIp)) throw new Error(`'${physicalId}' is not an '<publicIp>|<allocationId>' pair: CloudFormation identifies an AWS::EC2::EIP by [PublicIp, AllocationId], so one segment must be an allocation id ('${EIP_ALLOCATION_ID_PREFIX}…') and the other a dotted-quad public IP. State entry may be corrupt or written by an older cdkd binary; re-deploy the resource to refresh state`);
+		return {
+			resourceIdentifier: {
+				PublicIp: publicIp,
+				AllocationId: allocationId
+			},
+			propertiesOverlay: {}
+		};
+	},
 	"AWS::ApiGateway::Deployment": restApiChildSplitter({
 		resourceType: "AWS::ApiGateway::Deployment",
 		childField: "DeploymentId",
@@ -59167,6 +59197,21 @@ const COMPOSITE_ID_SPLITTERS = {
 			Namespace: namespace
 		} };
 	},
+	"AWS::Lambda::EventInvokeConfig": (physicalId) => {
+		if (!physicalId.trim()) throw new Error("empty physical id for AWS::Lambda::EventInvokeConfig (expected '<functionName>|<qualifier>' or a bare function name)");
+		const separator = physicalId.indexOf("|");
+		if (separator === -1) return { resourceIdentifier: {
+			FunctionName: physicalId,
+			Qualifier: "$LATEST"
+		} };
+		const functionName = physicalId.slice(0, separator);
+		const qualifier = physicalId.slice(separator + 1);
+		if (!functionName.trim() || !qualifier.trim()) throw new Error(`empty part in '<functionName>|<qualifier>': '${physicalId}'`);
+		return { resourceIdentifier: {
+			FunctionName: functionName,
+			Qualifier: qualifier
+		} };
+	},
 	"AWS::Lambda::Permission": (physicalId, properties) => {
 		const functionName = readStringProperty(properties, "FunctionName", "AWS::Lambda::Permission");
 		return {
@@ -59179,11 +59224,44 @@ const COMPOSITE_ID_SPLITTERS = {
 	}
 };
 /**
-* The two values CFn's `AWS::EC2::VPCGatewayAttachment.AttachmentType` takes.
-* The field is `readOnlyProperties`, so cdkd never sends it — it only has to
-* be reproduced for the IMPORT identifier map.
-*/
-const GATEWAY_ATTACHMENT_TYPES = ["InternetGateway", "VPN"];
+* The prefix every EC2 Elastic IP allocation id carries. Used to discriminate
+* the two segments of an `AWS::EC2::EIP` physicalId by SHAPE rather than by
+* position — see the splitter for why the order is not relied on.
+*/
+const EIP_ALLOCATION_ID_PREFIX = "eipalloc-";
+/**
+* The other half of the same discriminator: an Elastic IP's public address is
+* always a dotted quad (EIPs are IPv4-only). Shape-only — the octet RANGES are
+* not checked, because this exists to tell the two segments apart, not to
+* validate an address AWS itself minted.
+*/
+const EIP_PUBLIC_IP_PATTERN = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+const GATEWAY_ATTACHMENT_TYPE_IGW = "IGW";
+const GATEWAY_ATTACHMENT_TYPE_VGW = "VGW";
+/**
+* The values AWS actually uses for `AWS::EC2::VPCGatewayAttachment`'s
+* `AttachmentType`, plus the two spellings issue #1691 guessed.
+*
+* `IGW` / `VGW` are what every real writer produces: Cloud Control stores the
+* primaryIdentifier verbatim, so a CC-written cdkd state record carries one of
+* them as segment 0. `InternetGateway` / `VPN` were never written by anything —
+* they were produced by THIS table on the way OUT, and CloudFormation rejects
+* them (`Invalid request provided: Invalid Attachment Type 'InternetGateway'`;
+* the IMPORT changeset never reaches CREATE_COMPLETE). They are kept purely as
+* input compatibility, so a physicalId hand-written from the old comment, or
+* supplied via `cdkd import --resource`, normalizes instead of falling through
+* to the property-derivation arms. Nothing in cdkd can put them in state.
+*
+* `Object.hasOwn` at the lookup site, not a bare index: a bare index on an
+* object literal answers for inherited members too, so a first segment of
+* `constructor` would resolve to a function rather than missing.
