@go-to-k/cdkd 0.283.3 → 0.283.5

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as resolveStateBucketWithDefaultAndSource, A as green, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as slowCcOperationTimeoutMs, Bt as runDockerForeground, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ct as stringifyValue, D as bold, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as formatResourceLine, En as LocalMigrateError, Et as createAssetRedirectResolver, F as clearOnUpdateRemoval, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as getAccountInfo, Gt as synthesisStatusMessage, H as isTerminationProtectionPropagationError, Hn as withErrorHandling, Ht as AssetManifestLoader, I as ProviderRegistry, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as normalizeAwsTagsToCfn, Jt as resolveApp, K as refStateLookupFromResource, Kt as getDefaultStateBucketName, L as findActionableSilentDrops, Lt as buildDockerImage, M as yellow, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as IAMRoleProvider, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as cyan, Ot as rewriteTemplateAssetReferences, P as collectInlinePolicyNamesManagedBySiblings, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as configBooleanRefusal, Qt as resolveStateBucketWithDefault, R as findSilentDropProperties, Rt as formatDockerLoginError, S as extractDeploymentEventError, St as AssetPublisher, T as renderStatefulReason, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as IntrinsicFunctionResolver, Ut as getDockerImageBySourceHash, V as disableInstanceApiTermination, Vn as normalizeAwsError, Vt as runDockerStreaming, W as cfnRefValueFromPhysicalId, Wt as Synthesizer, X as assertRegionMatch, Xt as resolveCaptureObservedState, Y as resolveExplicitPhysicalId, Yt as resolveAutoAssetStorage, Z as coerceCfnBoolean, Zt as resolveSkipPrefix, _ as createPreDeleteFinalSnapshot, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as s3BucketArn, b as unsupportedFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as derivePartitionAndUrlSuffix, dt as DiffCalculator, en as resolveUseCdkBootstrapAssets, et as readConfigString, f as computeImplicitDeleteEdges, fn as AssemblyReader, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gn as AwsClients, gt as DagBuilder, h as buildFinalSnapshotIdentifier, hn as resolveBucketRegion, ht as isThrottlingError, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigString, j as red, jn as PartialFailureError, jt as ensureAssetStorage, k as gray, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mt as isRetryableTransientError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as requireConfigArray, o as planFailedOps, on as findLargeInlineResources, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as processStackMessages, pt as withRetry, q as WAFv2WebACLProvider, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as requireConfigObject, s as planRollback, sn as uploadCfnTemplate, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as replayWarn, u as withResourceDeadline, un as canonicalizeRegion, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as isStatefulRecreateTargetSync, wn as DeployCancelledError, wt as WorkGraph, x as makeCanonicalizePropertiesFn, xn as CdkdError, xt as shouldRetainResource, y as refusesFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as CloudControlProvider, zt as getDockerCmd } from "./deploy-engine-DxpS3fJ9.js";
+import { $ as configStringRefusal, $t as resolveSkipPrefix, A as green, At as rewriteTemplateAssetReferences, B as slowCcOperationTimeoutMs, Bt as formatDockerLoginError, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as CdkdError, Ct as shouldRetainResource, D as bold, Dn as LocalInvokeBuildError$1, Dt as buildAssetRedirectMap, E as formatResourceLine, En as DeployCancelledError, Et as WorkGraph, F as clearOnUpdateRemoval, Fn as ResourceTimeoutError, Ft as parseBootstrapMarker, G as getAccountInfo, Gt as getDockerImageBySourceHash, H as isTerminationProtectionPropagationError, Ht as runDockerForeground, I as ProviderRegistry, In as ResourceUpdateNotSupportedError, It as validateAssetBucketName, J as normalizeAwsTagsToCfn, Jt as getDefaultStateBucketName, K as refStateLookupFromResource, Kt as Synthesizer, L as findActionableSilentDrops, Ln as StackHasActiveImportsError, Lt as validateContainerRepoName, M as yellow, Mn as NestedStackChildDirectDestroyError, Mt as BOOTSTRAP_MARKER_PREFIX, N as IAMRoleProvider, Nn as PartialFailureError, Nt as ensureAssetStorage, O as cyan, On as LocalMigrateError, Ot as createAssetRedirectResolver, P as collectInlinePolicyNamesManagedBySiblings, Pn as ProvisioningError, Pt as getBootstrapMarkerKey, Q as configBooleanRefusal, Qt as resolveCaptureObservedState, R as findSilentDropProperties, Rn as StackTerminationProtectionError, Rt as buildDenyExternalAccessPolicy, S as extractDeploymentEventError, St as rebuildClientForBucketRegion, T as renderStatefulReason, Tt as stringifyValue, U as IntrinsicFunctionResolver, Un as normalizeAwsError, Ut as runDockerStreaming, V as disableInstanceApiTermination, Vt as getDockerCmd, W as cfnRefValueFromPhysicalId, Wn as withErrorHandling, Wt as AssetManifestLoader, X as assertRegionMatch, Xt as resolveApp, Y as resolveExplicitPhysicalId, Yt as getLegacyStateBucketName, Z as coerceCfnBoolean, Zt as resolveAutoAssetStorage, _ as createPreDeleteFinalSnapshot, _n as resolveBucketRegion, _t as markNonRetryable, a as DeploymentEventsStore, an as CFN_TEMPLATE_BODY_LIMIT, at as s3BucketArn, b as unsupportedFinalSnapshotError, bn as resetAwsClients, bt as LockManager, c as replayFailedOperations, cn as findLargeInlineResources, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PARTITION_TABLE, dt as DiffCalculator, en as resolveStateBucketWithDefault, et as readConfigString, f as computeImplicitDeleteEdges, fn as canonicalizeRegion, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gt as isThrottlingError, h as buildFinalSnapshotIdentifier, hn as processStackMessages, ht as isRetryableTransientError, i as DeploymentEventsReader, in as warnDeprecatedNoPrefixCliFlag, it as requireConfigString, j as red, jn as MissingCdkCliError, jt as AssetModeResolver, k as gray, kn as LocalStartServiceError, kt as loadPublishableAssetManifest, l as replayRollback, ln as uploadCfnTemplate, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mn as AssemblyReader, mt as isMarkedNonRetryable, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveUseCdkBootstrapAssets, nt as requireConfigArray, o as planFailedOps, on as CFN_TEMPLATE_URL_LIMIT, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as derivePartitionAndUrlSuffix, pt as withRetry, q as WAFv2WebACLProvider, qt as synthesisStatusMessage, r as DeployEngine, rn as stateBucketExistenceConfirmed, rt as requireConfigObject, s as planRollback, sn as MIGRATE_TMP_PREFIX, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveStateBucketWithDefaultAndSource, tt as replayWarn, u as withResourceDeadline, un as expectedOwnerParam, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as AwsClients, vt as DagBuilder, w as isStatefulRecreateTargetSync, wt as AssetPublisher, x as makeCanonicalizePropertiesFn, xn as setAwsClients, xt as S3StateBackend, y as refusesFinalSnapshot, yn as getAwsClients, yt as TemplateParser, z as CloudControlProvider, zt as buildDockerImage } from "./deploy-engine-BcwNPlSk.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CtmogXk9.js";
+import { t as ASGProvider } from "./asg-provider-B9eSuRPc.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2619,6 +2619,38 @@ function collectCrossStackRefs(node, onRef) {
 //#endregion
 //#region src/provisioning/providers/iam-policy-provider.ts
 /**
+* The short `ResourceDeleteResult.reason` the no-policy-name DELETE arm
+* reports (issue [#1770](https://github.com/go-to-k/cdkd/issues/1770)).
