@go-to-k/cdkd 0.283.4 → 0.283.6

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as resolveSkipPrefix, A as green, At as rewriteTemplateAssetReferences, B as slowCcOperationTimeoutMs, Bt as formatDockerLoginError, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as CdkdError, Ct as shouldRetainResource, D as bold, Dn as LocalInvokeBuildError$1, Dt as buildAssetRedirectMap, E as formatResourceLine, En as DeployCancelledError, Et as WorkGraph, F as clearOnUpdateRemoval, Fn as ResourceTimeoutError, Ft as parseBootstrapMarker, G as getAccountInfo, Gt as getDockerImageBySourceHash, H as isTerminationProtectionPropagationError, Ht as runDockerForeground, I as ProviderRegistry, In as ResourceUpdateNotSupportedError, It as validateAssetBucketName, J as normalizeAwsTagsToCfn, Jt as getDefaultStateBucketName, K as refStateLookupFromResource, Kt as Synthesizer, L as findActionableSilentDrops, Ln as StackHasActiveImportsError, Lt as validateContainerRepoName, M as yellow, Mn as NestedStackChildDirectDestroyError, Mt as BOOTSTRAP_MARKER_PREFIX, N as IAMRoleProvider, Nn as PartialFailureError, Nt as ensureAssetStorage, O as cyan, On as LocalMigrateError, Ot as createAssetRedirectResolver, P as collectInlinePolicyNamesManagedBySiblings, Pn as ProvisioningError, Pt as getBootstrapMarkerKey, Q as configBooleanRefusal, Qt as resolveCaptureObservedState, R as findSilentDropProperties, Rn as StackTerminationProtectionError, Rt as buildDenyExternalAccessPolicy, S as extractDeploymentEventError, St as rebuildClientForBucketRegion, T as renderStatefulReason, Tt as stringifyValue, U as IntrinsicFunctionResolver, Un as normalizeAwsError, Ut as runDockerStreaming, V as disableInstanceApiTermination, Vt as getDockerCmd, W as cfnRefValueFromPhysicalId, Wn as withErrorHandling, Wt as AssetManifestLoader, X as assertRegionMatch, Xt as resolveApp, Y as resolveExplicitPhysicalId, Yt as getLegacyStateBucketName, Z as coerceCfnBoolean, Zt as resolveAutoAssetStorage, _ as createPreDeleteFinalSnapshot, _n as resolveBucketRegion, _t as markNonRetryable, a as DeploymentEventsStore, an as CFN_TEMPLATE_BODY_LIMIT, at as s3BucketArn, b as unsupportedFinalSnapshotError, bn as resetAwsClients, bt as LockManager, c as replayFailedOperations, cn as findLargeInlineResources, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PARTITION_TABLE, dt as DiffCalculator, en as resolveStateBucketWithDefault, et as readConfigString, f as computeImplicitDeleteEdges, fn as canonicalizeRegion, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gt as isThrottlingError, h as buildFinalSnapshotIdentifier, hn as processStackMessages, ht as isRetryableTransientError, i as DeploymentEventsReader, in as warnDeprecatedNoPrefixCliFlag, it as requireConfigString, j as red, jn as MissingCdkCliError, jt as AssetModeResolver, k as gray, kn as LocalStartServiceError, kt as loadPublishableAssetManifest, l as replayRollback, ln as uploadCfnTemplate, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mn as AssemblyReader, mt as isMarkedNonRetryable, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveUseCdkBootstrapAssets, nt as requireConfigArray, o as planFailedOps, on as CFN_TEMPLATE_URL_LIMIT, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as derivePartitionAndUrlSuffix, pt as withRetry, q as WAFv2WebACLProvider, qt as synthesisStatusMessage, r as DeployEngine, rn as stateBucketExistenceConfirmed, rt as requireConfigObject, s as planRollback, sn as MIGRATE_TMP_PREFIX, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveStateBucketWithDefaultAndSource, tt as replayWarn, u as withResourceDeadline, un as expectedOwnerParam, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as AwsClients, vt as DagBuilder, w as isStatefulRecreateTargetSync, wt as AssetPublisher, x as makeCanonicalizePropertiesFn, xn as setAwsClients, xt as S3StateBackend, y as refusesFinalSnapshot, yn as getAwsClients, yt as TemplateParser, z as CloudControlProvider, zt as buildDockerImage } from "./deploy-engine-C605sBVJ.js";
+import { $ as configStringRefusal, $t as resolveSkipPrefix, A as green, At as rewriteTemplateAssetReferences, B as slowCcOperationTimeoutMs, Bt as formatDockerLoginError, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as CdkdError, Ct as shouldRetainResource, D as bold, Dn as LocalInvokeBuildError$1, Dt as buildAssetRedirectMap, E as formatResourceLine, En as DeployCancelledError, Et as WorkGraph, F as clearOnUpdateRemoval, Fn as ResourceTimeoutError, Ft as parseBootstrapMarker, G as getAccountInfo, Gt as getDockerImageBySourceHash, H as isTerminationProtectionPropagationError, Ht as runDockerForeground, I as ProviderRegistry, In as ResourceUpdateNotSupportedError, It as validateAssetBucketName, J as normalizeAwsTagsToCfn, Jt as getDefaultStateBucketName, K as refStateLookupFromResource, Kt as Synthesizer, L as findActionableSilentDrops, Ln as StackHasActiveImportsError, Lt as validateContainerRepoName, M as yellow, Mn as NestedStackChildDirectDestroyError, Mt as BOOTSTRAP_MARKER_PREFIX, N as IAMRoleProvider, Nn as PartialFailureError, Nt as ensureAssetStorage, O as cyan, On as LocalMigrateError, Ot as createAssetRedirectResolver, P as collectInlinePolicyNamesManagedBySiblings, Pn as ProvisioningError, Pt as getBootstrapMarkerKey, Q as configBooleanRefusal, Qt as resolveCaptureObservedState, R as findSilentDropProperties, Rn as StackTerminationProtectionError, Rt as buildDenyExternalAccessPolicy, S as extractDeploymentEventError, St as rebuildClientForBucketRegion, T as renderStatefulReason, Tt as stringifyValue, U as IntrinsicFunctionResolver, Un as normalizeAwsError, Ut as runDockerStreaming, V as disableInstanceApiTermination, Vt as getDockerCmd, W as cfnRefValueFromPhysicalId, Wn as withErrorHandling, Wt as AssetManifestLoader, X as assertRegionMatch, Xt as resolveApp, Y as resolveExplicitPhysicalId, Yt as getLegacyStateBucketName, Z as coerceCfnBoolean, Zt as resolveAutoAssetStorage, _ as createPreDeleteFinalSnapshot, _n as resolveBucketRegion, _t as markNonRetryable, a as DeploymentEventsStore, an as CFN_TEMPLATE_BODY_LIMIT, at as s3BucketArn, b as unsupportedFinalSnapshotError, bn as resetAwsClients, bt as LockManager, c as replayFailedOperations, cn as findLargeInlineResources, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PARTITION_TABLE, dt as DiffCalculator, en as resolveStateBucketWithDefault, et as readConfigString, f as computeImplicitDeleteEdges, fn as canonicalizeRegion, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gt as isThrottlingError, h as buildFinalSnapshotIdentifier, hn as processStackMessages, ht as isRetryableTransientError, i as DeploymentEventsReader, in as warnDeprecatedNoPrefixCliFlag, it as requireConfigString, j as red, jn as MissingCdkCliError, jt as AssetModeResolver, k as gray, kn as LocalStartServiceError, kt as loadPublishableAssetManifest, l as replayRollback, ln as uploadCfnTemplate, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mn as AssemblyReader, mt as isMarkedNonRetryable, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveUseCdkBootstrapAssets, nt as requireConfigArray, o as planFailedOps, on as CFN_TEMPLATE_URL_LIMIT, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as derivePartitionAndUrlSuffix, pt as withRetry, q as WAFv2WebACLProvider, qt as synthesisStatusMessage, r as DeployEngine, rn as stateBucketExistenceConfirmed, rt as requireConfigObject, s as planRollback, sn as MIGRATE_TMP_PREFIX, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveStateBucketWithDefaultAndSource, tt as replayWarn, u as withResourceDeadline, un as expectedOwnerParam, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as AwsClients, vt as DagBuilder, w as isStatefulRecreateTargetSync, wt as AssetPublisher, x as makeCanonicalizePropertiesFn, xn as setAwsClients, xt as S3StateBackend, y as refusesFinalSnapshot, yn as getAwsClients, yt as TemplateParser, z as CloudControlProvider, zt as buildDockerImage } from "./deploy-engine-DaEsg4mn.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CZQewQcH.js";
+import { t as ASGProvider } from "./asg-provider-BA2wc324.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2619,6 +2619,38 @@ function collectCrossStackRefs(node, onRef) {
 //#endregion
 //#region src/provisioning/providers/iam-policy-provider.ts
 /**
+* The short `ResourceDeleteResult.reason` the no-policy-name DELETE arm
+* reports (issue [#1770](https://github.com/go-to-k/cdkd/issues/1770)).
