@go-to-k/cdkd 0.283.12 → 0.283.13

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-DHOpGcMS.js";
+import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-BdKa1DA4.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-BKR0cF_X.js";
+import { t as ASGProvider } from "./asg-provider-CrVgG0Pj.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -20534,6 +20534,128 @@ var SSMParameterProvider = class {
 		return out;
 	}
 	/**
+	* Build the `Arn` attribute for an SSM parameter (issue #1824).
+	*
+	* WHY THIS EXISTS. An output / cross-resource `Fn::GetAtt` reads the CACHED
+	* `resource.attributes[<CFnName>]` in
+	* `IntrinsicFunctionResolver.constructAttribute`, which never calls a
+	* provider's `getAttribute` — and for an `*Arn` name the resolver's shape
+	* guard HARD-FAILS rather than degrading when the cached value is missing and
+	* the physicalId is name-shaped (an SSM physicalId IS the parameter name). So
+	* `new cdk.CfnOutput(this, 'ParamArn', { value: param.attrArn })` failed the
+	* deploy until the ARN was cached under its CFn name.
+	*
+	* SOURCE DECISION — CONSTRUCTED, not read back. `PutParameter` returns only
+	* `Version` / `Tier`, so there were exactly two candidate sources, and the
+	* rejected one is recorded here so the call stays challengeable:
+	*
+	*  - `GetParameter`'s `Parameter.ARN` is authoritative, and cdkd already
+	*    issues that call in `readCurrentState` / `import`, so it needs no new IAM
+	*    permission. It was REJECTED on COST: it would be a brand-new round trip
+	*    on EVERY parameter create AND every update, and SSM parameters are among
+	*    the most numerous resources in real CDK stacks — a 50-parameter stack
+	*    would pay 50 extra reads for a value that is a pure function of data
+	*    cdkd already holds, against a project whose whole premise is removing
+	*    round trips.
+	*  - CONSTRUCTION is deterministic. The parameter ARN is the documented
+	*    `arn:{partition}:ssm:{region}:{account}:parameter/{name}`, with the
+	*    name's leading `/` folded into the separator — the same formula
+	*    `aws-cdk-lib`'s `StringParameter.parameterArn` uses — so nothing has to
+	*    be discovered from AWS. It is also the established idiom in this repo for
+	*    "the create response carries no ARN": `AppSyncProvider.buildAppSyncArn`
+	*    and the four `CloudControlProvider` enrichment sites (KMS key, ECR
+	*    repository x2, Kinesis stream) all construct through the same
+	*    `getAccountInfo` + `derivePartitionAndUrlSuffix` + `fabricated`-refusal
+	*    pair this method reuses.
+	*
+	* The PARTITION is DERIVED, never hardcoded `arn:aws:` — that hardcoding is an
+	* active bug class here (#1794 / #1815), and on a `cn-` / `us-gov-` deploy it
+	* would record an ARN naming a partition the parameter is not in.
+	*
+	* The `fabricated`-account guard (#1730 / #1746) is honored by REFUSING rather
+	* than by substituting: `getAccountInfo` catches its own STS failure and
+	* answers the placeholder `123456789012`, which carries no wildcard and is
+	* therefore invisible to `isPlaceholderArn`, so a fabricated id must yield NO
+	* attribute instead of a plausible-looking wrong one. Returning `undefined`
+	* degrades to exactly the pre-fix behavior — the resolver's shape guard fails
+	* LOUDLY on the name-shaped physicalId — never to a silently wrong value.
+	*
+	* DEGRADATION ON THE UPDATE PATH is a DELIBERATE trade-off, not one this
+	* design avoids. An update result's `attributes` REPLACE the state record's
+	* rather than merging into it (`deploy-engine.ts`:
+	* `result.attributes ?? (wasReplaced ? undefined : currentResource.attributes)`),
+	* so whenever this method degrades during an `update` the returned map carries
+	* no `Arn` and the create-time one is DROPPED. Construction does not prevent
+	* that — it only swaps WHICH dependency can fail, STS plus the client's region
+	* resolver instead of SSM — so read the source decision above as buying one
+	* fewer round trip and nothing else.
+	*
+	* The alternative is to return NO `attributes` at all on the degraded path, so
+	* the engine's `??` carries the previous map forward and the `Arn` survives.