+*
+* Rendered inline on the destroy status line, so it is the SHORT form; the full
+* remediation sentence goes out as the `logger.warn` beside it. It says "in
+* state" rather than "in physicalId" because the arm is only reached once BOTH
+* sources have been exhausted — the physicalId and `properties['PolicyName']`.
+*/
+const POLICY_NAME_SKIP_REASON = "no policy name in state — no delete issued";
+/**
+* The short `ResourceDeleteResult.reason` for a record that names no principal
+* to detach the inline policy from (issue
+* [#1770](https://github.com/go-to-k/cdkd/issues/1770) review).
+*
+* Distinct from {@link POLICY_NAME_SKIP_REASON}: the policy may be perfectly
+* well named and it is the ATTACHMENT that is unknown, so pointing the user at
+* the physicalId would send them to the wrong half of the record.
+*/
+const POLICY_NO_TARGET_SKIP_REASON = "no Roles/Groups/Users in state — no delete issued";
+/**
+* The deploy-side caveat the skip warning in this file carries (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
+*
+* "Repair state.json and re-run" is only true on DESTROY, where the skip KEEPS
+* the record. The same arm is ALSO reached from `deploy-engine.ts` and
+* `rollback-executor.ts`, which discard the delete result and DROP the record —
+* there the id is gone, so re-running cannot help and the resource has to be
+* removed by hand. Mirrors the caveat `compositeIdFormatMessage` already
+* carries for the composite-id family.
+*/
+const DEPLOY_SKIP_CAVEAT$3 = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, remove the resource by hand.";
+/**
 * AWS IAM Policy Provider
 *
 * Implements resource provisioning for AWS::IAM::Policy using the IAM SDK.
@@ -2780,21 +2812,34 @@ var IAMPolicyProvider = class {
 	*/
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting IAM policy ${logicalId}: ${physicalId}`);
-		const policyName = physicalId.includes(":") ? physicalId.split(":")[0] : physicalId;
+		const policyNameFromPhysicalId = physicalId.includes(":") ? physicalId.split(":")[0] : physicalId;
+		const policyNameFromProperties = typeof properties?.["PolicyName"] === "string" ? properties["PolicyName"] : void 0;
+		const policyName = policyNameFromPhysicalId || policyNameFromProperties;
+		const roles = properties?.["Roles"];
+		const groups = properties?.["Groups"];
+		const users = properties?.["Users"];
+		const legacyRoleFromPhysicalId = !roles && !groups && !users && physicalId.includes(":") ? physicalId.split(":")[1] : void 0;
 		if (!policyName) {
-			this.logger.warn(`Invalid physical ID format: ${physicalId}, skipping deletion`);
-			return;
+			this.logger.warn(`Invalid physical ID format: ${physicalId}, and no PolicyName in the state record's properties — skipping deletion. No AWS call is issued, so the inline policy is LEFT ATTACHED to its roles / groups / users, UNLESS the role / group / user it is attached to is itself part of this stack (deleting that principal removes its inline policies, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack>'). Otherwise repair the physicalId in state.json and re-run, or delete the inline policy by hand. ${DEPLOY_SKIP_CAVEAT$3}`);
+			return {
+				outcome: "skipped",
+				reason: POLICY_NAME_SKIP_REASON
+			};
+		}
+		if (!roles && !groups && !users && !legacyRoleFromPhysicalId) {
+			this.logger.warn(`No Roles, Groups or Users in the state record for IAM policy ${logicalId} (physicalId "${physicalId}"), skipping deletion — an inline policy exists only as an attachment, so with no principal named there is no delete to issue and the policy is LEFT ATTACHED wherever it is, UNLESS the role / group / user it is attached to is itself part of this stack (deleting that principal removes its inline policies, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack>'). Otherwise restore Roles / Groups / Users in state.json and re-run, or delete the inline policy by hand. ${DEPLOY_SKIP_CAVEAT$3}`);
+			return {
+				outcome: "skipped",
+				reason: POLICY_NO_TARGET_SKIP_REASON
+			};
 		}
 		const onNotFound = async (target) => {
 			assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, `${physicalId} (${target})`);
 		};
 		try {
-			const roles = properties?.["Roles"];
-			const groups = properties?.["Groups"];
-			const users = properties?.["Users"];
-			if (!roles && !groups && !users && physicalId.includes(":")) {
-				const firstRole = physicalId.split(":")[1];
-				if (firstRole) try {
+			if (legacyRoleFromPhysicalId) {
+				const firstRole = legacyRoleFromPhysicalId;
+				try {
 					await this.iamClient.send(new DeleteRolePolicyCommand({
 						RoleName: firstRole,
 						PolicyName: policyName
@@ -3032,7 +3077,8 @@ var IAMManagedPolicyProvider = class {
 			this.logger.debug(`${reason} changed, replacing managed policy: ${physicalId} (${reason} mutation)`);
 			const createResult = await this.create(logicalId, resourceType, properties);
 			try {
-				await this.delete(logicalId, physicalId, resourceType, previousProperties);
+				const deleteResult = await this.delete(logicalId, physicalId, resourceType, previousProperties);
+				if (deleteResult?.outcome === "skipped") this.logger.warn(`Skipped deleting old managed policy ${physicalId} during replacement: ${deleteResult.reason}. The old policy may be orphaned and require manual cleanup.`);
 			} catch (error) {
 				this.logger.warn(`Failed to delete old managed policy ${physicalId} during replacement: ${String(error)}. The old policy may be orphaned and require manual cleanup.`);
 			}
@@ -3892,6 +3938,36 @@ var IAMAccessKeyProvider = class {
 //#endregion
 //#region src/provisioning/providers/iam-user-group-provider.ts
 /**
+* The short `ResourceDeleteResult.reason` the no-properties
+* `AWS::IAM::UserToGroupAddition` DELETE arm reports (issue
+* [#1770](https://github.com/go-to-k/cdkd/issues/1770)).
