@go-to-k/cdkd 0.290.33 → 0.290.35

package/dist/{program-D75-DVWT.js → program-COiS7GZJ.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as recordMaskOnlyValue, $r as AssetManifestLoader, $t as s3BucketArn, A as extractDeploymentEventError, Ai as getAwsClients, An as refuseMalformedState, Ar as BOOTSTRAP_MARKER_PREFIX, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as IntrinsicResolutionRefusalError, Bn as STATE_SOURCED_BASELINE_RULES, Br as buildDockerImage, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as canonicalizeRegion, Cn as producerRecordKey, Cr as stringifyValue, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Dn as refuseMalformedOutputsForDestroy, Dr as loadPublishableAssetManifest, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as processStackMessages, En as refuseMalformedOutputs, Er as createAssetRedirectResolver, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as findSilentDropProperties, Fr as parseBootstrapMarker, Ft as isSettledInstanceState, G as gray, Gi as NestedStackChildDirectDestroyError, Gn as createSecretMasker, Gr as formatDockerLoginError, Gt as readConfigString, H as formatResourceLine, Hi as LocalStartServiceError, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerExecFailure, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as CrossAccountSecretRefusalError, In as describeTypeWithThrottleRetry, Ir as readBootstrapMarkerBody, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceTimeoutError, Jn as identityKeyFor, Jr as redactDockerArgvValues, Jt as requireConfigObject, K as green, Ki as PartialFailureError, Kn as dynamicReferenceTokens, Kr as getDockerCmd, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Ln as withRetry, Lr as validateAssetBucketName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as setAwsClients, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as ensureAssetStorage, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as repairMalformedResourcesForReadOnly, Nr as getBootstrapMarkerKey, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as resolveBucketRegion, On as refuseMalformedResourcePropertiesForOrphan, Or as rewriteTemplateAssetReferences, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CdkdError, Pn as findActionableSilentDrops, Pr as isCrossRegionRedirect, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as stripControlChars, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DeployCancelledError, Rn as DagBuilder, Rr as validateContainerRepoName, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as PARTITION_TABLE, Sn as malformedStateRefusalMessage, Sr as AssetPublisher, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as AssemblyReader, Tn as refuseMalformedNestedChildOutputs, Tr as buildAssetRedirectMap, Tt as carriesDynamicReference, U as bold, Un as TEMPLATE_SOURCED_RULES, Ur as describeDockerFailure, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalInvokeBuildError$1, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerCapturedOutput, Vt as coerceCfnInteger, W as cyan, Wi as MalformedProducerRecordRefusalError, Wn as carriesSecretMask, Wr as dockerSpawnEnvWithSensitive, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackHasActiveImportsError, Xn as markSameGenerationBag, Xr as runDockerStreaming, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as ResourceUpdateNotSupportedError, Yn as isSingleDynamicReferenceToken, Yr as runDockerForeground, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zi as StackTerminationProtectionError, Zn as maskSecretsInError, Zr as escapeRegExp, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as findLargeInlineResources, _n as malformedOutputsRefusalMessage, _r as importableOutputs, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isRetryableTransientError, ai as resolveApp, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as decodeListingKey, bn as malformedResourcePropertiesWarning, br as orphansCarriedFrom, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markNonRetryable, ci as resolveSkipPrefix, cn as envCredentialsAreAssumedRole, cr as buildLockContentionMessage, ct as createMaskedRetryLogger, d as updatePartialReason, da as describeAwsFailure, di as resolveUseCdkBootstrapAssets, dn as STATE_RESOURCES_MALFORMED, dr as shellQuote, dt as beginCommandInterruptScope, ei as getDockerImageBySourceHash, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fa as safeStringify, fi as stateBucketExistenceConfirmed, fn as hasReadableOutputs, fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as MIGRATE_TMP_PREFIX, gn as malformedLocalOutputsWarning, gr as importableOutputKeys, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as CFN_TEMPLATE_URL_LIMIT, hn as malformedExportSourceWarning, hr as hasReadableExportSet, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isMarkedNonRetryable, ii as getLegacyStateBucketName, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as resetAwsClients, jn as repairMalformedOutputsForReadOnly, jr as assertAssetBucketRegion, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as AwsClients, kn as refuseMalformedResourcesForDestroy, kr as AssetModeResolver, kt as getAccountInfo, l as replayRollback, la as markRedactedCause, li as resolveStateBucketWithDefault, ln as DiffCalculator, lr as forceQuitRecoveryClause, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_BODY_LIMIT, mn as malformedExportNamesWarning, mr as exportNamesCarriedFrom, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as normalizeAwsError, ni as synthesisStatusMessage, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isThrottlingError, oi as resolveAutoAssetStorage, on as applyCallerIdentityCredentials, or as UNREPRODUCIBLE_LOCK_CLAUSE, ot as ProviderRegistry, p as maskingRetryLogger, pi as warnDeprecatedNoPrefixCliFlag, pn as hasReadableResources, pr as DEFAULT_STATE_PREFIX, pt as interruptWatchListenerCount, q as red, qi as ProvisioningError, qn as errorCauseChain, qr as partitionSensitiveEnv, qt as requireConfigArray, r as DeployEngine, ra as withErrorHandling, ri as getDefaultStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as isTransientServerError, si as resolveCaptureObservedState, sn as callerEnvCredentials, sr as buildForceUnlockCommand, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as Synthesizer, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as retryClassificationText, ui as resolveStateBucketWithDefaultAndSource, un as INTRINSIC_KEYS, ur as formatLockExpiry, ut as maskerOrIdentity, v as keptWholeReasonText, vi as uploadCfnTemplate, vn as malformedOutputsWarning, vr as isReadableBag, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as derivePartitionAndUrlSuffix, wn as refuseDivergentRecordRegionForDestroy, wr as WorkGraph, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as expectedOwnerParam, xn as malformedResourcesWarning, xr as shouldRetainResource, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, yn as malformedRenderedContainersWarning, yr as orphansAfterRollback, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as DynamicReferenceRegionAmbiguousError, zn as TemplateParser, zr as buildDenyExternalAccessPolicy, zt as assertRegionMatch } from "./deploy-engine-B6TcGQSU.js";
+import { $ as isExportAliasCollision, $i as StackTerminationProtectionError, $n as maskSecretsInText, $r as stripControlChars, $t as withSharedDrainBudget, A as makeCanonicalizePropertiesFn, Ai as resolveBucketRegion, An as refuseMalformedResourcesForDestroy, Ar as AssetModeResolver, At as getAccountInfo, B as isWarmThroughputDecrease, Bi as DeployCancelledError, Bn as TemplateParser, Br as buildDenyExternalAccessPolicy, Bt as assertRegionMatch, C as PRE_DELETE_SNAPSHOT_TYPES, Ci as expectedOwnerParam, Cn as malformedStateRefusalMessage, Cr as AssetPublisher, Ct as disableInstanceApiTermination, D as isFinalSnapshotError, Di as AssemblyReader, Dn as refuseMalformedOutputs, Dr as createAssetRedirectResolver, Dt as carriesFetchableDynamicReference, E as createPreDeleteFinalSnapshot, Ei as derivePartitionAndUrlSuffix, En as refuseMalformedNestedChildOutputs, Er as buildAssetRedirectMap, Et as carriesDynamicReference, F as isStatefulRecreateTargetForReplace, Fn as findActionableSilentDrops, Fr as isCrossRegionRedirect, Ft as refStateLookupFromResource, G as cyan, Gn as carriesSecretMask, Gr as dockerSpawnEnvWithSensitive, Gt as configStringRefusal, H as toFiniteNumber, Hi as IntrinsicResolutionRefusalError, Hn as STATE_SOURCED_CROSS_GENERATION_RULES, Hr as describeDockerCapturedOutput, Ht as coerceCfnInteger, I as isStatefulRecreateTargetSync, Ii as CdkdError, In as findSilentDropProperties, Ir as parseBootstrapMarker, It as isSettledInstanceState, J as red, Ji as PartialFailureError, Jn as errorCauseChain, Jr as partitionSensitiveEnv, Jt as requireConfigArray, K as gray, Ki as MalformedProducerRecordRefusalError, Kn as createSecretMasker, Kr as formatDockerLoginError, Kt as readConfigString, L as renderStatefulReason, Ln as describeTypeWithThrottleRetry, Lr as readBootstrapMarkerBody, Lt as WAFv2WebACLProvider, M as makeSiblingClaimReader, Mi as getAwsClients, Mn as repairMalformedOutputsForReadOnly, Mr as assertAssetBucketRegion, Mt as isNamelessDynamicReferenceError, N as planOrphanAdoption, Ni as resetAwsClients, Nn as repairMalformedResourcePropertiesForReadOnly, Nr as ensureAssetStorage, Nt as isUnboundTemplateParameter, O as refusesFinalSnapshot, Oi as processStackMessages, On as refuseMalformedOutputsForDestroy, Or as loadPublishableAssetManifest, Ot as cfnRefValueFromPhysicalId, P as MULTI_REGION_RECREATE_BLOCKED_TYPES, Pi as setAwsClients, Pn as repairMalformedResourcesForReadOnly, Pr as getBootstrapMarkerKey, Pt as parameterTypeMayLoseSecretIdentity, Q as exportAliasCollisionScrubWarning, Qi as StackHasActiveImportsError, Qn as maskSecretsInError, Qr as escapeRegExp, Qt as producerRegionsFromState, R as WARM_THROUGHPUT_MEMBERS, Ri as CrossAccountSecretRefusalError, Rn as withRetry, Rr as validateAssetBucketName, Rt as normalizeAwsTagsToCfn, S as ATOMIC_FINAL_SNAPSHOT_TYPES, Si as decodeListingKey, Sn as malformedResourcesWarning, Sr as shouldRetainResource, St as deleteSkipReason, T as ccRoutedFinalSnapshotError, Ti as canonicalizeRegion, Tn as refuseDivergentRecordRegionForDestroy, Tr as WorkGraph, Tt as IntrinsicFunctionResolver, U as formatResourceLine, Ui as LocalInvokeBuildError$1, Un as STATE_SOURCED_READBACK_RULES, Ur as describeDockerExecFailure, Ut as configBooleanRefusal, V as toCfnInteger, Vi as DynamicReferenceRegionAmbiguousError, Vn as STATE_SOURCED_BASELINE_RULES, Vr as buildDockerImage, Vt as coerceCfnBoolean, W as bold, Wi as LocalStartServiceError, Wn as TEMPLATE_SOURCED_RULES, Wr as describeDockerFailure, Wt as configIntegerRefusal, X as collectDeclaredOutputNames, Xi as ResourceTimeoutError, Xn as isSingleDynamicReferenceToken, Xr as runDockerForeground, Xt as requireConfigString, Y as yellow, Yi as ProvisioningError, Yn as identityKeyFor, Yr as redactDockerArgvValues, Yt as requireConfigObject, Z as collectPublishedOutputNames, Zi as ResourceUpdateNotSupportedError, Zn as markSameGenerationBag, Zr as runDockerStreaming, Zt as classifyReplaySecretRegion, _ as bagHoldsSecretExpression, _i as CFN_TEMPLATE_URL_LIMIT, _n as malformedLocalOutputsWarning, _r as importableOutputKeys, _t as CloudControlProvider, a as DeploymentEventsStore, aa as withErrorHandling, ai as getLegacyStateBucketName, an as applyRoleArnIfSet, ar as S3StateBackend, at as collectInlinePolicyNamesManagedBySiblings, b as mergeNoChangeOutputs, bi as uploadCfnTemplate, bn as malformedRenderedContainersWarning, br as orphansAfterRollback, bt as UNSPECIFIED_SKIP_REASON, c as replayFailedOperations, ca as isThrottlingError, ci as resolveCaptureObservedState, cn as callerEnvCredentials, cr as buildForceUnlockCommand, ct as wouldReturnToSdkProvider, d as updatePartialMessage, da as markRedactedCause, di as resolveStateBucketWithDefaultAndSource, dn as INTRINSIC_KEYS, dr as formatLockExpiry, dt as maskerOrIdentity, ei as AssetManifestLoader, en as s3BucketArn, er as recordMaskOnlyValue, et as secretBearing, f as updatePartialReason, fa as retryClassificationText, fi as resolveUseCdkBootstrapAssets, fn as STATE_RESOURCES_MALFORMED, fr as shellQuote, ft as beginCommandInterruptScope, g as computeImplicitDeleteEdges, gi as CFN_TEMPLATE_BODY_LIMIT, gn as malformedExportSourceWarning, gr as hasReadableExportSet, gt as startInterruptWatch, h as IMPLICIT_DELETE_DEPENDENCIES, hi as ssmResolvedValueType, hn as malformedExportNamesWarning, hr as exportNamesCarriedFrom, ht as isInterruptedWaitError, i as DeploymentEventsReader, ia as normalizeAwsError, ii as getDefaultStateBucketName, in as s3BucketWebsiteUrl, ir as LockManager, it as IAMRoleProvider, j as extractDeploymentEventError, ji as AwsClients, jn as refuseMalformedState, jr as BOOTSTRAP_MARKER_PREFIX, jt as isImpossibleEmptyStoredAttribute, k as unsupportedFinalSnapshotError, kn as refuseMalformedResourcePropertiesForOrphan, kr as rewriteTemplateAssetReferences, kt as coerceParameterTypedValue, l as replayRollback, la as isTransientServerError, li as resolveSkipPrefix, ln as envCredentialsAreAssumedRole, lr as buildLockContentionMessage, lt as createMaskedRetryLogger, m as maskingRetryLogger, ma as safeStringify, mi as warnDeprecatedNoPrefixCliFlag, mn as hasReadableResources, mr as DEFAULT_STATE_PREFIX, mt as interruptWatchListenerCount, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as Synthesizer, nn as s3BucketDualStackDomainName, nr as redactSecretsForState, nt as secretSafeKeyDisplay, o as planFailedOps, oa as isMarkedNonRetryable, oi as resolveApp, on as AWS_CREDENTIAL_ENV_KEYS, or as rebuildClientForBucketRegion, ot as clearOnUpdateRemoval, p as withResourceDeadline, pa as describeAwsFailure, pi as stateBucketExistenceConfirmed, pn as hasReadableOutputs, pr as CUSTOM_RESOURCE_RESPONSE_PREFIX, pt as endCommandInterruptScope, q as green, qi as NestedStackChildDirectDestroyError, qn as dynamicReferenceTokens, qr as getDockerCmd, qt as replayWarn, r as DeployEngine, ri as synthesisStatusMessage, rn as s3BucketRegionalDomainName, rr as scrubResourceRecord, rt as getCurrentResourceSecrets, s as planRollback, sa as isRetryableTransientError, si as resolveAutoAssetStorage, sn as applyCallerIdentityCredentials, sr as UNREPRODUCIBLE_LOCK_CLAUSE, st as ProviderRegistry, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as SynthesisError, ti as getDockerImageBySourceHash, tn as s3BucketDomainName, tr as recoverMaskedOutput, tt as secretBearingStateKeyWarning, u as resolveReplacementOldType, ua as markNonRetryable, ui as resolveStateBucketWithDefault, un as DiffCalculator, ur as forceQuitRecoveryClause, ut as maskDeep, v as isSecretBearingReferenceString, vi as MIGRATE_TMP_PREFIX, vn as malformedOutputsRefusalMessage, vr as importableOutputs, vt as isWaitAbandonedError, w as buildFinalSnapshotIdentifier, wi as PARTITION_TABLE, wn as producerRecordKey, wr as stringifyValue, wt as isTerminationProtectionPropagationError, x as bindingSkippedOutputs, xi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, xn as malformedResourcePropertiesWarning, xr as orphansCarriedFrom, xt as deleteIndeterminateGuards, y as keptWholeReasonText, yi as findLargeInlineResources, yn as malformedOutputsWarning, yr as isReadableBag, yt as slowCcOperationTimeoutMs, z as coerceWarmThroughput$1, zn as DagBuilder, zr as validateContainerRepoName, zt as resolveExplicitPhysicalId } from "./deploy-engine-DhZtBBq0.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-BX4pJk0T.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-xHGBnQbJ.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BCpZ70Ws.js";
+import { t as getCdkdVersion } from "./version-BIpCWEQx.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BguZAQtF.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2758,16 +2758,13 @@ const EMPTY_ALLOW_SET$1 = /* @__PURE__ */ new Set();
 * is spelled once, or the note could name ids the validator does not refuse.
