@go-to-k/cdkd 0.290.34 → 0.290.36

package/dist/{program-Dh1J573K.js → program-DcMcqr70.js}

@@ -1,8 +1,8 @@
-import { $ as isExportAliasCollision, $n as maskSecretsInText, $r as stripControlChars, $t as withSharedDrainBudget, A as makeCanonicalizePropertiesFn, Ai as AwsClients, An as refuseMalformedResourcesForDestroy, Ar as AssetModeResolver, At as getAccountInfo, B as isWarmThroughputDecrease, Bi as DynamicReferenceRegionAmbiguousError, Bn as TemplateParser, Br as buildDenyExternalAccessPolicy, Bt as assertRegionMatch, C as PRE_DELETE_SNAPSHOT_TYPES, Ci as PARTITION_TABLE, Cn as malformedStateRefusalMessage, Cr as AssetPublisher, Ct as disableInstanceApiTermination, D as isFinalSnapshotError, Di as processStackMessages, Dn as refuseMalformedOutputs, Dr as createAssetRedirectResolver, Dt as carriesFetchableDynamicReference, E as createPreDeleteFinalSnapshot, Ei as AssemblyReader, En as refuseMalformedNestedChildOutputs, Er as buildAssetRedirectMap, Et as carriesDynamicReference, F as isStatefulRecreateTargetForReplace, Fi as CdkdError, Fn as findActionableSilentDrops, Fr as isCrossRegionRedirect, Ft as refStateLookupFromResource, G as cyan, Gi as MalformedProducerRecordRefusalError, Gn as carriesSecretMask, Gr as dockerSpawnEnvWithSensitive, Gt as configStringRefusal, H as toFiniteNumber, Hi as LocalInvokeBuildError$1, Hn as STATE_SOURCED_CROSS_GENERATION_RULES, Hr as describeDockerCapturedOutput, Ht as coerceCfnInteger, I as isStatefulRecreateTargetSync, In as findSilentDropProperties, Ir as parseBootstrapMarker, It as isSettledInstanceState, J as red, Ji as ProvisioningError, Jn as errorCauseChain, Jr as partitionSensitiveEnv, Jt as requireConfigArray, K as gray, Ki as NestedStackChildDirectDestroyError, Kn as createSecretMasker, Kr as formatDockerLoginError, Kt as readConfigString, L as renderStatefulReason, Li as CrossAccountSecretRefusalError, Ln as describeTypeWithThrottleRetry, Lr as readBootstrapMarkerBody, Lt as WAFv2WebACLProvider, M as makeSiblingClaimReader, Mi as resetAwsClients, Mn as repairMalformedOutputsForReadOnly, Mr as assertAssetBucketRegion, Mt as isNamelessDynamicReferenceError, N as planOrphanAdoption, Ni as setAwsClients, Nn as repairMalformedResourcePropertiesForReadOnly, Nr as ensureAssetStorage, Nt as isUnboundTemplateParameter, O as refusesFinalSnapshot, On as refuseMalformedOutputsForDestroy, Or as loadPublishableAssetManifest, Ot as cfnRefValueFromPhysicalId, P as MULTI_REGION_RECREATE_BLOCKED_TYPES, Pn as repairMalformedResourcesForReadOnly, Pr as getBootstrapMarkerKey, Pt as parameterTypeMayLoseSecretIdentity, Q as exportAliasCollisionScrubWarning, Qi as StackTerminationProtectionError, Qn as maskSecretsInError, Qr as escapeRegExp, Qt as producerRegionsFromState, R as WARM_THROUGHPUT_MEMBERS, Rn as withRetry, Rr as validateAssetBucketName, Rt as normalizeAwsTagsToCfn, S as ATOMIC_FINAL_SNAPSHOT_TYPES, Si as expectedOwnerParam, Sn as malformedResourcesWarning, Sr as shouldRetainResource, St as deleteSkipReason, T as ccRoutedFinalSnapshotError, Ti as derivePartitionAndUrlSuffix, Tn as refuseDivergentRecordRegionForDestroy, Tr as WorkGraph, Tt as IntrinsicFunctionResolver, U as formatResourceLine, Ui as LocalStartServiceError, Un as STATE_SOURCED_READBACK_RULES, Ur as describeDockerExecFailure, Ut as configBooleanRefusal, V as toCfnInteger, Vi as IntrinsicResolutionRefusalError, Vn as STATE_SOURCED_BASELINE_RULES, Vr as buildDockerImage, Vt as coerceCfnBoolean, W as bold, Wn as TEMPLATE_SOURCED_RULES, Wr as describeDockerFailure, Wt as configIntegerRefusal, X as collectDeclaredOutputNames, Xi as ResourceUpdateNotSupportedError, Xn as isSingleDynamicReferenceToken, Xr as runDockerForeground, Xt as requireConfigString, Y as yellow, Yi as ResourceTimeoutError, Yn as identityKeyFor, Yr as redactDockerArgvValues, Yt as requireConfigObject, Z as collectPublishedOutputNames, Zi as StackHasActiveImportsError, Zn as markSameGenerationBag, Zr as runDockerStreaming, Zt as classifyReplaySecretRegion, _ as bagHoldsSecretExpression, _i as MIGRATE_TMP_PREFIX, _n as malformedLocalOutputsWarning, _r as importableOutputKeys, _t as CloudControlProvider, a as DeploymentEventsStore, aa as isMarkedNonRetryable, ai as getLegacyStateBucketName, an as applyRoleArnIfSet, ar as S3StateBackend, at as collectInlinePolicyNamesManagedBySiblings, b as mergeNoChangeOutputs, bi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, bn as malformedRenderedContainersWarning, br as orphansAfterRollback, bt as UNSPECIFIED_SKIP_REASON, c as replayFailedOperations, ca as isTransientServerError, ci as resolveCaptureObservedState, cn as callerEnvCredentials, cr as buildForceUnlockCommand, ct as wouldReturnToSdkProvider, d as updatePartialMessage, da as retryClassificationText, di as resolveStateBucketWithDefaultAndSource, dn as INTRINSIC_KEYS, dr as formatLockExpiry, dt as maskerOrIdentity, ea as SynthesisError, ei as AssetManifestLoader, en as s3BucketArn, er as recordMaskOnlyValue, et as secretBearing, f as updatePartialReason, fa as describeAwsFailure, fi as resolveUseCdkBootstrapAssets, fn as STATE_RESOURCES_MALFORMED, fr as shellQuote, ft as beginCommandInterruptScope, g as computeImplicitDeleteEdges, gi as CFN_TEMPLATE_URL_LIMIT, gn as malformedExportSourceWarning, gr as hasReadableExportSet, gt as startInterruptWatch, h as IMPLICIT_DELETE_DEPENDENCIES, hi as CFN_TEMPLATE_BODY_LIMIT, hn as malformedExportNamesWarning, hr as exportNamesCarriedFrom, ht as isInterruptedWaitError, i as DeploymentEventsReader, ia as withErrorHandling, ii as getDefaultStateBucketName, in as s3BucketWebsiteUrl, ir as LockManager, it as IAMRoleProvider, j as extractDeploymentEventError, ji as getAwsClients, jn as refuseMalformedState, jr as BOOTSTRAP_MARKER_PREFIX, jt as isImpossibleEmptyStoredAttribute, k as unsupportedFinalSnapshotError, ki as resolveBucketRegion, kn as refuseMalformedResourcePropertiesForOrphan, kr as rewriteTemplateAssetReferences, kt as coerceParameterTypedValue, l as replayRollback, la as markNonRetryable, li as resolveSkipPrefix, ln as envCredentialsAreAssumedRole, lr as buildLockContentionMessage, lt as createMaskedRetryLogger, m as maskingRetryLogger, mi as warnDeprecatedNoPrefixCliFlag, mn as hasReadableResources, mr as DEFAULT_STATE_PREFIX, mt as interruptWatchListenerCount, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as Synthesizer, nn as s3BucketDualStackDomainName, nr as redactSecretsForState, nt as secretSafeKeyDisplay, o as planFailedOps, oa as isRetryableTransientError, oi as resolveApp, on as AWS_CREDENTIAL_ENV_KEYS, or as rebuildClientForBucketRegion, ot as clearOnUpdateRemoval, p as withResourceDeadline, pa as safeStringify, pi as stateBucketExistenceConfirmed, pn as hasReadableOutputs, pr as CUSTOM_RESOURCE_RESPONSE_PREFIX, pt as endCommandInterruptScope, q as green, qi as PartialFailureError, qn as dynamicReferenceTokens, qr as getDockerCmd, qt as replayWarn, r as DeployEngine, ra as normalizeAwsError, ri as synthesisStatusMessage, rn as s3BucketRegionalDomainName, rr as scrubResourceRecord, rt as getCurrentResourceSecrets, s as planRollback, sa as isThrottlingError, si as resolveAutoAssetStorage, sn as applyCallerIdentityCredentials, sr as UNREPRODUCIBLE_LOCK_CLAUSE, st as ProviderRegistry, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as getDockerImageBySourceHash, tn as s3BucketDomainName, tr as recoverMaskedOutput, tt as secretBearingStateKeyWarning, u as resolveReplacementOldType, ua as markRedactedCause, ui as resolveStateBucketWithDefault, un as DiffCalculator, ur as forceQuitRecoveryClause, ut as maskDeep, v as isSecretBearingReferenceString, vi as findLargeInlineResources, vn as malformedOutputsRefusalMessage, vr as importableOutputs, vt as isWaitAbandonedError, w as buildFinalSnapshotIdentifier, wi as canonicalizeRegion, wn as producerRecordKey, wr as stringifyValue, wt as isTerminationProtectionPropagationError, x as bindingSkippedOutputs, xi as decodeListingKey, xn as malformedResourcePropertiesWarning, xr as orphansCarriedFrom, xt as deleteIndeterminateGuards, y as keptWholeReasonText, yi as uploadCfnTemplate, yn as malformedOutputsWarning, yr as isReadableBag, yt as slowCcOperationTimeoutMs, z as coerceWarmThroughput$1, zi as DeployCancelledError, zn as DagBuilder, zr as validateContainerRepoName, zt as resolveExplicitPhysicalId } from "./deploy-engine-efiVJ-rX.js";