+*
+* Rendered inline on the destroy status line, so it is the SHORT form; the full
+* remediation sentence goes out as the `logger.warn` beside it. It names the
+* MEMBERSHIP rather than the resource because that is what survives — the
+* resource itself is metadata, the users staying in the group is the residue.
+*/
+const MEMBERSHIP_NO_PROPERTIES_SKIP_REASON = "no properties in state — group membership not removed";
+/**
+* Sibling of {@link MEMBERSHIP_NO_PROPERTIES_SKIP_REASON} for the arm where the
+* record has properties but is missing `GroupName` or `Users` — both REQUIRED
+* by the CloudFormation schema, so their absence is corruption, not an
+* empty-but-valid membership list.
+*/
+const MEMBERSHIP_MISSING_FIELDS_SKIP_REASON = "GroupName/Users missing from state — membership not removed";
+/**
+* The deploy-side caveat both `UserToGroupAddition` skip warnings carry (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
+*
+* "Repair state.json and re-run" is only true on DESTROY, where the skip KEEPS
+* the record. The same arms are ALSO reached from `deploy-engine.ts` and
+* `rollback-executor.ts`, which discard the delete result and DROP the record —
+* there the id is gone, so re-running cannot help and the memberships have to
+* be removed by hand. Mirrors the caveat `compositeIdFormatMessage` already
+* carries for the composite-id family.
+*/
+const DEPLOY_SKIP_CAVEAT$2 = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, remove the memberships by hand.";
+/**
 * AWS IAM User / Group / UserToGroupAddition Provider
 *
 * Implements resource provisioning for:
@@ -4530,14 +4606,20 @@ var IAMUserGroupProvider = class {
 	async deleteUserToGroupAddition(logicalId, physicalId, resourceType, properties, _context) {
 		this.logger.debug(`Deleting IAM UserToGroupAddition ${logicalId}`);
 		if (!properties) {
-			this.logger.debug(`No properties for UserToGroupAddition ${logicalId}, skipping deletion`);
-			return;
+			this.logger.warn(`No properties for UserToGroupAddition ${logicalId}, skipping deletion — GroupName and Users are both required to call RemoveUserFromGroup, so no AWS call is issued and the group memberships are LEFT IN PLACE, UNLESS the group or the users are themselves part of this stack (their own deletes remove exactly these memberships, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack>'). Otherwise restore the record's properties in state.json and re-run, or remove the users from the group by hand. ${DEPLOY_SKIP_CAVEAT$2}`);
+			return {
+				outcome: "skipped",
+				reason: MEMBERSHIP_NO_PROPERTIES_SKIP_REASON
+			};
 		}
 		const groupName = properties["GroupName"];
 		const users = properties["Users"];
 		if (!groupName || !users) {
-			this.logger.debug(`Missing GroupName or Users for ${logicalId}, skipping deletion`);
-			return;
+			this.logger.warn(`Missing GroupName or Users for ${logicalId}, skipping deletion — both are required to call RemoveUserFromGroup, so no AWS call is issued and the group memberships are LEFT IN PLACE, UNLESS the group or the users are themselves part of this stack (their own deletes remove exactly these memberships, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack>'). Otherwise restore them in state.json and re-run, or remove the users from the group by hand. ${DEPLOY_SKIP_CAVEAT$2}`);
+			return {
+				outcome: "skipped",
+				reason: MEMBERSHIP_MISSING_FIELDS_SKIP_REASON
+			};
 		}
 		try {
 			for (const userName of users) try {
@@ -10399,11 +10481,16 @@ var SNSSubscriptionProvider = class {
 	*/
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
 		this.logger.debug(`Updating SNS subscription ${logicalId}: ${physicalId}`);
+		let deleteResult = void 0;
 		try {
-			await this.delete(logicalId, physicalId, resourceType);
+			deleteResult = await this.delete(logicalId, physicalId, resourceType);
 		} catch (error) {
 			this.logger.warn(`Failed to delete old subscription ${physicalId} during update: ${String(error)}`);
 		}
+		if (deleteResult?.outcome === "skipped") {
+			this.logger.warn(`Cannot replace SNS subscription ${logicalId}: the old subscription ${physicalId} was not deleted — ${deleteResult.reason}`);
+			throw markNonRetryable(new ProvisioningError(`Cannot replace SNS subscription ${logicalId}: cdkd could not delete the old subscription, and creating the replacement would leave both subscribed to the topic and deliver every message twice. See the warning naming ${logicalId} for the recorded physical id and the cause. Repair the state record for ${logicalId}, or remove the old subscription in AWS if it is still live, then re-run.`, resourceType, logicalId, physicalId));
+		}
 		const createResult = await this.create(logicalId, resourceType, properties);
 		return {
 			physicalId: createResult.physicalId,
@@ -10439,6 +10526,27 @@ var SNSSubscriptionProvider = class {
 	}
 	/**
 	* Log the CFn-parity skip for a pending-confirmation subscription delete.
+	*
+	* **Do NOT convert either caller into a `ResourceDeleteResult` skip** (the
+	* issue [#1770](https://github.com/go-to-k/cdkd/issues/1770) sweep) — the
+	* note lives here rather than only at `update()` because this is where a
+	* future converter looks. Both arms mean the resource is GONE as far as the
+	* stack is concerned: CloudFormation removes a pending-confirmation
+	* subscription from the stack without unsubscribing, and the pending record
+	* expires on its own, so `deleted` is the honest outcome and a skip would
+	* preserve state and fail an otherwise-clean destroy for no reason.
