@go-to-k/cdkd 0.290.34 → 0.290.35

package/dist/{program-Dh1J573K.js → program-COiS7GZJ.js}

@@ -1,8 +1,8 @@
-import { $ as isExportAliasCollision, $n as maskSecretsInText, $r as stripControlChars, $t as withSharedDrainBudget, A as makeCanonicalizePropertiesFn, Ai as AwsClients, An as refuseMalformedResourcesForDestroy, Ar as AssetModeResolver, At as getAccountInfo, B as isWarmThroughputDecrease, Bi as DynamicReferenceRegionAmbiguousError, Bn as TemplateParser, Br as buildDenyExternalAccessPolicy, Bt as assertRegionMatch, C as PRE_DELETE_SNAPSHOT_TYPES, Ci as PARTITION_TABLE, Cn as malformedStateRefusalMessage, Cr as AssetPublisher, Ct as disableInstanceApiTermination, D as isFinalSnapshotError, Di as processStackMessages, Dn as refuseMalformedOutputs, Dr as createAssetRedirectResolver, Dt as carriesFetchableDynamicReference, E as createPreDeleteFinalSnapshot, Ei as AssemblyReader, En as refuseMalformedNestedChildOutputs, Er as buildAssetRedirectMap, Et as carriesDynamicReference, F as isStatefulRecreateTargetForReplace, Fi as CdkdError, Fn as findActionableSilentDrops, Fr as isCrossRegionRedirect, Ft as refStateLookupFromResource, G as cyan, Gi as MalformedProducerRecordRefusalError, Gn as carriesSecretMask, Gr as dockerSpawnEnvWithSensitive, Gt as configStringRefusal, H as toFiniteNumber, Hi as LocalInvokeBuildError$1, Hn as STATE_SOURCED_CROSS_GENERATION_RULES, Hr as describeDockerCapturedOutput, Ht as coerceCfnInteger, I as isStatefulRecreateTargetSync, In as findSilentDropProperties, Ir as parseBootstrapMarker, It as isSettledInstanceState, J as red, Ji as ProvisioningError, Jn as errorCauseChain, Jr as partitionSensitiveEnv, Jt as requireConfigArray, K as gray, Ki as NestedStackChildDirectDestroyError, Kn as createSecretMasker, Kr as formatDockerLoginError, Kt as readConfigString, L as renderStatefulReason, Li as CrossAccountSecretRefusalError, Ln as describeTypeWithThrottleRetry, Lr as readBootstrapMarkerBody, Lt as WAFv2WebACLProvider, M as makeSiblingClaimReader, Mi as resetAwsClients, Mn as repairMalformedOutputsForReadOnly, Mr as assertAssetBucketRegion, Mt as isNamelessDynamicReferenceError, N as planOrphanAdoption, Ni as setAwsClients, Nn as repairMalformedResourcePropertiesForReadOnly, Nr as ensureAssetStorage, Nt as isUnboundTemplateParameter, O as refusesFinalSnapshot, On as refuseMalformedOutputsForDestroy, Or as loadPublishableAssetManifest, Ot as cfnRefValueFromPhysicalId, P as MULTI_REGION_RECREATE_BLOCKED_TYPES, Pn as repairMalformedResourcesForReadOnly, Pr as getBootstrapMarkerKey, Pt as parameterTypeMayLoseSecretIdentity, Q as exportAliasCollisionScrubWarning, Qi as StackTerminationProtectionError, Qn as maskSecretsInError, Qr as escapeRegExp, Qt as producerRegionsFromState, R as WARM_THROUGHPUT_MEMBERS, Rn as withRetry, Rr as validateAssetBucketName, Rt as normalizeAwsTagsToCfn, S as ATOMIC_FINAL_SNAPSHOT_TYPES, Si as expectedOwnerParam, Sn as malformedResourcesWarning, Sr as shouldRetainResource, St as deleteSkipReason, T as ccRoutedFinalSnapshotError, Ti as derivePartitionAndUrlSuffix, Tn as refuseDivergentRecordRegionForDestroy, Tr as WorkGraph, Tt as IntrinsicFunctionResolver, U as formatResourceLine, Ui as LocalStartServiceError, Un as STATE_SOURCED_READBACK_RULES, Ur as describeDockerExecFailure, Ut as configBooleanRefusal, V as toCfnInteger, Vi as IntrinsicResolutionRefusalError, Vn as STATE_SOURCED_BASELINE_RULES, Vr as buildDockerImage, Vt as coerceCfnBoolean, W as bold, Wn as TEMPLATE_SOURCED_RULES, Wr as describeDockerFailure, Wt as configIntegerRefusal, X as collectDeclaredOutputNames, Xi as ResourceUpdateNotSupportedError, Xn as isSingleDynamicReferenceToken, Xr as runDockerForeground, Xt as requireConfigString, Y as yellow, Yi as ResourceTimeoutError, Yn as identityKeyFor, Yr as redactDockerArgvValues, Yt as requireConfigObject, Z as collectPublishedOutputNames, Zi as StackHasActiveImportsError, Zn as markSameGenerationBag, Zr as runDockerStreaming, Zt as classifyReplaySecretRegion, _ as bagHoldsSecretExpression, _i as MIGRATE_TMP_PREFIX, _n as malformedLocalOutputsWarning, _r as importableOutputKeys, _t as CloudControlProvider, a as DeploymentEventsStore, aa as isMarkedNonRetryable, ai as getLegacyStateBucketName, an as applyRoleArnIfSet, ar as S3StateBackend, at as collectInlinePolicyNamesManagedBySiblings, b as mergeNoChangeOutputs, bi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, bn as malformedRenderedContainersWarning, br as orphansAfterRollback, bt as UNSPECIFIED_SKIP_REASON, c as replayFailedOperations, ca as isTransientServerError, ci as resolveCaptureObservedState, cn as callerEnvCredentials, cr as buildForceUnlockCommand, ct as wouldReturnToSdkProvider, d as updatePartialMessage, da as retryClassificationText, di as resolveStateBucketWithDefaultAndSource, dn as INTRINSIC_KEYS, dr as formatLockExpiry, dt as maskerOrIdentity, ea as SynthesisError, ei as AssetManifestLoader, en as s3BucketArn, er as recordMaskOnlyValue, et as secretBearing, f as updatePartialReason, fa as describeAwsFailure, fi as resolveUseCdkBootstrapAssets, fn as STATE_RESOURCES_MALFORMED, fr as shellQuote, ft as beginCommandInterruptScope, g as computeImplicitDeleteEdges, gi as CFN_TEMPLATE_URL_LIMIT, gn as malformedExportSourceWarning, gr as hasReadableExportSet, gt as startInterruptWatch, h as IMPLICIT_DELETE_DEPENDENCIES, hi as CFN_TEMPLATE_BODY_LIMIT, hn as malformedExportNamesWarning, hr as exportNamesCarriedFrom, ht as isInterruptedWaitError, i as DeploymentEventsReader, ia as withErrorHandling, ii as getDefaultStateBucketName, in as s3BucketWebsiteUrl, ir as LockManager, it as IAMRoleProvider, j as extractDeploymentEventError, ji as getAwsClients, jn as refuseMalformedState, jr as BOOTSTRAP_MARKER_PREFIX, jt as isImpossibleEmptyStoredAttribute, k as unsupportedFinalSnapshotError, ki as resolveBucketRegion, kn as refuseMalformedResourcePropertiesForOrphan, kr as rewriteTemplateAssetReferences, kt as coerceParameterTypedValue, l as replayRollback, la as markNonRetryable, li as resolveSkipPrefix, ln as envCredentialsAreAssumedRole, lr as buildLockContentionMessage, lt as createMaskedRetryLogger, m as maskingRetryLogger, mi as warnDeprecatedNoPrefixCliFlag, mn as hasReadableResources, mr as DEFAULT_STATE_PREFIX, mt as interruptWatchListenerCount, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as Synthesizer, nn as s3BucketDualStackDomainName, nr as redactSecretsForState, nt as secretSafeKeyDisplay, o as planFailedOps, oa as isRetryableTransientError, oi as resolveApp, on as AWS_CREDENTIAL_ENV_KEYS, or as rebuildClientForBucketRegion, ot as clearOnUpdateRemoval, p as withResourceDeadline, pa as safeStringify, pi as stateBucketExistenceConfirmed, pn as hasReadableOutputs, pr as CUSTOM_RESOURCE_RESPONSE_PREFIX, pt as endCommandInterruptScope, q as green, qi as PartialFailureError, qn as dynamicReferenceTokens, qr as getDockerCmd, qt as replayWarn, r as DeployEngine, ra as normalizeAwsError, ri as synthesisStatusMessage, rn as s3BucketRegionalDomainName, rr as scrubResourceRecord, rt as getCurrentResourceSecrets, s as planRollback, sa as isThrottlingError, si as resolveAutoAssetStorage, sn as applyCallerIdentityCredentials, sr as UNREPRODUCIBLE_LOCK_CLAUSE, st as ProviderRegistry, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as getDockerImageBySourceHash, tn as s3BucketDomainName, tr as recoverMaskedOutput, tt as secretBearingStateKeyWarning, u as resolveReplacementOldType, ua as markRedactedCause, ui as resolveStateBucketWithDefault, un as DiffCalculator, ur as forceQuitRecoveryClause, ut as maskDeep, v as isSecretBearingReferenceString, vi as findLargeInlineResources, vn as malformedOutputsRefusalMessage, vr as importableOutputs, vt as isWaitAbandonedError, w as buildFinalSnapshotIdentifier, wi as canonicalizeRegion, wn as producerRecordKey, wr as stringifyValue, wt as isTerminationProtectionPropagationError, x as bindingSkippedOutputs, xi as decodeListingKey, xn as malformedResourcePropertiesWarning, xr as orphansCarriedFrom, xt as deleteIndeterminateGuards, y as keptWholeReasonText, yi as uploadCfnTemplate, yn as malformedOutputsWarning, yr as isReadableBag, yt as slowCcOperationTimeoutMs, z as coerceWarmThroughput$1, zi as DeployCancelledError, zn as DagBuilder, zr as validateContainerRepoName, zt as resolveExplicitPhysicalId } from "./deploy-engine-efiVJ-rX.js";