 *
 * The two are NOT the same set, and deliberately so. The refusal fires when
-* EITHER the state record or the template says nested, because the two types
-* select different halves of the destructive path: the TEMPLATE's type picks
-* the provider that deletes the old resource (a Type change emits an UPDATE
-* carrying `resourceType: desiredResource.Type`, which is what
-* `oldDeleteProvider` resolves from), while the STATE's type is what
-* `NestedStackProvider` owns and derives `<parent>~<logicalId>` from. The note
-* keys on the TEMPLATE alone, because it is telling the user what their current
-* template contains. Which type governs was argued from plausibility twice and
-* settled by reading `analyzer/diff-calculator.ts` and `deploy-engine.ts`'s
-* `oldDeleteProvider`; do not re-derive it from either name. Other modules spell it
+* EITHER the state record or the template says nested, because a recreate has
+* two halves with two types (issue #2668): the STATE's type routes the delete
+* of the old resource — `NestedStackProvider` derives `<parent>~<logicalId>`
+* from it — and the TEMPLATE's type routes the create, which for a nested row
+* is a whole child-stack deploy. Either half alone is outside what a recreate
+* is built for. The note keys on the TEMPLATE alone, because it is telling the
+* user what their current template contains. Other modules spell it
 * for themselves rather than sharing one export: the only EXPORTED copy lives
 * in `src/cli/commands/retire-cfn-stack.ts`, and importing a CLI command module
 * from the deployment layer would invert the dependency direction. (No count of
@@ -3382,6 +3379,297 @@ function analyzePinCcApiReachability(pinnedLogicalIds, stacks) {
 	};
 }
 
+//#endregion
+//#region src/utils/nested-template-cycle.ts
+/**
+* Static, READ-ONLY validation of a nested-template tree, run BEFORE anything
+* is deployed from it (issue go-to-k/cdkd#3247).
+*
+* `NestedStackProvider` follows `Metadata['aws:asset:path']` from one nested
+* template to the next and runs a whole child `DeployEngine` per level. A
+* relative path that resolves back onto the same nesting chain therefore
+* DEPLOYS every level of the cycle until S3's key limit stops it. Threading an
+* ancestor chain through the provider's recursion would only refuse at the
+* first repeat, by which point every level above it is already provisioned.
+* Everything the walk follows is on disk before the first child engine exists,
+* so the whole subtree is validated up front instead.
+*
+* Two properties are copied from the `cdkd diff --recursive` guard (issue
+* go-to-k/cdkd#3239), because re-deriving them gets them wrong:
+*
+* - The refused shape is a repeat along ONE root-to-node chain, never a repeat
+*   anywhere in the tree: two sibling rows may name the same child template,
+*   and that diamond is a legitimate assembly.
+* - It is a refusal, not a depth cap. A cyclic assembly has no correct deploy.
+*
+* `Condition`s are deliberately NOT evaluated: a row whose condition would be
+* false at deploy time still counts. A self-including template that terminates
+* through a condition is refused here exactly as the diff walk refuses it, so
+* the two commands agree about which assemblies are well-formed.
+*
+* A leaf apart from `display-safe.ts`, so any layer may import it.
+*/
+const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
+/**
+* Same predicate `NestedStackProvider` applies per level. The `startsWith('/')`
+* arm covers a POSIX-style absolute path consumed on Windows, where
+* `path.isAbsolute` alone answers `false`.
+*/
+function isAbsoluteAssetPath(p) {
+	return path.isAbsolute(p) || p.startsWith("/");
+}
+/**
+* What "the same template" means ON A CHAIN: the file's name inside its REAL
+* directory.
+*
+* The directory is `realpath`ed because a symlinked DIRECTORY (`d -> .`) makes
+* every level's joined path a new, longer string (`d/a.json`, `d/d/a.json`,
+* ...) for one and the same file, which a comparison of resolved path strings
+* never sees repeat. There are finitely many (real directory, name) pairs, so
+* an endless descent must repeat one, however it is spelled.
+*
+* It is NOT what decides a template's children. Those resolve LEXICALLY
+* against the directory the template was reached in (`path.join` folds `d/..`
+* without following the link), so one identity reached through two spellings
+* can have two different subtrees. That is why the clean-subtree memo in
+* `findNestedTemplateTreeDefect` is keyed on the lexical path instead, and why
+* an identity repeat is a conservative refusal rather than an exact one: with
+* a symlinked directory AND a `..` row it can refuse a tree that would have
+* terminated. Such an assembly is hand-built by definition.
+*
+* Falls back to `path.resolve` for a directory that does not exist; the walk
+* stops there anyway.
+*/
+function templateIdentity(templatePath) {
+	const dir = path.dirname(templatePath);
+	let realDir;
+	try {
+		realDir = fs.realpathSync(dir);
+	} catch {
+		realDir = path.resolve(dir);
+	}
+	return path.join(realDir, path.basename(templatePath));
+}
+/**
+* The nested-stack rows of a parsed template that name a child template file.
+*
+* THE ONE SPELLING, shared by this module's walk and by
+* `NestedStackProvider.indexGrandchildTemplates`, because the walk is only a
+* guard if it follows exactly the rows the deploy follows. Two hand-written
+* copies disagreed on an ARRAY-valued `Resources`: `Object.entries` indexes an
+* array as `'0'`, `'1'`, ..., the deploy followed those rows, and a walk that
+* skipped them accepted a cyclic tree. So this takes whatever `Object.entries`
+* takes, and does not pre-judge the container's shape.
+*/
+function listNestedTemplateRows(template) {
+	if (template === null || typeof template !== "object") return [];
+	const resources = template.Resources;
+	if (resources === null || resources === void 0) return [];
+	const rows = [];
+	for (const [logicalId, resource] of Object.entries(resources)) {
+		const row = resource;
+		if (row?.Type !== NESTED_STACK_TYPE$1) continue;
+		const assetPath = row.Metadata?.["aws:asset:path"];
+		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
+		rows.push({
+			logicalId,
+			assetPath
+		});
+	}
+	return rows;
+}
+/**
+* The rows of the template FILE at `templatePath`. Unreadable or unparseable
+* input yields `undefined`: reporting that is the job of the site that
+* actually loads the template, with its own message, and a walk that cannot
+* descend cannot loop.
+*/
+function readNestedRows(templatePath) {
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(templatePath, "utf-8"));
+	} catch {
+		return;
+	}
+	return listNestedTemplateRows(parsed);
+}
+/**
+* Deeper than this cannot deploy at all, so it is refused rather than walked.
+* A child's state key is `cdkd/<root>~<id>~<id>.../<region>/state.json`; each
+* level adds at least two bytes (`~` plus a one-character logical id) and S3
+* caps a key at 1024 bytes. The bound exists so a hostile chain of tens of
+* thousands of DISTINCT templates is a readable refusal instead of a
+* `RangeError` from the recursion below. It is not a cycle heuristic: a cycle
+* is refused at its first repeat, long before this.
+*/
+const MAX_NESTING_DEPTH = 512;
+/**
+* Rows the walk will follow before it refuses the tree as too large.
+*
+* The clean-subtree memo is keyed on the LEXICAL path (it has to be, see
+* `templateIdentity`), and symlinked directories give one file arbitrarily
+* many lexical spellings: with `d1 -> .` and `d2 -> .`, rows naming
+* `t.json`, `d1/t.json` and `d2/t.json` at every level multiply the spellings
+* per level while no chain ever repeats an identity. Such a walk is finite but
+* exponential, so it needs a budget rather than a better key. Far above any
+* real assembly: a CDK app's nested templates number in the tens, and a memo
+* hit costs one row, not a subtree.
+*/
+const MAX_ROWS_FOLLOWED = 1e4;
+/**
+* Walk every nested template reachable from `nestedTemplates` (logical id ->
+* template file path, the shape `AssemblyReader` and the provider's own
+* per-level index produce) and return the first defect, or `undefined` when
+* the tree is well-formed.
+*
+* `ancestorTemplatePaths` seeds the chain with templates ABOVE the entry rows,
+* for a caller that knows them. Detection does not depend on it: a cycle
+* through an unseeded ancestor is followed once around and refused when it
+* re-enters the first template the walk did see.
+*/
+function findNestedTemplateTreeDefect(nestedTemplates, ancestorTemplatePaths = []) {
+	const onChain = /* @__PURE__ */ new Set();
+	for (const p of ancestorTemplatePaths) onChain.add(templateIdentity(p));
+	const clean = /* @__PURE__ */ new Set();
+	const chain = [];
+	let rowsFollowed = 0;
+	const visit = (logicalId, templatePath) => {
+		if (typeof templatePath !== "string") return void 0;
+		const identity = templateIdentity(templatePath);
+		const lexical = path.resolve(templatePath);
+		chain.push({
+			logicalId,
+			templatePath: identity
+		});
+		try {
+			if (onChain.has(identity)) return {
+				kind: "cycle",
+				chain: [...chain]
+			};
+			if (chain.length > 512) return {
+				kind: "too-deep",
+				chain: [...chain]
+			};
+			if (++rowsFollowed > 1e4) return {
+				kind: "too-large",
+				chain: [...chain]
+			};
+			if (clean.has(lexical)) return void 0;
+			const rows = readNestedRows(templatePath);
+			if (rows === void 0) return void 0;
+			onChain.add(identity);
+			try {
+				const dir = path.dirname(templatePath);
+				for (const row of rows) {
+					if (isAbsoluteAssetPath(row.assetPath)) return {
+						kind: "absolute-path",
+						chain: [...chain],
+						logicalId: row.logicalId,
+						assetPath: row.assetPath
+					};
+					const defect = visit(row.logicalId, path.join(dir, row.assetPath));
+					if (defect) return defect;
+				}
+			} finally {
+				onChain.delete(identity);
+			}
+			clean.add(lexical);
+			return;
+		} finally {
+			chain.pop();
+		}
+	};
+	for (const [logicalId, templatePath] of Object.entries(nestedTemplates)) {
+		const defect = visit(logicalId, templatePath);
+		if (defect) return defect;
+	}
+}
+/** Hops rendered in full before the middle of a long chain is elided. */
+const MAX_RENDERED_HOPS = 8;
+/**
+* `'A' (/x/a.json) -> 'B' (/x/b.json)`. Every interpolation goes through
+* `displaySafe`: this text exists FOR a hand-modified assembly, so a logical id
+* (a template key) and a path (derived from `aws:asset:path`) are both
+* attacker-controlled, and a bare `Error` message is not sanitized downstream.