+	*
+	* There is a second consequence, and it is why the warning is this loud:
+	* `update()` ABORTS the DELETE-first replacement on a skip (issue
+	* [#1778](https://github.com/go-to-k/cdkd/issues/1778)). Reporting a skip
+	* here would therefore make every deploy of a subscription whose state
+	* physicalId is the `PendingConfirmation` placeholder — reachable via
+	* `cdkd import --resource <id>=PendingConfirmation` — throw permanently,
+	* with no flag to force it, and `cdkd drift --revert` would fail the same
+	* way. Exempting that placeholder from the abort was the alternative and
+	* was rejected: it would duplicate this method's knowledge of the
+	* placeholder inside `update()`, where a later change to the accepted set
+	* would silently un-fence the abort.
 	*/
 	logPendingConfirmationSkip(logicalId, physicalId) {
 		this.logger.warn(`SNS subscription ${logicalId} (${physicalId}) is pending confirmation and cannot be unsubscribed; skipping deletion to match CloudFormation behavior (the pending record expires automatically within 3 days)`);
@@ -11721,6 +11829,36 @@ var LambdaFunctionProvider = class {
 //#endregion
 //#region src/provisioning/providers/lambda-permission-provider.ts
 /**
+* The short `ResourceDeleteResult.reason` the missing-`FunctionName` DELETE arm
+* reports (issue [#1770](https://github.com/go-to-k/cdkd/issues/1770)).
+*
+* Rendered inline on the destroy status line, so it is the SHORT form; the full
+* remediation sentence goes out as the `logger.warn` beside it.
+*/
+const PERMISSION_FUNCTION_NAME_SKIP_REASON = "FunctionName missing from state — no delete issued";
+/**
+* The short `ResourceDeleteResult.reason` for a composite physicalId whose
+* trailing StatementId segment is empty (`"<functionArn>|"`).
+*
+* Its own reason rather than {@link PERMISSION_FUNCTION_NAME_SKIP_REASON}: the
+* function may be perfectly well named, and pointing the user at FunctionName
+* would send them to the wrong half of the record.
+*/
+const PERMISSION_STATEMENT_ID_SKIP_REASON = "empty StatementId in state physicalId — no delete issued";
+/**
+* The deploy-side caveat the skip warning in this file carries (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
+*
+* "Repair state.json and re-run" is only true on DESTROY, where the skip KEEPS
+* the record. The same arm is ALSO reached from `deploy-engine.ts` and
+* `rollback-executor.ts`, which discard the delete result and DROP the record —
+* there the id is gone, so re-running cannot help and the resource has to be
+* removed by hand. Mirrors the caveat `compositeIdFormatMessage` already
+* carries for the composite-id family; a remedy that is impossible on the path
+* the user is actually on is worse than no remedy.
+*/
+const DEPLOY_SKIP_CAVEAT$1 = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, remove the resource by hand.";
+/**
 * AWS Lambda Permission Provider
 *
 * Implements resource provisioning for AWS::Lambda::Permission using the Lambda SDK.
@@ -11823,13 +11961,36 @@ var LambdaPermissionProvider = class {
 	*/
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting Lambda permission ${logicalId}: ${physicalId}`);
-		const functionName = properties?.["FunctionName"];
+		const physicalIdSegments = physicalId.split("|");
+		const isComposite = physicalIdSegments.length > 1;
+		const statementId = isComposite ? physicalIdSegments[physicalIdSegments.length - 1] : physicalId;
+		const functionNameFromProperties = typeof properties?.["FunctionName"] === "string" ? properties["FunctionName"] : void 0;
+		let functionNameFromPhysicalId;
+		const leadingSegment = isComposite ? physicalIdSegments[0] : "";
+		if (leadingSegment !== "") {
+			if (!leadingSegment.startsWith("arn:")) functionNameFromPhysicalId = leadingSegment;
+			else if (leadingSegment.includes(":function:")) {
+				const arnRegion = leadingSegment.split(":")[3];
+				const clientRegion = await this.lambdaClient.config.region();
+				if (arnRegion === clientRegion) functionNameFromPhysicalId = leadingSegment;
+				else this.logger.debug(`Lambda permission ${logicalId}: physicalId ARN region ${arnRegion} does not match the client region ${clientRegion}, so it cannot be used as a FunctionName`);
+			}
+		}
+		if (statementId === "") {
+			this.logger.warn(`Lambda permission ${logicalId} has no StatementId in its physicalId ("${physicalId}"), skipping deletion — no AWS call is issued, so the permission statement is LEFT IN PLACE on the function's resource policy, UNLESS the function itself is part of this stack (deleting it removes its whole resource policy, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack>'). Otherwise repair the physicalId in state.json and re-run, or remove the statement by hand ('aws lambda remove-permission'). ${DEPLOY_SKIP_CAVEAT$1}`);
+			return {
+				outcome: "skipped",
+				reason: PERMISSION_STATEMENT_ID_SKIP_REASON
+			};
+		}
+		const functionName = functionNameFromProperties || functionNameFromPhysicalId;
 		if (!functionName) {
-			this.logger.warn(`FunctionName not available for Lambda permission ${logicalId}, skipping deletion`);
-			return;
+			this.logger.warn(`FunctionName not available for Lambda permission ${logicalId} (neither the state record's FunctionName nor a function ARN in the physicalId), skipping deletion — no AWS call is issued, so the permission statement is LEFT IN PLACE on the function's resource policy, UNLESS the function itself is part of this stack (deleting it removes its whole resource policy, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack>'). Otherwise repair the record's FunctionName in state.json and re-run, or remove the statement by hand ('aws lambda remove-permission'). ${DEPLOY_SKIP_CAVEAT$1}`);
+			return {
+				outcome: "skipped",
+				reason: PERMISSION_FUNCTION_NAME_SKIP_REASON
+			};
 		}
-		let statementId = physicalId;
-		if (physicalId.includes("|")) statementId = physicalId.split("|").pop();
 		try {
 			await this.lambdaClient.send(new RemovePermissionCommand({
 				FunctionName: functionName,
@@ -12652,6 +12813,36 @@ var LambdaEventSourceMappingProvider = class {
 //#endregion
 //#region src/provisioning/providers/lambda-layer-provider.ts
 /**
+* The short `ResourceDeleteResult.reason` the two malformed-`LayerVersionArn`
+* DELETE arms report (issue
+* [#1770](https://github.com/go-to-k/cdkd/issues/1770)).