+*
+* Rendered inline on the destroy status line, so it is the SHORT form; the full
+* remediation sentence goes out as the `logger.warn` beside it. It says "in
+* state" rather than "in physicalId" because the arm is only reached once BOTH
+* sources have been exhausted — the physicalId and `properties['PolicyName']`.
+*/
+const POLICY_NAME_SKIP_REASON = "no policy name in state — no delete issued";
+/**
+* The short `ResourceDeleteResult.reason` for a record that names no principal
+* to detach the inline policy from (issue
+* [#1770](https://github.com/go-to-k/cdkd/issues/1770) review).
+*
+* Distinct from {@link POLICY_NAME_SKIP_REASON}: the policy may be perfectly
+* well named and it is the ATTACHMENT that is unknown, so pointing the user at
+* the physicalId would send them to the wrong half of the record.
+*/
+const POLICY_NO_TARGET_SKIP_REASON = "no Roles/Groups/Users in state — no delete issued";
+/**
+* The deploy-side caveat the skip warning in this file carries (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
+*
+* "Repair state.json and re-run" is only true on DESTROY, where the skip KEEPS
+* the record. The same arm is ALSO reached from `deploy-engine.ts` and
+* `rollback-executor.ts`, which discard the delete result and DROP the record —
+* there the id is gone, so re-running cannot help and the resource has to be
+* removed by hand. Mirrors the caveat `compositeIdFormatMessage` already
+* carries for the composite-id family.
+*/
+const DEPLOY_SKIP_CAVEAT$3 = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, remove the resource by hand.";
+/**
 * AWS IAM Policy Provider
 *
 * Implements resource provisioning for AWS::IAM::Policy using the IAM SDK.
@@ -2780,21 +2812,34 @@ var IAMPolicyProvider = class {
 	*/
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting IAM policy ${logicalId}: ${physicalId}`);
-		const policyName = physicalId.includes(":") ? physicalId.split(":")[0] : physicalId;
+		const policyNameFromPhysicalId = physicalId.includes(":") ? physicalId.split(":")[0] : physicalId;
+		const policyNameFromProperties = typeof properties?.["PolicyName"] === "string" ? properties["PolicyName"] : void 0;
+		const policyName = policyNameFromPhysicalId || policyNameFromProperties;
+		const roles = properties?.["Roles"];
+		const groups = properties?.["Groups"];
+		const users = properties?.["Users"];
+		const legacyRoleFromPhysicalId = !roles && !groups && !users && physicalId.includes(":") ? physicalId.split(":")[1] : void 0;
 		if (!policyName) {
-			this.logger.warn(`Invalid physical ID format: ${physicalId}, skipping deletion`);
-			return;
+			this.logger.warn(`Invalid physical ID format: ${physicalId}, and no PolicyName in the state record's properties — skipping deletion. No AWS call is issued, so the inline policy is LEFT ATTACHED to its roles / groups / users, UNLESS the role / group / user it is attached to is itself part of this stack (deleting that principal removes its inline policies, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack>'). Otherwise repair the physicalId in state.json and re-run, or delete the inline policy by hand. ${DEPLOY_SKIP_CAVEAT$3}`);
+			return {
+				outcome: "skipped",
+				reason: POLICY_NAME_SKIP_REASON
+			};
+		}
+		if (!roles && !groups && !users && !legacyRoleFromPhysicalId) {
+			this.logger.warn(`No Roles, Groups or Users in the state record for IAM policy ${logicalId} (physicalId "${physicalId}"), skipping deletion — an inline policy exists only as an attachment, so with no principal named there is no delete to issue and the policy is LEFT ATTACHED wherever it is, UNLESS the role / group / user it is attached to is itself part of this stack (deleting that principal removes its inline policies, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack>'). Otherwise restore Roles / Groups / Users in state.json and re-run, or delete the inline policy by hand. ${DEPLOY_SKIP_CAVEAT$3}`);
+			return {
+				outcome: "skipped",
+				reason: POLICY_NO_TARGET_SKIP_REASON
+			};
 		}
 		const onNotFound = async (target) => {
 			assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, `${physicalId} (${target})`);
 		};
 		try {
-			const roles = properties?.["Roles"];
-			const groups = properties?.["Groups"];
-			const users = properties?.["Users"];
-			if (!roles && !groups && !users && physicalId.includes(":")) {
-				const firstRole = physicalId.split(":")[1];
-				if (firstRole) try {
+			if (legacyRoleFromPhysicalId) {
+				const firstRole = legacyRoleFromPhysicalId;
+				try {
 					await this.iamClient.send(new DeleteRolePolicyCommand({
 						RoleName: firstRole,
 						PolicyName: policyName
@@ -3893,6 +3938,36 @@ var IAMAccessKeyProvider = class {
 //#endregion
 //#region src/provisioning/providers/iam-user-group-provider.ts
 /**
+* The short `ResourceDeleteResult.reason` the no-properties
+* `AWS::IAM::UserToGroupAddition` DELETE arm reports (issue
+* [#1770](https://github.com/go-to-k/cdkd/issues/1770)).
+*
+* Rendered inline on the destroy status line, so it is the SHORT form; the full
+* remediation sentence goes out as the `logger.warn` beside it. It names the
+* MEMBERSHIP rather than the resource because that is what survives — the
+* resource itself is metadata, the users staying in the group is the residue.
+*/
+const MEMBERSHIP_NO_PROPERTIES_SKIP_REASON = "no properties in state — group membership not removed";
+/**
+* Sibling of {@link MEMBERSHIP_NO_PROPERTIES_SKIP_REASON} for the arm where the
+* record has properties but is missing `GroupName` or `Users` — both REQUIRED
+* by the CloudFormation schema, so their absence is corruption, not an
+* empty-but-valid membership list.
+*/
+const MEMBERSHIP_MISSING_FIELDS_SKIP_REASON = "GroupName/Users missing from state — membership not removed";
+/**
+* The deploy-side caveat both `UserToGroupAddition` skip warnings carry (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
+*
+* "Repair state.json and re-run" is only true on DESTROY, where the skip KEEPS
+* the record. The same arms are ALSO reached from `deploy-engine.ts` and
+* `rollback-executor.ts`, which discard the delete result and DROP the record —
+* there the id is gone, so re-running cannot help and the memberships have to
+* be removed by hand. Mirrors the caveat `compositeIdFormatMessage` already
+* carries for the composite-id family.