+* A long chain keeps both ends, since the entry row and the closing row are
+* the two a reader needs.
+*/
+function renderChain(chain) {
+	const hop = (h) => `'${displaySafe(h.logicalId)}' (${displaySafe(h.templatePath)})`;
+	if (chain.length <= MAX_RENDERED_HOPS) return chain.map(hop).join(" -> ");
+	const keep = MAX_RENDERED_HOPS / 2;
+	return [
+		...chain.slice(0, keep).map(hop),
+		`... ${chain.length - 8} more ...`,
+		...chain.slice(-4).map(hop)
+	].join(" -> ");
+}
+/**
+* The refusal text for a defect found under `stackName`. `action` completes
+* "Refusing to ..." so each caller states what it declined to do.
+*/
+function renderNestedTemplateTreeDefect(defect, stackName, action) {
+	const provenance = `CDK emits an acyclic nested template tree with relative asset paths, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
+	const owner = (chain) => {
+		const ids = chain.slice(0, -1).map((h) => h.logicalId);
+		const keep = MAX_RENDERED_HOPS / 2;
+		const shown = ids.length <= MAX_RENDERED_HOPS ? ids : [
+			...ids.slice(0, keep),
+			`...${ids.length - 8} more...`,
+			...ids.slice(-4)
+		];
+		return displaySafe([stackName, ...shown].join("~"));
+	};
+	if (defect.kind === "cycle") {
+		const closing = defect.chain[defect.chain.length - 1];
+		return `The nested template tree under stack '${displaySafe(stackName)}' contains a cycle: ${renderChain(defect.chain)}. Nested stack '${displaySafe(closing.logicalId)}' (declared in stack '${owner(defect.chain)}') resolves to a template that is already on that nesting chain, so its Metadata['aws:asset:path'] closes a cycle. ${provenance}`;
+	}
+	if (defect.kind === "too-large") return `The nested template tree under stack '${displaySafe(stackName)}' has more than ${MAX_ROWS_FOLLOWED} nested-stack rows to follow (the walk stopped at ${renderChain(defect.chain)}). That is far beyond any CDK-generated assembly. Symlinked directories can give one template file many paths, which multiplies the tree without ever repeating on one chain. Refusing to ${action}.`;
+	if (defect.kind === "too-deep") return `The nested template tree under stack '${displaySafe(stackName)}' nests more than ${512} levels deep: ${renderChain(defect.chain)}. No tree that deep can deploy, because each level lengthens the child's state key and S3 caps a key at 1024 bytes. ${provenance}`;
+	return `The nested template tree under stack '${displaySafe(stackName)}' has nested stack '${displaySafe(defect.logicalId)}' (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']='${displaySafe(defect.assetPath)}' which is absolute. ${provenance}`;
+}
+
+//#endregion
+//#region src/cli/commands/nested-template-preflight.ts
+/**
+* Refuse a malformed nested-template tree (a cycle, an absolute
+* `aws:asset:path` below the top level, a chain too deep or a tree too large
+* to deploy) for every SELECTED stack, before `cdkd deploy` does anything a
+* refusal would have to undo (issue go-to-k/cdkd#3449).
+*
+* `NestedStackProvider` runs the same walk per nested-stack row
+* (go-to-k/cdkd#3247), which is the earliest point the provider owns: by then
+* the stack's assets are published, its lock is held, and any root resource
+* that does not depend on the nested row may already be created and must be
+* rolled back. Everything the walk reads is on disk as soon as synth returns,
+* so the CLI asks first and the deploy never starts. The provider call stays
+* as the guard for a context this command did not build.
+*
+* Read-only and synchronous: a few file reads per nested template, none at all
+* for a stack without nested-stack rows. One walk covers all of a stack's
+* top-level rows, so the walker's row budget is per STACK here and per row in
+* the provider; no CDK-generated assembly comes near either.
+*
+* The root template's own path is not seeded into the walk (`StackInfo` does
+* not carry it). Detection does not depend on the seed: a child that points
+* back at the root template is followed once around and refused when the walk
+* re-enters the first nested template it saw.
+*
+* `SynthesisError` because the defect is in the synthesized assembly, like the
+* absolute-path refusal `AssemblyReader` raises for a top-level row.
+* `markNonRetryable` because the message carries template-controlled text the
+* substring-matching retry classifier must never read, wherever the error ends
+* up being caught.
+*/
+function refuseMalformedNestedTemplateTrees(stacks) {
+	for (const stack of stacks) {
+		if (!stack.nestedTemplates) continue;
+		const defect = findNestedTemplateTreeDefect(stack.nestedTemplates);
+		if (!defect) continue;
+		throw markNonRetryable(new SynthesisError(renderNestedTemplateTreeDefect(defect, stack.stackName, "start the deploy; nothing has been published or provisioned")));
+	}
+}
+
 //#endregion
 //#region src/cli/commands/confirm-prompt.ts
 /**
@@ -16655,6 +16943,216 @@ function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-contributor-insights.ts
+/**
+* The `AWS::DynamoDB::Table` `ContributorInsightsSpecification` rules, in ONE
+* spelling for the table-level block and the per-index
+* (`GlobalSecondaryIndexes[].ContributorInsightsSpecification`) one (issue
+* [#1782](https://github.com/go-to-k/cdkd/issues/1782)).
+*
+* Neither block rides `CreateTable` / `UpdateTable`: DynamoDB applies it
+* through `UpdateContributorInsights` and reports it through
+* `DescribeContributorInsights`, and both calls address an index by adding
+* `IndexName`. The SDK's `GlobalSecondaryIndex` shape has NO such member, so a
+* per-index block left inside the forwarded index entry is discarded by the
+* serializer — a template asking for per-index Contributor Insights deployed
+* green with the feature off.
+*
+* Pure, so the write plan and the drift read-back gate cannot answer "does
+* this index declare the block" differently.
+*/
+/** The CFn property name, shared by the table-level and the per-index block. */
+const CONTRIBUTOR_INSIGHTS_KEY = "ContributorInsightsSpecification";
+/**
+* Read a `ContributorInsightsSpecification` block.
+*
+* An ABSENT `Enabled` reads as `false` — the member is required by the CFn
+* schema, and disabling is the answer that cannot start a billed feature.
+*/
+function readContributorInsightsSpec(value, path) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const refusal = configBooleanRefusal(value, "Enabled", path) ?? configStringRefusal(value, "Mode", "", path);
+	if (refusal !== void 0) return {
+		kind: "unusable",
+		reason: refusal
+	};
+	const block = value;
+	const enabled = coerceCfnBoolean(block["Enabled"]) ?? false;
+	const mode = block["Mode"];
+	return typeof mode === "string" && mode.length > 0 ? {
+		kind: "usable",
+		enabled,
+		mode
+	} : {
+		kind: "usable",
+		enabled
+	};
+}
+/**
+* The call one block needs, given the block the PREVIOUS side recorded.
+*
+* - `absent` with a DECLARED previous (usable or not) is a template REMOVAL and
+*   DISABLES — the rule this provider's other post-ACTIVE blocks (PITR, TTL,
+*   Kinesis) and the table-level block already follow. Because the rule is
+*   symmetric in its two sides, a rollback — which replays `update()` with the
+*   sides SWAPPED — restores the old setting through the same arms.
+* - `unusable` issues NOTHING and reports through `onUnusable`: the live
+*   setting is left alone rather than overwritten with a guess.
+* - An unchanged usable block issues nothing. `mode` takes part only while
+*   enabled, since it is never sent with `DISABLE`.
+*/
+function planContributorInsightsOp(desired, previous, onUnusable) {
+	if (desired.kind === "unusable") {
+		onUnusable(desired.reason);
+		return;
+	}
+	if (desired.kind === "absent") return previous.kind === "absent" ? void 0 : { action: "DISABLE" };
+	if (previous.kind === "usable" && previous.enabled === desired.enabled && (!desired.enabled || previous.mode === desired.mode)) return;
+	if (!desired.enabled) return { action: "DISABLE" };
+	return desired.mode === void 0 ? { action: "ENABLE" } : {
+		action: "ENABLE",
+		mode: desired.mode
+	};
+}
+/**
+* The path a per-index refusal names. Deliberately WITHOUT the index name: the
+* name is a RESOLVED template value, the caller's message already carries it
+* through a whole-value mask, and a copy embedded here would reach only the
+* substring mask, which ignores a name shorter than its minimum needle.
+*/
+const INDEX_CONTRIBUTOR_INSIGHTS_PATH = `GlobalSecondaryIndexes[].${CONTRIBUTOR_INSIGHTS_KEY}`;
+/** Index a CFn `GlobalSecondaryIndexes` value by `IndexName`. */
+function indexEntriesByName(value) {
+	const byName = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return byName;
+	for (const entry of value) {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+		const name = entry["IndexName"];
+		if (typeof name === "string") byName.set(name, entry);
+	}
+	return byName;
+}
+/**
+* The per-index calls an index list needs, in DESIRED order.
+*
+* Only an index the DESIRED list still names can produce a call: an index the
+* update removed takes its Contributor Insights rules with it, and a call
+* naming it fails with `ResourceNotFoundException`. An index that is NEW in
+* the desired list has an `absent` previous side, so its declared block is
+* always applied.
+*/
+function planIndexContributorInsightsOps(desiredIndexes, previousIndexes, onUnusable) {
+	const previousByName = indexEntriesByName(previousIndexes);
+	const ops = [];
+	for (const [indexName, entry] of indexEntriesByName(desiredIndexes)) {
+		const path = INDEX_CONTRIBUTOR_INSIGHTS_PATH;
+		const op = planContributorInsightsOp(readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], path), readContributorInsightsSpec(previousByName.get(indexName)?.[CONTRIBUTOR_INSIGHTS_KEY], path), (reason) => onUnusable(indexName, reason));
+		if (op !== void 0) ops.push({
+			indexName,
+			...op
+		});
+	}
+	return ops;
+}
+/**
+* Every refusal a CREATE must raise before `CreateTable` goes out: the
+* table-level block's and each index's. A create has no live setting to leave
+* alone, so an unreadable block there is a template error, not a skip.
+*/
+function contributorInsightsRefusals(tableBlock, indexes) {
+	const refusals = [];
+	const table = readContributorInsightsSpec(tableBlock, CONTRIBUTOR_INSIGHTS_KEY);
+	if (table.kind === "unusable") refusals.push(table.reason);
+	if (!Array.isArray(indexes)) return refusals;
+	indexes.forEach((entry, position) => {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return;
+		const read = readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], `GlobalSecondaryIndexes[${position}].${CONTRIBUTOR_INSIGHTS_KEY}`);
+		if (read.kind === "unusable") refusals.push(read.reason);
+	});
+	return refusals;
+}
+/**
+* One index entry WITHOUT its `ContributorInsightsSpecification`, for the
+* `CreateTable` forward.
+*
+* Explicit so nothing relies on the SDK serializer discarding a member its
+* `GlobalSecondaryIndex` shape does not have. Returns the entry UNCHANGED —
+* identity included — when there is nothing to strip, and never mutates it: the
+* bag is the caller's resolved template, which the engine records into state.
+*/
+function stripIndexContributorInsights(entry) {
+	if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
+	if (!("ContributorInsightsSpecification" in entry)) return entry;
+	const { [CONTRIBUTOR_INSIGHTS_KEY]: _stripped, ...rest } = entry;
+	return rest;
+}
+/**
+* Does this DESIRED index entry declare a block cdkd would act on — the gate
+* for the per-index drift read-back, which costs one API call per index?
+*
+* The same reader the write plan runs, so an `unusable` block (never sent) is
+* never read back either.
+*/
+function indexDeclaresContributorInsights(desiredEntry) {
+	return readContributorInsightsSpec(desiredEntry?.[CONTRIBUTOR_INSIGHTS_KEY], "").kind === "usable";
+}
+/** The setting a `ContributorInsightsStatus` stands for, if any. */
+function enabledForStatus(status, transientAsTarget) {
+	if (status === "ENABLED" || transientAsTarget && status === "ENABLING") return true;
+	if (status === "DISABLED" || transientAsTarget && status === "DISABLING") return false;
+}
+/**
+* Reverse-map the TABLE-level `DescribeContributorInsights` answer to the CFn
+* block, or `undefined` when there is nothing stable to report.