+*
+* Rendered inline on the destroy status line
+* (`⚠ MyLayer (AWS::Lambda::LayerVersion) skipped (<reason>)`), so it is the
+* SHORT form — the full remediation sentence goes out as the `logger.warn`
+* beside it. Exported so the wording is pinned by a test rather than retyped.
+*/
+const LAYER_ARN_SKIP_REASON = "malformed LayerVersionArn in state — no delete issued";
+/**
+* Sibling of {@link LAYER_ARN_SKIP_REASON} for the arm where the ARN has the
+* right shape but its trailing version segment is not a number. Kept distinct
+* because the two point at different halves of the id, and the destroy line is
+* all the user sees.
+*/
+const LAYER_VERSION_SKIP_REASON = "unparsable version in state LayerVersionArn — no delete issued";
+/**
+* The deploy-side caveat both skip warnings in this file carry (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
+*
+* "Repair state.json and re-run" is only true on DESTROY, where the skip KEEPS
+* the record. The same arms are ALSO reached from `deploy-engine.ts` and
+* `rollback-executor.ts`, which discard the delete result and DROP the record —
+* there the id is gone, so re-running cannot help and the resource has to be
+* removed by hand. Mirrors the caveat `compositeIdFormatMessage` already
+* carries for the composite-id family.
+*/
+const DEPLOY_SKIP_CAVEAT = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, remove the resource by hand.";
+/**
 * AWS Lambda LayerVersion Provider
 *
 * Implements resource provisioning for AWS::Lambda::LayerVersion using the Lambda SDK.
@@ -12741,14 +12932,20 @@ var LambdaLayerVersionProvider = class {
 		this.logger.debug(`Deleting Lambda layer version ${logicalId}: ${physicalId}`);
 		const arnParts = physicalId.split(":");
 		if (arnParts.length < 8) {
-			this.logger.warn(`Invalid LayerVersionArn format: ${physicalId}, skipping deletion`);
-			return;
+			this.logger.warn(`Invalid LayerVersionArn format: ${physicalId}, skipping deletion — no AWS call is issued, so the layer version is LEFT IN PLACE and still counts against the account's storage quota. Repair the physicalId in state.json and re-run, or delete the layer version by hand. ${DEPLOY_SKIP_CAVEAT}`);
+			return {
+				outcome: "skipped",
+				reason: LAYER_ARN_SKIP_REASON
+			};
 		}
 		const layerName = arnParts[6];
 		const versionNumber = parseInt(arnParts[7], 10);
 		if (isNaN(versionNumber)) {
-			this.logger.warn(`Could not parse version number from ARN: ${physicalId}, skipping deletion`);
-			return;
+			this.logger.warn(`Could not parse version number from ARN: ${physicalId}, skipping deletion — no AWS call is issued, so the layer version is LEFT IN PLACE and still counts against the account's storage quota. Repair the physicalId in state.json and re-run, or delete the layer version by hand. ${DEPLOY_SKIP_CAVEAT}`);
+			return {
+				outcome: "skipped",
+				reason: LAYER_VERSION_SKIP_REASON
+			};
 		}
 		try {
 			await this.lambdaClient.send(new DeleteLayerVersionCommand({
@@ -53511,7 +53708,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 						} catch (retryError) {
 							lastDeleteError = retryError;
 							const msg = retryError instanceof Error ? retryError.message : String(retryError);
-							if (!(isRetryableTransientError(retryError, msg) || msg.includes("Too Many Requests")) || attempt >= maxAttempts) break;
+							if (!(!isMarkedNonRetryable(retryError) && (isRetryableTransientError(retryError, msg) || msg.includes("Too Many Requests"))) || attempt >= maxAttempts) break;
 							const delay = 5e3 * Math.pow(2, attempt);
 							logger.debug(`  ⏳ Retrying delete ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxAttempts})`);
 							await new Promise((resolve) => setTimeout(resolve, delay));
@@ -54209,7 +54406,8 @@ var ACMCertificateProvider = class {
 			this.logger.debug(`${changedImmutable} changed, replacing ACM certificate: ${physicalId}`);
 			const createResult = await this.create(logicalId, resourceType, properties);
 			try {
-				await this.delete(logicalId, physicalId, resourceType, previousProperties);
+				const deleteResult = await this.delete(logicalId, physicalId, resourceType, previousProperties);
+				if (deleteResult?.outcome === "skipped") this.logger.warn(`Skipped deleting old ACM certificate ${physicalId} during replacement: ${deleteResult.reason}. The old certificate may be orphaned and require manual cleanup.`);
 			} catch (error) {
 				this.logger.warn(`Failed to delete old ACM certificate ${physicalId} during replacement: ${String(error)}. The old certificate may be orphaned and require manual cleanup.`);
 			}
@@ -59595,6 +59793,27 @@ const COMPOSITE_ID_SPLITTERS = {
 			propertiesOverlay: { VpcId: vpcId }
 		};
 	},
+	"AWS::EC2::VPCCidrBlock": (physicalId, properties) => {
+		if (!physicalId.trim()) throw new Error("empty physical id for AWS::EC2::VPCCidrBlock (expected an association id)");
+		const parts = physicalId.split("|").map((p) => p.trim());
+		if (parts.length > 2) throw new Error(`expected a bare '<Id>' or '<Id>|<VpcId>', got ${parts.length} parts: '${physicalId}'`);
+		const id = parts[0];
+		if (!id) throw new Error(`empty part in '<Id>|<VpcId>': '${physicalId}'`);
+		if (!id.startsWith(VPC_CIDR_ASSOCIATION_ID_PREFIX)) throw new Error(`'${physicalId}' does not start with an association id: CloudFormation identifies an AWS::EC2::VPCCidrBlock by [Id, VpcId], so the first segment must be a '${VPC_CIDR_ASSOCIATION_ID_PREFIX}…' id. State entry may be corrupt, or the segments may be reversed; re-deploy the resource to refresh state`);
+		let vpcId;
+		if (parts.length === 2) {
+			vpcId = parts[1];
+			if (!vpcId) throw new Error(`empty part in '<Id>|<VpcId>': '${physicalId}'`);
+		} else vpcId = readStringProperty(properties, "VpcId", "AWS::EC2::VPCCidrBlock");
+		if (!VPC_ID_PATTERN.test(vpcId)) throw new Error(`'${vpcId}' is not a VPC id (expected 'vpc-…', not an association id): '${physicalId}' may have its segments reversed`);
+		return {
+			resourceIdentifier: {
+				Id: id,
+				VpcId: vpcId
+			},
+			propertiesOverlay: { VpcId: vpcId }
+		};
+	},
 	"AWS::EC2::Route": (physicalId, properties) => {
 		const parts = physicalId.split("|");
 		if (parts.length !== 2) throw new Error(`expected 2 parts ('<routeTableId>|<destination>'), got ${parts.length}: '${physicalId}'`);
@@ -59724,6 +59943,26 @@ const EIP_ALLOCATION_ID_PREFIX = "eipalloc-";
 * validate an address AWS itself minted.