+import { $ as isExportAliasCollision, $i as StackHasActiveImportsError, $n as maskSecretsInText, $r as escapeRegExp, $t as withSharedDrainBudget, A as makeCanonicalizePropertiesFn, An as refuseMalformedResourcesForDestroy, Ar as rewriteTemplateAssetReferences, At as getAccountInfo, B as isWarmThroughputDecrease, Bn as TemplateParser, Br as validateContainerRepoName, Bt as assertRegionMatch, C as PRE_DELETE_SNAPSHOT_TYPES, Ci as decodeListingKey, Cn as malformedStateRefusalMessage, Cr as shouldRetainResource, Ct as disableInstanceApiTermination, D as isFinalSnapshotError, Di as derivePartitionAndUrlSuffix, Dn as refuseMalformedOutputs, Dr as buildAssetRedirectMap, Dt as carriesFetchableDynamicReference, E as createPreDeleteFinalSnapshot, Ei as canonicalizeRegion, En as refuseMalformedNestedChildOutputs, Er as WorkGraph, Et as carriesDynamicReference, F as isStatefulRecreateTargetForReplace, Fi as setAwsClients, Fn as findActionableSilentDrops, Fr as getBootstrapMarkerKey, Ft as refStateLookupFromResource, G as cyan, Gi as LocalStartServiceError, Gn as carriesSecretMask, Gr as describeDockerFailure, Gt as configStringRefusal, H as toFiniteNumber, Hi as DynamicReferenceRegionAmbiguousError, Hn as STATE_SOURCED_CROSS_GENERATION_RULES, Hr as buildDockerImage, Ht as coerceCfnInteger, I as isStatefulRecreateTargetSync, In as findSilentDropProperties, Ir as isCrossRegionRedirect, It as isSettledInstanceState, J as red, Ji as NestedStackChildDirectDestroyError, Jn as errorCauseChain, Jr as getDockerCmd, Jt as requireConfigArray, K as gray, Kn as createSecretMasker, Kr as dockerSpawnEnvWithSensitive, Kt as readConfigString, L as renderStatefulReason, Li as CdkdError, Ln as describeTypeWithThrottleRetry, Lr as parseBootstrapMarker, Lt as WAFv2WebACLProvider, M as makeSiblingClaimReader, Mi as AwsClients, Mn as repairMalformedOutputsForReadOnly, Mr as BOOTSTRAP_MARKER_PREFIX, Mt as isNamelessDynamicReferenceError, N as planOrphanAdoption, Ni as getAwsClients, Nn as repairMalformedResourcePropertiesForReadOnly, Nr as assertAssetBucketRegion, Nt as isUnboundTemplateParameter, O as refusesFinalSnapshot, Oi as AssemblyReader, On as refuseMalformedOutputsForDestroy, Or as createAssetRedirectResolver, Ot as cfnRefValueFromPhysicalId, P as MULTI_REGION_RECREATE_BLOCKED_TYPES, Pi as resetAwsClients, Pn as repairMalformedResourcesForReadOnly, Pr as ensureAssetStorage, Pt as parameterTypeMayLoseSecretIdentity, Q as exportAliasCollisionScrubWarning, Qi as ResourceUpdateNotSupportedError, Qn as maskSecretsInError, Qr as runDockerStreaming, Qt as producerRegionsFromState, R as WARM_THROUGHPUT_MEMBERS, Rn as withRetry, Rr as readBootstrapMarkerBody, Rt as normalizeAwsTagsToCfn, S as ATOMIC_FINAL_SNAPSHOT_TYPES, Si as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Sn as malformedResourcesWarning, Sr as orphansCarriedFrom, St as deleteSkipReason, T as ccRoutedFinalSnapshotError, Ti as PARTITION_TABLE, Tn as refuseDivergentRecordRegionForDestroy, Tr as stringifyValue, Tt as IntrinsicFunctionResolver, U as formatResourceLine, Ui as IntrinsicResolutionRefusalError, Un as STATE_SOURCED_READBACK_RULES, Ur as describeDockerCapturedOutput, Ut as configBooleanRefusal, V as toCfnInteger, Vi as DeployCancelledError, Vn as STATE_SOURCED_BASELINE_RULES, Vr as buildDenyExternalAccessPolicy, Vt as coerceCfnBoolean, W as bold, Wi as LocalInvokeBuildError$1, Wn as TEMPLATE_SOURCED_RULES, Wr as describeDockerExecFailure, Wt as configIntegerRefusal, X as collectDeclaredOutputNames, Xi as ProvisioningError, Xn as isSingleDynamicReferenceToken, Xr as redactDockerArgvValues, Xt as requireConfigString, Y as yellow, Yi as PartialFailureError, Yn as identityKeyFor, Yr as partitionSensitiveEnv, Yt as requireConfigObject, Z as collectPublishedOutputNames, Zi as ResourceTimeoutError, Zn as markSameGenerationBag, Zr as runDockerForeground, Zt as classifyReplaySecretRegion, _ as bagHoldsSecretExpression, _i as CFN_TEMPLATE_BODY_LIMIT, _n as malformedLocalOutputsWarning, _r as hasUnverifiableParameterRefusal, _t as CloudControlProvider, a as DeploymentEventsStore, aa as normalizeAwsError, ai as getDefaultStateBucketName, an as applyRoleArnIfSet, ar as S3StateBackend, at as collectInlinePolicyNamesManagedBySiblings, b as mergeNoChangeOutputs, bi as findLargeInlineResources, bn as malformedRenderedContainersWarning, br as isReadableBag, bt as UNSPECIFIED_SKIP_REASON, c as replayFailedOperations, ca as isRetryableTransientError, ci as resolveAutoAssetStorage, cn as callerEnvCredentials, cr as buildForceUnlockCommand, ct as wouldReturnToSdkProvider, d as updatePartialMessage, da as markNonRetryable, di as resolveStateBucketWithDefault, dn as INTRINSIC_KEYS, dr as formatLockExpiry, dt as maskerOrIdentity, ea as StackTerminationProtectionError, ei as stripControlChars, en as s3BucketArn, er as recordMaskOnlyValue, et as secretBearing, f as updatePartialReason, fa as markRedactedCause, fi as resolveStateBucketWithDefaultAndSource, fn as STATE_RESOURCES_MALFORMED, fr as shellQuote, ft as beginCommandInterruptScope, g as computeImplicitDeleteEdges, gi as ssmResolvedValueType, gn as malformedExportSourceWarning, gr as hasReadableExportSet, gt as startInterruptWatch, h as IMPLICIT_DELETE_DEPENDENCIES, ha as safeStringify, hi as warnDeprecatedNoPrefixCliFlag, hn as malformedExportNamesWarning, hr as exportNamesCarriedFrom, ht as isInterruptedWaitError, i as DeploymentEventsReader, ii as synthesisStatusMessage, in as s3BucketWebsiteUrl, ir as LockManager, it as IAMRoleProvider, j as extractDeploymentEventError, ji as resolveBucketRegion, jn as refuseMalformedState, jr as AssetModeResolver, jt as isImpossibleEmptyStoredAttribute, k as unsupportedFinalSnapshotError, ki as processStackMessages, kn as refuseMalformedResourcePropertiesForOrphan, kr as loadPublishableAssetManifest, kt as coerceParameterTypedValue, l as replayRollback, la as isThrottlingError, li as resolveCaptureObservedState, ln as envCredentialsAreAssumedRole, lr as buildLockContentionMessage, lt as createMaskedRetryLogger, m as maskingRetryLogger, ma as describeAwsFailure, mi as stateBucketExistenceConfirmed, mn as hasReadableResources, mr as DEFAULT_STATE_PREFIX, mt as interruptWatchListenerCount, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as SynthesisError, ni as getDockerImageBySourceHash, nn as s3BucketDualStackDomainName, nr as redactSecretsForState, nt as secretSafeKeyDisplay, o as planFailedOps, oa as withErrorHandling, oi as getLegacyStateBucketName, on as AWS_CREDENTIAL_ENV_KEYS, or as rebuildClientForBucketRegion, ot as clearOnUpdateRemoval, p as withResourceDeadline, pa as retryClassificationText, pi as resolveUseCdkBootstrapAssets, pn as hasReadableOutputs, pr as CUSTOM_RESOURCE_RESPONSE_PREFIX, pt as endCommandInterruptScope, q as green, qi as MalformedProducerRecordRefusalError, qn as dynamicReferenceTokens, qr as formatDockerLoginError, qt as replayWarn, r as DeployEngine, ri as Synthesizer, rn as s3BucketRegionalDomainName, rr as scrubResourceRecord, rt as getCurrentResourceSecrets, s as planRollback, sa as isMarkedNonRetryable, si as resolveApp, sn as applyCallerIdentityCredentials, sr as UNREPRODUCIBLE_LOCK_CLAUSE, st as ProviderRegistry, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as AssetManifestLoader, tn as s3BucketDomainName, tr as recoverMaskedOutput, tt as secretBearingStateKeyWarning, u as resolveReplacementOldType, ua as isTransientServerError, ui as resolveSkipPrefix, un as DiffCalculator, ur as forceQuitRecoveryClause, ut as maskDeep, v as isSecretBearingReferenceString, vi as CFN_TEMPLATE_URL_LIMIT, vn as malformedOutputsRefusalMessage, vr as importableOutputKeys, vt as isWaitAbandonedError, w as buildFinalSnapshotIdentifier, wi as expectedOwnerParam, wn as producerRecordKey, wr as AssetPublisher, wt as isTerminationProtectionPropagationError, x as bindingSkippedOutputs, xi as uploadCfnTemplate, xn as malformedResourcePropertiesWarning, xr as orphansAfterRollback, xt as deleteIndeterminateGuards, y as keptWholeReasonText, yi as MIGRATE_TMP_PREFIX, yn as malformedOutputsWarning, yr as importableOutputs, yt as slowCcOperationTimeoutMs, z as coerceWarmThroughput$1, zi as CrossAccountSecretRefusalError, zn as DagBuilder, zr as validateAssetBucketName, zt as resolveExplicitPhysicalId } from "./deploy-engine-tX_-qy5a.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-BX4pJk0T.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-CpyoQ3PO.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BTxYWlwu.js";
+import { t as getCdkdVersion } from "./version-BYmXwLpd.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DWY8_Kn4.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12,7 +12,7 @@ import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesComman
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListTagsCommand, PublishLayerVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
-import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
+import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStackEventsCommand, DescribeStackResourcesCommand, DescribeStacksCommand, ExecuteChangeSetCommand, GetTemplateCommand, UpdateStackCommand, waitUntilChangeSetCreateComplete, waitUntilStackDeleteComplete, waitUntilStackImportComplete, waitUntilStackUpdateComplete } from "@aws-sdk/client-cloudformation";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteMethodCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetDeploymentCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
 import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
@@ -7137,7 +7137,7 @@ function manualBucketDeletionClause(bucketName, maskSecrets) {
 * disagree about what an `Id` is.