+*/
+const DEPLOY_SKIP_CAVEAT$2 = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, remove the memberships by hand.";
+/**
 * AWS IAM User / Group / UserToGroupAddition Provider
 *
 * Implements resource provisioning for:
@@ -4531,14 +4606,20 @@ var IAMUserGroupProvider = class {
 	async deleteUserToGroupAddition(logicalId, physicalId, resourceType, properties, _context) {
 		this.logger.debug(`Deleting IAM UserToGroupAddition ${logicalId}`);
 		if (!properties) {
-			this.logger.debug(`No properties for UserToGroupAddition ${logicalId}, skipping deletion`);
-			return;
+			this.logger.warn(`No properties for UserToGroupAddition ${logicalId}, skipping deletion — GroupName and Users are both required to call RemoveUserFromGroup, so no AWS call is issued and the group memberships are LEFT IN PLACE, UNLESS the group or the users are themselves part of this stack (their own deletes remove exactly these memberships, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack>'). Otherwise restore the record's properties in state.json and re-run, or remove the users from the group by hand. ${DEPLOY_SKIP_CAVEAT$2}`);
+			return {
+				outcome: "skipped",
+				reason: MEMBERSHIP_NO_PROPERTIES_SKIP_REASON
+			};
 		}
 		const groupName = properties["GroupName"];
 		const users = properties["Users"];
 		if (!groupName || !users) {
-			this.logger.debug(`Missing GroupName or Users for ${logicalId}, skipping deletion`);
-			return;
+			this.logger.warn(`Missing GroupName or Users for ${logicalId}, skipping deletion — both are required to call RemoveUserFromGroup, so no AWS call is issued and the group memberships are LEFT IN PLACE, UNLESS the group or the users are themselves part of this stack (their own deletes remove exactly these memberships, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack>'). Otherwise restore them in state.json and re-run, or remove the users from the group by hand. ${DEPLOY_SKIP_CAVEAT$2}`);
+			return {
+				outcome: "skipped",
+				reason: MEMBERSHIP_MISSING_FIELDS_SKIP_REASON
+			};
 		}
 		try {
 			for (const userName of users) try {
@@ -11748,6 +11829,36 @@ var LambdaFunctionProvider = class {
 //#endregion
 //#region src/provisioning/providers/lambda-permission-provider.ts
 /**
+* The short `ResourceDeleteResult.reason` the missing-`FunctionName` DELETE arm
+* reports (issue [#1770](https://github.com/go-to-k/cdkd/issues/1770)).
+*
+* Rendered inline on the destroy status line, so it is the SHORT form; the full
+* remediation sentence goes out as the `logger.warn` beside it.
+*/
+const PERMISSION_FUNCTION_NAME_SKIP_REASON = "FunctionName missing from state — no delete issued";
+/**
+* The short `ResourceDeleteResult.reason` for a composite physicalId whose
+* trailing StatementId segment is empty (`"<functionArn>|"`).
+*
+* Its own reason rather than {@link PERMISSION_FUNCTION_NAME_SKIP_REASON}: the
+* function may be perfectly well named, and pointing the user at FunctionName
+* would send them to the wrong half of the record.
+*/
+const PERMISSION_STATEMENT_ID_SKIP_REASON = "empty StatementId in state physicalId — no delete issued";
+/**
+* The deploy-side caveat the skip warning in this file carries (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
+*
+* "Repair state.json and re-run" is only true on DESTROY, where the skip KEEPS
+* the record. The same arm is ALSO reached from `deploy-engine.ts` and
+* `rollback-executor.ts`, which discard the delete result and DROP the record —
+* there the id is gone, so re-running cannot help and the resource has to be
+* removed by hand. Mirrors the caveat `compositeIdFormatMessage` already
+* carries for the composite-id family; a remedy that is impossible on the path
+* the user is actually on is worse than no remedy.
+*/
+const DEPLOY_SKIP_CAVEAT$1 = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, remove the resource by hand.";
+/**
 * AWS Lambda Permission Provider
 *
 * Implements resource provisioning for AWS::Lambda::Permission using the Lambda SDK.
@@ -11850,13 +11961,36 @@ var LambdaPermissionProvider = class {
 	*/
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting Lambda permission ${logicalId}: ${physicalId}`);
-		const functionName = properties?.["FunctionName"];
+		const physicalIdSegments = physicalId.split("|");
+		const isComposite = physicalIdSegments.length > 1;
+		const statementId = isComposite ? physicalIdSegments[physicalIdSegments.length - 1] : physicalId;
+		const functionNameFromProperties = typeof properties?.["FunctionName"] === "string" ? properties["FunctionName"] : void 0;
+		let functionNameFromPhysicalId;
+		const leadingSegment = isComposite ? physicalIdSegments[0] : "";
+		if (leadingSegment !== "") {
+			if (!leadingSegment.startsWith("arn:")) functionNameFromPhysicalId = leadingSegment;
+			else if (leadingSegment.includes(":function:")) {
+				const arnRegion = leadingSegment.split(":")[3];
+				const clientRegion = await this.lambdaClient.config.region();
+				if (arnRegion === clientRegion) functionNameFromPhysicalId = leadingSegment;
+				else this.logger.debug(`Lambda permission ${logicalId}: physicalId ARN region ${arnRegion} does not match the client region ${clientRegion}, so it cannot be used as a FunctionName`);
+			}
+		}
+		if (statementId === "") {
+			this.logger.warn(`Lambda permission ${logicalId} has no StatementId in its physicalId ("${physicalId}"), skipping deletion — no AWS call is issued, so the permission statement is LEFT IN PLACE on the function's resource policy, UNLESS the function itself is part of this stack (deleting it removes its whole resource policy, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack>'). Otherwise repair the physicalId in state.json and re-run, or remove the statement by hand ('aws lambda remove-permission'). ${DEPLOY_SKIP_CAVEAT$1}`);
+			return {
+				outcome: "skipped",
+				reason: PERMISSION_STATEMENT_ID_SKIP_REASON
+			};
+		}
+		const functionName = functionNameFromProperties || functionNameFromPhysicalId;
 		if (!functionName) {
-			this.logger.warn(`FunctionName not available for Lambda permission ${logicalId}, skipping deletion`);
-			return;
+			this.logger.warn(`FunctionName not available for Lambda permission ${logicalId} (neither the state record's FunctionName nor a function ARN in the physicalId), skipping deletion — no AWS call is issued, so the permission statement is LEFT IN PLACE on the function's resource policy, UNLESS the function itself is part of this stack (deleting it removes its whole resource policy, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack>'). Otherwise repair the record's FunctionName in state.json and re-run, or remove the statement by hand ('aws lambda remove-permission'). ${DEPLOY_SKIP_CAVEAT$1}`);
+			return {
+				outcome: "skipped",
+				reason: PERMISSION_FUNCTION_NAME_SKIP_REASON
+			};
 		}
-		let statementId = physicalId;
-		if (physicalId.includes("|")) statementId = physicalId.split("|").pop();
 		try {
 			await this.lambdaClient.send(new RemovePermissionCommand({
 				FunctionName: functionName,
@@ -12679,6 +12813,36 @@ var LambdaEventSourceMappingProvider = class {
 //#endregion
 //#region src/provisioning/providers/lambda-layer-provider.ts
 /**
+* The short `ResourceDeleteResult.reason` the two malformed-`LayerVersionArn`
+* DELETE arms report (issue
+* [#1770](https://github.com/go-to-k/cdkd/issues/1770)).
+*
+* Rendered inline on the destroy status line
+* (`⚠ MyLayer (AWS::Lambda::LayerVersion) skipped (<reason>)`), so it is the
+* SHORT form — the full remediation sentence goes out as the `logger.warn`
+* beside it. Exported so the wording is pinned by a test rather than retyped.
+*/
+const LAYER_ARN_SKIP_REASON = "malformed LayerVersionArn in state — no delete issued";
+/**
+* Sibling of {@link LAYER_ARN_SKIP_REASON} for the arm where the ARN has the
+* right shape but its trailing version segment is not a number. Kept distinct
+* because the two point at different halves of the id, and the destroy line is
+* all the user sees.