+*
+* Only the terminal statuses are mapped, and `Mode` is emitted whenever AWS
+* reports one for an enabled table — the block is a TOP-LEVEL key, which the
+* comparator walks by the baseline's own keys. `Mode` is never emitted for a
+* disabled block: it is not sent with `DISABLE`, and a disabled block carrying
+* one is a CFn-invalid placeholder.
+*/
+function reverseMapTableContributorInsights(status, mode) {
+	const enabled = enabledForStatus(status, false);
+	if (enabled === void 0) return void 0;
+	const block = { Enabled: enabled };
+	if (enabled && mode !== void 0) block["Mode"] = mode;
+	return block;
+}
+/**
+* Reverse-map one PER-INDEX `DescribeContributorInsights` answer, shaped by
+* the block the DESIRED entry declares. `undefined` when there is nothing to
+* report or the declared block is not one cdkd acts on.
+*
+* The per-index block sits inside an ARRAY entry, which the comparator matches
+* as a whole and by exact key set, so everything here exists to make the
+* read-back equal the declaration whenever AWS holds what was declared:
+*
+*  - `ENABLING` / `DISABLING` read as their TARGET. The deploy does not wait
+*    for the toggle, so the post-deploy `observedProperties` capture usually
+*    sees `ENABLING`; omitting the block would freeze an entry the settled
+*    index can never equal.
+*  - `Mode` is emitted only when the declared block carries one: AWS reports a
+*    mode for every enabled rule set (its default when none was sent). While
+*    `ENABLING`, a mode AWS does not report yet reads as the declared one —
+*    the one that was just sent.
+*  - `Enabled` keeps the declared SPELLING when the template wrote a string
+*    (`'true'`), since the comparator does not coerce.
+*/
+function reverseMapIndexContributorInsights(status, mode, declaredBlock) {
+	const declared = readContributorInsightsSpec(declaredBlock, INDEX_CONTRIBUTOR_INSIGHTS_PATH);
+	if (declared.kind !== "usable") return void 0;
+	const enabled = enabledForStatus(status, true);
+	if (enabled === void 0) return void 0;
+	const declaredEnabled = declaredBlock["Enabled"];
+	const block = { Enabled: typeof declaredEnabled !== "string" ? enabled : declared.enabled === enabled ? declaredEnabled : String(enabled) };
+	if (enabled && declared.mode !== void 0) {
+		const liveMode = mode ?? (status === "ENABLING" ? declared.mode : void 0);
+		if (liveMode !== void 0) block["Mode"] = liveMode;
+	}
+	return block;
+}
+
 //#endregion
 //#region src/provisioning/dynamodb-index-busy-delete.ts
 /**
@@ -18479,16 +18977,10 @@ function warmThroughputAlreadyMatches(desired, live) {
 * to decide with and every block is emitted, cleaned of its AWS-managed
 * members.
 *
-* Known residual, unchanged by this fix: CFn's per-index
-* `ContributorInsightsSpecification` has no `DescribeTable` counterpart (it
-* needs a per-index `DescribeContributorInsights` call), so a template
-* declaring one still cannot converge against a `properties` baseline. It is
-* ALSO dropped on the write side, since `create()` forwards the CFn blob to
-* `CreateTable` and the SDK serializer discards the unknown member — still
-* true after round 6 taught that path to coerce `WarmThroughput`, because the
-* entry is rebuilt with a SPREAD and every other member, known or not, rides
-* along unchanged. Filed as issue
-* [#1782](https://github.com/go-to-k/cdkd/issues/1782).
+* CFn's per-index `ContributorInsightsSpecification` is NOT mapped here: it
+* has no `DescribeTable` counterpart, so `readCurrentState` adds it afterwards
+* from a gated per-index `DescribeContributorInsights` (issue
+* [#1782](https://github.com/go-to-k/cdkd/issues/1782)).
 */
 function reverseMapSecondaryIndex(live, desired, bagInformative) {
 	const out = {};
@@ -18754,6 +19246,10 @@ var DynamoDBTableProvider = class {
 		let tableCreated = false;
 		try {
 			const billingMode = requireConfigString(properties["BillingMode"], "PROVISIONED", "AWS::DynamoDB::Table BillingMode", replayWarn(this.logger, context));
+			if (context?.replayingState !== true) {
+				const [refusal] = contributorInsightsRefusals(properties["ContributorInsightsSpecification"], properties["GlobalSecondaryIndexes"]);
+				if (refusal !== void 0) throw new Error(`${refusal}. Fix the template value`);
+			}
 			const createParams = {
 				TableName: tableName,
 				KeySchema: keySchema,
@@ -18778,7 +19274,7 @@ var DynamoDBTableProvider = class {
 			};
 			if (properties["GlobalSecondaryIndexes"]) {
 				const declaredGsis = properties["GlobalSecondaryIndexes"];
-				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexThroughputForCreate(logicalId, entry, maskSecrets)) : declaredGsis;
+				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexThroughputForCreate(logicalId, stripIndexContributorInsights(entry), maskSecrets)) : declaredGsis;
 			}
 			if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
 			const sse = mapSSESpecification(properties["SSESpecification"]);
@@ -18795,7 +19291,8 @@ var DynamoDBTableProvider = class {
 			await this.applyPointInTimeRecovery(tableName, properties["PointInTimeRecoverySpecification"], void 0, maskSecrets);
 			await this.applyTimeToLive(tableName, properties["TimeToLiveSpecification"]);
 			await this.applyKinesisStreamingDestination(tableName, properties["KinesisStreamSpecification"], void 0, maskSecrets);
-			await this.applyContributorInsights(tableName, properties["ContributorInsightsSpecification"]);
+			await this.applyContributorInsights(tableName, properties["ContributorInsightsSpecification"], void 0, maskSecrets);
+			await this.applyIndexContributorInsights(tableName, properties["GlobalSecondaryIndexes"], void 0, maskSecrets);
 			this.logger.debug(`Successfully created DynamoDB table ${logicalId}: ${tableName}`);
 			return {
 				physicalId: tableName,
@@ -19030,7 +19527,8 @@ var DynamoDBTableProvider = class {
 				await this.applyResourcePolicy(table.TableArn, properties["ResourcePolicy"], previousProperties["ResourcePolicy"]);
 			}
 			if (JSON.stringify(properties["KinesisStreamSpecification"]) !== JSON.stringify(previousProperties["KinesisStreamSpecification"])) await this.applyKinesisStreamingDestination(physicalId, properties["KinesisStreamSpecification"], previousProperties["KinesisStreamSpecification"], maskSecrets);
-			if (JSON.stringify(properties["ContributorInsightsSpecification"]) !== JSON.stringify(previousProperties["ContributorInsightsSpecification"])) await this.applyContributorInsights(physicalId, properties["ContributorInsightsSpecification"], previousProperties["ContributorInsightsSpecification"]);
+			if (JSON.stringify(properties["ContributorInsightsSpecification"]) !== JSON.stringify(previousProperties["ContributorInsightsSpecification"])) await this.applyContributorInsights(physicalId, properties["ContributorInsightsSpecification"], previousProperties["ContributorInsightsSpecification"], maskSecrets);
+			await this.applyIndexContributorInsights(physicalId, properties["GlobalSecondaryIndexes"], previousProperties["GlobalSecondaryIndexes"], maskSecrets);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -19446,24 +19944,53 @@ var DynamoDBTableProvider = class {
 	*
 	* Called from both `create()` (after the table is ACTIVE) and `update()`
 	* (only when the value changed). On `update()`-side removal — template drops
-	* the block but it was present before — insights is disabled.
+	* the block but it was present before — insights is disabled. The block is
+	* read by the reader the per-index twin uses
+	* ({@link applyIndexContributorInsights}), so the two cannot disagree about
+	* one shape: an unreadable block is announced and SKIPPED rather than read as
+	* a default (`Boolean('false')` used to ENABLE what the template disabled).
 	*/
-	async applyContributorInsights(tableName, spec, previousSpec) {
-		let action;
-		let mode;
-		if (spec !== void 0 && spec !== null) {
-			const s = spec;
-			const enabled = Boolean(s["Enabled"]);
-			action = enabled ? "ENABLE" : "DISABLE";
-			if (enabled && s["Mode"] !== void 0) mode = s["Mode"];
-		} else if (previousSpec !== void 0 && previousSpec !== null) action = "DISABLE";
-		if (action === void 0) return;
+	async applyContributorInsights(tableName, spec, previousSpec, maskSecrets) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const op = planContributorInsightsOp(readContributorInsightsSpec(spec, CONTRIBUTOR_INSIGHTS_KEY), readContributorInsightsSpec(previousSpec, CONTRIBUTOR_INSIGHTS_KEY), (reason) => warn(`DynamoDB table ${tableName}: ${reason}, so Contributor Insights was left as it is. Fix the template value and re-deploy.`));
+		if (op === void 0) return;
+		await this.sendContributorInsightsOp(tableName, op, maskSecrets);
+	}
+	/**
+	* Apply every per-index `ContributorInsightsSpecification`
+	* (`GlobalSecondaryIndexes[].ContributorInsightsSpecification`, issue
+	* [#1782](https://github.com/go-to-k/cdkd/issues/1782)) — the table-level
+	* call with `IndexName` added, one call per index whose block changed.
+	*
+	* The block is not a member of the SDK's `GlobalSecondaryIndex`, so until
+	* this existed it was dropped by the serializer on `CreateTable` and never
+	* sent by `applyGsiUpdates`: the deploy was green and the feature was off.
+	*
+	* `UpdateContributorInsights` answers `ResourceNotFoundException` for an
+	* index that is not ACTIVE yet, which {@link retryOnTransientControlPlane}
+	* does not retry, so the index wait runs FIRST — and only when there is a
+	* call to make, so an ordinary update pays no extra `DescribeTable`.
+	* `previousIndexes` is `undefined` on `create()`. Removal and rollback
+	* semantics live on {@link planContributorInsightsOp}.
+	*/
+	async applyIndexContributorInsights(tableName, desiredIndexes, previousIndexes, maskSecrets) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const ops = planIndexContributorInsightsOps(desiredIndexes, previousIndexes, (indexName, reason) => warn(`${this.indexScopeAt(indexName, tableName, maskSecrets)}: ${reason}, so its Contributor Insights was left as it is. Fix the template value and re-deploy.`));
+		if (ops.length === 0) return;
+		await this.waitForTableAndIndexesActive(tableName);
+		for (const op of ops) await this.sendContributorInsightsOp(tableName, op, maskSecrets);
+	}
+	/** Issue ONE `UpdateContributorInsights`, against the table or one index. */
+	async sendContributorInsightsOp(tableName, op, maskSecrets) {
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		const target = op.indexName === void 0 ? `DynamoDB table ${tableName}` : this.indexScopeAt(op.indexName, tableName, maskSecrets);
 		await this.retryOnTransientControlPlane(() => this.dynamoDBClient.send(new UpdateContributorInsightsCommand({
 			TableName: tableName,
-			ContributorInsightsAction: action,
-			...mode ? { ContributorInsightsMode: mode } : {}
-		})), `set ContributorInsights on ${tableName}`);
-		this.logger.debug(`Set ContributorInsightsAction=${action}${mode !== void 0 ? ` Mode=${mode}` : ""} on DynamoDB table ${tableName}`);
+			...op.indexName !== void 0 ? { IndexName: op.indexName } : {},
+			ContributorInsightsAction: op.action,
+			...op.mode !== void 0 ? { ContributorInsightsMode: op.mode } : {}
+		})), `set ContributorInsights on ${target}`);
+		debug(`Set ContributorInsightsAction=${op.action}${op.mode !== void 0 ? ` Mode=${op.mode}` : ""} on ${target}`);
 	}
 	/**
 	* Poll DescribeTable until the table reaches ACTIVE status
@@ -20444,32 +20971,35 @@ var DynamoDBTableProvider = class {
 	* level: it is order-SIGNIFICANT (HASH before RANGE), so sorting it would
 	* HIDE a real key change rather than remove a phantom one.
 	*
-	* `GlobalSecondaryIndexes` / `LocalSecondaryIndexes` are NOT declared either,
-	* and that is a MECHANISM limit rather than a judgement about the lists —
-	* both really are sets keyed by `IndexName` (issue #1767 proposes declaring
-	* them). Every entry here is a SUBTREE declaration, and unlike
-	* `getDriftUnknownPaths` this walk DESCENDS INTO ARRAY ELEMENTS giving each
-	* the parent's path (`drift-normalize.ts`), so a `'GlobalSecondaryIndexes'`
-	* entry also reaches `GlobalSecondaryIndexes.KeySchema` and would sort the
-	* per-index key schema — reversing the sentence above at the index level
-	* only. Issue #1767 calls the sort and the member reverse-map separable;
-	* this change ships the reverse-map, and the ordering half needed a
-	* leaf-only form of the declaration first (issue
-	* [#1783](https://github.com/go-to-k/cdkd/issues/1783)). **That form now
-	* EXISTS** — `LEAF_ONLY_PATH_SUFFIX` (`[]`) landed in
-	* [#1799](https://github.com/go-to-k/cdkd/pull/1799), so
-	* `'GlobalSecondaryIndexes[]'` would claim the list alone without reaching
-	* the per-index `KeySchema`. It is deliberately NOT declared here yet:
-	* adopting it is its own change with its own real-AWS verification, tracked
-	* as issue [#1812](https://github.com/go-to-k/cdkd/issues/1812). Consequence
-	* until then, stated so it is not mistaken for solved: an index list AWS
-	* returns in a different ORDER than the template declared is still phantom
-	* drift against a `properties` baseline. It is not reachable on the ordinary
-	* `observedProperties` path, where both sides come from this same readback.