+import { $ as isExportAliasCollision, $i as StackTerminationProtectionError, $n as maskSecretsInText, $r as stripControlChars, $t as withSharedDrainBudget, A as makeCanonicalizePropertiesFn, Ai as resolveBucketRegion, An as refuseMalformedResourcesForDestroy, Ar as AssetModeResolver, At as getAccountInfo, B as isWarmThroughputDecrease, Bi as DeployCancelledError, Bn as TemplateParser, Br as buildDenyExternalAccessPolicy, Bt as assertRegionMatch, C as PRE_DELETE_SNAPSHOT_TYPES, Ci as expectedOwnerParam, Cn as malformedStateRefusalMessage, Cr as AssetPublisher, Ct as disableInstanceApiTermination, D as isFinalSnapshotError, Di as AssemblyReader, Dn as refuseMalformedOutputs, Dr as createAssetRedirectResolver, Dt as carriesFetchableDynamicReference, E as createPreDeleteFinalSnapshot, Ei as derivePartitionAndUrlSuffix, En as refuseMalformedNestedChildOutputs, Er as buildAssetRedirectMap, Et as carriesDynamicReference, F as isStatefulRecreateTargetForReplace, Fn as findActionableSilentDrops, Fr as isCrossRegionRedirect, Ft as refStateLookupFromResource, G as cyan, Gn as carriesSecretMask, Gr as dockerSpawnEnvWithSensitive, Gt as configStringRefusal, H as toFiniteNumber, Hi as IntrinsicResolutionRefusalError, Hn as STATE_SOURCED_CROSS_GENERATION_RULES, Hr as describeDockerCapturedOutput, Ht as coerceCfnInteger, I as isStatefulRecreateTargetSync, Ii as CdkdError, In as findSilentDropProperties, Ir as parseBootstrapMarker, It as isSettledInstanceState, J as red, Ji as PartialFailureError, Jn as errorCauseChain, Jr as partitionSensitiveEnv, Jt as requireConfigArray, K as gray, Ki as MalformedProducerRecordRefusalError, Kn as createSecretMasker, Kr as formatDockerLoginError, Kt as readConfigString, L as renderStatefulReason, Ln as describeTypeWithThrottleRetry, Lr as readBootstrapMarkerBody, Lt as WAFv2WebACLProvider, M as makeSiblingClaimReader, Mi as getAwsClients, Mn as repairMalformedOutputsForReadOnly, Mr as assertAssetBucketRegion, Mt as isNamelessDynamicReferenceError, N as planOrphanAdoption, Ni as resetAwsClients, Nn as repairMalformedResourcePropertiesForReadOnly, Nr as ensureAssetStorage, Nt as isUnboundTemplateParameter, O as refusesFinalSnapshot, Oi as processStackMessages, On as refuseMalformedOutputsForDestroy, Or as loadPublishableAssetManifest, Ot as cfnRefValueFromPhysicalId, P as MULTI_REGION_RECREATE_BLOCKED_TYPES, Pi as setAwsClients, Pn as repairMalformedResourcesForReadOnly, Pr as getBootstrapMarkerKey, Pt as parameterTypeMayLoseSecretIdentity, Q as exportAliasCollisionScrubWarning, Qi as StackHasActiveImportsError, Qn as maskSecretsInError, Qr as escapeRegExp, Qt as producerRegionsFromState, R as WARM_THROUGHPUT_MEMBERS, Ri as CrossAccountSecretRefusalError, Rn as withRetry, Rr as validateAssetBucketName, Rt as normalizeAwsTagsToCfn, S as ATOMIC_FINAL_SNAPSHOT_TYPES, Si as decodeListingKey, Sn as malformedResourcesWarning, Sr as shouldRetainResource, St as deleteSkipReason, T as ccRoutedFinalSnapshotError, Ti as canonicalizeRegion, Tn as refuseDivergentRecordRegionForDestroy, Tr as WorkGraph, Tt as IntrinsicFunctionResolver, U as formatResourceLine, Ui as LocalInvokeBuildError$1, Un as STATE_SOURCED_READBACK_RULES, Ur as describeDockerExecFailure, Ut as configBooleanRefusal, V as toCfnInteger, Vi as DynamicReferenceRegionAmbiguousError, Vn as STATE_SOURCED_BASELINE_RULES, Vr as buildDockerImage, Vt as coerceCfnBoolean, W as bold, Wi as LocalStartServiceError, Wn as TEMPLATE_SOURCED_RULES, Wr as describeDockerFailure, Wt as configIntegerRefusal, X as collectDeclaredOutputNames, Xi as ResourceTimeoutError, Xn as isSingleDynamicReferenceToken, Xr as runDockerForeground, Xt as requireConfigString, Y as yellow, Yi as ProvisioningError, Yn as identityKeyFor, Yr as redactDockerArgvValues, Yt as requireConfigObject, Z as collectPublishedOutputNames, Zi as ResourceUpdateNotSupportedError, Zn as markSameGenerationBag, Zr as runDockerStreaming, Zt as classifyReplaySecretRegion, _ as bagHoldsSecretExpression, _i as CFN_TEMPLATE_URL_LIMIT, _n as malformedLocalOutputsWarning, _r as importableOutputKeys, _t as CloudControlProvider, a as DeploymentEventsStore, aa as withErrorHandling, ai as getLegacyStateBucketName, an as applyRoleArnIfSet, ar as S3StateBackend, at as collectInlinePolicyNamesManagedBySiblings, b as mergeNoChangeOutputs, bi as uploadCfnTemplate, bn as malformedRenderedContainersWarning, br as orphansAfterRollback, bt as UNSPECIFIED_SKIP_REASON, c as replayFailedOperations, ca as isThrottlingError, ci as resolveCaptureObservedState, cn as callerEnvCredentials, cr as buildForceUnlockCommand, ct as wouldReturnToSdkProvider, d as updatePartialMessage, da as markRedactedCause, di as resolveStateBucketWithDefaultAndSource, dn as INTRINSIC_KEYS, dr as formatLockExpiry, dt as maskerOrIdentity, ei as AssetManifestLoader, en as s3BucketArn, er as recordMaskOnlyValue, et as secretBearing, f as updatePartialReason, fa as retryClassificationText, fi as resolveUseCdkBootstrapAssets, fn as STATE_RESOURCES_MALFORMED, fr as shellQuote, ft as beginCommandInterruptScope, g as computeImplicitDeleteEdges, gi as CFN_TEMPLATE_BODY_LIMIT, gn as malformedExportSourceWarning, gr as hasReadableExportSet, gt as startInterruptWatch, h as IMPLICIT_DELETE_DEPENDENCIES, hi as ssmResolvedValueType, hn as malformedExportNamesWarning, hr as exportNamesCarriedFrom, ht as isInterruptedWaitError, i as DeploymentEventsReader, ia as normalizeAwsError, ii as getDefaultStateBucketName, in as s3BucketWebsiteUrl, ir as LockManager, it as IAMRoleProvider, j as extractDeploymentEventError, ji as AwsClients, jn as refuseMalformedState, jr as BOOTSTRAP_MARKER_PREFIX, jt as isImpossibleEmptyStoredAttribute, k as unsupportedFinalSnapshotError, kn as refuseMalformedResourcePropertiesForOrphan, kr as rewriteTemplateAssetReferences, kt as coerceParameterTypedValue, l as replayRollback, la as isTransientServerError, li as resolveSkipPrefix, ln as envCredentialsAreAssumedRole, lr as buildLockContentionMessage, lt as createMaskedRetryLogger, m as maskingRetryLogger, ma as safeStringify, mi as warnDeprecatedNoPrefixCliFlag, mn as hasReadableResources, mr as DEFAULT_STATE_PREFIX, mt as interruptWatchListenerCount, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as Synthesizer, nn as s3BucketDualStackDomainName, nr as redactSecretsForState, nt as secretSafeKeyDisplay, o as planFailedOps, oa as isMarkedNonRetryable, oi as resolveApp, on as AWS_CREDENTIAL_ENV_KEYS, or as rebuildClientForBucketRegion, ot as clearOnUpdateRemoval, p as withResourceDeadline, pa as describeAwsFailure, pi as stateBucketExistenceConfirmed, pn as hasReadableOutputs, pr as CUSTOM_RESOURCE_RESPONSE_PREFIX, pt as endCommandInterruptScope, q as green, qi as NestedStackChildDirectDestroyError, qn as dynamicReferenceTokens, qr as getDockerCmd, qt as replayWarn, r as DeployEngine, ri as synthesisStatusMessage, rn as s3BucketRegionalDomainName, rr as scrubResourceRecord, rt as getCurrentResourceSecrets, s as planRollback, sa as isRetryableTransientError, si as resolveAutoAssetStorage, sn as applyCallerIdentityCredentials, sr as UNREPRODUCIBLE_LOCK_CLAUSE, st as ProviderRegistry, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as SynthesisError, ti as getDockerImageBySourceHash, tn as s3BucketDomainName, tr as recoverMaskedOutput, tt as secretBearingStateKeyWarning, u as resolveReplacementOldType, ua as markNonRetryable, ui as resolveStateBucketWithDefault, un as DiffCalculator, ur as forceQuitRecoveryClause, ut as maskDeep, v as isSecretBearingReferenceString, vi as MIGRATE_TMP_PREFIX, vn as malformedOutputsRefusalMessage, vr as importableOutputs, vt as isWaitAbandonedError, w as buildFinalSnapshotIdentifier, wi as PARTITION_TABLE, wn as producerRecordKey, wr as stringifyValue, wt as isTerminationProtectionPropagationError, x as bindingSkippedOutputs, xi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, xn as malformedResourcePropertiesWarning, xr as orphansCarriedFrom, xt as deleteIndeterminateGuards, y as keptWholeReasonText, yi as findLargeInlineResources, yn as malformedOutputsWarning, yr as isReadableBag, yt as slowCcOperationTimeoutMs, z as coerceWarmThroughput$1, zn as DagBuilder, zr as validateContainerRepoName, zt as resolveExplicitPhysicalId } from "./deploy-engine-DhZtBBq0.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-BX4pJk0T.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-CpyoQ3PO.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BTxYWlwu.js";
+import { t as getCdkdVersion } from "./version-BIpCWEQx.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BguZAQtF.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -16943,6 +16943,216 @@ function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-contributor-insights.ts
+/**
+* The `AWS::DynamoDB::Table` `ContributorInsightsSpecification` rules, in ONE
+* spelling for the table-level block and the per-index
+* (`GlobalSecondaryIndexes[].ContributorInsightsSpecification`) one (issue
+* [#1782](https://github.com/go-to-k/cdkd/issues/1782)).