+	* That is REJECTED: the same map carries `Type` / `Value`, which are the values
+	* THIS update just sent. Carrying the previous map forward would answer
+	* `Fn::GetAtt [Param, Value]` with the SUPERSEDED value — silently, and to a
+	* question cdkd can answer correctly — and would hand `cdkd drift` a baseline
+	* AWS does not hold. Dropping the `Arn` instead degrades to the resolver's LOUD
+	* `*Arn` shape-guard failure, which is exactly the pre-fix behavior, and the
+	* resource's next UPDATE re-records it. A loud missing value beats a quiet
+	* wrong one — the same reasoning the `fabricated`-account arm above applies.
+	*
+	* Two honest bounds on that "next update re-records it". `getAccountInfo`
+	* caches a SUCCESSFUL identity for the process, so within one deploy only a run
+	* whose FIRST `GetCallerIdentity` fails degrades at all — but the 10s
+	* fabricated-answer TTL then covers every parameter created in that window
+	* rather than a random subset. And a plain re-deploy does NOT heal it: a
+	* resource whose resolved properties equal its state record is skipped with no
+	* provider call, so healing needs a real property change (issue
+	* [#1852](https://github.com/go-to-k/cdkd/issues/1852), which also covers the
+	* resolver message that currently misattributes this to a missing enrichment).
+	*
+	* NEVER THROWS, and that is enforced here rather than asserted at the call
+	* sites. `create` calls this AFTER `PutParameter` has already committed a
+	* parameter, so a throw would surface as a failed create over a missing
+	* ATTRIBUTE — leaving an orphan that makes the next deploy hit
+	* `ParameterAlreadyExists` (the issue #376 class), and the cleanup that exists
+	* for that is deliberately out of reach by then. `getAccountInfo` catches its
+	* own STS failure, but `config.region()` is a resolver that can reject, so the
+	* whole body is wrapped: an unexpected failure degrades to "no Arn recorded"
+	* exactly as the fabricated-account arm does.
+	*/
+	async buildParameterArn(name) {
+		try {
+			return await this.buildParameterArnUnguarded(name);
+		} catch (error) {
+			this.logger.warn(`Could not build the Arn attribute for SSM parameter ${name}: ${error instanceof Error ? error.message : String(error)}. The parameter itself is unaffected; the Arn is NOT recorded, so an Fn::GetAtt on it will fail until a later deploy records it.`);
+			return;
+		}
+	}
+	/**
+	* {@link buildParameterArn}'s body. Only that method may call it.
+	*
+	* `name` is always a parameter NAME, never an ARN, and that is an INVARIANT
+	* rather than an assumption this method has to defend (issue #1824 review
+	* round 3). Both callers pass a value SSM has just accepted as a
+	* `PutParameter` `Name`, and that field forbids an ARN outright — "You can't
+	* enter the Amazon Resource Name (ARN) for a parameter, only the parameter
+	* name itself", plus a name charset of `a-zA-Z0-9_.-` and `/` that excludes
+	* `:`. So an ARN-shaped id fails at `PutParameter` several statements ABOVE
+	* this method on both paths, and a guard here could only ever fire against a
+	* mock. Round 2 added exactly such a guard, believing an ARN could arrive from
+	* `cdkd import --resource Param=arn:...`; it can, but the defect is that the
+	* import RECORDED it, so the fix belongs at the import boundary — where
+	* `import()` now refuses it — and not here. Do not re-add it.