+	* `GlobalSecondaryIndexes` / `LocalSecondaryIndexes` ARE declared, in the
+	* LEAF-ONLY form (`LEAF_ONLY_PATH_SUFFIX`, `[]`, from
+	* [#1799](https://github.com/go-to-k/cdkd/pull/1799)): both are sets keyed
+	* by `IndexName`, and `DescribeTable` does not return them in the template's
+	* order. A plain SUBTREE entry would be wrong — the unordered walk descends
+	* into array elements giving each the parent's path (`drift-normalize.ts`),
+	* so `'GlobalSecondaryIndexes'` would also sort each index's `KeySchema` and
+	* reverse the sentence above at the index level. The leaf-only form sorts
+	* the list and stops there.
+	*
+	* Measured on real AWS by issue
+	* [#1782](https://github.com/go-to-k/cdkd/issues/1782)'s two-index fixture:
+	* a table created with `[giA, giB]` read back as `[giB, giA]`, so a
+	* `properties` baseline reported whole-list drift although every member
+	* round-tripped. The phantom pre-dates that issue — the #1767 arm only ever
+	* had ONE index — and was not reachable against an `observedProperties`
+	* baseline, where both sides come from the same readback. Both comparison
+	* sides are sorted, by a key-order-independent serialization of the whole
+	* entry, so a baseline captured in AWS's order by an earlier binary keeps
+	* converging; a REAL difference still reports the list, since entries that
+	* differ cannot be made equal by reordering them.
 	*/
 	getDriftUnorderedPaths(resourceType) {
 		if (resourceType !== "AWS::DynamoDB::Table") return [];
-		return ["AttributeDefinitions"];
+		return [
+			"AttributeDefinitions",
+			"GlobalSecondaryIndexes[]",
+			"LocalSecondaryIndexes[]"
+		];
 	}
 	/**
 	* `WarmThroughput` is reported by AWS for EVERY table, whether or not the
@@ -20614,7 +21144,9 @@ var DynamoDBTableProvider = class {
 	* caller passes). It is consulted for the table-level `WarmThroughput` — see
 	* {@link getDriftUnknownPaths} for the measurement and the reasoning — and,
 	* since issue #1767, for the per-index throughput blocks of each secondary
-	* index, matched by `IndexName`.
+	* index, matched by `IndexName`. Since issue #1782 it also gates the per-index
+	* `ContributorInsightsSpecification` read, which costs one
+	* `DescribeContributorInsights` per declaring index.
 	*/
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
 		try {
@@ -20713,15 +21245,31 @@ var DynamoDBTableProvider = class {
 			}
 			try {
 				const ciResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({ TableName: physicalId }));
-				const status = ciResp.ContributorInsightsStatus;
-				if (status === "ENABLED" || status === "DISABLED") {
-					const cspec = { Enabled: status === "ENABLED" };
-					if (status === "ENABLED" && ciResp.ContributorInsightsMode !== void 0) cspec["Mode"] = ciResp.ContributorInsightsMode;
-					result["ContributorInsightsSpecification"] = cspec;
-				}
+				const cspec = reverseMapTableContributorInsights(ciResp.ContributorInsightsStatus, ciResp.ContributorInsightsMode);
+				if (cspec !== void 0) result["ContributorInsightsSpecification"] = cspec;
 			} catch (err) {
 				this.logger.debug(`Could not read ContributorInsights for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			}
+			const emittedGsis = result["GlobalSecondaryIndexes"];
+			if (bagInformative && Array.isArray(emittedGsis)) {
+				const desiredByName = desiredIndexEntriesByName(properties?.["GlobalSecondaryIndexes"]);
+				for (const emitted of emittedGsis) {
+					const indexName = emitted["IndexName"];
+					if (typeof indexName !== "string") continue;
+					const desiredEntry = desiredByName.get(indexName);
+					if (!indexDeclaresContributorInsights(desiredEntry)) continue;
+					try {
+						const indexResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({
+							TableName: physicalId,
+							IndexName: indexName
+						}));
+						const block = reverseMapIndexContributorInsights(indexResp.ContributorInsightsStatus, indexResp.ContributorInsightsMode, desiredEntry?.[CONTRIBUTOR_INSIGHTS_KEY]);
+						if (block !== void 0) emitted[CONTRIBUTOR_INSIGHTS_KEY] = block;
+					} catch (err) {
+						this.logger.debug(`Could not read ContributorInsights for index ${indexName} of ${physicalId}: ${describeAwsFailure(err).detail}`);
+					}
+				}
+			}
 			return result;
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$1) return void 0;
@@ -26356,7 +26904,8 @@ var SSMParameterProvider = class {
 	* question cdkd can answer correctly — and would hand `cdkd drift` a baseline
 	* AWS does not hold. Dropping the `Arn` instead degrades to the resolver's LOUD
 	* `*Arn` shape-guard failure, which is exactly the pre-fix behavior, and the
-	* resource's next UPDATE re-records it. A loud missing value beats a quiet
+	* resource's next UPDATE re-records it (as does the deploy engine's re-read
+	* on a `Fn::GetAtt` miss, issue #1852). A loud missing value beats a quiet
 	* wrong one — the same reasoning the `fabricated`-account arm above applies.
 	*
 	* Two honest bounds on that "next update re-records it". `getAccountInfo`
@@ -41121,10 +41670,14 @@ var RDSProvider = class {
 	async importDBInstance(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBInstanceIdentifier");
 		if (explicit) try {
-			await this.getClient().send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: explicit }));
+			const described = (await this.getClient().send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: explicit }))).DBInstances?.[0];
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
+					Arn: described?.DBInstanceArn
+				})
 			};
 		} catch (err) {
 			if (err.name === "DBInstanceNotFoundFault") return null;
@@ -42714,10 +43267,14 @@ var DocDBProvider = class {
 	async importDBInstance(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBInstanceIdentifier");
 		if (explicit) try {
-			await this.getClient().send(new DescribeDBInstancesCommand$1({ DBInstanceIdentifier: explicit }));
+			const described = (await this.getClient().send(new DescribeDBInstancesCommand$1({ DBInstanceIdentifier: explicit }))).DBInstances?.[0];
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
+					Arn: described?.DBInstanceArn
+				})
 			};
 		} catch (err) {
 			if (err.name === "DBInstanceNotFoundFault") return null;
@@ -43357,10 +43914,14 @@ var NeptuneProvider = class {
 	async importDBInstance(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBInstanceIdentifier");
 		if (explicit) try {
-			await this.getClient().send(new DescribeDBInstancesCommand$2({ DBInstanceIdentifier: explicit }));
+			const described = (await this.getClient().send(new DescribeDBInstancesCommand$2({ DBInstanceIdentifier: explicit }))).DBInstances?.[0];
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
+					Arn: described?.DBInstanceArn
+				})
 			};
 		} catch (err) {
 			if (err.name === "DBInstanceNotFoundFault") return null;
@@ -48076,7 +48637,7 @@ var AppSyncProvider = class {
 				return await this.buildAppSyncArn(suffix, regionOverride);
 			} catch (error) {
 				if (!omitArnOnFailure) throw error;
-				this.logger.warn(`Imported ${resourceType} (${physicalId}) but its ARN attribute was NOT recorded: ${describeAwsFailure(error).detail}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update heals the record.`);
+				this.logger.warn(`Imported ${resourceType} (${physicalId}) but its ARN attribute was NOT recorded: ${describeAwsFailure(error).detail}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update — or a later deploy that needs the attribute and re-reads it from AWS — heals the record.`);
 				return;
 			}
 		};
@@ -48164,7 +48725,7 @@ var AppSyncProvider = class {
 		try {
 			return await this.childRefAttributes(resourceType, physicalId, region, true) ?? {};
 		} catch (error) {
-			this.logger.warn(`Imported ${resourceType} (${physicalId}) but could not build its ARN attribute: ${describeAwsFailure(error).detail}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update heals the record.`);
+			this.logger.warn(`Imported ${resourceType} (${physicalId}) but could not build its ARN attribute: ${describeAwsFailure(error).detail}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update — or a later deploy that needs the attribute and re-reads it from AWS — heals the record.`);
 			return {};
 		}
 	}
@@ -63555,7 +64116,7 @@ function nestedStackChildFailureMessage(childStackName, errorCount, alsoSkippedC
 * `path.isAbsolute()` alone. Exported for unit testing.
 */
 function isAbsoluteCrossPlatform$1(p) {
-	return path.isAbsolute(p) || p.startsWith("/");
+	return isAbsoluteAssetPath(p);
 }
 /**
 * Provider for `AWS::CloudFormation::Stack` — cdkd's recursive nested-stack
@@ -63642,14 +64203,14 @@ var NestedStackProvider = class {
 		const ctx = this.requireContext();
 		this.requireDeployContext(ctx, "create");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
-		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack '${logicalId}' under parent '${ctx.parentStackName}'. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default).`);
-		const childTemplate = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
+		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack '${displaySafe(logicalId)}' under parent '${displaySafe(ctx.parentStackName)}'. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default).`);
+		this.refuseMalformedNestedTemplateTree(ctx, logicalId, childTemplatePath);
+		const { template: childTemplate, grandchildTemplates } = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
 		const childStackName = this.deriveChildStackName(ctx.parentStackName, logicalId);
 		const childRegion = ctx.parentRegion;
 		const childParameters = this.extractParameters(properties);
-		const grandchildTemplates = this.indexGrandchildTemplates(childTemplate, childTemplatePath);
 		const resourceCount = Object.keys(childTemplate.Resources ?? {}).length;
-		this.logger.info(`Deploying nested stack ${childStackName} (logicalId=${logicalId}, ${resourceCount} resource(s))`);
+		this.logger.info(`Deploying nested stack ${displaySafe(childStackName)} (logicalId=${displaySafe(logicalId)}, ${resourceCount} resource(s))`);
 		await this.runChildDeploy(ctx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates);
 		const childOutputs = await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion);
 		return {
@@ -63662,14 +64223,14 @@ var NestedStackProvider = class {
 		const ctx = this.requireContext();
 		this.requireDeployContext(ctx, "update");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
-		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack '${logicalId}' on update.`);
-		const childTemplate = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
+		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack '${displaySafe(logicalId)}' on update.`);
+		this.refuseMalformedNestedTemplateTree(ctx, logicalId, childTemplatePath);
+		const { template: childTemplate, grandchildTemplates } = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
 		const childStackName = this.deriveChildStackName(ctx.parentStackName, logicalId);
 		const childRegion = ctx.parentRegion;
 		const childParameters = this.extractParameters(properties);
-		const grandchildTemplates = this.indexGrandchildTemplates(childTemplate, childTemplatePath);
 		const resourceCount = Object.keys(childTemplate.Resources ?? {}).length;
-		this.logger.info(`Updating nested stack ${childStackName} (logicalId=${logicalId}, ${resourceCount} resource(s))`);
+		this.logger.info(`Updating nested stack ${displaySafe(childStackName)} (logicalId=${displaySafe(logicalId)}, ${resourceCount} resource(s))`);
 		await this.runChildDeploy(ctx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates);
 		const updatedOutputs = await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion);
 		return {
@@ -63685,12 +64246,12 @@ var NestedStackProvider = class {
 		const childRegion = ctx.parentRegion;
 		const childStateData = await ctx.stateBackend.getState(childStackName, childRegion);
 		if (!childStateData) {
-			this.logger.debug(`Nested stack ${childStackName} has no state — treating delete as idempotent success.`);
+			this.logger.debug(`Nested stack ${displaySafe(childStackName)} has no state — treating delete as idempotent success.`);
 			return;
 		}
 		refuseMalformedResourcesForDestroy(childStateData.state, childStackName, childRegion);
 		const resourceCount = Object.keys(childStateData.state.resources).length;
-		this.logger.info(`Destroying nested stack ${childStackName} (logicalId=${logicalId}, ${resourceCount} resource(s))`);
+		this.logger.info(`Destroying nested stack ${displaySafe(childStackName)} (logicalId=${displaySafe(logicalId)}, ${resourceCount} resource(s))`);
 		const childCtx = {
 			...ctx,
 			parentStackName: childStackName,
@@ -63726,12 +64287,12 @@ var NestedStackProvider = class {
 			if (childResult.interrupted) causes.push("was interrupted");
 			return {
 				outcome: "skipped",
-				reason: `nested stack ${childStackName} ${causes.join(" and ")}`
+				reason: `nested stack ${displaySafe(childStackName)} ${causes.join(" and ")}`
 			};
 		}
 	}
 	async getAttribute(_physicalId, _resourceType, attributeName) {
-		throw new Error(`AWS::CloudFormation::Stack: attribute '${attributeName}' is not in the recorded Outputs map. Only 'Outputs.<Key>' references to declared Output names on the child template are supported.`);
+		throw new Error(`AWS::CloudFormation::Stack: attribute '${displaySafe(attributeName)}' is not in the recorded Outputs map. Only 'Outputs.<Key>' references to declared Output names on the child template are supported.`);
 	}
 	async runChildDeploy(parentCtx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates) {
 		const inheritedSecrets = getCurrentResourceSecrets();
@@ -63782,7 +64343,7 @@ var NestedStackProvider = class {
 	*/
 	async readChildOutputsAsAttributes(ctx, childStackName, childRegion) {
 		const childStateData = await ctx.stateBackend.getState(childStackName, childRegion);
-		if (!childStateData) throw new Error(`Child stack state '${childStackName}' not found after deploy — NestedStackProvider invariant violated.`);
+		if (!childStateData) throw new Error(`Child stack state '${displaySafe(childStackName)}' not found after deploy — NestedStackProvider invariant violated.`);
 		refuseMalformedNestedChildOutputs(childStateData.state, childStackName, childRegion);
 		const attributes = this.buildOutputsAttributes(childStateData.state.outputs ?? {});
 		const noEchoAttributeNames = [];
@@ -63807,6 +64368,40 @@ var NestedStackProvider = class {
 	requireDeployContext(ctx, op) {
 		if (!ctx.nestedTemplates || !ctx.dagBuilder || !ctx.diffCalculator) throw new Error(`NestedStackProvider.${op}: deploy-mode context fields (nestedTemplates / dagBuilder / diffCalculator) are missing. This usually means a destroy-mode entry point called into create/update by mistake.`);
 	}
+	/**
+	* Validate the WHOLE nested-template subtree under this row before the first
+	* child engine is built (issue go-to-k/cdkd#3247).