+*
+* Neither block rides `CreateTable` / `UpdateTable`: DynamoDB applies it
+* through `UpdateContributorInsights` and reports it through
+* `DescribeContributorInsights`, and both calls address an index by adding
+* `IndexName`. The SDK's `GlobalSecondaryIndex` shape has NO such member, so a
+* per-index block left inside the forwarded index entry is discarded by the
+* serializer — a template asking for per-index Contributor Insights deployed
+* green with the feature off.
+*
+* Pure, so the write plan and the drift read-back gate cannot answer "does
+* this index declare the block" differently.
+*/
+/** The CFn property name, shared by the table-level and the per-index block. */
+const CONTRIBUTOR_INSIGHTS_KEY = "ContributorInsightsSpecification";
+/**
+* Read a `ContributorInsightsSpecification` block.
+*
+* An ABSENT `Enabled` reads as `false` — the member is required by the CFn
+* schema, and disabling is the answer that cannot start a billed feature.
+*/
+function readContributorInsightsSpec(value, path) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const refusal = configBooleanRefusal(value, "Enabled", path) ?? configStringRefusal(value, "Mode", "", path);
+	if (refusal !== void 0) return {
+		kind: "unusable",
+		reason: refusal
+	};
+	const block = value;
+	const enabled = coerceCfnBoolean(block["Enabled"]) ?? false;
+	const mode = block["Mode"];
+	return typeof mode === "string" && mode.length > 0 ? {
+		kind: "usable",
+		enabled,
+		mode
+	} : {
+		kind: "usable",
+		enabled
+	};
+}
+/**
+* The call one block needs, given the block the PREVIOUS side recorded.
+*
+* - `absent` with a DECLARED previous (usable or not) is a template REMOVAL and
+*   DISABLES — the rule this provider's other post-ACTIVE blocks (PITR, TTL,
+*   Kinesis) and the table-level block already follow. Because the rule is
+*   symmetric in its two sides, a rollback — which replays `update()` with the
+*   sides SWAPPED — restores the old setting through the same arms.
+* - `unusable` issues NOTHING and reports through `onUnusable`: the live
+*   setting is left alone rather than overwritten with a guess.
+* - An unchanged usable block issues nothing. `mode` takes part only while
+*   enabled, since it is never sent with `DISABLE`.
+*/
+function planContributorInsightsOp(desired, previous, onUnusable) {
+	if (desired.kind === "unusable") {
+		onUnusable(desired.reason);
+		return;
+	}
+	if (desired.kind === "absent") return previous.kind === "absent" ? void 0 : { action: "DISABLE" };
+	if (previous.kind === "usable" && previous.enabled === desired.enabled && (!desired.enabled || previous.mode === desired.mode)) return;
+	if (!desired.enabled) return { action: "DISABLE" };
+	return desired.mode === void 0 ? { action: "ENABLE" } : {
+		action: "ENABLE",
+		mode: desired.mode
+	};
+}
+/**
+* The path a per-index refusal names. Deliberately WITHOUT the index name: the
+* name is a RESOLVED template value, the caller's message already carries it
+* through a whole-value mask, and a copy embedded here would reach only the
+* substring mask, which ignores a name shorter than its minimum needle.
+*/
+const INDEX_CONTRIBUTOR_INSIGHTS_PATH = `GlobalSecondaryIndexes[].${CONTRIBUTOR_INSIGHTS_KEY}`;
+/** Index a CFn `GlobalSecondaryIndexes` value by `IndexName`. */
+function indexEntriesByName(value) {
+	const byName = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return byName;
+	for (const entry of value) {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+		const name = entry["IndexName"];
+		if (typeof name === "string") byName.set(name, entry);
+	}
+	return byName;
+}
+/**
+* The per-index calls an index list needs, in DESIRED order.
+*
+* Only an index the DESIRED list still names can produce a call: an index the
+* update removed takes its Contributor Insights rules with it, and a call
+* naming it fails with `ResourceNotFoundException`. An index that is NEW in
+* the desired list has an `absent` previous side, so its declared block is
+* always applied.
+*/
+function planIndexContributorInsightsOps(desiredIndexes, previousIndexes, onUnusable) {
+	const previousByName = indexEntriesByName(previousIndexes);
+	const ops = [];
+	for (const [indexName, entry] of indexEntriesByName(desiredIndexes)) {
+		const path = INDEX_CONTRIBUTOR_INSIGHTS_PATH;
+		const op = planContributorInsightsOp(readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], path), readContributorInsightsSpec(previousByName.get(indexName)?.[CONTRIBUTOR_INSIGHTS_KEY], path), (reason) => onUnusable(indexName, reason));
+		if (op !== void 0) ops.push({
+			indexName,
+			...op
+		});
+	}
+	return ops;
+}
+/**
+* Every refusal a CREATE must raise before `CreateTable` goes out: the
+* table-level block's and each index's. A create has no live setting to leave
+* alone, so an unreadable block there is a template error, not a skip.
+*/
+function contributorInsightsRefusals(tableBlock, indexes) {
+	const refusals = [];
+	const table = readContributorInsightsSpec(tableBlock, CONTRIBUTOR_INSIGHTS_KEY);
+	if (table.kind === "unusable") refusals.push(table.reason);
+	if (!Array.isArray(indexes)) return refusals;
+	indexes.forEach((entry, position) => {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return;
+		const read = readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], `GlobalSecondaryIndexes[${position}].${CONTRIBUTOR_INSIGHTS_KEY}`);
+		if (read.kind === "unusable") refusals.push(read.reason);
+	});
+	return refusals;
+}
+/**
+* One index entry WITHOUT its `ContributorInsightsSpecification`, for the
+* `CreateTable` forward.
+*
+* Explicit so nothing relies on the SDK serializer discarding a member its
+* `GlobalSecondaryIndex` shape does not have. Returns the entry UNCHANGED —
+* identity included — when there is nothing to strip, and never mutates it: the
+* bag is the caller's resolved template, which the engine records into state.
+*/
+function stripIndexContributorInsights(entry) {
+	if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
+	if (!("ContributorInsightsSpecification" in entry)) return entry;
+	const { [CONTRIBUTOR_INSIGHTS_KEY]: _stripped, ...rest } = entry;
+	return rest;
+}
+/**
+* Does this DESIRED index entry declare a block cdkd would act on — the gate
+* for the per-index drift read-back, which costs one API call per index?
+*
+* The same reader the write plan runs, so an `unusable` block (never sent) is
+* never read back either.
+*/
+function indexDeclaresContributorInsights(desiredEntry) {
+	return readContributorInsightsSpec(desiredEntry?.[CONTRIBUTOR_INSIGHTS_KEY], "").kind === "usable";
+}
+/** The setting a `ContributorInsightsStatus` stands for, if any. */
+function enabledForStatus(status, transientAsTarget) {
+	if (status === "ENABLED" || transientAsTarget && status === "ENABLING") return true;
+	if (status === "DISABLED" || transientAsTarget && status === "DISABLING") return false;
+}
+/**
+* Reverse-map the TABLE-level `DescribeContributorInsights` answer to the CFn
+* block, or `undefined` when there is nothing stable to report.