+*/
+const LAYER_VERSION_SKIP_REASON = "unparsable version in state LayerVersionArn — no delete issued";
+/**
+* The deploy-side caveat both skip warnings in this file carry (issue
+* [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
+*
+* "Repair state.json and re-run" is only true on DESTROY, where the skip KEEPS
+* the record. The same arms are ALSO reached from `deploy-engine.ts` and
+* `rollback-executor.ts`, which discard the delete result and DROP the record —
+* there the id is gone, so re-running cannot help and the resource has to be
+* removed by hand. Mirrors the caveat `compositeIdFormatMessage` already
+* carries for the composite-id family.
+*/
+const DEPLOY_SKIP_CAVEAT = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, remove the resource by hand.";
+/**
 * AWS Lambda LayerVersion Provider
 *
 * Implements resource provisioning for AWS::Lambda::LayerVersion using the Lambda SDK.
@@ -12768,14 +12932,20 @@ var LambdaLayerVersionProvider = class {
 		this.logger.debug(`Deleting Lambda layer version ${logicalId}: ${physicalId}`);
 		const arnParts = physicalId.split(":");
 		if (arnParts.length < 8) {
-			this.logger.warn(`Invalid LayerVersionArn format: ${physicalId}, skipping deletion`);
-			return;
+			this.logger.warn(`Invalid LayerVersionArn format: ${physicalId}, skipping deletion — no AWS call is issued, so the layer version is LEFT IN PLACE and still counts against the account's storage quota. Repair the physicalId in state.json and re-run, or delete the layer version by hand. ${DEPLOY_SKIP_CAVEAT}`);
+			return {
+				outcome: "skipped",
+				reason: LAYER_ARN_SKIP_REASON
+			};
 		}
 		const layerName = arnParts[6];
 		const versionNumber = parseInt(arnParts[7], 10);
 		if (isNaN(versionNumber)) {
-			this.logger.warn(`Could not parse version number from ARN: ${physicalId}, skipping deletion`);
-			return;
+			this.logger.warn(`Could not parse version number from ARN: ${physicalId}, skipping deletion — no AWS call is issued, so the layer version is LEFT IN PLACE and still counts against the account's storage quota. Repair the physicalId in state.json and re-run, or delete the layer version by hand. ${DEPLOY_SKIP_CAVEAT}`);
+			return {
+				outcome: "skipped",
+				reason: LAYER_VERSION_SKIP_REASON
+			};
 		}
 		try {
 			await this.lambdaClient.send(new DeleteLayerVersionCommand({
@@ -40765,7 +40935,7 @@ var GlueProvider = class {
 	}
 	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::Glue::Database": return this.createDatabase(logicalId, resourceType, properties);
+			case "AWS::Glue::Database": return this.createDatabase(logicalId, resourceType, properties, context);
 			case "AWS::Glue::Table": return this.createTable(logicalId, resourceType, properties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
@@ -40784,7 +40954,7 @@ var GlueProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
-	async createDatabase(logicalId, resourceType, properties) {
+	async createDatabase(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Glue Database ${logicalId}`);
 		const databaseInput = properties["DatabaseInput"];
 		if (!databaseInput) throw new ProvisioningError(`DatabaseInput is required for Glue Database ${logicalId}`, resourceType, logicalId);
@@ -40794,7 +40964,7 @@ var GlueProvider = class {
 		try {
 			await this.getClient().send(new CreateDatabaseCommand({
 				CatalogId: catalogId,
-				DatabaseInput: this.buildDatabaseInput(databaseInput, databaseName)
+				DatabaseInput: this.buildDatabaseInput(databaseInput, databaseName, { ...replayWarn(this.logger, context) })
 			}));
 			this.logger.debug(`Successfully created Glue Database ${logicalId}: ${databaseName}`);
 			return {
@@ -40812,9 +40982,13 @@ var GlueProvider = class {
 		if (!databaseInput) throw new ProvisioningError(`DatabaseInput is required for Glue Database update ${logicalId}`, resourceType, logicalId, physicalId);
 		const catalogId = properties["CatalogId"];
 		const liveParameters = await this.readLiveDatabaseParameters(logicalId, resourceType, physicalId, catalogId);
+		const previousDatabaseInput = asRecord(previousProperties?.["DatabaseInput"]);
 		try {
-			const builtDatabaseInput = this.buildDatabaseInput(databaseInput, physicalId);
-			this.preserveAwsManagedParameters(builtDatabaseInput, databaseInput["Parameters"], (previousProperties?.["DatabaseInput"])?.["Parameters"], liveParameters);
+			const builtDatabaseInput = this.buildDatabaseInput(databaseInput, physicalId, {
+				onUnusable: (message) => this.logger.warn(message),
+				previousDatabaseInput
+			});
+			this.preserveAwsManagedParameters(builtDatabaseInput, databaseInput["Parameters"], previousDatabaseInput?.["Parameters"], liveParameters);
 			await this.getClient().send(new UpdateDatabaseCommand({
 				...catalogId !== void 0 && { CatalogId: catalogId },
 				Name: physicalId,
@@ -41188,15 +41362,137 @@ var GlueProvider = class {
 	* so empty-string Description, empty Parameters map, etc. reach AWS
 	* intact — `cdkd drift --revert` relies on this to clear console-side
 	* additions.
-	*/
-	buildDatabaseInput(databaseInput, fallbackName) {
+	*
+	* `options` carries the shape-guard policy for the three nested blocks added
+	* by issue #1807, and the two call sites answer differently because their
+	* desired bag has a different provenance (`.claude/rules/providers.md`):
+	*
+	*   - CREATE passes NO `onUnusable`, so a malformed block is REFUSED before
+	*     the AWS call — the value is template-borne, and the alternative is
+	*     sending an empty `{}` block AWS would reject with a far less
+	*     actionable message. Under `CreateContext.replayingState` the refusal
+	*     downgrades through the shared `replayWarn`, since a reverse-replacement
+	*     re-create reads a STATE record the user cannot edit from the template.
+	*   - UPDATE passes a warn callback UNCONDITIONALLY (the `updateRoute`
+	*     precedent — `update()` has no context, so it cannot tell a template
+	*     push from the state-borne bag `drift --revert` and the rollback revert
+	*     arm hand it), and then RETAINS the PREVIOUS side's block, which is why
+	*     `previousDatabaseInput` is threaded in. Omitting instead would ERASE a
+	*     live resource link, because `UpdateDatabase` replaces `DatabaseInput`
+	*     wholesale — the #1612 "UPDATE retains the previous value" row, reached
+	*     here through a whole-blob API rather than a per-item one. When the
+	*     previous side is unusable too the key is DROPPED: there is no value
+	*     cdkd can vouch for either way (#1653 review).
+	*/
+	buildDatabaseInput(databaseInput, fallbackName, options) {
+		const guardOptions = options?.onUnusable ? { onUnusable: options.onUnusable } : void 0;
+		const previous = options?.previousDatabaseInput;
+		/**
+		* The record a nested block is BUILT FROM: the desired side when it names
+		* at least one sendable member, else the previous side when IT does, else
+		* nothing.
+		*
+		* The emptiness test is what makes the ladder complete, and getting it
+		* wrong is how the first cut of this guard still erased a live resource
+		* link: a bare `{}` and an unresolved `{Ref: ...}` are plain OBJECTS, so
+		* the shape guard accepts them and a `?? previous` fallback never fires —
+		* the block then built empty and `UpdateDatabase`, which replaces
+		* `DatabaseInput` wholesale, dropped a link the template still declared.
+		*
+		* A member counts as sendable only when it is a STRING or a NUMBER: the
+		* leaf casts below are unchecked, so an intrinsic-valued `DatabaseName`
+		* would otherwise put an OBJECT on the wire — the same defect one level in.