 */
 function configItemId(item) {
-	if (!isPlainObject$1(item)) return void 0;
+	if (!isPlainObject$2(item)) return void 0;
 	const id = item["Id"];
 	if (typeof id === "string") return id;
 	if (typeof id === "number" && Number.isFinite(id)) return String(id);
@@ -7157,7 +7157,7 @@ function configItemId(item) {
 function declaresBucketObjectLock(properties) {
 	return properties["ObjectLockEnabled"] === true || properties["ObjectLockEnabled"] === "true";
 }
-function isPlainObject$1(value) {
+function isPlainObject$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -7192,7 +7192,7 @@ function isFlattenedDestination(dest) {
 * via the critic's `--providers-dir=` seam.
 */
 function s3BucketDestinationPath(dest, destinationPath) {
-	return isPlainObject$1(dest) && isFlattenedDestination(dest) ? destinationPath : `${destinationPath}.S3BucketDestination`;
+	return isPlainObject$2(dest) && isFlattenedDestination(dest) ? destinationPath : `${destinationPath}.S3BucketDestination`;
 }
 /**
 * The FLATTENED CFn `Destination` block cdkd actually SENDS for `declared`
@@ -7231,9 +7231,9 @@ function s3BucketDestinationPath(dest, destinationPath) {
 *   resolver's own refusal to report).
 */
 function effectiveS3BucketDestination(declared, sentFormat) {
-	if (!isPlainObject$1(declared)) return declared;
+	if (!isPlainObject$2(declared)) return declared;
 	const bag = isFlattenedDestination(declared) ? declared : declared["S3BucketDestination"];
-	if (!isPlainObject$1(bag)) return declared;
+	if (!isPlainObject$2(bag)) return declared;
 	if (!bag["BucketArn"] && !bag["Bucket"]) return declared;
 	const out = {};
 	const bucketArn = bag["BucketArn"] ?? bag["Bucket"];
@@ -7364,7 +7364,7 @@ function effectiveInventoryItem(item, sent) {
 	const scheduleContainerUsable = configStringRefusal(declaredSchedule, "Frequency", INVENTORY_DEFAULT_SCHEDULE_FREQUENCY, "AWS::S3::Bucket InventoryConfigurations[].Schedule") === void 0;
 	const canFoldSchedule = sent?.frequency !== void 0 || scheduleFrequencyUsable || !declaresScheduleFrequency && scheduleContainerUsable;
 	if (canFoldSchedule) {
-		const declaredFrequency = declaresScheduleFrequency ? item["ScheduleFrequency"] : isPlainObject$1(declaredSchedule) && declaredSchedule["Frequency"] !== void 0 ? declaredSchedule["Frequency"] : INVENTORY_DEFAULT_SCHEDULE_FREQUENCY;
+		const declaredFrequency = declaresScheduleFrequency ? item["ScheduleFrequency"] : isPlainObject$2(declaredSchedule) && declaredSchedule["Frequency"] !== void 0 ? declaredSchedule["Frequency"] : INVENTORY_DEFAULT_SCHEDULE_FREQUENCY;
 		const frequency = sent?.frequency ?? declaredFrequency;
 		if (!Object.is(item["ScheduleFrequency"], frequency)) patch["ScheduleFrequency"] = frequency;
 	}
@@ -7395,9 +7395,9 @@ function effectiveInventoryItem(item, sent) {
 */
 function effectiveAnalyticsItem(item, sent) {
 	const storageClassAnalysis = item["StorageClassAnalysis"];
-	if (!isPlainObject$1(storageClassAnalysis)) return item;
+	if (!isPlainObject$2(storageClassAnalysis)) return item;
 	const dataExport = storageClassAnalysis["DataExport"];
-	if (!isPlainObject$1(dataExport)) return item;
+	if (!isPlainObject$2(dataExport)) return item;
 	const patch = {};
 	const outputSchemaVersion = sent?.outputSchemaVersion ?? declaredOrDefault(dataExport, "OutputSchemaVersion", ANALYTICS_DEFAULT_OUTPUT_SCHEMA_VERSION);
 	if (!Object.is(dataExport["OutputSchemaVersion"], outputSchemaVersion)) patch["OutputSchemaVersion"] = outputSchemaVersion;
@@ -7513,7 +7513,7 @@ const EVENTBRIDGE_DEFAULT_ENABLED = true;
 * correct once every declared-but-unusable value has been refused.
 */
 function eventBridgeEnabledOf(eb) {
-	const declared = isPlainObject$1(eb) ? eb["EventBridgeEnabled"] : void 0;
+	const declared = isPlainObject$2(eb) ? eb["EventBridgeEnabled"] : void 0;
 	return coerceCfnBoolean(declared) ?? EVENTBRIDGE_DEFAULT_ENABLED;
 }
 /** The notification families whose empty declaration is never SENT (issue #1759). */
@@ -7620,7 +7620,7 @@ function foldNotificationEvents(item) {
 *   handling).
 */
 function effectiveNotificationConfiguration(config) {
-	if (!isPlainObject$1(config)) return config;
+	if (!isPlainObject$2(config)) return config;
 	let out = config;
 	for (const [listKey, aliases] of NOTIFICATION_ARN_ALIASES) out = canonicalizeItemList(out, listKey, (item) => foldNotificationEvents(foldToleratedAliases(item, aliases)));
 	out = dropEmptyNotificationFamilies(out);
@@ -7677,8 +7677,8 @@ function foldEventBridgeConfiguration(config) {
 	if (eb === void 0) return config;
 	if (eb !== null && configBooleanRefusal(eb, "EventBridgeEnabled", EVENTBRIDGE_CONFIG_PATH)) return config;
 	const enabled = eb === null ? false : eventBridgeEnabledOf(eb);
-	const declared = isPlainObject$1(eb) ? eb["EventBridgeEnabled"] : void 0;
-	if (isPlainObject$1(eb) && Object.keys(eb).length === 1 && Object.is(declared, enabled)) return config;
+	const declared = isPlainObject$2(eb) ? eb["EventBridgeEnabled"] : void 0;
+	if (isPlainObject$2(eb) && Object.keys(eb).length === 1 && Object.is(declared, enabled)) return config;
 	return {
 		...config,
 		[EVENTBRIDGE_CONFIG_KEY]: { EventBridgeEnabled: enabled }
@@ -7758,7 +7758,7 @@ function deepSameValue(a, b) {
 		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((element, index) => deepSameValue(element, b[index]));
 	}
-	if (isPlainObject$1(a) && isPlainObject$1(b)) {
+	if (isPlainObject$2(a) && isPlainObject$2(b)) {
 		const keysA = Object.keys(a);
 		if (keysA.length !== Object.keys(b).length) return false;
 		return keysA.every((key) => key in b && deepSameValue(a[key], b[key]));
@@ -7833,9 +7833,9 @@ function foldLegacySingularTransitions(rule) {
 	let out;
 	for (const [pluralKey, singularKey] of LEGACY_SINGULAR_TRANSITIONS) {
 		const singular = rule[singularKey];
-		const hasSingular = isPlainObject$1(singular);
+		const hasSingular = isPlainObject$2(singular);
 		const plural = rule[pluralKey];
-		const needsFilter = Array.isArray(plural) && plural.some((element) => !isPlainObject$1(element));
+		const needsFilter = Array.isArray(plural) && plural.some((element) => !isPlainObject$2(element));
 		if (!hasSingular && !needsFilter) continue;
 		let collided = false;
 		const merged = mergeLegacySingular(plural, hasSingular ? singular : void 0, () => {
@@ -7943,7 +7943,7 @@ function foldLifecycleExpiration(rule) {
 		const iso = cfnDateToIso(expiration);
 		if (iso === void 0) return rule;
 		date = iso;
-	} else if (isPlainObject$1(expiration)) {
+	} else if (isPlainObject$2(expiration)) {
 		if (expiration["Days"] !== void 0) days = expiration["Days"];
 		if (expiration["Date"]) {
 			const iso = cfnDateToIso(expiration["Date"]);
@@ -7991,10 +7991,10 @@ function foldNoncurrentVersionExpiration(rule) {
 	const legacy = rule["NoncurrentVersionExpirationInDays"];
 	if (legacy === void 0) return rule;
 	const declaredObject = rule["NoncurrentVersionExpiration"];
-	if (declaredObject !== void 0 && !isPlainObject$1(declaredObject)) return rule;
+	if (declaredObject !== void 0 && !isPlainObject$2(declaredObject)) return rule;
 	const out = { ...rule };
 	delete out["NoncurrentVersionExpirationInDays"];
-	if (isPlainObject$1(declaredObject)) return out;
+	if (isPlainObject$2(declaredObject)) return out;
 	const days = coerceCfnNumber(legacy);
 	if (days === void 0) return rule;
 	out["NoncurrentVersionExpiration"] = { NoncurrentDays: days };
@@ -8089,10 +8089,10 @@ function foldLifecycleScope(rule, useFilterForm) {
 * @returns `config` BY IDENTITY when the declared bag IS what goes on the wire.
 */
 function effectiveLifecycleConfiguration(config) {
-	if (!isPlainObject$1(config)) return config;
+	if (!isPlainObject$2(config)) return config;
 	const rules = config["Rules"];
 	if (!Array.isArray(rules)) return config;
-	const objectRules = rules.filter(isPlainObject$1);
+	const objectRules = rules.filter(isPlainObject$2);
 	if (objectRules.length !== rules.length || objectRules.length === 0) return config;
 	if (objectRules.some(lifecycleRuleRefused)) return config;
 	const useFilterForm = lifecycleUsesFilterForm(objectRules);
@@ -8178,7 +8178,7 @@ function canonicalizeItemList(properties, key, fold) {
 	if (!Array.isArray(list)) return properties;
 	let changed = false;
 	const mapped = list.map((element) => {
-		if (!isPlainObject$1(element)) return element;
+		if (!isPlainObject$2(element)) return element;
 		const next = fold(element);
 		if (next !== element) changed = true;
 		return next;
@@ -8198,7 +8198,7 @@ function describeValue$1(value, maskSecrets = (text) => text) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return `a string ${JSON.stringify(maskDeep(value, maskSecrets))}`;
-	if (isPlainObject$1(value)) return `an object with keys [${Object.keys(value).map((key) => maskSecrets(key)).join(", ")}]`;
+	if (isPlainObject$2(value)) return `an object with keys [${Object.keys(value).map((key) => maskSecrets(key)).join(", ")}]`;
 	return `a ${typeof value} (${maskSecrets(String(value))})`;
 }
 /**
@@ -8223,8 +8223,8 @@ function coerceCfnNumber(value) {
 * StorageClass collision, and say so rather than dropping in silence.