+*/
+const GATEWAY_ATTACHMENT_TYPE_ALIASES = {
+	[GATEWAY_ATTACHMENT_TYPE_IGW]: GATEWAY_ATTACHMENT_TYPE_IGW,
+	[GATEWAY_ATTACHMENT_TYPE_VGW]: GATEWAY_ATTACHMENT_TYPE_VGW,
+	InternetGateway: GATEWAY_ATTACHMENT_TYPE_IGW,
+	VPN: GATEWAY_ATTACHMENT_TYPE_VGW
+};
 /**
 * Resolve `AttachmentType` for an `AWS::EC2::VPCGatewayAttachment` from the
 * first segment of cdkd's composite physicalId plus the recorded properties.
@@ -59191,19 +59269,154 @@ const GATEWAY_ATTACHMENT_TYPES = ["InternetGateway", "VPN"];
 * The Cloud-Control-written shape already carries the attachment type verbatim
 * (it is the CFn primaryIdentifier's first field). The SDK-written shape
 * carries the gateway id instead, so the type is derived from WHICH gateway
-* property cdkd recorded — never hardcoded to `InternetGateway`, which would
-* ship a wrong identifier for a VPN attachment and make CFn's identifier-match
-* reject the import.
+* property cdkd recorded — never hardcoded to the internet-gateway value, which
+* would ship a wrong identifier for a VPN attachment and make CFn's
+* identifier-match reject the import.
+*
+* The VALUES are `IGW` / `VGW`, measured live (Cloud Control `ListResources`,
+* us-east-1, 2026-08-13) against a VPC carrying both an internet-gateway and a
+* virtual-private-gateway attachment:
+*
+*   `IGW|vpc-…` -> {"AttachmentType":"IGW","VpcId":"vpc-…"}
+*   `VGW|vpc-…` -> {"AttachmentType":"VGW","VpcId":"vpc-…"}
+*
+* The registry schema does not enumerate them (`AttachmentType` is a bare
+* `{"type": "string"}` whose description only says it distinguishes the two
+* kinds), which is how the spelled-out `InternetGateway` / `VPN` guesses this
+* function shipped with in issue #1691 went unnoticed: they are plausible, they
+* satisfy every unit test written against them, and CFn only rejects them at
+* changeset-create time — measured 2026-08-13 as `Invalid request provided:
+* Invalid Attachment Type 'InternetGateway'` (issue #1771).
 */
 function resolveGatewayAttachmentType(firstSegment, properties) {
-	if (GATEWAY_ATTACHMENT_TYPES.includes(firstSegment)) return firstSegment;
-	if (typeof properties["InternetGatewayId"] === "string" && properties["InternetGatewayId"]) return "InternetGateway";
-	if (typeof properties["VpnGatewayId"] === "string" && properties["VpnGatewayId"]) return "VPN";
-	if (firstSegment.startsWith("igw-")) return "InternetGateway";
-	if (firstSegment.startsWith("vgw-")) return "VPN";
+	if (Object.hasOwn(GATEWAY_ATTACHMENT_TYPE_ALIASES, firstSegment)) return GATEWAY_ATTACHMENT_TYPE_ALIASES[firstSegment];
+	if (typeof properties["InternetGatewayId"] === "string" && properties["InternetGatewayId"]) return GATEWAY_ATTACHMENT_TYPE_IGW;
+	if (typeof properties["VpnGatewayId"] === "string" && properties["VpnGatewayId"]) return GATEWAY_ATTACHMENT_TYPE_VGW;
+	if (firstSegment.startsWith("igw-")) return GATEWAY_ATTACHMENT_TYPE_IGW;
+	if (firstSegment.startsWith("vgw-")) return GATEWAY_ATTACHMENT_TYPE_VGW;
 	throw new Error(`cannot determine AttachmentType for AWS::EC2::VPCGatewayAttachment: cdkd state's properties carry neither 'InternetGatewayId' nor 'VpnGatewayId', and the physical id segment '${firstSegment}' is not a recognized gateway id. State entry may be corrupt or written by an older cdkd binary; re-deploy the resource to refresh state.`);
 }
 /**
+* The `AWS::EC2::Route` destination keys, in CloudFormation's own precedence
+* order — the same order (and the same list) `narrowRouteDestinations` in
+* `src/provisioning/providers/ec2-provider.ts` resolves them in when it decides
+* which one `createRoute` actually sends, i.e. which one ends up in the
+* physicalId's destination segment. Restated here rather than imported so this
+* command does not pull the EC2 provider (and its SDK client) into the export
+* module graph.