 */
 const EIP_PUBLIC_IP_PATTERN = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+/**
+* The prefix every `AWS::EC2::VPCCidrBlock` association id carries. The same
+* kind of shape discriminator as {@link EIP_ALLOCATION_ID_PREFIX}: a VPC id and
+* an association id BOTH start with `vpc-`, so the longer prefix is what tells
+* the two segments apart.
+*/
+const VPC_CIDR_ASSOCIATION_ID_PREFIX = "vpc-cidr-assoc-";
+/**
+* The other half of that discriminator. ANCHORED, so an association id
+* (`vpc-cidr-assoc-…`, which also begins `vpc-`) does NOT match — a reversed
+* pair is exactly what this exists to catch.
+*
+* The character class is `[0-9a-z]` rather than hex, and the LENGTH is not
+* pinned. EC2 ids are hex today, but `cdkd export` is all-or-nothing, so a
+* false REFUSAL here blocks an entire export — and the discrimination does not
+* depend on the alphabet at all: it is the `-` in `cidr-assoc`, which no
+* character class here admits. Widening the class therefore costs nothing and
+* removes a false-refusal vector.
+*/
+const VPC_ID_PATTERN = /^vpc-[0-9a-z]+$/;
 const GATEWAY_ATTACHMENT_TYPE_IGW = "IGW";
 const GATEWAY_ATTACHMENT_TYPE_VGW = "VGW";
 /**
@@ -60319,8 +60558,8 @@ async function exportCommand(stackArg, options) {
 		});
 		if (blocked.length > 0) {
 			logger.error("The following resources block migration:");
-			for (const b of blocked) logger.error(`  - ${b.logicalId} (${b.resourceType}): ${b.reason}`);
-			throw new Error(`${blocked.length} resource(s) block migration. Either destroy them first (cdkd destroy / cdkd state destroy cherry-picked), or remove them from the CDK app and re-synthesize.`);
+			for (const line of groupBlockedReasons(blocked)) logger.error(line);
+			throw new Error(`${new Set(blocked.map((b) => b.logicalId)).size} resource(s) block migration. Either destroy them first (cdkd destroy / cdkd state destroy cherry-picked), or remove them from the CDK app and re-synthesize.`);
 		}
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
 		if (!options.dryRun) {
@@ -60927,12 +61166,25 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			});
 			continue;
 		}
+		const propertiesOverlay = resolved.propertiesOverlay ?? resolved.resourceIdentifier;
+		const unrepresentable = unrepresentableOverlayFields(raw, propertiesOverlay);
+		if (unrepresentable.length > 0) {
+			for (const u of unrepresentable) blocked.push({
+				logicalId,
+				resourceType,
+				reason: unrepresentableOverlayMessage({
+					logicalId,
+					resourceType
+				}, u.field, u.current, u.value)
+			});
+			continue;
+		}
 		phase1Imports.push({
 			logicalId,
 			resourceType,
 			physicalId: stateEntry.physicalId,
 			resourceIdentifier: resolved.resourceIdentifier,
-			propertiesOverlay: resolved.propertiesOverlay ?? resolved.resourceIdentifier
+			propertiesOverlay
 		});
 	}
 	return {
@@ -60944,6 +61196,28 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 	};
 }
 /**
+* Render the `blocked` list one bullet per RESOURCE, folding a resource's
+* several reasons into it.
+*
+* The pre-flight pushes one entry per offending FIELD (issue #1787), so a
+* multi-field overlay such as `AWS::S3Tables::Namespace` contributes two rows
+* for one resource — which made the count ("1 resource(s)") disagree with the
+* bullets printed under it. Grouping keeps the two consistent without losing a
+* reason.
+*/
+function groupBlockedReasons(blocked) {
+	const byResource = /* @__PURE__ */ new Map();
+	for (const b of blocked) {
+		const entry = byResource.get(b.logicalId) ?? {
+			resourceType: b.resourceType,
+			reasons: []
+		};
+		entry.reasons.push(b.reason);
+		byResource.set(b.logicalId, entry);
+	}
+	return [...byResource].map(([logicalId, { resourceType, reasons }]) => reasons.length === 1 ? `  - ${logicalId} (${resourceType}): ${reasons[0]}` : `  - ${logicalId} (${resourceType}):\n${reasons.map((r) => `      - ${r}`).join("\n")}`);
+}
+/**
 * Build the `ResourceIdentifier` map CloudFormation IMPORT expects in
 * `ResourcesToImport[].ResourceIdentifier` for the given resource type
 * and cdkd state's physical ID.
@@ -61202,14 +61476,14 @@ function injectDeletionPolicyForImport(template) {
 	}
 	return injected;
 }
-function filterTemplateForImport(template, plan) {
+function filterTemplateForImport(template, plan, warnOnRewrite = true) {
 	const allow = new Map(plan.map((p) => [p.logicalId, p]));
 	const original = template["Resources"];
 	const filteredResources = {};
 	for (const [logicalId, resource] of Object.entries(original)) {
 		const entry = allow.get(logicalId);
 		if (!entry) continue;
-		filteredResources[logicalId] = overlayResourceIdentifierOnProperties(resource, entry);
+		filteredResources[logicalId] = overlayResourceIdentifierOnProperties(resource, entry, warnOnRewrite);
 	}
 	const result = {
 		...template,
@@ -61236,8 +61510,10 @@ function filterTemplateForImport(template, plan) {
 * migration" value proposition. Closes [#319].