 */
 function mergeLegacySingular(plural, singular, onCollision) {
-	const out = (Array.isArray(plural) ? plural : []).filter(isPlainObject$1);
-	if (!isPlainObject$1(singular)) return out;
+	const out = (Array.isArray(plural) ? plural : []).filter(isPlainObject$2);
+	if (!isPlainObject$2(singular)) return out;
 	const sc = singular["StorageClass"];
 	if (typeof sc === "string" && out.some((e) => e["StorageClass"] === sc)) {
 		onCollision(sc);
@@ -8722,7 +8722,7 @@ var S3BucketProvider = class S3BucketProvider {
 				if (!(exp?.["Days"] !== void 0 || exp?.["Date"] !== void 0)) sdkRule.Expiration = { ExpiredObjectDeleteMarker: true };
 				else this.logger.warn(`Lifecycle rule '${rule["Id"] ?? "<unnamed>"}' on ${bucketName} sets ExpiredObjectDeleteMarker alongside an expiration Days/Date; S3 forbids combining them, so the delete-marker cleanup was not applied.`);
 			}
-			const nve = isPlainObject$1(rule["NoncurrentVersionExpiration"]) ? rule["NoncurrentVersionExpiration"] : void 0;
+			const nve = isPlainObject$2(rule["NoncurrentVersionExpiration"]) ? rule["NoncurrentVersionExpiration"] : void 0;
 			const legacyNveDays = rule["NoncurrentVersionExpirationInDays"];
 			if (nve) sdkRule.NoncurrentVersionExpiration = {
 				NoncurrentDays: nve["NoncurrentDays"],
@@ -8747,7 +8747,7 @@ var S3BucketProvider = class S3BucketProvider {
 			const singularTransition = rule["Transition"];
 			const allTransitions = mergeLegacySingular(transitions, singularTransition, (sc) => this.logger.warn(`Lifecycle rule '${rule["Id"] ?? "<unnamed>"}' on ${bucketName} declares both Transitions and the legacy Transition for storage class ${sc}; S3 rejects duplicates, so the legacy singular was ignored.`));
 			if (allTransitions.length > 0) sdkRule.Transitions = allTransitions.map(toSdkTransition);
-			const abort = isPlainObject$1(rule["AbortIncompleteMultipartUpload"]) ? rule["AbortIncompleteMultipartUpload"] : void 0;
+			const abort = isPlainObject$2(rule["AbortIncompleteMultipartUpload"]) ? rule["AbortIncompleteMultipartUpload"] : void 0;
 			if (abort) sdkRule.AbortIncompleteMultipartUpload = { DaysAfterInitiation: abort["DaysAfterInitiation"] };
 			const { prefix, tagFilters, sizeGt, sizeLt } = lifecycleRuleScope(rule);
 			const hasTags = tagFilters != null && tagFilters.length > 0;
@@ -9081,10 +9081,10 @@ var S3BucketProvider = class S3BucketProvider {
 			throw new Error(message);
 		};
 		if (dest === void 0 || dest === null) return;
-		if (!isPlainObject$1(dest)) return drop(`${destinationPath} must be an object (got ${describeValue$1(dest, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		if (!isPlainObject$2(dest)) return drop(`${destinationPath} must be an object (got ${describeValue$1(dest, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
 		const bag = isFlattenedDestination(dest) ? dest : dest["S3BucketDestination"];
 		if (bag === void 0 || bag === null) return drop(`${destinationPath} carries neither a bucket (BucketArn / Bucket) nor a nested S3BucketDestination object (got ${describeValue$1(dest, maskSecrets)}) — the destination would otherwise be dropped from the request with no error`);
-		if (!isPlainObject$1(bag)) return drop(`${nestedPath} must be an object (got ${describeValue$1(bag, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		if (!isPlainObject$2(bag)) return drop(`${nestedPath} must be an object (got ${describeValue$1(bag, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
 		if (!bag["BucketArn"] && !bag["Bucket"]) return drop(`${bag === dest ? destinationPath : nestedPath} has no destination bucket (BucketArn / Bucket) (got ${describeValue$1(bag, maskSecrets)}) — the request would be rejected by S3, or silently carry no destination`);
 		return bag;
 	}
@@ -16943,6 +16943,511 @@ function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-contributor-insights.ts
+/**
+* The `AWS::DynamoDB::Table` `ContributorInsightsSpecification` rules, in ONE
+* spelling for the table-level block and the per-index
+* (`GlobalSecondaryIndexes[].ContributorInsightsSpecification`) one (issue
+* [#1782](https://github.com/go-to-k/cdkd/issues/1782)).
+*
+* Neither block rides `CreateTable` / `UpdateTable`: DynamoDB applies it
+* through `UpdateContributorInsights` and reports it through
+* `DescribeContributorInsights`, and both calls address an index by adding
+* `IndexName`. The SDK's `GlobalSecondaryIndex` shape has NO such member, so a
+* per-index block left inside the forwarded index entry is discarded by the
+* serializer — a template asking for per-index Contributor Insights deployed
+* green with the feature off.
+*
+* Pure, so the write plan and the drift read-back gate cannot answer "does
+* this index declare the block" differently.
+*/
+/** The CFn property name, shared by the table-level and the per-index block. */
+const CONTRIBUTOR_INSIGHTS_KEY = "ContributorInsightsSpecification";
+/**
+* Read a `ContributorInsightsSpecification` block.
+*
+* An ABSENT `Enabled` reads as `false` — the member is required by the CFn
+* schema, and disabling is the answer that cannot start a billed feature.
+*/
+function readContributorInsightsSpec(value, path) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const refusal = configBooleanRefusal(value, "Enabled", path) ?? configStringRefusal(value, "Mode", "", path);
+	if (refusal !== void 0) return {
+		kind: "unusable",
+		reason: refusal
+	};
+	const block = value;
+	const enabled = coerceCfnBoolean(block["Enabled"]) ?? false;
+	const mode = block["Mode"];
+	return typeof mode === "string" && mode.length > 0 ? {
+		kind: "usable",
+		enabled,
+		mode
+	} : {
+		kind: "usable",
+		enabled
+	};
+}
+/**
+* The call one block needs, given the block the PREVIOUS side recorded.
+*
+* - `absent` with a DECLARED previous (usable or not) is a template REMOVAL and
+*   DISABLES — the rule this provider's other post-ACTIVE blocks (PITR, TTL,
+*   Kinesis) and the table-level block already follow. Because the rule is
+*   symmetric in its two sides, a rollback — which replays `update()` with the
+*   sides SWAPPED — restores the old setting through the same arms.
+* - `unusable` issues NOTHING and reports through `onUnusable`: the live
+*   setting is left alone rather than overwritten with a guess.
+* - An unchanged usable block issues nothing. `mode` takes part only while
+*   enabled, since it is never sent with `DISABLE`.
+*/
+function planContributorInsightsOp(desired, previous, onUnusable) {
+	if (desired.kind === "unusable") {
+		onUnusable(desired.reason);
+		return;
+	}
+	if (desired.kind === "absent") return previous.kind === "absent" ? void 0 : { action: "DISABLE" };
+	if (previous.kind === "usable" && previous.enabled === desired.enabled && (!desired.enabled || previous.mode === desired.mode)) return;
+	if (!desired.enabled) return { action: "DISABLE" };
+	return desired.mode === void 0 ? { action: "ENABLE" } : {
+		action: "ENABLE",
+		mode: desired.mode
+	};
+}
+/**
+* The path a per-index refusal names. Deliberately WITHOUT the index name: the
+* name is a RESOLVED template value, the caller's message already carries it
+* through a whole-value mask, and a copy embedded here would reach only the
+* substring mask, which ignores a name shorter than its minimum needle.
+*/
+const INDEX_CONTRIBUTOR_INSIGHTS_PATH = `GlobalSecondaryIndexes[].${CONTRIBUTOR_INSIGHTS_KEY}`;
+/** Index a CFn `GlobalSecondaryIndexes` value by `IndexName`. */
+function indexEntriesByName(value) {
+	const byName = /* @__PURE__ */ new Map();
+	if (!Array.isArray(value)) return byName;
+	for (const entry of value) {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) continue;
+		const name = entry["IndexName"];
+		if (typeof name === "string") byName.set(name, entry);
+	}
+	return byName;
+}
+/**
+* The per-index calls an index list needs, in DESIRED order.
+*
+* Only an index the DESIRED list still names can produce a call: an index the
+* update removed takes its Contributor Insights rules with it, and a call
+* naming it fails with `ResourceNotFoundException`. An index that is NEW in
+* the desired list has an `absent` previous side, so its declared block is
+* always applied.
+*/
+function planIndexContributorInsightsOps(desiredIndexes, previousIndexes, onUnusable) {
+	const previousByName = indexEntriesByName(previousIndexes);
+	const ops = [];
+	for (const [indexName, entry] of indexEntriesByName(desiredIndexes)) {
+		const path = INDEX_CONTRIBUTOR_INSIGHTS_PATH;
+		const op = planContributorInsightsOp(readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], path), readContributorInsightsSpec(previousByName.get(indexName)?.[CONTRIBUTOR_INSIGHTS_KEY], path), (reason) => onUnusable(indexName, reason));
+		if (op !== void 0) ops.push({
+			indexName,
+			...op
+		});
+	}
+	return ops;
+}
+/**
+* Every refusal a CREATE must raise before `CreateTable` goes out: the
+* table-level block's and each index's. A create has no live setting to leave
+* alone, so an unreadable block there is a template error, not a skip.
+*/
+function contributorInsightsRefusals(tableBlock, indexes) {
+	const refusals = [];
+	const table = readContributorInsightsSpec(tableBlock, CONTRIBUTOR_INSIGHTS_KEY);
+	if (table.kind === "unusable") refusals.push(table.reason);
+	if (!Array.isArray(indexes)) return refusals;
+	indexes.forEach((entry, position) => {
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return;
+		const read = readContributorInsightsSpec(entry[CONTRIBUTOR_INSIGHTS_KEY], `GlobalSecondaryIndexes[${position}].${CONTRIBUTOR_INSIGHTS_KEY}`);
+		if (read.kind === "unusable") refusals.push(read.reason);
+	});
+	return refusals;
+}
+/**
+* One index entry WITHOUT its `ContributorInsightsSpecification`, for the
+* `CreateTable` forward.
+*
+* Explicit so nothing relies on the SDK serializer discarding a member its
+* `GlobalSecondaryIndex` shape does not have. Returns the entry UNCHANGED —
+* identity included — when there is nothing to strip, and never mutates it: the
+* bag is the caller's resolved template, which the engine records into state.
+*/
+function stripIndexContributorInsights(entry) {
+	if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
+	if (!("ContributorInsightsSpecification" in entry)) return entry;
+	const { [CONTRIBUTOR_INSIGHTS_KEY]: _stripped, ...rest } = entry;
+	return rest;
+}
+/**
+* Does this DESIRED index entry declare a block cdkd would act on — the gate
+* for the per-index drift read-back, which costs one API call per index?