+		*/
+		const pickBlockSource = (desiredRaw, previousRaw, path, block, members) => {
+			const namesSendable = (bag) => {
+				if (bag === void 0) return false;
+				const present = members.filter((m) => bag[m] !== void 0);
+				return present.length > 0 && present.every((m) => isSendableLeaf(bag[m]));
+			};
+			const desired = guardOptions ? requireConfigObject(desiredRaw, path, guardOptions) : requireConfigObject(desiredRaw, path);
+			if (namesSendable(desired)) return desired;
+			if (desired !== void 0) {
+				const message = emptyBlockMessage(block);
+				if (options?.onUnusable) options.onUnusable(message);
+				else throw new Error(message);
+			}
+			const retained = asRecord(previousRaw);
+			return namesSendable(retained) ? retained : void 0;
+		};
 		const result = { Name: databaseInput["Name"] ?? fallbackName };
 		if (databaseInput["Description"] !== void 0) result.Description = databaseInput["Description"];
 		if (databaseInput["LocationUri"] !== void 0) result.LocationUri = databaseInput["LocationUri"];
 		if (databaseInput["Parameters"] !== void 0) result.Parameters = stringifyParameterValues(databaseInput["Parameters"]);
+		if (databaseInput["TargetDatabase"] !== void 0) {
+			const target = pickBlockSource(databaseInput["TargetDatabase"], previous?.["TargetDatabase"], "AWS::Glue::Database DatabaseInput.TargetDatabase", "TargetDatabase", TARGET_DATABASE_MEMBERS);
+			if (target !== void 0) {
+				const targetDatabase = {};
+				if (isSendableLeaf(target["CatalogId"])) targetDatabase.CatalogId = String(target["CatalogId"]);
+				if (isSendableLeaf(target["DatabaseName"])) targetDatabase.DatabaseName = String(target["DatabaseName"]);
+				if (isSendableLeaf(target["Region"])) targetDatabase.Region = String(target["Region"]);
+				result.TargetDatabase = targetDatabase;
+			}
+		}
+		if (databaseInput["FederatedDatabase"] !== void 0) {
+			const federated = pickBlockSource(databaseInput["FederatedDatabase"], previous?.["FederatedDatabase"], "AWS::Glue::Database DatabaseInput.FederatedDatabase", "FederatedDatabase", FEDERATED_DATABASE_MEMBERS);
+			if (federated !== void 0) {
+				const federatedDatabase = {};
+				if (isSendableLeaf(federated["ConnectionName"])) federatedDatabase.ConnectionName = String(federated["ConnectionName"]);
+				if (isSendableLeaf(federated["Identifier"])) federatedDatabase.Identifier = String(federated["Identifier"]);
+				result.FederatedDatabase = federatedDatabase;
+			}
+		}
+		if (databaseInput["CreateTableDefaultPermissions"] !== void 0) {
+			const permissions = this.usableDefaultPermissions(databaseInput["CreateTableDefaultPermissions"], guardOptions) ?? this.usableDefaultPermissions(previous?.["CreateTableDefaultPermissions"], { onUnusable: () => void 0 });
+			if (permissions !== void 0) result.CreateTableDefaultPermissions = permissions.map((entry) => {
+				const permission = {};
+				if (entry["Permissions"] !== void 0) permission.Permissions = entry["Permissions"];
+				const declaredPrincipal = asRecord(entry["Principal"]);
+				if (declaredPrincipal !== void 0) {
+					const principal = {};
+					if (isSendableLeaf(declaredPrincipal["DataLakePrincipalIdentifier"])) principal.DataLakePrincipalIdentifier = String(declaredPrincipal["DataLakePrincipalIdentifier"]);
+					permission.Principal = principal;
+				}
+				return permission;
+			});
+		}
 		return result;
 	}
 	/**
+	* `DatabaseInput.CreateTableDefaultPermissions` as a USABLE list, or
+	* `undefined` when the declared value is a shape cdkd refuses to narrow.
+	*
+	* The block is validated ALL-OR-NOTHING rather than per entry, which is the
+	* opposite of the S3 per-`Id` appliers and deliberate: this is a Lake
+	* Formation grant list delivered by ONE wholesale `CreateDatabase` /
+	* `UpdateDatabase` call, so dropping the entries cdkd cannot read would
+	* silently NARROW the permissions the template declared — the failure this
+	* guard exists to prevent, one level in from the block itself. A malformed
+	* ENTRY therefore invalidates the block, and the caller then refuses (create)
+	* or retains the previous list (update).
+	*
+	* `Permissions` is checked for ARRAY-ness for the same reason: the SDK member
+	* is `Permission[]`, so a bare string would be forwarded verbatim and the
+	* serializer would drop it, granting nothing while the deploy reports success.
+	*/
+	usableDefaultPermissions(value, guardOptions) {
+		if (value === void 0) return void 0;
+		const path = "AWS::Glue::Database DatabaseInput.CreateTableDefaultPermissions";
+		const entries = guardOptions ? requireConfigArray(value, path, guardOptions) : requireConfigArray(value, path);
+		if (entries === void 0) return void 0;
+		for (const entry of entries) {
+			const principal = asRecord(entry["Principal"]);
+			if (asRecord(entry) !== void 0 && (entry["Permissions"] !== void 0 || entry["Principal"] !== void 0) && (entry["Permissions"] === void 0 || Array.isArray(entry["Permissions"])) && (entry["Principal"] === void 0 || principal !== void 0 && isSendableLeaf(principal["DataLakePrincipalIdentifier"]))) continue;
+			const detail = `${path} carries an entry cdkd cannot read (each entry must be an object naming Permissions as a list and/or Principal as an object whose DataLakePrincipalIdentifier is a string or a number)`;
+			if (guardOptions?.onUnusable) {
+				guardOptions.onUnusable(`${detail}. Leaving the whole block unapplied rather than sending a NARROWED grant list. On an UPDATE that is a RESET: UpdateDatabase replaces DatabaseInput wholesale, so unless a usable previous list is retained the database falls back to the account default (IAM_ALLOWED_PRINCIPALS / ALL) — fix the template value to restore the declared grants`);
+				return;
+			}
+			throw new Error(detail);
+		}
+		return entries;
+	}
+	/**
 	* Build TableInput for Glue API from CFn template properties
 	*/
 	buildTableInput(tableInput, fallbackName) {
@@ -41306,9 +41602,30 @@ var GlueProvider = class {
 	* readback for it (and fabricating a placeholder would itself fire false
 	* drift). Declaring it here keeps the drift comparator from false-positiving
 	* on a state-recorded `OpenTableFormatInput` that the readback never surfaces.
+	*
+	* `AWS::Glue::Database` declares `DatabaseInput.CreateTableDefaultPermissions`
+	* PER RESOURCE (the issue #1602 seam), and only for a database whose template
+	* does NOT declare the block. AWS materializes a Lake Formation DEFAULT there
+	* — `[{IAM_ALLOWED_PRINCIPALS, [ALL]}]` on a catalog that has not been
+	* onboarded to Lake Formation (measured us-east-1, 2026-08-13) — so once
+	* issue #1807 taught `readDatabase` to surface the block, comparing it would
+	* report drift on EVERY existing database: the baseline is an
+	* `observedProperties` capture written by a binary that did not read the key,
+	* `drift.ts` walks the key UNION on that baseline (`unionWalkObjects`), and
+	* `deploy-engine.ts` does not refresh a record that already has one — so the
+	* phantom would persist until an unrelated UPDATE or a `drift --accept`.
+	* This is the ELBv2 `Targets` shape one type over: a value a SIBLING owns is
+	* ignored while the template declares none, and an explicit declaration —
+	* including an empty list — IS a declaration and stays compared.
+	*
+	* `TargetDatabase` / `FederatedDatabase` need no such scoping: AWS reports
+	* them only when they were actually set, so an appearance is real drift.