+	*/
+	async buildParameterArnUnguarded(name) {
+		const accountInfo = await getAccountInfo(await this.ssmClient.config.region());
+		if (accountInfo.fabricated) {
+			this.logger.warn(`Cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so the Arn attribute for SSM parameter ${name} would be fabricated and is NOT recorded. An Fn::GetAtt on it will fail until a later deploy resolves the account.`);
+			return;
+		}
+		const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
+		const qualifiedName = name.startsWith("/") ? name.slice(1) : name;
+		return `arn:${partition}:ssm:${canonicalizeRegion(accountInfo.region)}:${accountInfo.accountId}:parameter/${qualifiedName}`;
+	}
+	/**
 	* Create an SSM parameter
 	*/
 	async create(logicalId, resourceType, properties) {
@@ -20575,11 +20697,13 @@ var SSMParameterProvider = class {
 				throw innerError;
 			}
 			this.logger.debug(`Successfully created SSM parameter ${logicalId}: ${name}`);
+			const arn = await this.buildParameterArn(name);
 			return {
 				physicalId: name,
 				attributes: {
 					Type: type,
-					Value: value
+					Value: value,
+					...arn !== void 0 && { Arn: arn }
 				}
 			};
 		} catch (error) {
@@ -20626,12 +20750,14 @@ var SSMParameterProvider = class {
 				this.logger.debug(`Updated tags for SSM parameter ${physicalId}`);
 			}
 			this.logger.debug(`Successfully updated SSM parameter ${logicalId}`);
+			const arn = await this.buildParameterArn(physicalId);
 			return {
 				physicalId,
 				wasReplaced: false,
 				attributes: {
 					Type: type,
-					Value: value
+					Value: value,
+					...arn !== void 0 && { Arn: arn }
 				}
 			};
 		} catch (error) {
@@ -20742,6 +20868,57 @@ var SSMParameterProvider = class {
 		return result;
 	}
 	/**
+	* Refuse a physical id SSM's WRITE APIs could never accept (issue #1824
+	* review round 3).
+	*
+	* An SSM parameter's physicalId must always be the parameter NAME, because
+	* that is the only thing the write APIs take. `PutParameterRequest.Name`:
+	* "You can't enter the Amazon Resource Name (ARN) for a parameter, only the
+	* parameter name itself", with a name charset of `a-zA-Z0-9_.-` plus `/` as
+	* the hierarchy separator; `DeleteParameterRequest.Name` repeats the ARN
+	* prohibition verbatim. A COLON therefore cannot appear in any writable name,
+	* which is the single predicate used here — it covers both shapes
+	* `GetParameter` additionally accepts and this method has to stop:
+	*
+	*  - an ARN (`arn:aws:ssm:us-east-1:111122223333:parameter/foo`), and
+	*  - a version / label SELECTOR (`GetParameterRequest.Name`: "To query by
+	*    parameter label, use `"Name": "name:label"`. To query by parameter
+	*    version, use `"Name": "name:version"`").
+	*
+	* Both sail through this provider's existence check, so before this guard the
+	* value was RECORDED as the physicalId and the damage landed later and
+	* elsewhere: `cdkd deploy` failing at `PutParameter({Name: physicalId})` with
+	* a `ValidationException` after a `Value` change, and `cdkd destroy` failing
+	* identically at `DeleteParameter`. This is where the bad value ENTERS
+	* (`--resource` / `Properties.Name`), so it is where it is stopped.
+	*
+	* REFUSED, NOT NORMALIZED to the name, and the ARN grammar is the reason. The
+	* mapping back is genuinely ambiguous rather than merely awkward:
+	*
+	*  - The leading `/` is NOT recoverable. `arn:…:parameter/foo` is the ARN of
+	*    BOTH the simple name `foo` and the one-level hierarchical name `/foo`,
+	*    since the name's leading slash IS the separator — `aws-cdk-lib`'s
+	*    `arnForParameterName` renders the two to the identical string, and that
+	*    is precisely why CDK needs an explicit `simpleName` flag whenever the
+	*    name is a token. Guessing wrong writes a physicalId naming a DIFFERENT
+	*    parameter, i.e. converts a loud failure into a silent wrong-resource
+	*    write.
+	*  - A parameter SHARED from another account has no name form at all
+	*    ("For parameters shared with you from another account, you must use the
+	*    full ARN"), so for that shape there is nothing to normalize TO.
+	*
+	* A refusal is a loud, fixable error, and the message names the exact command
+	* that prints the name to pass instead.