+*
+* The same reader the write plan runs, so an `unusable` block (never sent) is
+* never read back either.
+*/
+function indexDeclaresContributorInsights(desiredEntry) {
+	return readContributorInsightsSpec(desiredEntry?.[CONTRIBUTOR_INSIGHTS_KEY], "").kind === "usable";
+}
+/** The setting a `ContributorInsightsStatus` stands for, if any. */
+function enabledForStatus(status, transientAsTarget) {
+	if (status === "ENABLED" || transientAsTarget && status === "ENABLING") return true;
+	if (status === "DISABLED" || transientAsTarget && status === "DISABLING") return false;
+}
+/**
+* Reverse-map the TABLE-level `DescribeContributorInsights` answer to the CFn
+* block, or `undefined` when there is nothing stable to report.
+*
+* Only the terminal statuses are mapped, and `Mode` is emitted whenever AWS
+* reports one for an enabled table — the block is a TOP-LEVEL key, which the
+* comparator walks by the baseline's own keys. `Mode` is never emitted for a
+* disabled block: it is not sent with `DISABLE`, and a disabled block carrying
+* one is a CFn-invalid placeholder.
+*/
+function reverseMapTableContributorInsights(status, mode) {
+	const enabled = enabledForStatus(status, false);
+	if (enabled === void 0) return void 0;
+	const block = { Enabled: enabled };
+	if (enabled && mode !== void 0) block["Mode"] = mode;
+	return block;
+}
+/**
+* Reverse-map one PER-INDEX `DescribeContributorInsights` answer, shaped by
+* the block the DESIRED entry declares. `undefined` when there is nothing to
+* report or the declared block is not one cdkd acts on.
+*
+* The per-index block sits inside an ARRAY entry, which the comparator matches
+* as a whole and by exact key set, so everything here exists to make the
+* read-back equal the declaration whenever AWS holds what was declared:
+*
+*  - `ENABLING` / `DISABLING` read as their TARGET. The deploy does not wait
+*    for the toggle, so the post-deploy `observedProperties` capture usually
+*    sees `ENABLING`; omitting the block would freeze an entry the settled
+*    index can never equal.
+*  - `Mode` is emitted only when the declared block carries one: AWS reports a
+*    mode for every enabled rule set (its default when none was sent). While
+*    `ENABLING`, a mode AWS does not report yet reads as the declared one —
+*    the one that was just sent.
+*  - `Enabled` keeps the declared SPELLING when the template wrote a string
+*    (`'true'`), since the comparator does not coerce.
+*/
+function reverseMapIndexContributorInsights(status, mode, declaredBlock) {
+	const declared = readContributorInsightsSpec(declaredBlock, INDEX_CONTRIBUTOR_INSIGHTS_PATH);
+	if (declared.kind !== "usable") return void 0;
+	const enabled = enabledForStatus(status, true);
+	if (enabled === void 0) return void 0;
+	const declaredEnabled = declaredBlock["Enabled"];
+	const block = { Enabled: typeof declaredEnabled !== "string" ? enabled : declared.enabled === enabled ? declaredEnabled : String(enabled) };
+	if (enabled && declared.mode !== void 0) {
+		const liveMode = mode ?? (status === "ENABLING" ? declared.mode : void 0);
+		if (liveMode !== void 0) block["Mode"] = liveMode;
+	}
+	return block;
+}
+
+//#endregion
+//#region src/provisioning/dynamodb-stream-members.ts
+/**
+* The two `AWS::DynamoDB::Table` `StreamSpecification` members that are NOT
+* members of the SDK's `StreamSpecification`: `ResourcePolicy`
+* (`{ PolicyDocument }`, the resource-based policy of the STREAM) and `Tags`
+* (issue [#3458](https://github.com/go-to-k/cdkd/issues/3458)).
+*
+* `CreateTable` / `UpdateTable` take only `{ StreamEnabled, StreamViewType }`,
+* so a block carrying either member deployed green with neither applied — a
+* template granting access to a table's stream left the stream with no policy.
+* CloudFormation applies both against the STREAM arn (`LatestStreamArn`),
+* re-applies both after a `StreamViewType` change (which mints a NEW arn), and
+* REMOVES both when the member leaves a block whose stream stays (measured on
+* real CloudFormation; the measurements are on the issue).
+*
+* Pure, so the write plan, the create-time refusal and the drift read-back
+* gate cannot answer "does this block declare the member" differently.
+*/
+/** The CFn property holding both members. */
+const STREAM_SPECIFICATION_KEY = "StreamSpecification";
+/** The stream's resource-based policy member. */
+const STREAM_POLICY_KEY = "ResourcePolicy";
+/** The stream's tag-list member. */
+const STREAM_TAGS_KEY = "Tags";
+const POLICY_PATH = `${STREAM_SPECIFICATION_KEY}.${STREAM_POLICY_KEY}`;
+const TAGS_PATH = `${STREAM_SPECIFICATION_KEY}.${STREAM_TAGS_KEY}`;
+function isPlainObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The message a `config-shape` guard would throw, or `undefined`. */
+function refusalOf(guard) {
+	try {
+		guard();
+		return;
+	} catch (error) {
+		return describeAwsFailure(error).detail;
+	}
+}
+/** The members of a `StreamSpecification` block, or none for a non-object. */
+function blockMembers(block) {
+	return isPlainObject$1(block) ? block : {};
+}
+/**
+* Read `StreamSpecification.ResourcePolicy`.
+*
+* The CFn shape is `{ PolicyDocument: <object | JSON string> }` and the
+* document is REQUIRED, so a block without one is unreadable rather than "no
+* policy": reading it as absent would DELETE the live policy on an update.
+*/
+function readStreamPolicy(block) {
+	const value = blockMembers(block)[STREAM_POLICY_KEY];
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const containerRefusal = refusalOf(() => requireConfigObject(value, POLICY_PATH));
+	if (containerRefusal !== void 0) return {
+		kind: "unusable",
+		reason: containerRefusal
+	};
+	const documentPath = `${POLICY_PATH}.PolicyDocument`;
+	const document = value["PolicyDocument"];
+	if (typeof document === "string") return document.trim() === "" ? {
+		kind: "unusable",
+		reason: `${documentPath} must not be a blank string`
+	} : {
+		kind: "usable",
+		document
+	};
+	if (document === void 0 || document === null) return {
+		kind: "unusable",
+		reason: `${documentPath} is required when ${POLICY_PATH} is declared`
+	};
+	const documentRefusal = refusalOf(() => requireConfigObject(document, documentPath));
+	if (documentRefusal !== void 0) return {
+		kind: "unusable",
+		reason: documentRefusal
+	};
+	return {
+		kind: "usable",
+		document: JSON.stringify(document)
+	};
+}
+/**
+* Read `StreamSpecification.Tags`.
+*
+* Refusals name an entry by POSITION, never by its key: the key is a RESOLVED
+* template value, and a copy embedded here would reach only the substring
+* mask, which ignores a value shorter than its minimum needle.
+*
+* ONE unreadable entry makes the whole list unusable. Filtering it out would
+* send a list nobody declared, and on an update would untag a key the
+* unreadable entry may well have named.
+*/
+function readStreamTags(block) {
+	const value = blockMembers(block)[STREAM_TAGS_KEY];
+	if (value === void 0 || value === null) return { kind: "absent" };
+	if (!Array.isArray(value)) return {
+		kind: "unusable",
+		reason: `${TAGS_PATH} must be an array of {Key, Value} entries`
+	};
+	const tags = /* @__PURE__ */ new Map();
+	for (const [position, entry] of value.entries()) {
+		const entryPath = `${TAGS_PATH}[${position}]`;
+		const refusal = refusalOf(() => requireConfigObject(entry, entryPath)) ?? configStringRefusal(entry, "Key", "required", entryPath) ?? configStringRefusal(entry, "Value", "", entryPath);
+		if (refusal !== void 0) return {
+			kind: "unusable",
+			reason: refusal
+		};
+		const { Key: key, Value: tagValue } = entry;
+		if (typeof key !== "string") return {
+			kind: "unusable",
+			reason: `${entryPath}.Key is required`
+		};
+		tags.set(key, typeof tagValue === "string" ? tagValue : "");
+	}
+	return {
+		kind: "usable",
+		tags
+	};
+}
+/**
+* Every refusal a CREATE must raise before `CreateTable` goes out. A create has
+* no live setting to leave alone, so an unreadable member there is a template
+* error, not a skip — and refusing after the table exists would create it only
+* to delete it again.
+*/
+function streamMemberRefusals(block) {
+	const refusals = [];
+	const policy = readStreamPolicy(block);
+	if (policy.kind === "unusable") refusals.push(policy.reason);
+	const tags = readStreamTags(block);
+	if (tags.kind === "unusable") refusals.push(tags.reason);
+	return refusals;
+}
+/**
+* The calls one update (or create) needs against the CURRENT stream arn.
+*
+* `freshStream` says the arn the calls will address was minted by THIS
+* operation — a create, an update-time enable, or the disable / re-enable a
+* `StreamViewType` change is applied as. A fresh stream holds nothing, so the
+* previous side is irrelevant there: every readable declared member is
+* applied, and nothing is deleted. Otherwise the stream is the one the previous
+* side was applied to, and the plan is the difference. `contentsUnknown` is
+* the third case: a live stream this operation did NOT mint and the previous
+* side does not describe (a re-run after a deploy that enabled the stream,
+* applied a policy, and failed before state recorded any of it). It may hold a
+* policy, so it is never planned as empty: a policy the desired side does not
+* declare is deleted, and a declared one is always put.
+*
+* On a stream the previous side describes:
+*
+* - a member `absent` with a DECLARED previous is a template REMOVAL and is
+*   removed (CloudFormation does the same). Because the rule is symmetric in
+*   its two sides, a rollback — which replays `update()` with the sides SWAPPED
+*   — restores the old policy and tags through the same arms, a view-type
+*   change included (the rollback mints yet another arn, and `freshStream`
+*   applies the old members to it).
+* - an `unusable` member reaches this plan only from a STATE-borne caller (a
+*   rollback replay, `drift --revert`): the provider refuses it on the template
+*   path before any call. It reports through `onUnusable` and the live setting
+*   is left alone rather than overwritten with a guess: no call on a stream
+*   that stays, and the PREVIOUS member carried over onto a fresh one.
+* - an `unusable` PREVIOUS tag list cannot say which keys cdkd applied, so a
+*   removal against it untags nothing.