 	*/
-	getDriftUnknownPaths(resourceType) {
+	getDriftUnknownPaths(resourceType, properties) {
 		if (resourceType === "AWS::Glue::Table") return ["OpenTableFormatInput"];
+		if (resourceType === "AWS::Glue::Database") {
+			if (asRecord(properties?.["DatabaseInput"])?.["CreateTableDefaultPermissions"] === void 0) return ["DatabaseInput.CreateTableDefaultPermissions"];
+		}
 		return [];
 	}
 	async readDatabase(physicalId, catalogId) {
@@ -41328,6 +41645,9 @@ var GlueProvider = class {
 		dbInput["Description"] = db.Description ?? "";
 		if (db.LocationUri !== void 0) dbInput["LocationUri"] = db.LocationUri;
 		dbInput["Parameters"] = db.Parameters ?? {};
+		if (db.TargetDatabase !== void 0) dbInput["TargetDatabase"] = { ...db.TargetDatabase };
+		if (db.FederatedDatabase !== void 0) dbInput["FederatedDatabase"] = { ...db.FederatedDatabase };
+		if (db.CreateTableDefaultPermissions !== void 0) dbInput["CreateTableDefaultPermissions"] = db.CreateTableDefaultPermissions.map((entry) => ({ ...entry }));
 		const result = { DatabaseInput: dbInput };
 		if (db.Name !== void 0) result["DatabaseName"] = db.Name;
 		return result;
@@ -42210,6 +42530,35 @@ function parameterKeySet(value) {
 * its `Fn::*`/`Ref` key — harmless here, since providers only ever see
 * resolved values.)
 */
+/**
+* The CFn members of the two `DatabaseInput` object blocks, as the SENDABLE-ness
+* test sees them. They must stay in step with the per-member writes in
+* `buildDatabaseInput` — a name here that the builder does not write would let
+* an EMPTY block onto the wire, and one the builder writes but this list omits
+* would refuse a valid template that names only it. The unit suite fences both
+* directions by asserting each member ALONE reaches AWS, which fails on a
+* dropped entry (the member stops being sendable) and on an added one (the
+* block builds empty).
+*/
+const TARGET_DATABASE_MEMBERS = [
+	"CatalogId",
+	"DatabaseName",
+	"Region"
+];
+const FEDERATED_DATABASE_MEMBERS = ["ConnectionName", "Identifier"];
+/**
+* Is this leaf value one cdkd can put on the wire? A STRING or a NUMBER — CFn
+* is stringly typed and an unquoted YAML account id arrives as a number (the
+* reason `catalogIdForApi` exists) — and nothing else, so an unresolved
+* intrinsic cannot ride an unchecked cast into the request.
+*/
+const isSendableLeaf = (value) => typeof value === "string" || typeof value === "number" && Number.isFinite(value);
+/**
+* The refusal sentence for a `DatabaseInput` block that IS a plain object and
+* still names nothing cdkd can send — an unresolved intrinsic or a bare `{}`.
+* Shared so the create refusal and the update warning cannot drift apart.
+*/
+const emptyBlockMessage = (block) => `AWS::Glue::Database DatabaseInput.${block} declares no member cdkd can send (an unresolved intrinsic, an empty block), or mixes sendable members with unreadable ones; sending it would put an empty or NARROWED ${block} on the wire. Where this is only WARNED — an update, or a state replay — the previously applied block is retained if cdkd can still read one, and otherwise the key is omitted, which UpdateDatabase applies as a removal because it replaces DatabaseInput wholesale`;
 function asRecord(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return;
 	return value;
@@ -59623,6 +59972,27 @@ const COMPOSITE_ID_SPLITTERS = {
 			propertiesOverlay: { VpcId: vpcId }
 		};
 	},
+	"AWS::EC2::VPCCidrBlock": (physicalId, properties) => {
+		if (!physicalId.trim()) throw new Error("empty physical id for AWS::EC2::VPCCidrBlock (expected an association id)");
+		const parts = physicalId.split("|").map((p) => p.trim());
+		if (parts.length > 2) throw new Error(`expected a bare '<Id>' or '<Id>|<VpcId>', got ${parts.length} parts: '${physicalId}'`);
+		const id = parts[0];
+		if (!id) throw new Error(`empty part in '<Id>|<VpcId>': '${physicalId}'`);
+		if (!id.startsWith(VPC_CIDR_ASSOCIATION_ID_PREFIX)) throw new Error(`'${physicalId}' does not start with an association id: CloudFormation identifies an AWS::EC2::VPCCidrBlock by [Id, VpcId], so the first segment must be a '${VPC_CIDR_ASSOCIATION_ID_PREFIX}…' id. State entry may be corrupt, or the segments may be reversed; re-deploy the resource to refresh state`);
+		let vpcId;
+		if (parts.length === 2) {
+			vpcId = parts[1];
+			if (!vpcId) throw new Error(`empty part in '<Id>|<VpcId>': '${physicalId}'`);
+		} else vpcId = readStringProperty(properties, "VpcId", "AWS::EC2::VPCCidrBlock");
+		if (!VPC_ID_PATTERN.test(vpcId)) throw new Error(`'${vpcId}' is not a VPC id (expected 'vpc-…', not an association id): '${physicalId}' may have its segments reversed`);
+		return {
+			resourceIdentifier: {
+				Id: id,
+				VpcId: vpcId
+			},
+			propertiesOverlay: { VpcId: vpcId }
+		};
+	},
 	"AWS::EC2::Route": (physicalId, properties) => {
 		const parts = physicalId.split("|");
 		if (parts.length !== 2) throw new Error(`expected 2 parts ('<routeTableId>|<destination>'), got ${parts.length}: '${physicalId}'`);
@@ -59752,6 +60122,26 @@ const EIP_ALLOCATION_ID_PREFIX = "eipalloc-";
 * validate an address AWS itself minted.
 */
 const EIP_PUBLIC_IP_PATTERN = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+/**
+* The prefix every `AWS::EC2::VPCCidrBlock` association id carries. The same
+* kind of shape discriminator as {@link EIP_ALLOCATION_ID_PREFIX}: a VPC id and
+* an association id BOTH start with `vpc-`, so the longer prefix is what tells
+* the two segments apart.
+*/
+const VPC_CIDR_ASSOCIATION_ID_PREFIX = "vpc-cidr-assoc-";
+/**
+* The other half of that discriminator. ANCHORED, so an association id
+* (`vpc-cidr-assoc-…`, which also begins `vpc-`) does NOT match — a reversed
+* pair is exactly what this exists to catch.
+*
+* The character class is `[0-9a-z]` rather than hex, and the LENGTH is not
+* pinned. EC2 ids are hex today, but `cdkd export` is all-or-nothing, so a
+* false REFUSAL here blocks an entire export — and the discrimination does not
+* depend on the alphabet at all: it is the `-` in `cidr-assoc`, which no
+* character class here admits. Widening the class therefore costs nothing and
+* removes a false-refusal vector.