+*
+* Only the terminal statuses are mapped, and `Mode` is emitted whenever AWS
+* reports one for an enabled table — the block is a TOP-LEVEL key, which the
+* comparator walks by the baseline's own keys. `Mode` is never emitted for a
+* disabled block: it is not sent with `DISABLE`, and a disabled block carrying
+* one is a CFn-invalid placeholder.
+*/
+function reverseMapTableContributorInsights(status, mode) {
+	const enabled = enabledForStatus(status, false);
+	if (enabled === void 0) return void 0;
+	const block = { Enabled: enabled };
+	if (enabled && mode !== void 0) block["Mode"] = mode;
+	return block;
+}
+/**
+* Reverse-map one PER-INDEX `DescribeContributorInsights` answer, shaped by
+* the block the DESIRED entry declares. `undefined` when there is nothing to
+* report or the declared block is not one cdkd acts on.
+*
+* The per-index block sits inside an ARRAY entry, which the comparator matches
+* as a whole and by exact key set, so everything here exists to make the
+* read-back equal the declaration whenever AWS holds what was declared:
+*
+*  - `ENABLING` / `DISABLING` read as their TARGET. The deploy does not wait
+*    for the toggle, so the post-deploy `observedProperties` capture usually
+*    sees `ENABLING`; omitting the block would freeze an entry the settled
+*    index can never equal.
+*  - `Mode` is emitted only when the declared block carries one: AWS reports a
+*    mode for every enabled rule set (its default when none was sent). While
+*    `ENABLING`, a mode AWS does not report yet reads as the declared one —
+*    the one that was just sent.
+*  - `Enabled` keeps the declared SPELLING when the template wrote a string
+*    (`'true'`), since the comparator does not coerce.
+*/
+function reverseMapIndexContributorInsights(status, mode, declaredBlock) {
+	const declared = readContributorInsightsSpec(declaredBlock, INDEX_CONTRIBUTOR_INSIGHTS_PATH);
+	if (declared.kind !== "usable") return void 0;
+	const enabled = enabledForStatus(status, true);
+	if (enabled === void 0) return void 0;
+	const declaredEnabled = declaredBlock["Enabled"];
+	const block = { Enabled: typeof declaredEnabled !== "string" ? enabled : declared.enabled === enabled ? declaredEnabled : String(enabled) };
+	if (enabled && declared.mode !== void 0) {
+		const liveMode = mode ?? (status === "ENABLING" ? declared.mode : void 0);
+		if (liveMode !== void 0) block["Mode"] = liveMode;
+	}
+	return block;
+}
+
 //#endregion
 //#region src/provisioning/dynamodb-index-busy-delete.ts
 /**
@@ -18767,16 +18977,10 @@ function warmThroughputAlreadyMatches(desired, live) {
 * to decide with and every block is emitted, cleaned of its AWS-managed
 * members.
 *
-* Known residual, unchanged by this fix: CFn's per-index
-* `ContributorInsightsSpecification` has no `DescribeTable` counterpart (it
-* needs a per-index `DescribeContributorInsights` call), so a template
-* declaring one still cannot converge against a `properties` baseline. It is
-* ALSO dropped on the write side, since `create()` forwards the CFn blob to
-* `CreateTable` and the SDK serializer discards the unknown member — still
-* true after round 6 taught that path to coerce `WarmThroughput`, because the
-* entry is rebuilt with a SPREAD and every other member, known or not, rides
-* along unchanged. Filed as issue
-* [#1782](https://github.com/go-to-k/cdkd/issues/1782).
+* CFn's per-index `ContributorInsightsSpecification` is NOT mapped here: it
+* has no `DescribeTable` counterpart, so `readCurrentState` adds it afterwards
+* from a gated per-index `DescribeContributorInsights` (issue
+* [#1782](https://github.com/go-to-k/cdkd/issues/1782)).
 */
 function reverseMapSecondaryIndex(live, desired, bagInformative) {
 	const out = {};
@@ -19042,6 +19246,10 @@ var DynamoDBTableProvider = class {
 		let tableCreated = false;
 		try {
 			const billingMode = requireConfigString(properties["BillingMode"], "PROVISIONED", "AWS::DynamoDB::Table BillingMode", replayWarn(this.logger, context));
+			if (context?.replayingState !== true) {
+				const [refusal] = contributorInsightsRefusals(properties["ContributorInsightsSpecification"], properties["GlobalSecondaryIndexes"]);
+				if (refusal !== void 0) throw new Error(`${refusal}. Fix the template value`);
+			}
 			const createParams = {
 				TableName: tableName,
 				KeySchema: keySchema,
@@ -19066,7 +19274,7 @@ var DynamoDBTableProvider = class {
 			};
 			if (properties["GlobalSecondaryIndexes"]) {
 				const declaredGsis = properties["GlobalSecondaryIndexes"];
-				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexThroughputForCreate(logicalId, entry, maskSecrets)) : declaredGsis;
+				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexThroughputForCreate(logicalId, stripIndexContributorInsights(entry), maskSecrets)) : declaredGsis;
 			}
 			if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
 			const sse = mapSSESpecification(properties["SSESpecification"]);
@@ -19083,7 +19291,8 @@ var DynamoDBTableProvider = class {
 			await this.applyPointInTimeRecovery(tableName, properties["PointInTimeRecoverySpecification"], void 0, maskSecrets);
 			await this.applyTimeToLive(tableName, properties["TimeToLiveSpecification"]);
 			await this.applyKinesisStreamingDestination(tableName, properties["KinesisStreamSpecification"], void 0, maskSecrets);
-			await this.applyContributorInsights(tableName, properties["ContributorInsightsSpecification"]);
+			await this.applyContributorInsights(tableName, properties["ContributorInsightsSpecification"], void 0, maskSecrets);
+			await this.applyIndexContributorInsights(tableName, properties["GlobalSecondaryIndexes"], void 0, maskSecrets);
 			this.logger.debug(`Successfully created DynamoDB table ${logicalId}: ${tableName}`);
 			return {
 				physicalId: tableName,
@@ -19318,7 +19527,8 @@ var DynamoDBTableProvider = class {
 				await this.applyResourcePolicy(table.TableArn, properties["ResourcePolicy"], previousProperties["ResourcePolicy"]);
 			}
 			if (JSON.stringify(properties["KinesisStreamSpecification"]) !== JSON.stringify(previousProperties["KinesisStreamSpecification"])) await this.applyKinesisStreamingDestination(physicalId, properties["KinesisStreamSpecification"], previousProperties["KinesisStreamSpecification"], maskSecrets);
-			if (JSON.stringify(properties["ContributorInsightsSpecification"]) !== JSON.stringify(previousProperties["ContributorInsightsSpecification"])) await this.applyContributorInsights(physicalId, properties["ContributorInsightsSpecification"], previousProperties["ContributorInsightsSpecification"]);
+			if (JSON.stringify(properties["ContributorInsightsSpecification"]) !== JSON.stringify(previousProperties["ContributorInsightsSpecification"])) await this.applyContributorInsights(physicalId, properties["ContributorInsightsSpecification"], previousProperties["ContributorInsightsSpecification"], maskSecrets);
+			await this.applyIndexContributorInsights(physicalId, properties["GlobalSecondaryIndexes"], previousProperties["GlobalSecondaryIndexes"], maskSecrets);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -19734,24 +19944,53 @@ var DynamoDBTableProvider = class {
 	*
 	* Called from both `create()` (after the table is ACTIVE) and `update()`
 	* (only when the value changed). On `update()`-side removal — template drops
-	* the block but it was present before — insights is disabled.
+	* the block but it was present before — insights is disabled. The block is
+	* read by the reader the per-index twin uses
+	* ({@link applyIndexContributorInsights}), so the two cannot disagree about
+	* one shape: an unreadable block is announced and SKIPPED rather than read as
+	* a default (`Boolean('false')` used to ENABLE what the template disabled).
 	*/
-	async applyContributorInsights(tableName, spec, previousSpec) {
-		let action;
-		let mode;
-		if (spec !== void 0 && spec !== null) {
-			const s = spec;
-			const enabled = Boolean(s["Enabled"]);
-			action = enabled ? "ENABLE" : "DISABLE";
-			if (enabled && s["Mode"] !== void 0) mode = s["Mode"];
-		} else if (previousSpec !== void 0 && previousSpec !== null) action = "DISABLE";
-		if (action === void 0) return;
+	async applyContributorInsights(tableName, spec, previousSpec, maskSecrets) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const op = planContributorInsightsOp(readContributorInsightsSpec(spec, CONTRIBUTOR_INSIGHTS_KEY), readContributorInsightsSpec(previousSpec, CONTRIBUTOR_INSIGHTS_KEY), (reason) => warn(`DynamoDB table ${tableName}: ${reason}, so Contributor Insights was left as it is. Fix the template value and re-deploy.`));
+		if (op === void 0) return;
+		await this.sendContributorInsightsOp(tableName, op, maskSecrets);
+	}
+	/**
+	* Apply every per-index `ContributorInsightsSpecification`
+	* (`GlobalSecondaryIndexes[].ContributorInsightsSpecification`, issue
+	* [#1782](https://github.com/go-to-k/cdkd/issues/1782)) — the table-level
+	* call with `IndexName` added, one call per index whose block changed.