+*
+* ORDER is part of the contract, because a resource policy is an access grant
+* and can condition on `aws:ResourceTag`: `deletePolicy` comes FIRST and
+* `putPolicy` LAST. A policy that CHANGES together with the tags is therefore
+* deleted before the first tag call and put back after the last, so neither
+* the old policy nor the new one is ever evaluated against the other side's
+* tag set — also when a call in between fails. The price is a window with NO
+* policy, which drops that policy's `Deny` statements along with its grants;
+* nothing here is atomic, and that window is the narrower of the two hazards.
+* An UNCHANGED policy stays in place across a tag-only change: both sides
+* declare it, and the two tag calls cannot be made one.
+*
+* The caller asks only while the DESIRED side has a stream: a disabled stream
+* is gone and takes both members with it, so nothing addresses its dead arn.
+*/
+function planStreamMemberOps(desiredBlock, previousBlock, options, onUnusable) {
+	let desiredPolicy = readStreamPolicy(desiredBlock);
+	let desiredTags = readStreamTags(desiredBlock);
+	if (desiredPolicy.kind === "unusable") onUnusable(desiredPolicy.reason);
+	if (desiredTags.kind === "unusable") onUnusable(desiredTags.reason);
+	let previousPolicy = readStreamPolicy(previousBlock);
+	let previousTags = readStreamTags(previousBlock);
+	if (options.freshStream) {
+		if (desiredPolicy.kind === "unusable" && previousPolicy.kind === "usable") desiredPolicy = previousPolicy;
+		if (desiredTags.kind === "unusable" && previousTags.kind === "usable") desiredTags = previousTags;
+		previousPolicy = { kind: "absent" };
+		previousTags = { kind: "absent" };
+	} else if (options.contentsUnknown === true) {
+		previousPolicy = {
+			kind: "unusable",
+			reason: ""
+		};
+		previousTags = { kind: "absent" };
+	}
+	const tagOps = [];
+	if (desiredTags.kind !== "unusable") {
+		const desired = desiredTags.kind === "usable" ? desiredTags.tags : /* @__PURE__ */ new Map();
+		const previous = previousTags.kind === "usable" ? previousTags.tags : /* @__PURE__ */ new Map();
+		const keysToRemove = [...previous.keys()].filter((key) => !desired.has(key));
+		if (keysToRemove.length > 0) tagOps.push({
+			kind: "untag",
+			keys: keysToRemove
+		});
+		const tagsToSet = [...desired].filter(([key, value]) => previous.get(key) !== value).map(([Key, Value]) => ({
+			Key,
+			Value
+		}));
+		if (tagsToSet.length > 0) tagOps.push({
+			kind: "tag",
+			tags: tagsToSet
+		});
+	}
+	const policyPut = desiredPolicy.kind === "usable" && !(previousPolicy.kind === "usable" && samePolicyDocument(previousPolicy.document, desiredPolicy.document));
+	const policyDelete = previousPolicy.kind !== "absent" && (desiredPolicy.kind === "absent" || policyPut && tagOps.length > 0);
+	const ops = [];
+	if (policyDelete) ops.push({ kind: "deletePolicy" });
+	ops.push(...tagOps);
+	if (policyPut && desiredPolicy.kind === "usable") ops.push({
+		kind: "putPolicy",
+		document: desiredPolicy.document
+	});
+	return ops;
+}
+/** Two policy JSON strings saying the same thing, whatever their key order. */
+function samePolicyDocument(left, right) {
+	if (left === right) return true;
+	try {
+		return canonicalJson$1(JSON.parse(left)) === canonicalJson$1(JSON.parse(right));
+	} catch {
+		return false;
+	}
+}
+/** The drift read-back gates: one API call each, so each is asked separately. */
+function streamDeclaresPolicy(desiredBlock) {
+	return readStreamPolicy(desiredBlock).kind === "usable";
+}
+/** See {@link streamDeclaresPolicy}. */
+function streamDeclaresTags(desiredBlock) {
+	return readStreamTags(desiredBlock).kind === "usable";
+}
+/**
+* Re-shape a `GetResourcePolicy` answer into the CFn member, in the DECLARED
+* spelling of `PolicyDocument`: a template may carry the document as an object
+* or as a JSON string, and the comparator does not convert between them.
+* `undefined` when AWS holds no policy.
+*/
+function reverseMapStreamPolicy(livePolicy, desiredBlock) {
+	if (livePolicy === void 0 || livePolicy === "") return void 0;
+	const declared = blockMembers(blockMembers(desiredBlock)[STREAM_POLICY_KEY])["PolicyDocument"];
+	let parsed;
+	try {
+		parsed = JSON.parse(livePolicy);
+	} catch {
+		return { PolicyDocument: livePolicy };
+	}
+	if (typeof declared !== "string") return { PolicyDocument: parsed };
+	let declaredParsed;
+	try {
+		declaredParsed = JSON.parse(declared);
+	} catch {
+		return { PolicyDocument: livePolicy };
+	}
+	return { PolicyDocument: canonicalJson$1(declaredParsed) === canonicalJson$1(parsed) ? declared : livePolicy };
+}
+/**
+* Does the live policy say what the DECLARED one says? The read-back's
+* "settled" test: `GetResourcePolicy` is eventually consistent and can answer
+* with the PREVIOUS policy right after a put, so an answer that differs from
+* the declaration is re-asked before it is believed.
+*/
+function streamPolicyMatchesDeclared(livePolicy, desiredBlock) {
+	const declared = readStreamPolicy(desiredBlock);
+	if (declared.kind !== "usable" || livePolicy === void 0) return false;
+	try {
+		return canonicalJson$1(JSON.parse(livePolicy)) === canonicalJson$1(JSON.parse(declared.document));
+	} catch {
+		return false;
+	}
+}
+/** The tag twin of {@link streamPolicyMatchesDeclared}, over USER tags. */
+function streamTagsMatchDeclared(liveTags, desiredBlock) {
+	const declared = readStreamTags(desiredBlock);
+	if (declared.kind !== "usable" || liveTags.length !== declared.tags.size) return false;
+	return liveTags.every((tag) => declared.tags.get(tag.Key) === tag.Value);
+}
+/** A key-order-independent serialization. */
+function canonicalJson$1(value) {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson$1).join(",")}]`;
+	if (isPlainObject$1(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$1(value[key])}`).join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+}
+
 //#endregion
 //#region src/provisioning/dynamodb-index-busy-delete.ts
 /**
@@ -18767,16 +19272,10 @@ function warmThroughputAlreadyMatches(desired, live) {
 * to decide with and every block is emitted, cleaned of its AWS-managed
 * members.
 *
-* Known residual, unchanged by this fix: CFn's per-index
-* `ContributorInsightsSpecification` has no `DescribeTable` counterpart (it
-* needs a per-index `DescribeContributorInsights` call), so a template
-* declaring one still cannot converge against a `properties` baseline. It is
-* ALSO dropped on the write side, since `create()` forwards the CFn blob to
-* `CreateTable` and the SDK serializer discards the unknown member — still
-* true after round 6 taught that path to coerce `WarmThroughput`, because the
-* entry is rebuilt with a SPREAD and every other member, known or not, rides
-* along unchanged. Filed as issue
-* [#1782](https://github.com/go-to-k/cdkd/issues/1782).
+* CFn's per-index `ContributorInsightsSpecification` is NOT mapped here: it
+* has no `DescribeTable` counterpart, so `readCurrentState` adds it afterwards
+* from a gated per-index `DescribeContributorInsights` (issue
+* [#1782](https://github.com/go-to-k/cdkd/issues/1782)).
 */
 function reverseMapSecondaryIndex(live, desired, bagInformative) {
 	const out = {};
@@ -19042,6 +19541,12 @@ var DynamoDBTableProvider = class {
 		let tableCreated = false;
 		try {
 			const billingMode = requireConfigString(properties["BillingMode"], "PROVISIONED", "AWS::DynamoDB::Table BillingMode", replayWarn(this.logger, context));
+			if (context?.replayingState !== true) {
+				const [refusal] = contributorInsightsRefusals(properties["ContributorInsightsSpecification"], properties["GlobalSecondaryIndexes"]);
+				if (refusal !== void 0) throw new Error(`${refusal}. Fix the template value`);
+				const [streamRefusal] = streamMemberRefusals(properties["StreamSpecification"]);
+				if (streamRefusal !== void 0) throw new Error(`${streamRefusal}. Fix the template value`);
+			}
 			const createParams = {
 				TableName: tableName,
 				KeySchema: keySchema,
@@ -19066,7 +19571,7 @@ var DynamoDBTableProvider = class {
 			};
 			if (properties["GlobalSecondaryIndexes"]) {
 				const declaredGsis = properties["GlobalSecondaryIndexes"];
-				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexThroughputForCreate(logicalId, entry, maskSecrets)) : declaredGsis;
+				createParams.GlobalSecondaryIndexes = Array.isArray(declaredGsis) ? declaredGsis.map((entry) => this.coerceIndexThroughputForCreate(logicalId, stripIndexContributorInsights(entry), maskSecrets)) : declaredGsis;
 			}
 			if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
 			const sse = mapSSESpecification(properties["SSESpecification"]);
@@ -19083,7 +19588,9 @@ var DynamoDBTableProvider = class {
 			await this.applyPointInTimeRecovery(tableName, properties["PointInTimeRecoverySpecification"], void 0, maskSecrets);
 			await this.applyTimeToLive(tableName, properties["TimeToLiveSpecification"]);
 			await this.applyKinesisStreamingDestination(tableName, properties["KinesisStreamSpecification"], void 0, maskSecrets);
-			await this.applyContributorInsights(tableName, properties["ContributorInsightsSpecification"]);
+			await this.applyContributorInsights(tableName, properties["ContributorInsightsSpecification"], void 0, maskSecrets);
+			await this.applyIndexContributorInsights(tableName, properties["GlobalSecondaryIndexes"], void 0, maskSecrets);
+			await this.applyStreamMembers(logicalId, resourceType, tableName, tableInfo.streamArn, properties["StreamSpecification"], void 0, true, maskSecrets);
 			this.logger.debug(`Successfully created DynamoDB table ${logicalId}: ${tableName}`);
 			return {
 				physicalId: tableName,
@@ -19119,6 +19626,10 @@ var DynamoDBTableProvider = class {
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		debug(`Updating DynamoDB table ${logicalId}: ${maskSecrets(physicalId)}`);
 		try {
+			if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true && JSON.stringify(properties["StreamSpecification"]) !== JSON.stringify(previousProperties["StreamSpecification"])) {
+				const [streamRefusal] = streamMemberRefusals(properties["StreamSpecification"]);
+				if (streamRefusal !== void 0) throw new ProvisioningError(`${streamRefusal}. Nothing was applied to DynamoDB table ${logicalId}; fix the template value`, resourceType, logicalId, physicalId);
+			}
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
 			let latestStreamArn = table?.LatestStreamArn;