+*/
+const VPC_ID_PATTERN = /^vpc-[0-9a-z]+$/;
 const GATEWAY_ATTACHMENT_TYPE_IGW = "IGW";
 const GATEWAY_ATTACHMENT_TYPE_VGW = "VGW";
 /**
@@ -60347,8 +60737,8 @@ async function exportCommand(stackArg, options) {
 		});
 		if (blocked.length > 0) {
 			logger.error("The following resources block migration:");
-			for (const b of blocked) logger.error(`  - ${b.logicalId} (${b.resourceType}): ${b.reason}`);
-			throw new Error(`${blocked.length} resource(s) block migration. Either destroy them first (cdkd destroy / cdkd state destroy cherry-picked), or remove them from the CDK app and re-synthesize.`);
+			for (const line of groupBlockedReasons(blocked)) logger.error(line);
+			throw new Error(`${new Set(blocked.map((b) => b.logicalId)).size} resource(s) block migration. Either destroy them first (cdkd destroy / cdkd state destroy cherry-picked), or remove them from the CDK app and re-synthesize.`);
 		}
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
 		if (!options.dryRun) {
@@ -60955,12 +61345,25 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			});
 			continue;
 		}
+		const propertiesOverlay = resolved.propertiesOverlay ?? resolved.resourceIdentifier;
+		const unrepresentable = unrepresentableOverlayFields(raw, propertiesOverlay);
+		if (unrepresentable.length > 0) {
+			for (const u of unrepresentable) blocked.push({
+				logicalId,
+				resourceType,
+				reason: unrepresentableOverlayMessage({
+					logicalId,
+					resourceType
+				}, u.field, u.current, u.value)
+			});
+			continue;
+		}
 		phase1Imports.push({
 			logicalId,
 			resourceType,
 			physicalId: stateEntry.physicalId,
 			resourceIdentifier: resolved.resourceIdentifier,
-			propertiesOverlay: resolved.propertiesOverlay ?? resolved.resourceIdentifier
+			propertiesOverlay
 		});
 	}
 	return {
@@ -60972,6 +61375,28 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 	};
 }
 /**
+* Render the `blocked` list one bullet per RESOURCE, folding a resource's
+* several reasons into it.
+*
+* The pre-flight pushes one entry per offending FIELD (issue #1787), so a
+* multi-field overlay such as `AWS::S3Tables::Namespace` contributes two rows
+* for one resource — which made the count ("1 resource(s)") disagree with the
+* bullets printed under it. Grouping keeps the two consistent without losing a
+* reason.
+*/
+function groupBlockedReasons(blocked) {
+	const byResource = /* @__PURE__ */ new Map();
+	for (const b of blocked) {
+		const entry = byResource.get(b.logicalId) ?? {
+			resourceType: b.resourceType,
+			reasons: []
+		};
+		entry.reasons.push(b.reason);
+		byResource.set(b.logicalId, entry);
+	}
+	return [...byResource].map(([logicalId, { resourceType, reasons }]) => reasons.length === 1 ? `  - ${logicalId} (${resourceType}): ${reasons[0]}` : `  - ${logicalId} (${resourceType}):\n${reasons.map((r) => `      - ${r}`).join("\n")}`);
+}
+/**
 * Build the `ResourceIdentifier` map CloudFormation IMPORT expects in
 * `ResourcesToImport[].ResourceIdentifier` for the given resource type
 * and cdkd state's physical ID.
@@ -61230,14 +61655,14 @@ function injectDeletionPolicyForImport(template) {
 	}
 	return injected;
 }
-function filterTemplateForImport(template, plan) {
+function filterTemplateForImport(template, plan, warnOnRewrite = true) {
 	const allow = new Map(plan.map((p) => [p.logicalId, p]));
 	const original = template["Resources"];
 	const filteredResources = {};
 	for (const [logicalId, resource] of Object.entries(original)) {
 		const entry = allow.get(logicalId);
 		if (!entry) continue;
-		filteredResources[logicalId] = overlayResourceIdentifierOnProperties(resource, entry);
+		filteredResources[logicalId] = overlayResourceIdentifierOnProperties(resource, entry, warnOnRewrite);
 	}
 	const result = {
 		...template,
@@ -61264,8 +61689,10 @@ function filterTemplateForImport(template, plan) {
 * migration" value proposition. Closes [#319].
 *
 * **Post-v0.95 behavior** (this function): override only when synth
-* already carries a *literal-string* value for the field AND it differs
-* from `ResourceIdentifier`. Three cases:
+* already carries a *literal* value for the field AND it differs
+* from `ResourceIdentifier`. Four cases (the fourth added by issue #1787,
+* which also widened "literal" past `typeof === 'string'` — see
+* {@link classifyOverlayCurrentValue} for the full classification):
 *
 * - **Absent** (auto-generated names — user did NOT declare a physical
 *   name in CDK code): `Properties[field]` stays absent. Matches
@@ -61302,12 +61729,19 @@ function filterTemplateForImport(template, plan) {
 *   names` flip are no longer in this case — Properties.RoleName matches
 *   the AWS name without override.
 *
+* - **Unrepresentable** (a list carrying an intrinsic / a nested list / an
+*   empty list): REFUSED with a message naming the resource, the property and
+*   the scalar to declare instead. Preserving ANY of the three reproduces the
+*   opaque `CreateChangeSet` rejection; what makes OVERRIDING wrong differs per
+*   shape, so {@link refusalReason} says which rather than asserting one cause
+*   for all — only a list actually carrying an object element has an intrinsic
+*   to discard. Either way the command stops before submitting anything
+*   (issue #1787).
+*
 * For literal-match (Properties already has the right value), the
-* override is a no-op, so the check is effectively
-* `Properties[field] !== overlayValue && typeof Properties[field] ===
-* 'string'`.
+* override is a no-op.
 */
-function overlayResourceIdentifierOnProperties(resource, entry) {
+function overlayResourceIdentifierOnProperties(resource, entry, warnOnRewrite = true) {
 	if (!resource || typeof resource !== "object" || Array.isArray(resource)) return resource;
 	const r = resource;
 	const existingProperties = r["Properties"];
@@ -61315,7 +61749,13 @@ function overlayResourceIdentifierOnProperties(resource, entry) {
 	const overlay = entry.propertiesOverlay ?? entry.resourceIdentifier;
 	for (const [field, value] of Object.entries(overlay)) {
 		const current = properties[field];
-		if (typeof current === "string" && current !== value) properties[field] = value;
+		const kind = classifyOverlayCurrentValue(current);
+		if (kind === "intrinsic" || kind === "absent") continue;
+		if (kind === "unrepresentable") throw new Error(unrepresentableOverlayMessage(entry, field, current, value));
+		if (current !== value) {
+			if (warnOnRewrite && typeof current !== "string") getLogger().warn(`${entry.logicalId} (${entry.resourceType}): rewriting the identifier property '${field}' from ${describeOverlayValueShape(current)} to the scalar '${value}' recorded in cdkd state. CloudFormation types this property as a string; the exported template will carry the scalar.`);
+			properties[field] = value;
+		}
 	}
 	return {
 		...r,
@@ -61323,6 +61763,133 @@ function overlayResourceIdentifierOnProperties(resource, entry) {
 	};
 }
 /**
+* Why a given `unrepresentable` value is refused rather than rewritten.
+*
+* THREE shapes reach `unrepresentable`, and they are refused for two different
+* reasons — an earlier revision of this message asserted the intrinsic reason
+* for all of them, which is false for two of the three. The distinction is not
+* cosmetic: a message that names a cause the value does not have sends the user
+* looking for an intrinsic that is not there.
+*/
+function refusalReason(current) {
+	if (Array.isArray(current) && current.length === 0) return "cdkd will not invent a scalar where the template declared no value";
+	return Array.isArray(current) && current.some((e) => e !== null && typeof e === "object" && !Array.isArray(e)) ? "cdkd will not rewrite it, because doing so would discard the intrinsic it carries" : "cdkd will not replace a value it cannot represent as the scalar the schema declares";
+}
+/**
+* The shared message for a refused overlay value — used by the pre-flight in
+* {@link buildImportPlan} (which BLOCKS the resource) and by
+* {@link overlayResourceIdentifierOnProperties}'s defense-in-depth throw, so
+* the two cannot drift into describing the same defect differently.
+*/
+function unrepresentableOverlayMessage(entry, field, current, value) {
+	return `${entry.logicalId} (${entry.resourceType}): the identifier property '${field}' is ${describeOverlayValueShape(current)}, but CloudFormation types it as a string. ${refusalReason(current)}. Declare '${field}' as the scalar '${value}' (or drop the addPropertyOverride that made it a list) and re-run 'cdkd export'.`;
+}
+/**
+* Every overlay field of `entry` whose value in `resource`'s `Properties` is
+* {@link classifyOverlayCurrentValue}-`unrepresentable`.