+	*
+	* Up front rather than as an ancestor chain threaded through the recursion,
+	* because here a level is not a read, it is a DEPLOY: refusing at the first
+	* repeat would leave every level above it provisioned, with a state record
+	* each, for the rollback to unwind. Every file the recursion would follow is
+	* already on disk, so the top-most row's call sees the entire cycle and
+	* nothing below it ever starts. Deeper levels re-run the same walk over
+	* their own (already proven) subtree; it is a few file reads next to a
+	* deploy, and it keeps the guard independent of who built the context.
+	*
+	* This is the earliest point THIS FILE owns. The parent stack's other
+	* resources may already be in flight when its nested-stack row is
+	* dispatched; they are unwound by the parent's ordinary rollback. No level of
+	* the cyclic tree is deployed.
+	*
+	* It also reports an absolute `aws:asset:path` at ANY depth, for the same
+	* reason: `indexGrandchildTemplates` refuses one too, but only on reaching
+	* that level, after the levels above it deployed. That check stays as the
+	* per-level backstop.
+	*
+	* `markNonRetryable`: the verdict is computed from files no retry changes,
+	* while the message carries template-controlled text (logical ids, paths)
+	* that the SUBSTRING-matching retry classifier would otherwise read. Latent
+	* while `disableOuterRetry` is set, and declared anyway, like the sibling
+	* marks in this file.
+	*/
+	refuseMalformedNestedTemplateTree(ctx, logicalId, childTemplatePath) {
+		const defect = findNestedTemplateTreeDefect({ [logicalId]: childTemplatePath });
+		if (!defect) return;
+		throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: ${renderNestedTemplateTreeDefect(defect, ctx.parentStackName, "deploy any level of it")}`));
+	}
 	deriveChildStackName(parentStackName, nestedLogicalId) {
 		return `${parentStackName}~${nestedLogicalId}`;
 	}
@@ -63851,35 +64446,50 @@ var NestedStackProvider = class {
 	* points at `[2]` rather than at the whole parameter.
 	*/
 	refuseNonScalarParameter(k, offender, where) {
-		throw new Error(`NestedStackProvider: child Parameter '${k}'${where} resolved to a non-scalar value (type=${offender === null ? "null" : typeof offender}). Parameters must be scalars (string / number / boolean), or an ARRAY of them from a list-typed parameter, by the time they reach the provider — an unresolved intrinsic here means IntrinsicFunctionResolver upstream did not handle the value, which is a bug. Surface the unresolved input rather than silently coercing to '[object Object]'.`);
+		throw new Error(`NestedStackProvider: child Parameter '${displaySafe(k)}'${where} resolved to a non-scalar value (type=${offender === null ? "null" : typeof offender}). Parameters must be scalars (string / number / boolean), or an ARRAY of them from a list-typed parameter, by the time they reach the provider — an unresolved intrinsic here means IntrinsicFunctionResolver upstream did not handle the value, which is a bug. Surface the unresolved input rather than silently coercing to '[object Object]'.`);
 	}
+	/**
+	* The child template as the child engine deploys it, plus the grandchild
+	* template paths indexed from it.
+	*
+	* The index is taken BEFORE the asset-reference rewrite, and returning both
+	* from here is what keeps that order from being undone by a caller. The
+	* rewrite walks every string in the template, `Metadata['aws:asset:path']`
+	* included, and a path segment that spells a bootstrap bucket name is
+	* rewritten like any other occurrence. `aws:asset:path` is a LOCAL file
+	* path, never an asset-storage reference; indexing after the rewrite made
+	* the deploy follow a different file than the one
+	* `refuseMalformedNestedTemplateTree` had validated from the raw file, which
+	* is a way around that guard (issue go-to-k/cdkd#3247).
+	*/
 	readChildTemplate(templatePath, assetRedirect) {
 		let raw;
 		try {
 			raw = fs.readFileSync(templatePath, "utf-8");
 		} catch (err) {
-			throw new Error(`Failed to read nested template at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
+			throw new Error(`Failed to read nested template at ${displaySafe(templatePath)}: ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 		}
 		let template;
 		try {
 			template = JSON.parse(raw);
 		} catch (err) {
-			throw new Error(`Failed to parse nested template at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
+			throw new Error(`Failed to parse nested template at ${displaySafe(templatePath)}: ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 		}
+		const grandchildTemplates = this.indexGrandchildTemplates(template, templatePath);
 		if (assetRedirect) {
 			const n = rewriteTemplateAssetReferences(template, assetRedirect);
-			if (n > 0) this.logger.debug(`Rewrote ${n} asset reference(s) to cdkd asset storage in nested template ${templatePath}`);
+			if (n > 0) this.logger.debug(`Rewrote ${n} asset reference(s) to cdkd asset storage in nested template ${displaySafe(templatePath)}`);
 		}
-		return template;
+		return {
+			template,
+			grandchildTemplates
+		};
 	}
 	indexGrandchildTemplates(childTemplate, childTemplatePath) {
 		const dir = path.dirname(childTemplatePath);
-		const result = {};
-		for (const [grandLogicalId, resource] of Object.entries(childTemplate.Resources ?? {})) {
-			if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
-			const assetPath = resource.Metadata?.["aws:asset:path"];
-			if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-			if (isAbsoluteCrossPlatform$1(assetPath)) throw new Error(`NestedStackProvider: nested-stack '${grandLogicalId}' has Metadata['aws:asset:path']='${assetPath}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
+		const result = Object.create(null);
+		for (const { logicalId: grandLogicalId, assetPath } of listNestedTemplateRows(childTemplate)) {
+			if (isAbsoluteCrossPlatform$1(assetPath)) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`));
 			result[grandLogicalId] = path.join(dir, assetPath);
 		}
 		return result;
@@ -64931,6 +65541,7 @@ async function deployCommand(stacks, options) {
 			strict: options.strict === true,
 			ignoreErrors: options.ignoreErrors === true
 		});
+		refuseMalformedNestedTemplateTrees(targetStacks);
 		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		const stsClient = new STSClient({
@@ -81555,6 +82166,15 @@ function safeRoleArn(value) {
 * the Snapshot label would otherwise promise a final snapshot the run is about
 * to skip — a data-loss-relevant lie in the one preview the user reads.
 */
+/**
+* The type(s) a reversed replacement touches (issue #2668): `NEW -> OLD` when
+* the replacement changed the resource's `Type` — the replay deletes the first
+* and re-creates the second — and the single type otherwise.
+*/
+function replacementTypes(op) {
+	const routing = resolveReplacementOldType(op);
+	return routing.ok && routing.oldType !== op.resourceType ? `${safe(op.resourceType)} -> ${safe(routing.oldType)}` : safe(op.resourceType);
+}
 function actionLabel(item, skipFinalSnapshot) {
 	const { op, action, replacement } = item;
 	const rep = replacement ? " [replacement occurred, best-effort revert]" : "";
@@ -81564,11 +82184,15 @@ function actionLabel(item, skipFinalSnapshot) {
 		case "orphan-retain": return `  - orphan   ${safe(op.logicalId)} (${safe(op.resourceType)}) [DeletionPolicy Retain — left in AWS]`;
 		case "orphan-flag": return `  - orphan   ${safe(op.logicalId)} (${safe(op.resourceType)}) [--orphan]`;
 		case "revert": return `  - revert   ${safe(op.logicalId)} (${safe(op.resourceType)})${rep}`;
-		case "reverse-replacement": return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${safe(op.resourceType)}) [re-create old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked — REFUSED instead if the re-create collides with the name the retained resource still holds]` : `  - reverse-replace ${safe(op.logicalId)} (${safe(op.resourceType)}) [re-create old resource, delete new]`;
-		case "reverse-replacement-readopt": return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${safe(op.resourceType)}) [re-adopt retained old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked]` : `  - reverse-replace ${safe(op.logicalId)} (${safe(op.resourceType)}) [delete new, re-adopt retained old resource]`;
+		case "reverse-replacement": return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [re-create old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked — REFUSED instead if the re-create collides with the name the retained resource still holds]` : `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [re-create old resource, delete new]`;
+		case "reverse-replacement-readopt": return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [re-adopt retained old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked]` : `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [delete new, re-adopt retained old resource]`;
 		case "unrecoverable-delete": return `  - (cannot restore) ${safe(op.logicalId)} (${safe(op.resourceType)}) — was DELETED, unrecoverable`;
 		case "skip-mismatch": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — physical id changed, needs manual attention`;
 		case "skip-absent": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — no longer in state`;
+		case "refuse-replacement-routing": {
+			const routing = resolveReplacementOldType(op);
+			return `  - (REFUSED) ${safe(op.logicalId)} (${safe(op.resourceType)}) — cannot reverse the replacement: ${routing.ok ? "its old type could not be routed" : routing.reason}`;
+		}
 		case "skip-already-done": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — already reverted`;
 	}
 }
@@ -81588,6 +82212,7 @@ function failedActionLabel(item, skipFinalSnapshot) {
 		case "skip-failed-unknown": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — failed CREATE recorded no physical id`;
 		case "skip-failed-noop": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — failed ${safe(op.changeType)} left nothing to revert`;
 		case "skip-failed-absent": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — no previous state available`;
+		case "skip-failed-type-change": return `  - skip     ${safe(op.logicalId)} (${safe(op.previousState?.resourceType)} -> ${safe(op.resourceType)}) — failed Type change is a replacement, no in-place revert exists`;
 	}
 }
 /**
@@ -84616,6 +85241,368 @@ function createForceUnlockCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/cli/commands/import-deployed-parameters.ts
+/**
+* UNVERIFIABLE INPUTS for `cdkd import`'s observed-baseline refusal (issue
+* [#2854](https://github.com/go-to-k/cdkd/issues/2854)).
+*
+* `cdkd import` accepts no parameter values, so every template parameter is
+* bound to its `Default`. When the resources were deployed by a CloudFormation
+* stack, the value CloudFormation actually used can differ — and the ordinary
+* secret-carrying shape is a placeholder `Default` (`CHANGEME`) over a DEPLOYED
+* value of `{{resolve:secretsmanager:...}}`. The persisted `properties` then
+* spell no reference anywhere, the position-based redaction of the observed
+* capture has no evidence, and the decrypted readback would be persisted.
+*
+* The remedy here is deliberately PREMISE-INDEPENDENT. It never looks for a
+* `{{resolve:` opener in what `DescribeStacks` returns (AWS documents
+* `ParameterValue` as "the input value", which says the reference comes back
+* literally, but nothing in this module relies on it). It asks one question —
+* "is the deployed value PROVABLY the value this import bound?" — and treats
+* every other answer as divergent: a literal reference, the `****` a `NoEcho`
+* parameter is masked to, a value AWS resolved, a parameter missing from the
+* response, a `DescribeStacks` that failed. All of those differ from the bound
+* placeholder, so all of them refuse.