+	*
+	* The block is not a member of the SDK's `GlobalSecondaryIndex`, so until
+	* this existed it was dropped by the serializer on `CreateTable` and never
+	* sent by `applyGsiUpdates`: the deploy was green and the feature was off.
+	*
+	* `UpdateContributorInsights` answers `ResourceNotFoundException` for an
+	* index that is not ACTIVE yet, which {@link retryOnTransientControlPlane}
+	* does not retry, so the index wait runs FIRST — and only when there is a
+	* call to make, so an ordinary update pays no extra `DescribeTable`.
+	* `previousIndexes` is `undefined` on `create()`. Removal and rollback
+	* semantics live on {@link planContributorInsightsOp}.
+	*/
+	async applyIndexContributorInsights(tableName, desiredIndexes, previousIndexes, maskSecrets) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const ops = planIndexContributorInsightsOps(desiredIndexes, previousIndexes, (indexName, reason) => warn(`${this.indexScopeAt(indexName, tableName, maskSecrets)}: ${reason}, so its Contributor Insights was left as it is. Fix the template value and re-deploy.`));
+		if (ops.length === 0) return;
+		await this.waitForTableAndIndexesActive(tableName);
+		for (const op of ops) await this.sendContributorInsightsOp(tableName, op, maskSecrets);
+	}
+	/** Issue ONE `UpdateContributorInsights`, against the table or one index. */
+	async sendContributorInsightsOp(tableName, op, maskSecrets) {
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		const target = op.indexName === void 0 ? `DynamoDB table ${tableName}` : this.indexScopeAt(op.indexName, tableName, maskSecrets);
 		await this.retryOnTransientControlPlane(() => this.dynamoDBClient.send(new UpdateContributorInsightsCommand({
 			TableName: tableName,
-			ContributorInsightsAction: action,
-			...mode ? { ContributorInsightsMode: mode } : {}
-		})), `set ContributorInsights on ${tableName}`);
-		this.logger.debug(`Set ContributorInsightsAction=${action}${mode !== void 0 ? ` Mode=${mode}` : ""} on DynamoDB table ${tableName}`);
+			...op.indexName !== void 0 ? { IndexName: op.indexName } : {},
+			ContributorInsightsAction: op.action,
+			...op.mode !== void 0 ? { ContributorInsightsMode: op.mode } : {}
+		})), `set ContributorInsights on ${target}`);
+		debug(`Set ContributorInsightsAction=${op.action}${op.mode !== void 0 ? ` Mode=${op.mode}` : ""} on ${target}`);
 	}
 	/**
 	* Poll DescribeTable until the table reaches ACTIVE status
@@ -20732,32 +20971,35 @@ var DynamoDBTableProvider = class {
 	* level: it is order-SIGNIFICANT (HASH before RANGE), so sorting it would
 	* HIDE a real key change rather than remove a phantom one.
 	*
-	* `GlobalSecondaryIndexes` / `LocalSecondaryIndexes` are NOT declared either,
-	* and that is a MECHANISM limit rather than a judgement about the lists —
-	* both really are sets keyed by `IndexName` (issue #1767 proposes declaring
-	* them). Every entry here is a SUBTREE declaration, and unlike
-	* `getDriftUnknownPaths` this walk DESCENDS INTO ARRAY ELEMENTS giving each
-	* the parent's path (`drift-normalize.ts`), so a `'GlobalSecondaryIndexes'`
-	* entry also reaches `GlobalSecondaryIndexes.KeySchema` and would sort the
-	* per-index key schema — reversing the sentence above at the index level
-	* only. Issue #1767 calls the sort and the member reverse-map separable;
-	* this change ships the reverse-map, and the ordering half needed a
-	* leaf-only form of the declaration first (issue
-	* [#1783](https://github.com/go-to-k/cdkd/issues/1783)). **That form now
-	* EXISTS** — `LEAF_ONLY_PATH_SUFFIX` (`[]`) landed in
-	* [#1799](https://github.com/go-to-k/cdkd/pull/1799), so
-	* `'GlobalSecondaryIndexes[]'` would claim the list alone without reaching
-	* the per-index `KeySchema`. It is deliberately NOT declared here yet:
-	* adopting it is its own change with its own real-AWS verification, tracked
-	* as issue [#1812](https://github.com/go-to-k/cdkd/issues/1812). Consequence
-	* until then, stated so it is not mistaken for solved: an index list AWS
-	* returns in a different ORDER than the template declared is still phantom
-	* drift against a `properties` baseline. It is not reachable on the ordinary
-	* `observedProperties` path, where both sides come from this same readback.
+	* `GlobalSecondaryIndexes` / `LocalSecondaryIndexes` ARE declared, in the
+	* LEAF-ONLY form (`LEAF_ONLY_PATH_SUFFIX`, `[]`, from
+	* [#1799](https://github.com/go-to-k/cdkd/pull/1799)): both are sets keyed
+	* by `IndexName`, and `DescribeTable` does not return them in the template's
+	* order. A plain SUBTREE entry would be wrong — the unordered walk descends
+	* into array elements giving each the parent's path (`drift-normalize.ts`),
+	* so `'GlobalSecondaryIndexes'` would also sort each index's `KeySchema` and
+	* reverse the sentence above at the index level. The leaf-only form sorts
+	* the list and stops there.
+	*
+	* Measured on real AWS by issue
+	* [#1782](https://github.com/go-to-k/cdkd/issues/1782)'s two-index fixture:
+	* a table created with `[giA, giB]` read back as `[giB, giA]`, so a
+	* `properties` baseline reported whole-list drift although every member
+	* round-tripped. The phantom pre-dates that issue — the #1767 arm only ever
+	* had ONE index — and was not reachable against an `observedProperties`
+	* baseline, where both sides come from the same readback. Both comparison
+	* sides are sorted, by a key-order-independent serialization of the whole
+	* entry, so a baseline captured in AWS's order by an earlier binary keeps
+	* converging; a REAL difference still reports the list, since entries that
+	* differ cannot be made equal by reordering them.
 	*/
 	getDriftUnorderedPaths(resourceType) {
 		if (resourceType !== "AWS::DynamoDB::Table") return [];
-		return ["AttributeDefinitions"];
+		return [
+			"AttributeDefinitions",
+			"GlobalSecondaryIndexes[]",
+			"LocalSecondaryIndexes[]"
+		];
 	}
 	/**
 	* `WarmThroughput` is reported by AWS for EVERY table, whether or not the
@@ -20902,7 +21144,9 @@ var DynamoDBTableProvider = class {
 	* caller passes). It is consulted for the table-level `WarmThroughput` — see
 	* {@link getDriftUnknownPaths} for the measurement and the reasoning — and,
 	* since issue #1767, for the per-index throughput blocks of each secondary
-	* index, matched by `IndexName`.
+	* index, matched by `IndexName`. Since issue #1782 it also gates the per-index
+	* `ContributorInsightsSpecification` read, which costs one
+	* `DescribeContributorInsights` per declaring index.
 	*/
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
 		try {
@@ -21001,15 +21245,31 @@ var DynamoDBTableProvider = class {
 			}
 			try {
 				const ciResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({ TableName: physicalId }));
-				const status = ciResp.ContributorInsightsStatus;
-				if (status === "ENABLED" || status === "DISABLED") {
-					const cspec = { Enabled: status === "ENABLED" };
-					if (status === "ENABLED" && ciResp.ContributorInsightsMode !== void 0) cspec["Mode"] = ciResp.ContributorInsightsMode;
-					result["ContributorInsightsSpecification"] = cspec;
-				}
+				const cspec = reverseMapTableContributorInsights(ciResp.ContributorInsightsStatus, ciResp.ContributorInsightsMode);
+				if (cspec !== void 0) result["ContributorInsightsSpecification"] = cspec;
 			} catch (err) {
 				this.logger.debug(`Could not read ContributorInsights for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			}
+			const emittedGsis = result["GlobalSecondaryIndexes"];
+			if (bagInformative && Array.isArray(emittedGsis)) {
+				const desiredByName = desiredIndexEntriesByName(properties?.["GlobalSecondaryIndexes"]);
+				for (const emitted of emittedGsis) {
+					const indexName = emitted["IndexName"];
+					if (typeof indexName !== "string") continue;
+					const desiredEntry = desiredByName.get(indexName);
+					if (!indexDeclaresContributorInsights(desiredEntry)) continue;
+					try {
+						const indexResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({
+							TableName: physicalId,
+							IndexName: indexName
+						}));
+						const block = reverseMapIndexContributorInsights(indexResp.ContributorInsightsStatus, indexResp.ContributorInsightsMode, desiredEntry?.[CONTRIBUTOR_INSIGHTS_KEY]);
+						if (block !== void 0) emitted[CONTRIBUTOR_INSIGHTS_KEY] = block;
+					} catch (err) {
+						this.logger.debug(`Could not read ContributorInsights for index ${indexName} of ${physicalId}: ${describeAwsFailure(err).detail}`);
+					}
+				}
+			}
 			return result;
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$1) return void 0;
@@ -84981,6 +85241,368 @@ function createForceUnlockCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/cli/commands/import-deployed-parameters.ts
+/**
+* UNVERIFIABLE INPUTS for `cdkd import`'s observed-baseline refusal (issue
+* [#2854](https://github.com/go-to-k/cdkd/issues/2854)).