 *
 * **Post-v0.95 behavior** (this function): override only when synth
-* already carries a *literal-string* value for the field AND it differs
-* from `ResourceIdentifier`. Three cases:
+* already carries a *literal* value for the field AND it differs
+* from `ResourceIdentifier`. Four cases (the fourth added by issue #1787,
+* which also widened "literal" past `typeof === 'string'` — see
+* {@link classifyOverlayCurrentValue} for the full classification):
 *
 * - **Absent** (auto-generated names — user did NOT declare a physical
 *   name in CDK code): `Properties[field]` stays absent. Matches
@@ -61274,12 +61550,19 @@ function filterTemplateForImport(template, plan) {
 *   names` flip are no longer in this case — Properties.RoleName matches
 *   the AWS name without override.
 *
+* - **Unrepresentable** (a list carrying an intrinsic / a nested list / an
+*   empty list): REFUSED with a message naming the resource, the property and
+*   the scalar to declare instead. Preserving ANY of the three reproduces the
+*   opaque `CreateChangeSet` rejection; what makes OVERRIDING wrong differs per
+*   shape, so {@link refusalReason} says which rather than asserting one cause
+*   for all — only a list actually carrying an object element has an intrinsic
+*   to discard. Either way the command stops before submitting anything
+*   (issue #1787).
+*
 * For literal-match (Properties already has the right value), the
-* override is a no-op, so the check is effectively
-* `Properties[field] !== overlayValue && typeof Properties[field] ===
-* 'string'`.
+* override is a no-op.
 */
-function overlayResourceIdentifierOnProperties(resource, entry) {
+function overlayResourceIdentifierOnProperties(resource, entry, warnOnRewrite = true) {
 	if (!resource || typeof resource !== "object" || Array.isArray(resource)) return resource;
 	const r = resource;
 	const existingProperties = r["Properties"];
@@ -61287,7 +61570,13 @@ function overlayResourceIdentifierOnProperties(resource, entry) {
 	const overlay = entry.propertiesOverlay ?? entry.resourceIdentifier;
 	for (const [field, value] of Object.entries(overlay)) {
 		const current = properties[field];
-		if (typeof current === "string" && current !== value) properties[field] = value;
+		const kind = classifyOverlayCurrentValue(current);
+		if (kind === "intrinsic" || kind === "absent") continue;
+		if (kind === "unrepresentable") throw new Error(unrepresentableOverlayMessage(entry, field, current, value));
+		if (current !== value) {
+			if (warnOnRewrite && typeof current !== "string") getLogger().warn(`${entry.logicalId} (${entry.resourceType}): rewriting the identifier property '${field}' from ${describeOverlayValueShape(current)} to the scalar '${value}' recorded in cdkd state. CloudFormation types this property as a string; the exported template will carry the scalar.`);
+			properties[field] = value;
+		}
 	}
 	return {
 		...r,
@@ -61295,6 +61584,133 @@ function overlayResourceIdentifierOnProperties(resource, entry) {
 	};
 }
 /**
+* Why a given `unrepresentable` value is refused rather than rewritten.
+*
+* THREE shapes reach `unrepresentable`, and they are refused for two different
+* reasons — an earlier revision of this message asserted the intrinsic reason
+* for all of them, which is false for two of the three. The distinction is not
+* cosmetic: a message that names a cause the value does not have sends the user
+* looking for an intrinsic that is not there.
+*/
+function refusalReason(current) {
+	if (Array.isArray(current) && current.length === 0) return "cdkd will not invent a scalar where the template declared no value";
+	return Array.isArray(current) && current.some((e) => e !== null && typeof e === "object" && !Array.isArray(e)) ? "cdkd will not rewrite it, because doing so would discard the intrinsic it carries" : "cdkd will not replace a value it cannot represent as the scalar the schema declares";
+}
+/**
+* The shared message for a refused overlay value — used by the pre-flight in
+* {@link buildImportPlan} (which BLOCKS the resource) and by
+* {@link overlayResourceIdentifierOnProperties}'s defense-in-depth throw, so
+* the two cannot drift into describing the same defect differently.
+*/
+function unrepresentableOverlayMessage(entry, field, current, value) {
+	return `${entry.logicalId} (${entry.resourceType}): the identifier property '${field}' is ${describeOverlayValueShape(current)}, but CloudFormation types it as a string. ${refusalReason(current)}. Declare '${field}' as the scalar '${value}' (or drop the addPropertyOverride that made it a list) and re-run 'cdkd export'.`;
+}
+/**
+* Every overlay field of `entry` whose value in `resource`'s `Properties` is
+* {@link classifyOverlayCurrentValue}-`unrepresentable`.
+*
+* Exists so the refusal happens during PLANNING rather than during template
+* preprocessing. `overlayResourceIdentifierOnProperties` is called from three
+* places, and two of them are past the point of no return: `--dry-run` returns
+* BEFORE any overlay call (so a dry run would report a clean plan for a
+* template the real run aborts on), and the nested-stack path calls it inside
+* the per-stack IMPORT loop — where a throw on stack N leaves stacks 1..N-1
+* already imported, outside the loop's own "stacks imported so far" recovery
+* handler. Running the same classification in `buildImportPlan` puts the
+* verdict where every other unfixable-resource verdict already lives: reported
+* for EVERY offender at once, before the lock, before dry-run's return, and
+* before any AWS write.
+*/
+function unrepresentableOverlayFields(resource, overlay) {
+	if (!resource || typeof resource !== "object" || Array.isArray(resource)) return [];
+	const props = resource["Properties"];
+	if (!props || typeof props !== "object" || Array.isArray(props)) return [];
+	const bag = props;
+	const out = [];
+	for (const [field, value] of Object.entries(overlay)) if (classifyOverlayCurrentValue(bag[field]) === "unrepresentable") out.push({
+		field,
+		current: bag[field],
+		value
+	});
+	return out;
+}
+/**
+* Classify what the synth template currently carries at an identifier field,
+* for {@link overlayResourceIdentifierOnProperties} (issue #1787).