+*
+* THE DEPLOYED VALUES ARE COMPARISON-ONLY. They are never bound into the
+* resolve, never logged, never put in an error message, and never persisted:
+* binding them is the one design that would leak if AWS ever returned a
+* resolved value. {@link DeployedParameters} holds them in a `#private` field so
+* that a stray `JSON.stringify` / `util.inspect` / template literal of the
+* object renders nothing, and an SDK failure is reported by its error NAME
+* alone, because an SDK message can echo request input.
+*
+* TAINT THROUGH ANOTHER RESOURCE'S ATTRIBUTES IS FOLLOWED within one stack: the
+* walk records the target of every `Fn::GetAtt` / `${A.Attr}`, and the caller
+* closes the refused set over those targets, so a resource reading an attribute
+* of a refused resource (`{Fn::GetAtt: [SsmParam, Value]}` into a Lambda
+* environment — what CDK's `param.stringValue` emits) is refused with it. A
+* plain `Ref` of a resource is NOT followed: it yields the physical id, and a
+* secret used as a resource NAME is already disclosed by the identifier itself.
+*
+* KNOWN RESIDUAL, not followed: taint ACROSS the nested-stack boundary. A
+* parent property reading `Fn::GetAtt: [Child, Outputs.X]`, where the child's
+* output derives from a divergent CHILD parameter, is judged on the parent's
+* own parameters only — the root is resolved before any child is read.
+*/
+/**
+* What CloudFormation reports a stack was deployed with. Opaque on purpose:
+* the only question it answers is {@link DeployedParameters.provablyEquals}.
+*/
+var DeployedParameters = class DeployedParameters {
+	#entries;
+	constructor(entries) {
+		this.#entries = entries;
+	}
+	/** `DescribeStacks` answered; `entries` is its `Parameters` list. */
+	static fromDescribeStacks(parameters) {
+		const entries = /* @__PURE__ */ new Map();
+		for (const parameter of parameters) {
+			if (typeof parameter.ParameterKey !== "string") continue;
+			entries.set(parameter.ParameterKey, {
+				value: parameter.ParameterValue,
+				resolvedValue: parameter.ResolvedValue
+			});
+		}
+		return new DeployedParameters(entries);
+	}
+	/** The deployed values could not be read: NOTHING is provable. */
+	static unavailable() {
+		return new DeployedParameters(void 0);
+	}
+	/**
+	* Whether the deployed value of `name` is provably the value the import
+	* BOUND. The deployed string goes through the SAME coercion the resolver
+	* applied to the bound one (`Number`, `CommaDelimitedList`, `List<...>`), so
+	* `'1'` equals a bound `1` and `'a, b'` equals a bound `['a', 'b']`. For an
+	* SSM-typed parameter the resolver binds the RESOLVED value, so that is the
+	* side compared — `ParameterValue` is only the key there.
+	*/
+	provablyEquals(name, type, bound) {
+		const entry = this.#entries?.get(name);
+		if (entry === void 0 || typeof type !== "string") return false;
+		const ssmType = type.startsWith("AWS::SSM::Parameter::Value");
+		const deployed = ssmType ? entry.resolvedValue : entry.value;
+		if (typeof deployed !== "string") return false;
+		const comparedType = ssmType ? ssmResolvedValueType(type) : type;
+		return stableEquals(comparedType === void 0 ? deployed : coerceParameterTypedValue(deployed, comparedType), bound);
+	}
+};
+/** Structural equality for the scalar / scalar-array values a parameter binds to. */
+function stableEquals(a, b) {
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((element, index) => stableEquals(element, b[index]));
+	}
+	if (typeof a === "string" && typeof b === "number") return Number.isFinite(b) && a === String(b);
+	if (typeof a === "number" || typeof b === "number") return typeof a === "number" && typeof b === "number" && Number.isFinite(a) && a === b;
+	if (typeof a === "string" && typeof b === "boolean") return a === String(b);
+	return typeof a === "string" && typeof b === "string" && a === b;
+}
+async function readDeployedParameters(cfnStackName, cfnClient, logger, displayName, options) {
+	try {
+		const stack = (await cfnClient.send(new DescribeStacksCommand({ StackName: cfnStackName }))).Stacks?.[0];
+		if (!stack) {
+			logger.warn(unavailableWarning(displayName, "the stack was not returned"));
+			return DeployedParameters.unavailable();
+		}
+		return DeployedParameters.fromDescribeStacks(stack.Parameters ?? []);
+	} catch (err) {
+		if (options?.absentStackIsNoSource === true && err instanceof Error && err.name === "ValidationError" && /does not exist/i.test(err.message)) return;
+		const name = err instanceof Error && /^[A-Za-z0-9_.]{1,80}$/.test(err.name) ? err.name : "error";
+		logger.warn(unavailableWarning(displayName, name));
+		return DeployedParameters.unavailable();
+	}
+}
+function unavailableWarning(displayName, reason) {
+	return `Could not read the deployed parameter values of CloudFormation stack '${displayName}' (${reason}). 'cdkd import' needs the cloudformation:DescribeStacks permission to prove that a template parameter was deployed with its 'Default'; without it every resource that depends on a template parameter is imported WITHOUT an observed drift baseline. Review 'cdkd diff' before the next 'cdkd deploy'.`;
+}
+/**
+* The declared parameters whose deployed value is NOT provably the bound one.
+* A parameter the import could not bind at all (no `Default`, an unreferenced
+* or failed SSM default, the empty fallback bag) is divergent by definition.
+*/
+function divergentParameterNames(template, bound, deployed) {
+	const divergent = /* @__PURE__ */ new Set();
+	const declared = template.Parameters;
+	if (declared === void 0 || declared === null || typeof declared !== "object") return divergent;
+	for (const [name, definition] of Object.entries(declared)) {
+		const record = definition !== null && typeof definition === "object" ? definition : void 0;
+		const type = record?.["Type"];
+		const noEcho = record?.["NoEcho"];
+		if (noEcho === true || typeof noEcho === "string" && noEcho.toLowerCase() === "true") {
+			divergent.add(name);
+			continue;
+		}
+		if (!Object.hasOwn(bound, name) || !deployed.provablyEquals(name, type, bound[name])) divergent.add(name);
+	}
+	return divergent;
+}
+/**
+* Every intrinsic the dependence walk knows how to read. An `Fn::`-prefixed
+* key OUTSIDE this list is unclassifiable: it may name a parameter in a way
+* the generic recursion cannot see, so the walk fails closed on it.
+*/
+const KNOWN_INTRINSICS = /* @__PURE__ */ new Set([
+	"Fn::GetAtt",
+	"Fn::Join",
+	"Fn::Sub",
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::If",
+	"Fn::Equals",
+	"Fn::And",
+	"Fn::Or",
+	"Fn::Not",
+	"Fn::ImportValue",
+	"Fn::GetStackOutput",
+	"Fn::FindInMap",
+	"Fn::Base64",
+	"Fn::GetAZs",
+	"Fn::Cidr"
+]);
+/** `${Name}` / `${Name.Attr}` in an `Fn::Sub` string; `${!Literal}` is an escape. */
+const SUB_VARIABLE = /\$\{([^!}][^}]*)\}/g;
+/**
+* Which names (parameters, but also resources and pseudo parameters — the
+* caller intersects with the divergent set) the RAW `Properties` of a resource
+* depend on, plus its resource-level `Condition`.
+*
+* Generic by design: instead of modelling each intrinsic's argument grammar it
+* recurses into EVERY value, so a `Ref` nested in an `Fn::Join` / `Fn::Select`
+* / `Fn::Split` operand, an `Fn::FindInMap` key, or an `Fn::Sub` variable-map
+* value is found without being named. Only the three forms that name something
+* by BARE STRING need their own arm: `Ref`, `Fn::Sub`'s template text, and a
+* condition name (`Fn::If`'s first argument, and `Condition` inside the
+* `Conditions` section), which is followed transitively through
+* `template.Conditions`.
+*
+* May throw `RangeError` on a bag deeper than the call stack; the caller wraps
+* it fail-closed, like the discard walk beside it.
+*/
+function collectParameterDependencies(properties, resourceCondition, template) {
+	const names = /* @__PURE__ */ new Set();
+	const attributeTargets = /* @__PURE__ */ new Set();
+	const visitedConditions = /* @__PURE__ */ new Set();
+	let unclassifiable = false;
+	const conditions = template.Conditions !== null && typeof template.Conditions === "object" ? template.Conditions : {};
+	const followCondition = (name) => {
+		if (typeof name !== "string") {
+			unclassifiable = true;
+			return;
+		}
+		if (visitedConditions.has(name)) return;
+		visitedConditions.add(name);
+		if (!Object.hasOwn(conditions, name)) {
+			unclassifiable = true;
+			return;
+		}
+		walk(conditions[name], true);
+	};
+	const walk = (node, inConditions) => {
+		if (node === null || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const element of node) walk(element, inConditions);
+			return;
+		}
+		for (const [key, value] of Object.entries(node)) {
+			if (key === "Ref") {
+				if (typeof value === "string") names.add(value);
+				else unclassifiable = true;
+				continue;
+			}
+			if (key === "Fn::Sub") {
+				const text = Array.isArray(value) ? value[0] : value;
+				if (typeof text !== "string" || Array.isArray(value) && value.length !== 2) unclassifiable = true;
+				else for (const match of text.matchAll(SUB_VARIABLE)) {
+					const variable = (match[1] ?? "").trim();
+					names.add(variable);
+					const dot = variable.indexOf(".");
+					if (dot > 0) {
+						names.add(variable.slice(0, dot));
+						attributeTargets.add(variable.slice(0, dot));
+					}
+				}
+				if (Array.isArray(value)) walk(value[1], inConditions);
+				continue;
+			}
+			if (key === "Fn::GetAtt") {
+				const target = Array.isArray(value) ? value[0] : value;
+				if (typeof target === "string") {
+					const dot = target.indexOf(".");
+					const logicalId = Array.isArray(value) || dot <= 0 ? target : target.slice(0, dot);
+					names.add(logicalId);
+					attributeTargets.add(logicalId);
+				} else unclassifiable = true;
+				walk(value, inConditions);
+				continue;
+			}
+			if (key === "Fn::If") {
+				if (Array.isArray(value) && value.length === 3) {
+					followCondition(value[0]);
+					walk(value[1], inConditions);
+					walk(value[2], inConditions);
+				} else unclassifiable = true;
+				continue;
+			}
+			if (key === "Condition" && inConditions) {
+				followCondition(value);
+				continue;
+			}
+			if (key.startsWith("Fn::") && !KNOWN_INTRINSICS.has(key)) unclassifiable = true;
+			walk(value, inConditions);
+		}
+	};
+	walk(properties, false);
+	if (resourceCondition !== void 0) followCondition(resourceCondition);
+	return {
+		names,
+		attributeTargets,
+		unclassifiable
+	};
+}
+/**
+* The divergent parameters that ANYTHING in the template names. A declared
+* parameter nothing names cannot have shaped a resource — and CDK's
+* `BootstrapVersion` is exactly that on every default-synthesized stack: SSM
+* typed, never bound by the resolver because nothing references it, hence
+* always "divergent". Left in, it would arm the unclassifiable-shape refusal on
+* stacks whose every real parameter is proven.
+*
+* "Names" is the UNION of this module's walk and `TemplateParser`'s reference
+* scan — the same scan the resolver uses to decide an SSM-typed parameter is
+* unreferenced — so the two cannot disagree about `BootstrapVersion`. An
+* unclassifiable shape does NOT keep the whole set here: CloudFormation names a
+* parameter only through `Ref`, `Fn::Sub` text or a condition, and the generic
+* recursion reads those inside any intrinsic, known or not. A walk that THROWS
+* keeps the whole set (fail closed).
+*/
+function reachableDivergentParameters(template, divergent, rawBags) {
+	if (divergent.size === 0) return /* @__PURE__ */ new Set();
+	try {
+		const roots = [
+			rawBags,
+			template.Resources,
+			template.Outputs,
+			template.Conditions
+		];
+		const named = new Set(collectParameterDependencies(roots, void 0, template).names);
+		const parser = new TemplateParser();
+		for (const root of roots) {
+			if (root === null || typeof root !== "object") continue;
+			for (const name of parser.extractReferences(root)) named.add(name);
+		}
+		return new Set([...divergent].filter((name) => named.has(name)));
+	} catch {
+		return new Set(divergent);
+	}
+}
+/** Whether any DECLARED parameter is named by anything in the template. */
+function namesAnyDeclaredParameter(template) {
+	const declared = template.Parameters;
+	if (declared === null || typeof declared !== "object") return false;
+	const names = new Set(Object.keys(declared));
+	return names.size > 0 && reachableDivergentParameters(template, names, []).size > 0;
+}
+/**
+* The per-stack ARM 4 verdict. Each resource is judged on its TEMPLATE
+* definition (`Properties` + `Condition`) AND on the raw bag the state record
+* carries, unioned: a record preserved by a selective merge holds a previous
+* run's RESOLVED literal (`Value: 'CHANGEME'`), which names no parameter, so
+* judging it on the state bag alone would leave nothing to carry to the
+* freshly imported resource that reads its attribute. Template resources that
+* are not in state at all are judged too, for the same reason.