+*
+* `cdkd import` accepts no parameter values, so every template parameter is
+* bound to its `Default`. When the resources were deployed by a CloudFormation
+* stack, the value CloudFormation actually used can differ — and the ordinary
+* secret-carrying shape is a placeholder `Default` (`CHANGEME`) over a DEPLOYED
+* value of `{{resolve:secretsmanager:...}}`. The persisted `properties` then
+* spell no reference anywhere, the position-based redaction of the observed
+* capture has no evidence, and the decrypted readback would be persisted.
+*
+* The remedy here is deliberately PREMISE-INDEPENDENT. It never looks for a
+* `{{resolve:` opener in what `DescribeStacks` returns (AWS documents
+* `ParameterValue` as "the input value", which says the reference comes back
+* literally, but nothing in this module relies on it). It asks one question —
+* "is the deployed value PROVABLY the value this import bound?" — and treats
+* every other answer as divergent: a literal reference, the `****` a `NoEcho`
+* parameter is masked to, a value AWS resolved, a parameter missing from the
+* response, a `DescribeStacks` that failed. All of those differ from the bound
+* placeholder, so all of them refuse.
+*
+* THE DEPLOYED VALUES ARE COMPARISON-ONLY. They are never bound into the
+* resolve, never logged, never put in an error message, and never persisted:
+* binding them is the one design that would leak if AWS ever returned a
+* resolved value. {@link DeployedParameters} holds them in a `#private` field so
+* that a stray `JSON.stringify` / `util.inspect` / template literal of the
+* object renders nothing, and an SDK failure is reported by its error NAME
+* alone, because an SDK message can echo request input.
+*
+* TAINT THROUGH ANOTHER RESOURCE'S ATTRIBUTES IS FOLLOWED within one stack: the
+* walk records the target of every `Fn::GetAtt` / `${A.Attr}`, and the caller
+* closes the refused set over those targets, so a resource reading an attribute
+* of a refused resource (`{Fn::GetAtt: [SsmParam, Value]}` into a Lambda
+* environment — what CDK's `param.stringValue` emits) is refused with it. A
+* plain `Ref` of a resource is NOT followed: it yields the physical id, and a
+* secret used as a resource NAME is already disclosed by the identifier itself.
+*
+* KNOWN RESIDUAL, not followed: taint ACROSS the nested-stack boundary. A
+* parent property reading `Fn::GetAtt: [Child, Outputs.X]`, where the child's
+* output derives from a divergent CHILD parameter, is judged on the parent's
+* own parameters only — the root is resolved before any child is read.
+*/
+/**
+* What CloudFormation reports a stack was deployed with. Opaque on purpose:
+* the only question it answers is {@link DeployedParameters.provablyEquals}.
+*/
+var DeployedParameters = class DeployedParameters {
+	#entries;
+	constructor(entries) {
+		this.#entries = entries;
+	}
+	/** `DescribeStacks` answered; `entries` is its `Parameters` list. */
+	static fromDescribeStacks(parameters) {
+		const entries = /* @__PURE__ */ new Map();
+		for (const parameter of parameters) {
+			if (typeof parameter.ParameterKey !== "string") continue;
+			entries.set(parameter.ParameterKey, {
+				value: parameter.ParameterValue,
+				resolvedValue: parameter.ResolvedValue
+			});
+		}
+		return new DeployedParameters(entries);
+	}
+	/** The deployed values could not be read: NOTHING is provable. */
+	static unavailable() {
+		return new DeployedParameters(void 0);
+	}
+	/**
+	* Whether the deployed value of `name` is provably the value the import
+	* BOUND. The deployed string goes through the SAME coercion the resolver
+	* applied to the bound one (`Number`, `CommaDelimitedList`, `List<...>`), so
+	* `'1'` equals a bound `1` and `'a, b'` equals a bound `['a', 'b']`. For an
+	* SSM-typed parameter the resolver binds the RESOLVED value, so that is the
+	* side compared — `ParameterValue` is only the key there.
+	*/
+	provablyEquals(name, type, bound) {
+		const entry = this.#entries?.get(name);
+		if (entry === void 0 || typeof type !== "string") return false;
+		const ssmType = type.startsWith("AWS::SSM::Parameter::Value");
+		const deployed = ssmType ? entry.resolvedValue : entry.value;
+		if (typeof deployed !== "string") return false;
+		const comparedType = ssmType ? ssmResolvedValueType(type) : type;
+		return stableEquals(comparedType === void 0 ? deployed : coerceParameterTypedValue(deployed, comparedType), bound);
+	}
+};
+/** Structural equality for the scalar / scalar-array values a parameter binds to. */
+function stableEquals(a, b) {
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((element, index) => stableEquals(element, b[index]));
+	}
+	if (typeof a === "string" && typeof b === "number") return Number.isFinite(b) && a === String(b);
+	if (typeof a === "number" || typeof b === "number") return typeof a === "number" && typeof b === "number" && Number.isFinite(a) && a === b;
+	if (typeof a === "string" && typeof b === "boolean") return a === String(b);
+	return typeof a === "string" && typeof b === "string" && a === b;
+}
+async function readDeployedParameters(cfnStackName, cfnClient, logger, displayName, options) {
+	try {
+		const stack = (await cfnClient.send(new DescribeStacksCommand({ StackName: cfnStackName }))).Stacks?.[0];
+		if (!stack) {
+			logger.warn(unavailableWarning(displayName, "the stack was not returned"));
+			return DeployedParameters.unavailable();
+		}
+		return DeployedParameters.fromDescribeStacks(stack.Parameters ?? []);
+	} catch (err) {
+		if (options?.absentStackIsNoSource === true && err instanceof Error && err.name === "ValidationError" && /does not exist/i.test(err.message)) return;
+		const name = err instanceof Error && /^[A-Za-z0-9_.]{1,80}$/.test(err.name) ? err.name : "error";
+		logger.warn(unavailableWarning(displayName, name));
+		return DeployedParameters.unavailable();
+	}
+}
+function unavailableWarning(displayName, reason) {
+	return `Could not read the deployed parameter values of CloudFormation stack '${displayName}' (${reason}). 'cdkd import' needs the cloudformation:DescribeStacks permission to prove that a template parameter was deployed with its 'Default'; without it every resource that depends on a template parameter is imported WITHOUT an observed drift baseline. Review 'cdkd diff' before the next 'cdkd deploy'.`;
+}
+/**
+* The declared parameters whose deployed value is NOT provably the bound one.
+* A parameter the import could not bind at all (no `Default`, an unreferenced
+* or failed SSM default, the empty fallback bag) is divergent by definition.
+*/
+function divergentParameterNames(template, bound, deployed) {
+	const divergent = /* @__PURE__ */ new Set();
+	const declared = template.Parameters;
+	if (declared === void 0 || declared === null || typeof declared !== "object") return divergent;
+	for (const [name, definition] of Object.entries(declared)) {
+		const record = definition !== null && typeof definition === "object" ? definition : void 0;
+		const type = record?.["Type"];
+		const noEcho = record?.["NoEcho"];
+		if (noEcho === true || typeof noEcho === "string" && noEcho.toLowerCase() === "true") {
+			divergent.add(name);
+			continue;
+		}
+		if (!Object.hasOwn(bound, name) || !deployed.provablyEquals(name, type, bound[name])) divergent.add(name);
+	}
+	return divergent;
+}
+/**
+* Every intrinsic the dependence walk knows how to read. An `Fn::`-prefixed
+* key OUTSIDE this list is unclassifiable: it may name a parameter in a way
+* the generic recursion cannot see, so the walk fails closed on it.
+*/
+const KNOWN_INTRINSICS = /* @__PURE__ */ new Set([
+	"Fn::GetAtt",
+	"Fn::Join",
+	"Fn::Sub",
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::If",
+	"Fn::Equals",
+	"Fn::And",
+	"Fn::Or",
+	"Fn::Not",
+	"Fn::ImportValue",
+	"Fn::GetStackOutput",
+	"Fn::FindInMap",
+	"Fn::Base64",
+	"Fn::GetAZs",
+	"Fn::Cidr"
+]);
+/** `${Name}` / `${Name.Attr}` in an `Fn::Sub` string; `${!Literal}` is an escape. */
+const SUB_VARIABLE = /\$\{([^!}][^}]*)\}/g;
+/**
+* Which names (parameters, but also resources and pseudo parameters — the
+* caller intersects with the divergent set) the RAW `Properties` of a resource
+* depend on, plus its resource-level `Condition`.
+*
+* Generic by design: instead of modelling each intrinsic's argument grammar it
+* recurses into EVERY value, so a `Ref` nested in an `Fn::Join` / `Fn::Select`
+* / `Fn::Split` operand, an `Fn::FindInMap` key, or an `Fn::Sub` variable-map
+* value is found without being named. Only the three forms that name something
+* by BARE STRING need their own arm: `Ref`, `Fn::Sub`'s template text, and a
+* condition name (`Fn::If`'s first argument, and `Condition` inside the
+* `Conditions` section), which is followed transitively through
+* `template.Conditions`.