+*
+* The pre-#1787 rule was `typeof current === 'string'`, which is correct for
+* the two cases it was designed for (an absent key, and a `Ref` / `Fn::GetAtt`
+* intrinsic that must be preserved — issue #319) and WRONG for a third,
+* reachable case: a field the template carries as a non-string LITERAL. The
+* measured instance is `AWS::S3Tables::Namespace`, whose CFn registry type is
+* `{"type": "string"}` and whose CDK L1 emits a string, but
+* `addPropertyOverride('Namespace', ['analytics'])` synthesizes
+* `"Namespace": ["analytics"]` — which cdkd deploys, because
+* `s3-tables-provider.ts` accepts both wire shapes. The array is not a literal
+* string, so the overlay left it alone and it reached `CreateChangeSet`, where
+* CFn answered with an opaque rejection.
+*
+* The classification, and why each arm is what it is:
+*
+* - `absent` (`undefined` only) — unchanged. An auto-generated name the user
+*   never declared; CFn accepts the IMPORT on `ResourceIdentifier` alone. An
+*   explicit `null` is deliberately NOT here: the key IS present, the shallow
+*   Properties copy keeps it, and `"Namespace": null` then reaches
+*   `CreateChangeSet` — the same opaque-rejection class as the array, through
+*   the same `addPropertyOverride` hatch. It is a literal, and overwritten.
+* - `intrinsic` (a non-array object) — unchanged. `{Ref: Parent}` /
+*   `{Fn::GetAtt: [...]}` resolve during changeset processing to exactly this
+*   resource's `ResourceIdentifier` value, so clobbering them would only make
+*   the post-export `cdk diff` dirty (issue #319).
+* - `literal` (string / number / boolean, or an array of those) — OVERRIDDEN
+*   with the overlay value. This is not a guess: the overlay value comes from
+*   the cdkd-recorded physicalId, which is the authority on what the resource
+*   IS, while the template side is only what CDK happened to synthesize. So a
+*   single-element `['analytics']` and a bare `analytics` both become the
+*   scalar CFn's schema declares, exactly as the pre-existing prefixed-name
+*   literal-mismatch case already does.
+* - `unrepresentable` (an array containing an object / array / null, or an
+*   EMPTY array) — REFUSED. Preserving any of them ships the same opaque CFn
+*   rejection this change exists to remove; the reason OVERRIDING is wrong
+*   differs by shape, and {@link refusalReason} splits it three ways rather
+*   than asserting one cause:
+*     - a list carrying an OBJECT element — overriding discards an intrinsic
+*       the user wrote;
+*     - a NESTED list, or one holding `null` — no intrinsic to protect, it is
+*       simply not representable as the declared scalar;
+*     - an EMPTY list — nothing to reconcile against the identifier, and
+*       materializing a scalar where the template declared "no value" is the
+*       invention this classification exists to avoid.
+*   Saying "would discard an intrinsic" for all three was the defect the
+*   #1787 review round removed; do not re-collapse it.
+*/
+function classifyOverlayCurrentValue(current) {
+	if (current === void 0) return "absent";
+	if (current === null) return "literal";
+	if (Array.isArray(current)) {
+		if (current.length === 0) return "unrepresentable";
+		return current.every((e) => typeof e === "string" || typeof e === "number" || typeof e === "boolean") ? "literal" : "unrepresentable";
+	}
+	if (typeof current === "object") return "intrinsic";
+	return "literal";
+}
+/**
+* Human-readable shape of an overlay value, for the refusal error and the
+* rewrite warning. Bounded: the value is user-supplied and lands in an error
+* message that a failed export persists, so a large list is summarized rather
+* than serialized whole.
+*/
+function describeOverlayValueShape(current) {
+	if (Array.isArray(current)) {
+		if (current.length === 0) return "an empty list";
+		const preview = JSON.stringify(current);
+		const shown = preview.length > 120 ? `${preview.slice(0, 120)}…` : preview;
+		return `a ${current.length}-element list (${shown})`;
+	}
+	if (current === null) return "an explicit null";
+	return `a ${typeof current} (${JSON.stringify(current)})`;
+}
+/**
 * Build the phase-2 UPDATE template: full synth template with the same
 * conditional overlay applied to every phase-1 import. Phase-1 and
 * phase-2 must stay symmetric — when `overlayResourceIdentifierOnProperties`
@@ -61329,7 +61745,7 @@ function applyImportOverlayForPhase2(template, phase1Imports) {
 	const resourcesMap = resources;
 	for (const entry of phase1Imports) {
 		const r = resourcesMap[entry.logicalId];
-		if (r !== void 0) resourcesMap[entry.logicalId] = overlayResourceIdentifierOnProperties(r, entry);
+		if (r !== void 0) resourcesMap[entry.logicalId] = overlayResourceIdentifierOnProperties(r, entry, false);
 	}
 	return result;
 }
@@ -62001,8 +62417,8 @@ async function runPerStackImportLoop(args) {
 			skipImportSupportPreflight: options.skipImportSupportPreflight === true
 		});
 		if (plan.blocked.length > 0) {
-			const lines = plan.blocked.map((b) => `  - ${b.logicalId} (${b.resourceType}): ${b.reason}`);
-			throw new Error(`Stack '${meta.cdkdStackName}' has ${plan.blocked.length} resource(s) that block migration:\n${lines.join("\n")}`);
+			const lines = groupBlockedReasons(plan.blocked);
+			throw new Error(`Stack '${meta.cdkdStackName}' has ${new Set(plan.blocked.map((b) => b.logicalId)).size} resource(s) that block migration:\n${lines.join("\n")}`);
 		}
 		perStackPlans.push({
 			cdkdName: meta.cdkdStackName,
@@ -62119,7 +62535,7 @@ async function runPerStackImportLoop(args) {
 				}
 				const rewrittenNestedRows = /* @__PURE__ */ new Map();
 				if (plan.nestedStackRows.length > 0) {
-					const phase1BTemplate = filterTemplateForImport(plan.template, plan.phase1Imports);
+					const phase1BTemplate = filterTemplateForImport(plan.template, plan.phase1Imports, false);
 					injectDeletionPolicyForImport(phase1BTemplate);
 					const phase1BResources = [];
 					for (const row of plan.nestedStackRows) {
@@ -76590,7 +77006,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.5");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;