+*
+* Seeds are direct dependents and unclassifiable bags (a bag that cannot be
+* read cannot be vouched for, and neither can what reads its attributes); the
+* refused set is then closed over ATTRIBUTE reads, to a fixpoint.
+*/
+function computeParameterTaint(template, stateBags, divergent) {
+	const refused = /* @__PURE__ */ new Set();
+	const unclassifiable = /* @__PURE__ */ new Set();
+	const parametersHit = /* @__PURE__ */ new Set();
+	if (divergent.size === 0) return {
+		refused,
+		unclassifiable,
+		parametersHit
+	};
+	const templateResources = template.Resources !== null && typeof template.Resources === "object" ? template.Resources : {};
+	const readers = /* @__PURE__ */ new Map();
+	for (const logicalId of /* @__PURE__ */ new Set([...Object.keys(templateResources), ...stateBags.keys()])) {
+		const definition = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+		const record = definition !== null && typeof definition === "object" ? definition : {};
+		try {
+			const dependencies = collectParameterDependencies([record["Properties"], stateBags.get(logicalId)], record["Condition"], template);
+			readers.set(logicalId, new Set(dependencies.attributeTargets));
+			const hits = [...dependencies.names].filter((name) => divergent.has(name));
+			for (const name of hits) parametersHit.add(name);
+			if (hits.length > 0) refused.add(logicalId);
+			else if (dependencies.unclassifiable) {
+				refused.add(logicalId);
+				unclassifiable.add(logicalId);
+			}
+		} catch {
+			refused.add(logicalId);
+			unclassifiable.add(logicalId);
+		}
+	}
+	for (let grew = refused.size > 0; grew;) {
+		grew = false;
+		for (const [logicalId, targets] of readers) {
+			if (refused.has(logicalId)) continue;
+			if (![...targets].some((target) => refused.has(target))) continue;
+			refused.add(logicalId);
+			grew = true;
+		}
+	}
+	return {
+		refused,
+		unclassifiable,
+		parametersHit
+	};
+}
+
 //#endregion
 //#region src/cli/commands/import.ts
 async function importCommand(stackArg, options) {
@@ -84818,7 +85805,8 @@ async function importCommand(stackArg, options) {
 				}
 			}
 			const stackState = buildStackState(stackInfo.stackName, targetRegion, rows, templateParser, stateTemplate, existingState, selectiveMode);
-			await captureObservedForImportedResources(stackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger)), rebuiltLogicalIdsFrom(rows, stateTemplate));
+			const deployedParameters = !namesAnyDeclaredParameter(stateTemplate) ? void 0 : migrationCfnStackName !== void 0 ? await readDeployedParameters(migrationCfnStackName, awsClients.cloudFormation, logger, displaySafe(migrationCfnStackName)) : await readDeployedParameters(stackInfo.stackName, awsClients.cloudFormation, logger, displaySafe(stackInfo.stackName), { absentStackIsNoSource: true });
+			await captureObservedForImportedResources(stackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger, deployedParameters)), rebuiltLogicalIdsFrom(rows, stateTemplate));
 			const saveOptions = {};
 			if (existingEtag) saveOptions.expectedEtag = existingEtag;
 			if (migrationPending) saveOptions.migrateLegacy = true;
@@ -84838,7 +85826,8 @@ async function importCommand(stackArg, options) {
 				lockOwner: owner,
 				accountId: accountIdForNestedSynth,
 				logger,
-				assetRedirect
+				assetRedirect,
+				cfnClient: awsClients.cloudFormation
 			});
 			if (migrationCfnStackName) {
 				const orphaned = resources.length - importedRows.length;
@@ -85286,7 +86275,7 @@ function defaultOnlyParameterTemplate(template) {
 * the clear.
 *
 * The predicate is deliberately CONSERVATIVE — it over-refuses — and that is a
-* decision a review round paid for. Three arms:
+* decision a review round paid for. Four arms:
 *
 *  - **Resolution THREW** — refuse, unconditionally. A throw means the
 *    resolver could not finish, so nothing about the persisted bag is
@@ -85327,6 +86316,15 @@ function defaultOnlyParameterTemplate(template) {
 *    opener text and no intrinsic anywhere, because every way a discarded
 *    subtree could have SOURCED a reference is an intrinsic.
 *
+*  - **An UNVERIFIABLE INPUT** (ARM 4, issue
+*    [#2854](https://github.com/go-to-k/cdkd/issues/2854)). The raw bag
+*    depends on a template parameter whose DEPLOYED value — read from the
+*    backing CloudFormation stack's `DescribeStacks`, root and every nested
+*    child alike — is not provably the `Default` this import bound. Runs only
+*    when `deployedParameters` is supplied; the comparison, the dependence
+*    walk and the comparison-only rule for the deployed values live in
+*    `import-deployed-parameters.ts`.
+*
 * The cost of a false refusal is one resource's drift baseline until its next
 * deploy; the cost of a false pass is a plaintext secret in `state.json`. So an
 * unmeasurable bag refuses too.
@@ -85341,8 +86339,21 @@ function defaultOnlyParameterTemplate(template) {
 * issue and none of them proven to be all of them:
 *
 *  - a parameter binds to a placeholder `Default` while the DEPLOYED value was
-*    the reference, so no opener exists in any template this walk is handed --
-*    [#2854](https://github.com/go-to-k/cdkd/issues/2854);
+*    the reference, so no opener exists in any template this walk is handed
+*    ([#2854](https://github.com/go-to-k/cdkd/issues/2854)). ARM 4 below
+*    refuses this when a CloudFormation stack backs the import (its
+*    `DescribeStacks` parameters are the comparison); what REMAINS is an
+*    import with NO CloudFormation stack, where no deployed-parameter source
+*    exists, taint across the nested-stack `Outputs` boundary
+*    (`import-deployed-parameters.ts` states it), and the NEXT DEPLOY: the
+*    refusal marker is cleared by any UPDATE that rebuilds the record, and
+*    `cdkd deploy` binds the same placeholder `Default`, so an UPDATE that does
+*    not rewrite the placeholder-bound property captures the readback against
+*    it ([#3462](https://github.com/go-to-k/cdkd/issues/3462);
+*    `deploy-engine.ts` owns the fix). ARM 4 also WIDENS the population of
+*    [#2872](https://github.com/go-to-k/cdkd/issues/2872): a record preserved
+*    by a selective merge that a pre-#2854 import already gave a plaintext
+*    baseline is now refused, and a refusal leaves that old baseline in place;
 *  - `redactSecretsForState` cannot PAIR the readback against the source at a
 *    position the source carries NO leaf for -- an observed KEY beside a paired
 *    one -- so there is nothing to refuse from and the value scan has no needle
@@ -85374,7 +86385,7 @@ function defaultOnlyParameterTemplate(template) {
 * resolver, since the plaintext reaches the message through the resolver's
 * own throw rather than through anything this function writes.
 */
-async function resolveImportedProperties(stackState, template, region, stateBackend, logger) {
+async function resolveImportedProperties(stackState, template, region, stateBackend, logger, deployedParameters) {
 	const unsafeObservedBaselineLogicalIds = /* @__PURE__ */ new Set();
 	const entries = Object.entries(stackState.resources ?? {});
 	if (entries.length === 0) return unsafeObservedBaselineLogicalIds;
@@ -85402,6 +86413,24 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		logger.debug(`Template condition evaluation failed during import-time property resolution: ${err instanceof Error ? err.message : String(err)} — continuing without conditions.`);
 	}
 	const unboundParameterNames = Object.keys(template.Parameters ?? {}).filter((name) => isUnboundTemplateParameter(name, template, parameters));
+	let divergentParameters;
+	if (deployedParameters !== void 0) try {
+		divergentParameters = reachableDivergentParameters(template, divergentParameterNames(template, parameters, deployedParameters), entries.map(([, resource]) => resource.properties));
+	} catch {
+		divergentParameters = new Set(Object.keys(template.Parameters ?? {}));
+	}
+	let parameterTaint;
+	if (divergentParameters !== void 0 && divergentParameters.size > 0) try {
+		parameterTaint = computeParameterTaint(template, new Map(entries.map(([logicalId, resource]) => [logicalId, resource.properties])), divergentParameters);
+	} catch (err) {
+		logger.debug(`observed-baseline parameter-dependence walk failed for '${displaySafe(stackState.stackName)}': ${err instanceof Error ? err.name : typeof err} — refusing every baseline in the stack fail-closed.`);
+		const all = new Set(entries.map(([logicalId]) => logicalId));
+		parameterTaint = {
+			refused: all,
+			unclassifiable: all,
+			parametersHit: /* @__PURE__ */ new Set()
+		};
+	}
 	const baseContext = {
 		template,
 		resources: stackState.resources,
@@ -85425,7 +86454,8 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 			threw = true;
 		}
 		if (recordedSecretValues.size > 0 && resource.attributes !== void 0) resource.attributes = redactSecretsForState(resource.attributes, recordedSecretValues);
-		if (threw) {
+		const dependsOnDivergent = parameterTaint?.refused.has(logicalId) === true;
+		if (threw || dependsOnDivergent) {
 			unsafeObservedBaselineLogicalIds.add(logicalId);
 			continue;
 		}
@@ -85440,6 +86470,15 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		}
 		if (rawOpeners === void 0 || persistedOpeners === void 0 || persistedOpeners < rawOpeners || discardsNonInertSubtree) unsafeObservedBaselineLogicalIds.add(logicalId);
 	}
+	if (parameterTaint !== void 0) {
+		const inState = new Set(entries.map(([logicalId]) => logicalId));
+		const refusedHere = [...parameterTaint.refused].filter((id) => inState.has(id));
+		const unreadable = refusedHere.filter((id) => parameterTaint.unclassifiable.has(id));
+		if (refusedHere.length > 0) {
+			const named = [...parameterTaint.parametersHit].sort().map((name) => displaySafe(name));
+			logger.warn(`${refusedHere.length} resource(s) in '${displaySafe(stackState.stackName)}' depend, directly or through another resource's attributes, on template parameter(s) whose deployed CloudFormation value could not be proven equal to the template 'Default' 'cdkd import' binds` + (named.length > 0 ? ` (${named.join(", ")})` : "") + (unreadable.length > 0 ? ` — ${unreadable.length} of them because their properties could not be checked for such a dependence` : "") + ". Their recorded properties hold the 'Default', NOT the deployed value, and no observed drift baseline was captured for them by this import (the live value may be a secret this import cannot position a redaction for). Review 'cdkd diff' before the next 'cdkd deploy'.");
+		}
+	}
 	return unsafeObservedBaselineLogicalIds;
 }
 /** The opener every dynamic reference starts with, secret-bearing or not. */
@@ -85801,7 +86840,7 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 		}
 		if (unsafeObservedBaselineLogicalIds.has(logicalId)) {
 			resource.observedBaselineRefused = true;
-			logger.debug(`observedProperties capture SKIPPED for imported ${logicalId} (${resource.resourceType}): the recorded properties no longer spell the template's dynamic reference, so they cannot position a redaction — capturing an AWS readback against them could persist a resolved secret in plaintext. Drift will compare against the recorded properties for this resource until the next successful deploy.`);
+			logger.debug(`observedProperties capture SKIPPED for imported ${logicalId} (${resource.resourceType}): the recorded properties cannot be shown to spell every dynamic reference the deployed resource was built from, so they cannot position a redaction — capturing an AWS readback against them could persist a resolved secret in plaintext. Drift will compare against the recorded properties for this resource until the next successful deploy.`);
 			return;
 		}
 		delete resource.observedBaselineRefused;
@@ -85984,7 +87023,8 @@ async function importNestedStackChildrenRecursive(args) {
 			childStackState.parentStack = parentStackName;
 			childStackState.parentLogicalId = childLogicalId;
 			childStackState.parentRegion = parentRegion;
-			await captureObservedForImportedResources(childStackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger)), rebuiltLogicalIdsFrom(rows, childTemplate));
+			const childDeployedParameters = namesAnyDeclaredParameter(childStateTemplate) ? await readDeployedParameters(childTreeNode.stackName, args.cfnClient, logger, displaySafe(childStackName)) : void 0;
+			await captureObservedForImportedResources(childStackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger, childDeployedParameters)), rebuiltLogicalIdsFrom(rows, childTemplate));
 			await stateBackend.saveState(childStackName, childRegion, childStackState);
 			logger.info(`✓ Nested stack state written: ${childStackName} (${childRegion}) — ${rows.filter((r) => r.outcome === "imported").length} resource(s) imported.`);
 			if (childTreeNode.nested.size > 0) await importNestedStackChildrenRecursive({
@@ -86000,7 +87040,8 @@ async function importNestedStackChildrenRecursive(args) {
 				lockOwner,
 				accountId,
 				logger,
-				assetRedirect
+				assetRedirect,
+				cfnClient: args.cfnClient
 			});
 		} finally {
 			await lockManager.releaseLock(childStackName, childRegion).catch((err) => {
@@ -95673,4 +96714,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-D75-DVWT.js.map
+//# sourceMappingURL=program-COiS7GZJ.js.map