+*
+* May throw `RangeError` on a bag deeper than the call stack; the caller wraps
+* it fail-closed, like the discard walk beside it.
+*/
+function collectParameterDependencies(properties, resourceCondition, template) {
+	const names = /* @__PURE__ */ new Set();
+	const attributeTargets = /* @__PURE__ */ new Set();
+	const visitedConditions = /* @__PURE__ */ new Set();
+	let unclassifiable = false;
+	const conditions = template.Conditions !== null && typeof template.Conditions === "object" ? template.Conditions : {};
+	const followCondition = (name) => {
+		if (typeof name !== "string") {
+			unclassifiable = true;
+			return;
+		}
+		if (visitedConditions.has(name)) return;
+		visitedConditions.add(name);
+		if (!Object.hasOwn(conditions, name)) {
+			unclassifiable = true;
+			return;
+		}
+		walk(conditions[name], true);
+	};
+	const walk = (node, inConditions) => {
+		if (node === null || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const element of node) walk(element, inConditions);
+			return;
+		}
+		for (const [key, value] of Object.entries(node)) {
+			if (key === "Ref") {
+				if (typeof value === "string") names.add(value);
+				else unclassifiable = true;
+				continue;
+			}
+			if (key === "Fn::Sub") {
+				const text = Array.isArray(value) ? value[0] : value;
+				if (typeof text !== "string" || Array.isArray(value) && value.length !== 2) unclassifiable = true;
+				else for (const match of text.matchAll(SUB_VARIABLE)) {
+					const variable = (match[1] ?? "").trim();
+					names.add(variable);
+					const dot = variable.indexOf(".");
+					if (dot > 0) {
+						names.add(variable.slice(0, dot));
+						attributeTargets.add(variable.slice(0, dot));
+					}
+				}
+				if (Array.isArray(value)) walk(value[1], inConditions);
+				continue;
+			}
+			if (key === "Fn::GetAtt") {
+				const target = Array.isArray(value) ? value[0] : value;
+				if (typeof target === "string") {
+					const dot = target.indexOf(".");
+					const logicalId = Array.isArray(value) || dot <= 0 ? target : target.slice(0, dot);
+					names.add(logicalId);
+					attributeTargets.add(logicalId);
+				} else unclassifiable = true;
+				walk(value, inConditions);
+				continue;
+			}
+			if (key === "Fn::If") {
+				if (Array.isArray(value) && value.length === 3) {
+					followCondition(value[0]);
+					walk(value[1], inConditions);
+					walk(value[2], inConditions);
+				} else unclassifiable = true;
+				continue;
+			}
+			if (key === "Condition" && inConditions) {
+				followCondition(value);
+				continue;
+			}
+			if (key.startsWith("Fn::") && !KNOWN_INTRINSICS.has(key)) unclassifiable = true;
+			walk(value, inConditions);
+		}
+	};
+	walk(properties, false);
+	if (resourceCondition !== void 0) followCondition(resourceCondition);
+	return {
+		names,
+		attributeTargets,
+		unclassifiable
+	};
+}
+/**
+* The divergent parameters that ANYTHING in the template names. A declared
+* parameter nothing names cannot have shaped a resource — and CDK's
+* `BootstrapVersion` is exactly that on every default-synthesized stack: SSM
+* typed, never bound by the resolver because nothing references it, hence
+* always "divergent". Left in, it would arm the unclassifiable-shape refusal on
+* stacks whose every real parameter is proven.
+*
+* "Names" is the UNION of this module's walk and `TemplateParser`'s reference
+* scan — the same scan the resolver uses to decide an SSM-typed parameter is
+* unreferenced — so the two cannot disagree about `BootstrapVersion`. An
+* unclassifiable shape does NOT keep the whole set here: CloudFormation names a
+* parameter only through `Ref`, `Fn::Sub` text or a condition, and the generic
+* recursion reads those inside any intrinsic, known or not. A walk that THROWS
+* keeps the whole set (fail closed).
+*/
+function reachableDivergentParameters(template, divergent, rawBags) {
+	if (divergent.size === 0) return /* @__PURE__ */ new Set();
+	try {
+		const roots = [
+			rawBags,
+			template.Resources,
+			template.Outputs,
+			template.Conditions
+		];
+		const named = new Set(collectParameterDependencies(roots, void 0, template).names);
+		const parser = new TemplateParser();
+		for (const root of roots) {
+			if (root === null || typeof root !== "object") continue;
+			for (const name of parser.extractReferences(root)) named.add(name);
+		}
+		return new Set([...divergent].filter((name) => named.has(name)));
+	} catch {
+		return new Set(divergent);
+	}
+}
+/** Whether any DECLARED parameter is named by anything in the template. */
+function namesAnyDeclaredParameter(template) {
+	const declared = template.Parameters;
+	if (declared === null || typeof declared !== "object") return false;
+	const names = new Set(Object.keys(declared));
+	return names.size > 0 && reachableDivergentParameters(template, names, []).size > 0;
+}
+/**
+* The per-stack ARM 4 verdict. Each resource is judged on its TEMPLATE
+* definition (`Properties` + `Condition`) AND on the raw bag the state record
+* carries, unioned: a record preserved by a selective merge holds a previous
+* run's RESOLVED literal (`Value: 'CHANGEME'`), which names no parameter, so
+* judging it on the state bag alone would leave nothing to carry to the
+* freshly imported resource that reads its attribute. Template resources that
+* are not in state at all are judged too, for the same reason.
+*
+* Seeds are direct dependents and unclassifiable bags (a bag that cannot be
+* read cannot be vouched for, and neither can what reads its attributes); the
+* refused set is then closed over ATTRIBUTE reads, to a fixpoint.
+*/
+function computeParameterTaint(template, stateBags, divergent) {
+	const refused = /* @__PURE__ */ new Set();
+	const unclassifiable = /* @__PURE__ */ new Set();
+	const parametersHit = /* @__PURE__ */ new Set();
+	if (divergent.size === 0) return {
+		refused,
+		unclassifiable,
+		parametersHit
+	};
+	const templateResources = template.Resources !== null && typeof template.Resources === "object" ? template.Resources : {};
+	const readers = /* @__PURE__ */ new Map();
+	for (const logicalId of /* @__PURE__ */ new Set([...Object.keys(templateResources), ...stateBags.keys()])) {
+		const definition = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+		const record = definition !== null && typeof definition === "object" ? definition : {};
+		try {
+			const dependencies = collectParameterDependencies([record["Properties"], stateBags.get(logicalId)], record["Condition"], template);
+			readers.set(logicalId, new Set(dependencies.attributeTargets));
+			const hits = [...dependencies.names].filter((name) => divergent.has(name));
+			for (const name of hits) parametersHit.add(name);
+			if (hits.length > 0) refused.add(logicalId);
+			else if (dependencies.unclassifiable) {
+				refused.add(logicalId);
+				unclassifiable.add(logicalId);
+			}
+		} catch {
+			refused.add(logicalId);
+			unclassifiable.add(logicalId);
+		}
+	}
+	for (let grew = refused.size > 0; grew;) {
+		grew = false;
+		for (const [logicalId, targets] of readers) {
+			if (refused.has(logicalId)) continue;
+			if (![...targets].some((target) => refused.has(target))) continue;
+			refused.add(logicalId);
+			grew = true;
+		}
+	}
+	return {
+		refused,
+		unclassifiable,
+		parametersHit
+	};
+}
+
 //#endregion
 //#region src/cli/commands/import.ts
 async function importCommand(stackArg, options) {
@@ -85183,7 +85805,8 @@ async function importCommand(stackArg, options) {
 				}
 			}
 			const stackState = buildStackState(stackInfo.stackName, targetRegion, rows, templateParser, stateTemplate, existingState, selectiveMode);
-			await captureObservedForImportedResources(stackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger)), rebuiltLogicalIdsFrom(rows, stateTemplate));
+			const deployedParameters = !namesAnyDeclaredParameter(stateTemplate) ? void 0 : migrationCfnStackName !== void 0 ? await readDeployedParameters(migrationCfnStackName, awsClients.cloudFormation, logger, displaySafe(migrationCfnStackName)) : await readDeployedParameters(stackInfo.stackName, awsClients.cloudFormation, logger, displaySafe(stackInfo.stackName), { absentStackIsNoSource: true });
+			await captureObservedForImportedResources(stackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger, deployedParameters)), rebuiltLogicalIdsFrom(rows, stateTemplate));
 			const saveOptions = {};
 			if (existingEtag) saveOptions.expectedEtag = existingEtag;
 			if (migrationPending) saveOptions.migrateLegacy = true;
@@ -85203,7 +85826,8 @@ async function importCommand(stackArg, options) {
 				lockOwner: owner,
 				accountId: accountIdForNestedSynth,
 				logger,
-				assetRedirect
+				assetRedirect,
+				cfnClient: awsClients.cloudFormation
 			});
 			if (migrationCfnStackName) {
 				const orphaned = resources.length - importedRows.length;
@@ -85651,7 +86275,7 @@ function defaultOnlyParameterTemplate(template) {
 * the clear.