+*/
+const ROUTE_DESTINATION_KEYS = [
+	"DestinationCidrBlock",
+	"DestinationIpv6CidrBlock",
+	"DestinationPrefixListId"
+];
+/**
+* Resolve the value CFn's read-only `AWS::EC2::Route.CidrBlock` identifier
+* field holds, from cdkd's physicalId destination segment plus the recorded
+* properties.
+*
+* The segment is the starting point — it is the destination cdkd sent to
+* `CreateRoute` (SDK path) or the `CidrBlock` AWS itself reported (Cloud Control
+* path), and `CidrBlock` holds whichever destination kind the route declares,
+* measured live; see the splitter's comment. But it is NOT returned verbatim:
+* EC2 clears host bits on the way in, so the SDK path can have stored a
+* destination AWS never held, and the identifier is always the CANONICAL form.
+*
+* The recorded properties are then read to CROSS-CHECK it, the way
+* {@link resolveGatewayAttachmentType} reads them to recover a field cdkd never
+* stores. Two very different things can make them disagree, and conflating them
+* is why this is not a plain warn:
+*
+*  - **Benign.** One side carries AWS's CANONICALIZED CIDR and the other what
+*    the user wrote; CFn documents rewriting e.g. `100.68.0.18/18` to
+*    `100.68.0.0/18`. The identifier is CORRECT here, so refusing would block an
+*    export that would have succeeded. Both sides are compared in canonical
+*    form, so this case never even registers as a divergence.
+*  - **Dangerous.** If state is merely stale, the id's destination can name a
+*    DIFFERENT route that still exists in the same table. IMPORT then succeeds
+*    against the wrong resource, and phase 2's UPDATE reconciles it to the
+*    template — REPLACING, i.e. DELETING, a route the user never targeted.
+*    Silently continuing here trades an opaque failure for data loss.
+*
+* So the outcome depends on whether the benign explanation is DECIDABLE, which
+* {@link routeDestinationNormalizationIsModelled} answers per declared value.
+* When every declared destination is a shape cdkd models — an IPv4 CIDR or a
+* prefix-list id — normalization either explains the difference or it does not,
+* and a non-match is refused. When any declared destination is an IPv6 CIDR,
+* whose AWS-side canonicalization cdkd does not reproduce, the divergence is
+* reported as a WARNING naming the replace-the-wrong-route outcome, because
+* refusing on an undecidable signal would block exports that are fine.
+*
+* Properties that declare NO destination at all are NOT treated as suspicious:
+* a partial / hand-edited state record must not become a refusal, and the id
+* alone is enough to build the identifier.
+*/
+function resolveRouteDestination(segment, properties) {
+	const identifier = canonicalizeIpv4Cidr(segment) ?? segment;
+	const declared = ROUTE_DESTINATION_KEYS.filter((key) => typeof properties[key] === "string" && properties[key] !== "");
+	if (declared.length === 0) return identifier;
+	const declaredValues = declared.map((key) => String(properties[key]));
+	if (declaredValues.some((value) => (canonicalizeIpv4Cidr(value) ?? value) === identifier)) return identifier;
+	const shared = `AWS::EC2::Route: cdkd state's recorded properties declare ${declared.map((key) => `${key}='${String(properties[key])}'`).join(", ")}, but the physical id's destination segment is '${segment}'. CloudFormation identifies the route by the destination, so IMPORT would adopt whatever route currently sits at '${identifier}' — and if that is a DIFFERENT route than the template declares, phase 2 would then REPLACE (delete) it. The state entry is stale; re-deploy the resource to refresh it`;
+	if (declaredValues.every((value) => routeDestinationNormalizationIsModelled(value))) throw new Error(`${shared}.`);
+	getLogger().warn(`${shared}, or pass the resource through 'cdkd import --resource' with the correct id. Continuing with the physical id because at least one recorded destination is an IPv6 CIDR, whose AWS-side canonicalization cdkd does not model — so the difference may be benign.`);
+	return identifier;
+}
+/**
+* An EC2 managed prefix list id (`pl-` + hex). Matched EXACTLY rather than by
+* prefix so a malformed value falls into the unmodelled class instead of being
+* treated as a comparable destination.
+*/
+const ROUTE_PREFIX_LIST_ID_PATTERN = /^pl-[0-9a-f]+$/;
+/**
+* True when cdkd models how AWS normalizes this destination value, i.e. when a
+* mismatch against the physical id's segment is CONCLUSIVE rather than possibly
+* explained by a rewrite cdkd cannot reproduce.