 			if (table?.TableArn) await this.applyTagDiff(table.TableArn, previousProperties["Tags"], properties["Tags"]);
@@ -19270,6 +19781,10 @@ var DynamoDBTableProvider = class {
 			if (JSON.stringify(properties["StreamSpecification"]) !== JSON.stringify(previousProperties["StreamSpecification"])) {
 				const newViewType = this.extractStreamViewType(properties["StreamSpecification"]);
 				const prevViewType = this.extractStreamViewType(previousProperties["StreamSpecification"]);
+				const liveStream = table?.StreamSpecification;
+				const preUpdateStreamArn = table?.LatestStreamArn;
+				let mintedStream = false;
+				let contentsUnknown = false;
 				if (newViewType && prevViewType && newViewType !== prevViewType) {
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
@@ -19284,9 +19799,11 @@ var DynamoDBTableProvider = class {
 						}
 					}));
 					await this.waitForTableActiveAfterUpdate(physicalId);
-					latestStreamArn = reenable.TableDescription?.LatestStreamArn ?? await this.describeLatestStreamArn(physicalId);
+					latestStreamArn = await this.resolveMintedStreamArn(physicalId, reenable.TableDescription?.LatestStreamArn, preUpdateStreamArn);
+					mintedStream = true;
 					this.logger.debug(`Changed StreamViewType on DynamoDB table ${physicalId} to ${newViewType}`);
-				} else if (newViewType) {
+				} else if (newViewType && liveStream?.StreamEnabled === true && liveStream.StreamViewType === newViewType) contentsUnknown = prevViewType !== newViewType;
+				else if (newViewType) {
 					const enable = await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						StreamSpecification: {
@@ -19295,7 +19812,8 @@ var DynamoDBTableProvider = class {
 						}
 					}));
 					await this.waitForTableActiveAfterUpdate(physicalId);
-					latestStreamArn = enable.TableDescription?.LatestStreamArn ?? await this.describeLatestStreamArn(physicalId);
+					latestStreamArn = await this.resolveMintedStreamArn(physicalId, enable.TableDescription?.LatestStreamArn, preUpdateStreamArn);
+					mintedStream = true;
 					this.logger.debug(`Enabled DynamoDB Stream on table ${physicalId} (${newViewType})`);
 				} else {
 					await this.dynamoDBClient.send(new UpdateTableCommand({
@@ -19306,6 +19824,7 @@ var DynamoDBTableProvider = class {
 					latestStreamArn = void 0;
 					this.logger.debug(`Disabled DynamoDB Stream on table ${physicalId}`);
 				}
+				if (newViewType) await this.applyStreamMembers(logicalId, resourceType, physicalId, latestStreamArn, properties["StreamSpecification"], previousProperties["StreamSpecification"], mintedStream, maskSecrets, mintedStream ? preUpdateStreamArn : void 0, contentsUnknown);
 			}
 			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, effectiveBillingMode === "PAY_PER_REQUEST", maskSecrets);
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"], maskSecrets);
@@ -19318,7 +19837,8 @@ var DynamoDBTableProvider = class {
 				await this.applyResourcePolicy(table.TableArn, properties["ResourcePolicy"], previousProperties["ResourcePolicy"]);
 			}
 			if (JSON.stringify(properties["KinesisStreamSpecification"]) !== JSON.stringify(previousProperties["KinesisStreamSpecification"])) await this.applyKinesisStreamingDestination(physicalId, properties["KinesisStreamSpecification"], previousProperties["KinesisStreamSpecification"], maskSecrets);
-			if (JSON.stringify(properties["ContributorInsightsSpecification"]) !== JSON.stringify(previousProperties["ContributorInsightsSpecification"])) await this.applyContributorInsights(physicalId, properties["ContributorInsightsSpecification"], previousProperties["ContributorInsightsSpecification"]);
+			if (JSON.stringify(properties["ContributorInsightsSpecification"]) !== JSON.stringify(previousProperties["ContributorInsightsSpecification"])) await this.applyContributorInsights(physicalId, properties["ContributorInsightsSpecification"], previousProperties["ContributorInsightsSpecification"], maskSecrets);
+			await this.applyIndexContributorInsights(physicalId, properties["GlobalSecondaryIndexes"], previousProperties["GlobalSecondaryIndexes"], maskSecrets);
 			return {
 				physicalId,
 				wasReplaced: false,
@@ -19535,15 +20055,16 @@ var DynamoDBTableProvider = class {
 	* Backoff: ~2s,4s,8s,16s,30s,30s... bounded to ~2min total, which comfortably
 	* covers the few-second PITR-enable window.
 	*/
-	async retryOnTransientControlPlane(op, label, maxAttempts = 8) {
+	async retryOnTransientControlPlane(op, label, maxAttempts = 8, options = {}) {
 		let delayMs = 2e3;
 		for (let attempt = 1;; attempt++) try {
 			return await op();
 		} catch (error) {
 			const msg = describeAwsFailure(error).detail;
 			const name = error instanceof Error ? error.name : "";
-			if (!(/being enabled|being updated|please retry later|backups are being/i.test(msg) || name === "ResourceInUseException" || name === "LimitExceededException") || attempt >= maxAttempts) throw error;
-			this.logger.debug(`Transient error on "${label}" (attempt ${attempt}/${maxAttempts}): ${msg} — retrying in ${delayMs}ms`);
+			if (!(/being enabled|being updated|please retry later|backups are being/i.test(msg) || name === "ResourceInUseException" || name === "LimitExceededException" || options.alsoTransient?.(error) === true) || attempt >= maxAttempts) throw error;
+			const retryLine = `Transient error on "${label}" (attempt ${attempt}/${maxAttempts}): ${msg} — retrying in ${delayMs}ms`;
+			this.logger.debug(options.maskSecrets ? options.maskSecrets(retryLine) : retryLine);
 			await new Promise((resolve) => setTimeout(resolve, delayMs));
 			delayMs = Math.min(delayMs * 2, 3e4);
 		}
@@ -19719,6 +20240,90 @@ var DynamoDBTableProvider = class {
 		return typeof viewType === "string" && viewType.length > 0 ? viewType : void 0;
 	}
 	/**
+	* Apply `StreamSpecification.ResourcePolicy` / `.Tags` (issue
+	* [#3458](https://github.com/go-to-k/cdkd/issues/3458)) against the STREAM
+	* arn. Neither is a member of the SDK's `StreamSpecification`, so until this
+	* existed both were dropped on `CreateTable` / `UpdateTable`: the deploy was
+	* green and the stream had no policy.
+	*
+	* `streamArn` must be the table's CURRENT `LatestStreamArn` — after a
+	* `StreamViewType` change that is the arn the re-enable minted, never the
+	* recorded one. What to call, in which order, and the removal / rollback /
+	* unreadable-member rules live on {@link planStreamMemberOps}.
+	*
+	* A plan with calls to make and no arn to make them against — or, when this
+	* operation minted the stream, only the `deadStreamArn` read before it —
+	* fails LOUDLY: a
+	* silent skip would record the policy in state as applied, the next deploy
+	* would see no difference, and the grant would stay missing for good.
+	*
+	* The policy text is never logged: it names principals and can carry a
+	* resolved secret in a condition value.
+	*/
+	async applyStreamMembers(logicalId, resourceType, tableName, streamArn, desiredBlock, previousBlock, freshStream, maskSecrets, deadStreamArn, contentsUnknown = false) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		const ops = planStreamMemberOps(desiredBlock, previousBlock, {
+			freshStream,
+			contentsUnknown
+		}, (reason) => warn(`DynamoDB table ${tableName}: ${reason}, so that member of the stream was left as it is. The value came from a recorded state, which a template edit cannot reach.`));
+		if (ops.length === 0) return;
+		if (streamArn === void 0 || streamArn === "" || streamArn === deadStreamArn) throw new ProvisioningError(`Cannot apply StreamSpecification.ResourcePolicy / Tags for DynamoDB table ${logicalId}: DescribeTable returned no ${deadStreamArn === void 0 ? "" : "new "}LatestStreamArn`, resourceType, logicalId, tableName);
+		for (const op of ops) {
+			await this.sendStreamMemberOp(streamArn, op, freshStream, maskSecrets);
+			debug(`Applied ${op.kind} to the stream of DynamoDB table ${tableName}`);
+		}
+	}
+	/** Issue ONE {@link StreamMemberOp} against the stream arn. */
+	async sendStreamMemberOp(streamArn, op, freshStream, maskSecrets) {
+		const target = maskSecrets(streamArn);
+		const retryOptions = {
+			maskSecrets,
+			...freshStream ? { alsoTransient: (error) => error instanceof ResourceNotFoundException$1 } : {}
+		};
+		const send = (call, label) => this.retryOnTransientControlPlane(call, label, void 0, retryOptions);
+		switch (op.kind) {
+			case "deletePolicy":
+				try {
+					await send(() => this.dynamoDBClient.send(new DeleteResourcePolicyCommand({ ResourceArn: streamArn })), `delete the stream ResourcePolicy of ${target}`);
+				} catch (error) {
+					if (!(error instanceof PolicyNotFoundException)) throw error;
+				}
+				return;
+			case "untag":
+				await send(() => this.dynamoDBClient.send(new UntagResourceCommand$2({
+					ResourceArn: streamArn,
+					TagKeys: op.keys
+				})), `untag the stream ${target}`);
+				return;
+			case "tag":
+				await send(() => this.dynamoDBClient.send(new TagResourceCommand$2({
+					ResourceArn: streamArn,
+					Tags: op.tags
+				})), `tag the stream ${target}`);
+				return;
+			case "putPolicy":
+				await send(() => this.dynamoDBClient.send(new PutResourcePolicyCommand({
+					ResourceArn: streamArn,
+					Policy: op.document
+				})), `put the stream ResourcePolicy of ${target}`);
+				return;
+		}
+	}
+	/**
+	* The arn of the stream an enabling `UpdateTable` just minted.
+	*
+	* The arn that call echoes is believed only when it DIFFERS from the one read
+	* before the update: DynamoDB keeps reporting a disabled stream's arn as
+	* `LatestStreamArn`, so an echo equal to it (or no echo) is re-read from
+	* `DescribeTable` after the ACTIVE wait. Shared by the enable and the
+	* view-type arms — a table whose stream was disabled by an earlier deploy is
+	* in the same state as one mid view-type change.
+	*/
+	async resolveMintedStreamArn(tableName, echoedArn, preUpdateArn) {
+		return echoedArn !== void 0 && echoedArn !== preUpdateArn ? echoedArn : this.describeLatestStreamArn(tableName);
+	}
+	/**
 	* Fetch the table's current `LatestStreamArn` via DescribeTable. Used as a
 	* fallback when an UpdateTable that enabled a stream did not echo the ARN
 	* back in its TableDescription, so `Fn::GetAtt [Table, StreamArn]` still
@@ -19734,24 +20339,53 @@ var DynamoDBTableProvider = class {
 	*
 	* Called from both `create()` (after the table is ACTIVE) and `update()`
 	* (only when the value changed). On `update()`-side removal — template drops
-	* the block but it was present before — insights is disabled.