 *
 * The predicate is deliberately CONSERVATIVE — it over-refuses — and that is a
-* decision a review round paid for. Three arms:
+* decision a review round paid for. Four arms:
 *
 *  - **Resolution THREW** — refuse, unconditionally. A throw means the
 *    resolver could not finish, so nothing about the persisted bag is
@@ -85692,6 +86316,15 @@ function defaultOnlyParameterTemplate(template) {
 *    opener text and no intrinsic anywhere, because every way a discarded
 *    subtree could have SOURCED a reference is an intrinsic.
 *
+*  - **An UNVERIFIABLE INPUT** (ARM 4, issue
+*    [#2854](https://github.com/go-to-k/cdkd/issues/2854)). The raw bag
+*    depends on a template parameter whose DEPLOYED value — read from the
+*    backing CloudFormation stack's `DescribeStacks`, root and every nested
+*    child alike — is not provably the `Default` this import bound. Runs only
+*    when `deployedParameters` is supplied; the comparison, the dependence
+*    walk and the comparison-only rule for the deployed values live in
+*    `import-deployed-parameters.ts`.
+*
 * The cost of a false refusal is one resource's drift baseline until its next
 * deploy; the cost of a false pass is a plaintext secret in `state.json`. So an
 * unmeasurable bag refuses too.
@@ -85706,8 +86339,21 @@ function defaultOnlyParameterTemplate(template) {
 * issue and none of them proven to be all of them:
 *
 *  - a parameter binds to a placeholder `Default` while the DEPLOYED value was
-*    the reference, so no opener exists in any template this walk is handed --
-*    [#2854](https://github.com/go-to-k/cdkd/issues/2854);
+*    the reference, so no opener exists in any template this walk is handed
+*    ([#2854](https://github.com/go-to-k/cdkd/issues/2854)). ARM 4 below
+*    refuses this when a CloudFormation stack backs the import (its
+*    `DescribeStacks` parameters are the comparison); what REMAINS is an
+*    import with NO CloudFormation stack, where no deployed-parameter source
+*    exists, taint across the nested-stack `Outputs` boundary
+*    (`import-deployed-parameters.ts` states it), and the NEXT DEPLOY: the
+*    refusal marker is cleared by any UPDATE that rebuilds the record, and
+*    `cdkd deploy` binds the same placeholder `Default`, so an UPDATE that does
+*    not rewrite the placeholder-bound property captures the readback against
+*    it ([#3462](https://github.com/go-to-k/cdkd/issues/3462);
+*    `deploy-engine.ts` owns the fix). ARM 4 also WIDENS the population of
+*    [#2872](https://github.com/go-to-k/cdkd/issues/2872): a record preserved
+*    by a selective merge that a pre-#2854 import already gave a plaintext
+*    baseline is now refused, and a refusal leaves that old baseline in place;
 *  - `redactSecretsForState` cannot PAIR the readback against the source at a
 *    position the source carries NO leaf for -- an observed KEY beside a paired
 *    one -- so there is nothing to refuse from and the value scan has no needle
@@ -85739,7 +86385,7 @@ function defaultOnlyParameterTemplate(template) {
 * resolver, since the plaintext reaches the message through the resolver's
 * own throw rather than through anything this function writes.
 */
-async function resolveImportedProperties(stackState, template, region, stateBackend, logger) {
+async function resolveImportedProperties(stackState, template, region, stateBackend, logger, deployedParameters) {
 	const unsafeObservedBaselineLogicalIds = /* @__PURE__ */ new Set();
 	const entries = Object.entries(stackState.resources ?? {});
 	if (entries.length === 0) return unsafeObservedBaselineLogicalIds;
@@ -85767,6 +86413,24 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		logger.debug(`Template condition evaluation failed during import-time property resolution: ${err instanceof Error ? err.message : String(err)} — continuing without conditions.`);
 	}
 	const unboundParameterNames = Object.keys(template.Parameters ?? {}).filter((name) => isUnboundTemplateParameter(name, template, parameters));
+	let divergentParameters;
+	if (deployedParameters !== void 0) try {
+		divergentParameters = reachableDivergentParameters(template, divergentParameterNames(template, parameters, deployedParameters), entries.map(([, resource]) => resource.properties));
+	} catch {
+		divergentParameters = new Set(Object.keys(template.Parameters ?? {}));
+	}
+	let parameterTaint;
+	if (divergentParameters !== void 0 && divergentParameters.size > 0) try {
+		parameterTaint = computeParameterTaint(template, new Map(entries.map(([logicalId, resource]) => [logicalId, resource.properties])), divergentParameters);
+	} catch (err) {
+		logger.debug(`observed-baseline parameter-dependence walk failed for '${displaySafe(stackState.stackName)}': ${err instanceof Error ? err.name : typeof err} — refusing every baseline in the stack fail-closed.`);
+		const all = new Set(entries.map(([logicalId]) => logicalId));
+		parameterTaint = {
+			refused: all,
+			unclassifiable: all,
+			parametersHit: /* @__PURE__ */ new Set()
+		};
+	}
 	const baseContext = {
 		template,
 		resources: stackState.resources,
@@ -85790,7 +86454,8 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 			threw = true;
 		}
 		if (recordedSecretValues.size > 0 && resource.attributes !== void 0) resource.attributes = redactSecretsForState(resource.attributes, recordedSecretValues);
-		if (threw) {
+		const dependsOnDivergent = parameterTaint?.refused.has(logicalId) === true;
+		if (threw || dependsOnDivergent) {
 			unsafeObservedBaselineLogicalIds.add(logicalId);
 			continue;
 		}
@@ -85805,6 +86470,15 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		}
 		if (rawOpeners === void 0 || persistedOpeners === void 0 || persistedOpeners < rawOpeners || discardsNonInertSubtree) unsafeObservedBaselineLogicalIds.add(logicalId);
 	}
+	if (parameterTaint !== void 0) {
+		const inState = new Set(entries.map(([logicalId]) => logicalId));
+		const refusedHere = [...parameterTaint.refused].filter((id) => inState.has(id));
+		const unreadable = refusedHere.filter((id) => parameterTaint.unclassifiable.has(id));
+		if (refusedHere.length > 0) {
+			const named = [...parameterTaint.parametersHit].sort().map((name) => displaySafe(name));
+			logger.warn(`${refusedHere.length} resource(s) in '${displaySafe(stackState.stackName)}' depend, directly or through another resource's attributes, on template parameter(s) whose deployed CloudFormation value could not be proven equal to the template 'Default' 'cdkd import' binds` + (named.length > 0 ? ` (${named.join(", ")})` : "") + (unreadable.length > 0 ? ` — ${unreadable.length} of them because their properties could not be checked for such a dependence` : "") + ". Their recorded properties hold the 'Default', NOT the deployed value, and no observed drift baseline was captured for them by this import (the live value may be a secret this import cannot position a redaction for). Review 'cdkd diff' before the next 'cdkd deploy'.");
+		}
+	}
 	return unsafeObservedBaselineLogicalIds;
 }
 /** The opener every dynamic reference starts with, secret-bearing or not. */
@@ -86166,7 +86840,7 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 		}
 		if (unsafeObservedBaselineLogicalIds.has(logicalId)) {
 			resource.observedBaselineRefused = true;
-			logger.debug(`observedProperties capture SKIPPED for imported ${logicalId} (${resource.resourceType}): the recorded properties no longer spell the template's dynamic reference, so they cannot position a redaction — capturing an AWS readback against them could persist a resolved secret in plaintext. Drift will compare against the recorded properties for this resource until the next successful deploy.`);
+			logger.debug(`observedProperties capture SKIPPED for imported ${logicalId} (${resource.resourceType}): the recorded properties cannot be shown to spell every dynamic reference the deployed resource was built from, so they cannot position a redaction — capturing an AWS readback against them could persist a resolved secret in plaintext. Drift will compare against the recorded properties for this resource until the next successful deploy.`);
 			return;
 		}
 		delete resource.observedBaselineRefused;
@@ -86349,7 +87023,8 @@ async function importNestedStackChildrenRecursive(args) {
 			childStackState.parentStack = parentStackName;
 			childStackState.parentLogicalId = childLogicalId;
 			childStackState.parentRegion = parentRegion;
-			await captureObservedForImportedResources(childStackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger)), rebuiltLogicalIdsFrom(rows, childTemplate));
+			const childDeployedParameters = namesAnyDeclaredParameter(childStateTemplate) ? await readDeployedParameters(childTreeNode.stackName, args.cfnClient, logger, displaySafe(childStackName)) : void 0;
+			await captureObservedForImportedResources(childStackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger, childDeployedParameters)), rebuiltLogicalIdsFrom(rows, childTemplate));
 			await stateBackend.saveState(childStackName, childRegion, childStackState);
 			logger.info(`✓ Nested stack state written: ${childStackName} (${childRegion}) — ${rows.filter((r) => r.outcome === "imported").length} resource(s) imported.`);
 			if (childTreeNode.nested.size > 0) await importNestedStackChildrenRecursive({
@@ -86365,7 +87040,8 @@ async function importNestedStackChildrenRecursive(args) {
 				lockOwner,
 				accountId,
 				logger,
-				assetRedirect
+				assetRedirect,
+				cfnClient: args.cfnClient
 			});
 		} finally {
 			await lockManager.releaseLock(childStackName, childRegion).catch((err) => {
@@ -96038,4 +96714,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Dh1J573K.js.map
+//# sourceMappingURL=program-COiS7GZJ.js.map