+*
+* Exists so the refusal happens during PLANNING rather than during template
+* preprocessing. `overlayResourceIdentifierOnProperties` is called from three
+* places, and two of them are past the point of no return: `--dry-run` returns
+* BEFORE any overlay call (so a dry run would report a clean plan for a
+* template the real run aborts on), and the nested-stack path calls it inside
+* the per-stack IMPORT loop — where a throw on stack N leaves stacks 1..N-1
+* already imported, outside the loop's own "stacks imported so far" recovery
+* handler. Running the same classification in `buildImportPlan` puts the
+* verdict where every other unfixable-resource verdict already lives: reported
+* for EVERY offender at once, before the lock, before dry-run's return, and
+* before any AWS write.
+*/
+function unrepresentableOverlayFields(resource, overlay) {
+	if (!resource || typeof resource !== "object" || Array.isArray(resource)) return [];
+	const props = resource["Properties"];
+	if (!props || typeof props !== "object" || Array.isArray(props)) return [];
+	const bag = props;
+	const out = [];
+	for (const [field, value] of Object.entries(overlay)) if (classifyOverlayCurrentValue(bag[field]) === "unrepresentable") out.push({
+		field,
+		current: bag[field],
+		value
+	});
+	return out;
+}
+/**
+* Classify what the synth template currently carries at an identifier field,
+* for {@link overlayResourceIdentifierOnProperties} (issue #1787).
+*
+* The pre-#1787 rule was `typeof current === 'string'`, which is correct for
+* the two cases it was designed for (an absent key, and a `Ref` / `Fn::GetAtt`
+* intrinsic that must be preserved — issue #319) and WRONG for a third,
+* reachable case: a field the template carries as a non-string LITERAL. The
+* measured instance is `AWS::S3Tables::Namespace`, whose CFn registry type is
+* `{"type": "string"}` and whose CDK L1 emits a string, but
+* `addPropertyOverride('Namespace', ['analytics'])` synthesizes
+* `"Namespace": ["analytics"]` — which cdkd deploys, because
+* `s3-tables-provider.ts` accepts both wire shapes. The array is not a literal
+* string, so the overlay left it alone and it reached `CreateChangeSet`, where
+* CFn answered with an opaque rejection.
+*
+* The classification, and why each arm is what it is:
+*
+* - `absent` (`undefined` only) — unchanged. An auto-generated name the user
+*   never declared; CFn accepts the IMPORT on `ResourceIdentifier` alone. An
+*   explicit `null` is deliberately NOT here: the key IS present, the shallow
+*   Properties copy keeps it, and `"Namespace": null` then reaches
+*   `CreateChangeSet` — the same opaque-rejection class as the array, through
+*   the same `addPropertyOverride` hatch. It is a literal, and overwritten.
+* - `intrinsic` (a non-array object) — unchanged. `{Ref: Parent}` /
+*   `{Fn::GetAtt: [...]}` resolve during changeset processing to exactly this
+*   resource's `ResourceIdentifier` value, so clobbering them would only make
+*   the post-export `cdk diff` dirty (issue #319).
+* - `literal` (string / number / boolean, or an array of those) — OVERRIDDEN
+*   with the overlay value. This is not a guess: the overlay value comes from
+*   the cdkd-recorded physicalId, which is the authority on what the resource
+*   IS, while the template side is only what CDK happened to synthesize. So a
+*   single-element `['analytics']` and a bare `analytics` both become the
+*   scalar CFn's schema declares, exactly as the pre-existing prefixed-name
+*   literal-mismatch case already does.
+* - `unrepresentable` (an array containing an object / array / null, or an
+*   EMPTY array) — REFUSED. Preserving any of them ships the same opaque CFn
+*   rejection this change exists to remove; the reason OVERRIDING is wrong
+*   differs by shape, and {@link refusalReason} splits it three ways rather
+*   than asserting one cause:
+*     - a list carrying an OBJECT element — overriding discards an intrinsic
+*       the user wrote;
+*     - a NESTED list, or one holding `null` — no intrinsic to protect, it is
+*       simply not representable as the declared scalar;
+*     - an EMPTY list — nothing to reconcile against the identifier, and
+*       materializing a scalar where the template declared "no value" is the
+*       invention this classification exists to avoid.
+*   Saying "would discard an intrinsic" for all three was the defect the
+*   #1787 review round removed; do not re-collapse it.
+*/
+function classifyOverlayCurrentValue(current) {
+	if (current === void 0) return "absent";
+	if (current === null) return "literal";
+	if (Array.isArray(current)) {
+		if (current.length === 0) return "unrepresentable";
+		return current.every((e) => typeof e === "string" || typeof e === "number" || typeof e === "boolean") ? "literal" : "unrepresentable";
+	}
+	if (typeof current === "object") return "intrinsic";
+	return "literal";
+}
+/**
+* Human-readable shape of an overlay value, for the refusal error and the
+* rewrite warning. Bounded: the value is user-supplied and lands in an error
+* message that a failed export persists, so a large list is summarized rather
+* than serialized whole.
+*/
+function describeOverlayValueShape(current) {
+	if (Array.isArray(current)) {
+		if (current.length === 0) return "an empty list";
+		const preview = JSON.stringify(current);
+		const shown = preview.length > 120 ? `${preview.slice(0, 120)}…` : preview;
+		return `a ${current.length}-element list (${shown})`;
+	}
+	if (current === null) return "an explicit null";
+	return `a ${typeof current} (${JSON.stringify(current)})`;
+}
+/**
 * Build the phase-2 UPDATE template: full synth template with the same
 * conditional overlay applied to every phase-1 import. Phase-1 and
 * phase-2 must stay symmetric — when `overlayResourceIdentifierOnProperties`
@@ -61357,7 +61924,7 @@ function applyImportOverlayForPhase2(template, phase1Imports) {
 	const resourcesMap = resources;
 	for (const entry of phase1Imports) {
 		const r = resourcesMap[entry.logicalId];
-		if (r !== void 0) resourcesMap[entry.logicalId] = overlayResourceIdentifierOnProperties(r, entry);
+		if (r !== void 0) resourcesMap[entry.logicalId] = overlayResourceIdentifierOnProperties(r, entry, false);
 	}
 	return result;
 }
@@ -62029,8 +62596,8 @@ async function runPerStackImportLoop(args) {
 			skipImportSupportPreflight: options.skipImportSupportPreflight === true
 		});
 		if (plan.blocked.length > 0) {
-			const lines = plan.blocked.map((b) => `  - ${b.logicalId} (${b.resourceType}): ${b.reason}`);
-			throw new Error(`Stack '${meta.cdkdStackName}' has ${plan.blocked.length} resource(s) that block migration:\n${lines.join("\n")}`);
+			const lines = groupBlockedReasons(plan.blocked);
+			throw new Error(`Stack '${meta.cdkdStackName}' has ${new Set(plan.blocked.map((b) => b.logicalId)).size} resource(s) that block migration:\n${lines.join("\n")}`);
 		}
 		perStackPlans.push({
 			cdkdName: meta.cdkdStackName,
@@ -62147,7 +62714,7 @@ async function runPerStackImportLoop(args) {
 				}
 				const rewrittenNestedRows = /* @__PURE__ */ new Map();
 				if (plan.nestedStackRows.length > 0) {
-					const phase1BTemplate = filterTemplateForImport(plan.template, plan.phase1Imports);
+					const phase1BTemplate = filterTemplateForImport(plan.template, plan.phase1Imports, false);
 					injectDeletionPolicyForImport(phase1BTemplate);
 					const phase1BResources = [];
 					for (const row of plan.nestedStackRows) {
@@ -76618,7 +77185,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.4");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.6");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;