+*
+* Two classes qualify:
+*   - an IPv4 CIDR, whose host-bit rewrite {@link canonicalizeIpv4Cidr} reproduces;
+*   - a prefix-list id, measured to be stored verbatim on both sides, so a
+*     `pl-AAA` vs `pl-BBB` difference is a genuine wrong-route signal.
+*
+* An IPv6 CIDR does not: AWS canonicalizes those too (zero-run compression,
+* host-bit clearing) and cdkd does not reproduce it, so a mismatch there could
+* still be the same route written two ways.
+*/
+function routeDestinationNormalizationIsModelled(value) {
+	return canonicalizeIpv4Cidr(value) !== void 0 || ROUTE_PREFIX_LIST_ID_PATTERN.test(value);
+}
+/**
+* Return the host-bit-cleared form of an IPv4 CIDR (`100.68.0.18/18` ->
+* `100.68.0.0/18`), or `undefined` when the input is not an IPv4 CIDR at all
+* (an IPv6 CIDR, a `pl-…` prefix-list id, or anything malformed).
+*
+* This exists to recognize the ONE benign reason an `AWS::EC2::Route`'s stored
+* destination can differ from its physicalId segment: AWS rewrites a
+* non-canonical CIDR on `CreateRoute`, and the Cloud Control path records what
+* AWS returned while the template kept what the user wrote. Returning
+* `undefined` for the shapes it does not model is load-bearing — the caller
+* uses it to decide whether a divergence is conclusive or merely unexplained.
+*/
+function canonicalizeIpv4Cidr(value) {
+	const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/.exec(value);
+	if (!match) return void 0;
+	const octets = [
+		match[1],
+		match[2],
+		match[3],
+		match[4]
+	].map(Number);
+	const prefixLength = Number(match[5]);
+	if (prefixLength > 32 || octets.some((octet) => octet > 255)) return void 0;
+	const network = ((octets[0] << 24 | octets[1] << 16 | octets[2] << 8 | octets[3]) >>> 0 & (prefixLength === 0 ? 0 : 4294967295 << 32 - prefixLength >>> 0)) >>> 0;
+	return `${[
+		network >>> 24,
+		network >>> 16 & 255,
+		network >>> 8 & 255,
+		network & 255
+	].join(".")}/${prefixLength}`;
+}
+/**
 * Build a splitter for an `AWS::ApiGateway::*` child type whose CFn primary
 * identifier is the parent `RestApiId` plus one child field.
 *
@@ -60201,7 +60414,7 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 * IMPORT pre-flight and this resolution.
 */
 function resolveResourceIdentifier(resourceType, logicalId, physicalId, properties, attributes, entry) {
-	const compositeIdentifier = COMPOSITE_PHYSICAL_ID_IDENTIFIERS[resourceType];
+	const compositeIdentifier = Object.hasOwn(COMPOSITE_PHYSICAL_ID_IDENTIFIERS, resourceType) ? COMPOSITE_PHYSICAL_ID_IDENTIFIERS[resourceType] : void 0;
 	if (compositeIdentifier) {
 		if (entry.fields.length !== 1 || entry.fields[0] !== compositeIdentifier.field) throw new Error(`${resourceType} is registered in COMPOSITE_PHYSICAL_ID_IDENTIFIERS as identified by '${compositeIdentifier.field}', but CloudFormation now reports primaryIdentifier [${entry.fields.join(", ")}]. The registry schema changed under cdkd — update the entry in src/cli/commands/export.ts (or move the type to COMPOSITE_ID_SPLITTERS if its identifier is now composite too)`);
 		const value = compositeIdentifier.resolve({
@@ -60215,7 +60428,7 @@ function resolveResourceIdentifier(resourceType, logicalId, physicalId, properti
 		};
 	}
 	if (entry.fields.length === 1) return { resourceIdentifier: { [entry.fields[0]]: physicalId } };
-	const splitter = COMPOSITE_ID_SPLITTERS[resourceType];
+	const splitter = Object.hasOwn(COMPOSITE_ID_SPLITTERS, resourceType) ? COMPOSITE_ID_SPLITTERS[resourceType] : void 0;
 	if (!splitter) throw new Error(`resource type uses a composite primary identifier (${entry.fields.length} fields: ${entry.fields.join(", ")}); add an entry to COMPOSITE_ID_SPLITTERS in src/cli/commands/export.ts that parses cdkd's physicalId for this type, or destroy the resource first and let CFn create it fresh`);
 	let result;
 	try {
@@ -75550,7 +75763,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.282.2");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.282.4");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;