+	*/
+	refuseUnwritableParameterId(input, explicit) {
+		if (!explicit.includes(":")) return;
+		const isArn = explicit.startsWith("arn:");
+		const shape = isArn ? "an ARN" : "a version / label selector";
+		const remedy = input.knownPhysicalId === explicit ? `pass the parameter NAME instead: --resource ${input.logicalId}=<parameterName>` : `set Properties.Name to the parameter NAME rather than ${shape}`;
+		const whyNotDerived = isArn ? " cdkd deliberately does NOT derive the name from the ARN: the leading \"/\" is not recoverable (arn:...:parameter/foo is the ARN of BOTH the simple name \"foo\" and the hierarchical name \"/foo\"), and a parameter shared from another account has no name form at all — so a derived name could silently address a DIFFERENT parameter." : "";
+		throw new ProvisioningError(`Cannot adopt SSM parameter ${input.logicalId} from ${shape} ('${explicit}'): cdkd records a parameter's NAME as its physical id, because SSM's write APIs accept only the name (PutParameter and DeleteParameter both reject an ARN, and a name cannot contain ':'), so the next cdkd deploy and cdkd destroy would fail with a ValidationException. ${remedy}.${whyNotDerived} Read the name AWS holds with: aws ssm get-parameter --name '${explicit}' --query Parameter.Name --output text`, input.resourceType, input.logicalId);
+	}
+	/**
 	* Adopt an existing SSM parameter into cdkd state.
 	*
 	* SSM physical IDs ARE the parameter names (`/foo/bar`). The CDK template
@@ -20749,19 +20926,25 @@ var SSMParameterProvider = class {
 	* covers most cases.
 	*
 	* Lookup order:
-	*  1. `--resource` override or `Properties.Name` → verify via `GetParameter`.
+	*  1. `--resource` override or `Properties.Name` → refuse it outright when it
+	*     is not a writable NAME (see {@link refuseUnwritableParameterId} — note
+	*     `GetParameter` accepts an ARN and a `name:version` selector while every
+	*     write API rejects both), else verify via `GetParameter`.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "Name");
-		if (explicit) try {
-			await this.ssmClient.send(new GetParameterCommand({ Name: explicit }));
-			return {
-				physicalId: explicit,
-				attributes: {}
-			};
-		} catch (err) {
-			if (err instanceof ParameterNotFound) return null;
-			throw err;
+		if (explicit) {
+			this.refuseUnwritableParameterId(input, explicit);
+			try {
+				const arn = (await this.ssmClient.send(new GetParameterCommand({ Name: explicit }))).Parameter?.ARN;
+				return {
+					physicalId: explicit,
+					attributes: { ...arn !== void 0 && { Arn: arn } }
+				};
+			} catch (err) {
+				if (err instanceof ParameterNotFound) return null;
+				throw err;
+			}
 		}
 		return null;
 	}
@@ -33740,16 +33923,20 @@ var RDSProvider = class {
 		});
 		try {
 			const tags = this.buildTags(properties);
-			await this.getClient().send(new CreateDBSubnetGroupCommand({
+			const created = await this.getClient().send(new CreateDBSubnetGroupCommand({
 				DBSubnetGroupName: dbSubnetGroupName,
 				DBSubnetGroupDescription: properties["DBSubnetGroupDescription"] || `Subnet group for ${logicalId}`,
 				SubnetIds: properties["SubnetIds"],
 				...tags.length > 0 && { Tags: tags }
 			}));
 			this.logger.debug(`Successfully created DBSubnetGroup ${logicalId}: ${dbSubnetGroupName}`);
+			const dbSubnetGroupArn = created.DBSubnetGroup?.DBSubnetGroupArn;
 			return {
 				physicalId: dbSubnetGroupName,
-				attributes: { DBSubnetGroupName: dbSubnetGroupName }
+				attributes: {
+					DBSubnetGroupName: dbSubnetGroupName,
+					...dbSubnetGroupArn !== void 0 && { DBSubnetGroupArn: dbSubnetGroupArn }
+				}
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -33773,7 +33960,10 @@ var RDSProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: { DBSubnetGroupName: physicalId }
+				attributes: {
+					DBSubnetGroupName: physicalId,
+					...arn !== void 0 && { DBSubnetGroupArn: arn }
+				}
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -34379,10 +34569,10 @@ var RDSProvider = class {
 	async importDBSubnetGroup(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBSubnetGroupName");
 		if (explicit) try {
-			await this.getClient().send(new DescribeDBSubnetGroupsCommand({ DBSubnetGroupName: explicit }));
+			const arn = (await this.getClient().send(new DescribeDBSubnetGroupsCommand({ DBSubnetGroupName: explicit }))).DBSubnetGroups?.[0]?.DBSubnetGroupArn;
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: { ...arn !== void 0 && { DBSubnetGroupArn: arn } }
 			};
 		} catch (err) {
 			if (err.name === "DBSubnetGroupNotFoundFault") return null;
@@ -78258,7 +78448,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.12");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.13");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;