+	* the block but it was present before — insights is disabled. The block is
+	* read by the reader the per-index twin uses
+	* ({@link applyIndexContributorInsights}), so the two cannot disagree about
+	* one shape: an unreadable block is announced and SKIPPED rather than read as
+	* a default (`Boolean('false')` used to ENABLE what the template disabled).
 	*/
-	async applyContributorInsights(tableName, spec, previousSpec) {
-		let action;
-		let mode;
-		if (spec !== void 0 && spec !== null) {
-			const s = spec;
-			const enabled = Boolean(s["Enabled"]);
-			action = enabled ? "ENABLE" : "DISABLE";
-			if (enabled && s["Mode"] !== void 0) mode = s["Mode"];
-		} else if (previousSpec !== void 0 && previousSpec !== null) action = "DISABLE";
-		if (action === void 0) return;
+	async applyContributorInsights(tableName, spec, previousSpec, maskSecrets) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const op = planContributorInsightsOp(readContributorInsightsSpec(spec, CONTRIBUTOR_INSIGHTS_KEY), readContributorInsightsSpec(previousSpec, CONTRIBUTOR_INSIGHTS_KEY), (reason) => warn(`DynamoDB table ${tableName}: ${reason}, so Contributor Insights was left as it is. Fix the template value and re-deploy.`));
+		if (op === void 0) return;
+		await this.sendContributorInsightsOp(tableName, op, maskSecrets);
+	}
+	/**
+	* Apply every per-index `ContributorInsightsSpecification`
+	* (`GlobalSecondaryIndexes[].ContributorInsightsSpecification`, issue
+	* [#1782](https://github.com/go-to-k/cdkd/issues/1782)) — the table-level
+	* call with `IndexName` added, one call per index whose block changed.
+	*
+	* The block is not a member of the SDK's `GlobalSecondaryIndex`, so until
+	* this existed it was dropped by the serializer on `CreateTable` and never
+	* sent by `applyGsiUpdates`: the deploy was green and the feature was off.
+	*
+	* `UpdateContributorInsights` answers `ResourceNotFoundException` for an
+	* index that is not ACTIVE yet, which {@link retryOnTransientControlPlane}
+	* does not retry, so the index wait runs FIRST — and only when there is a
+	* call to make, so an ordinary update pays no extra `DescribeTable`.
+	* `previousIndexes` is `undefined` on `create()`. Removal and rollback
+	* semantics live on {@link planContributorInsightsOp}.
+	*/
+	async applyIndexContributorInsights(tableName, desiredIndexes, previousIndexes, maskSecrets) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const ops = planIndexContributorInsightsOps(desiredIndexes, previousIndexes, (indexName, reason) => warn(`${this.indexScopeAt(indexName, tableName, maskSecrets)}: ${reason}, so its Contributor Insights was left as it is. Fix the template value and re-deploy.`));
+		if (ops.length === 0) return;
+		await this.waitForTableAndIndexesActive(tableName);
+		for (const op of ops) await this.sendContributorInsightsOp(tableName, op, maskSecrets);
+	}
+	/** Issue ONE `UpdateContributorInsights`, against the table or one index. */
+	async sendContributorInsightsOp(tableName, op, maskSecrets) {
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		const target = op.indexName === void 0 ? `DynamoDB table ${tableName}` : this.indexScopeAt(op.indexName, tableName, maskSecrets);
 		await this.retryOnTransientControlPlane(() => this.dynamoDBClient.send(new UpdateContributorInsightsCommand({
 			TableName: tableName,
-			ContributorInsightsAction: action,
-			...mode ? { ContributorInsightsMode: mode } : {}
-		})), `set ContributorInsights on ${tableName}`);
-		this.logger.debug(`Set ContributorInsightsAction=${action}${mode !== void 0 ? ` Mode=${mode}` : ""} on DynamoDB table ${tableName}`);
+			...op.indexName !== void 0 ? { IndexName: op.indexName } : {},
+			ContributorInsightsAction: op.action,
+			...op.mode !== void 0 ? { ContributorInsightsMode: op.mode } : {}
+		})), `set ContributorInsights on ${target}`);
+		debug(`Set ContributorInsightsAction=${op.action}${op.mode !== void 0 ? ` Mode=${op.mode}` : ""} on ${target}`);
 	}
 	/**
 	* Poll DescribeTable until the table reaches ACTIVE status
@@ -20732,32 +21366,35 @@ var DynamoDBTableProvider = class {
 	* level: it is order-SIGNIFICANT (HASH before RANGE), so sorting it would
 	* HIDE a real key change rather than remove a phantom one.
 	*
-	* `GlobalSecondaryIndexes` / `LocalSecondaryIndexes` are NOT declared either,
-	* and that is a MECHANISM limit rather than a judgement about the lists —
-	* both really are sets keyed by `IndexName` (issue #1767 proposes declaring
-	* them). Every entry here is a SUBTREE declaration, and unlike
-	* `getDriftUnknownPaths` this walk DESCENDS INTO ARRAY ELEMENTS giving each
-	* the parent's path (`drift-normalize.ts`), so a `'GlobalSecondaryIndexes'`
-	* entry also reaches `GlobalSecondaryIndexes.KeySchema` and would sort the
-	* per-index key schema — reversing the sentence above at the index level
-	* only. Issue #1767 calls the sort and the member reverse-map separable;
-	* this change ships the reverse-map, and the ordering half needed a
-	* leaf-only form of the declaration first (issue
-	* [#1783](https://github.com/go-to-k/cdkd/issues/1783)). **That form now
-	* EXISTS** — `LEAF_ONLY_PATH_SUFFIX` (`[]`) landed in
-	* [#1799](https://github.com/go-to-k/cdkd/pull/1799), so
-	* `'GlobalSecondaryIndexes[]'` would claim the list alone without reaching
-	* the per-index `KeySchema`. It is deliberately NOT declared here yet:
-	* adopting it is its own change with its own real-AWS verification, tracked
-	* as issue [#1812](https://github.com/go-to-k/cdkd/issues/1812). Consequence
-	* until then, stated so it is not mistaken for solved: an index list AWS
-	* returns in a different ORDER than the template declared is still phantom
-	* drift against a `properties` baseline. It is not reachable on the ordinary
-	* `observedProperties` path, where both sides come from this same readback.
+	* `GlobalSecondaryIndexes` / `LocalSecondaryIndexes` ARE declared, in the
+	* LEAF-ONLY form (`LEAF_ONLY_PATH_SUFFIX`, `[]`, from
+	* [#1799](https://github.com/go-to-k/cdkd/pull/1799)): both are sets keyed
+	* by `IndexName`, and `DescribeTable` does not return them in the template's
+	* order. A plain SUBTREE entry would be wrong — the unordered walk descends
+	* into array elements giving each the parent's path (`drift-normalize.ts`),
+	* so `'GlobalSecondaryIndexes'` would also sort each index's `KeySchema` and
+	* reverse the sentence above at the index level. The leaf-only form sorts
+	* the list and stops there.
+	*
+	* Measured on real AWS by issue
+	* [#1782](https://github.com/go-to-k/cdkd/issues/1782)'s two-index fixture:
+	* a table created with `[giA, giB]` read back as `[giB, giA]`, so a
+	* `properties` baseline reported whole-list drift although every member
+	* round-tripped. The phantom pre-dates that issue — the #1767 arm only ever
+	* had ONE index — and was not reachable against an `observedProperties`
+	* baseline, where both sides come from the same readback. Both comparison
+	* sides are sorted, by a key-order-independent serialization of the whole
+	* entry, so a baseline captured in AWS's order by an earlier binary keeps
+	* converging; a REAL difference still reports the list, since entries that
+	* differ cannot be made equal by reordering them.
 	*/
 	getDriftUnorderedPaths(resourceType) {
 		if (resourceType !== "AWS::DynamoDB::Table") return [];
-		return ["AttributeDefinitions"];
+		return [
+			"AttributeDefinitions",
+			"GlobalSecondaryIndexes[]",
+			"LocalSecondaryIndexes[]"
+		];
 	}
 	/**
 	* `WarmThroughput` is reported by AWS for EVERY table, whether or not the
@@ -20873,9 +21510,12 @@ var DynamoDBTableProvider = class {
 	* shape differences are wrapping:
 	*  - BillingMode lives under `BillingModeSummary.BillingMode` in the API
 	*    response, but the CFn property is a flat `BillingMode` string.
-	*  - StreamSpecification's CFn shape includes only `StreamViewType`; the
-	*    API response carries `StreamEnabled` too. We surface both since the
-	*    drift comparator only descends into keys present in state.
+	*  - StreamSpecification's CFn shape is `StreamViewType`, `ResourcePolicy`
+	*    and `Tags`; the API response carries `StreamEnabled` and
+	*    `StreamViewType` only. `StreamEnabled` is surfaced too, since the
+	*    comparator descends a `properties` baseline by the keys state holds.
+	*    `ResourcePolicy` / `Tags` (issue #3458) live on the STREAM arn and are
+	*    read from it, each only when the desired block declares that member.
 	*  - GSI / LSI in the API response include `IndexStatus`, `Backfilling`,
 	*    `ItemCount`, `IndexArn` and sizing fields cdkd never sets. They used to
 	*    be forwarded VERBATIM under a comment claiming "the comparator filters
@@ -20902,7 +21542,9 @@ var DynamoDBTableProvider = class {
 	* caller passes). It is consulted for the table-level `WarmThroughput` — see
 	* {@link getDriftUnknownPaths} for the measurement and the reasoning — and,
 	* since issue #1767, for the per-index throughput blocks of each secondary
-	* index, matched by `IndexName`.
+	* index, matched by `IndexName`. Since issue #1782 it also gates the per-index
+	* `ContributorInsightsSpecification` read, which costs one
+	* `DescribeContributorInsights` per declaring index.
 	*/
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
 		try {
@@ -20929,10 +21571,14 @@ var DynamoDBTableProvider = class {
 				if (table.WarmThroughput.WriteUnitsPerSecond !== void 0) wt["WriteUnitsPerSecond"] = table.WarmThroughput.WriteUnitsPerSecond;
 				if (Object.keys(wt).length > 0) result["WarmThroughput"] = wt;
 			}
-			if (table.StreamSpecification?.StreamEnabled && table.StreamSpecification.StreamViewType) result["StreamSpecification"] = {
-				StreamEnabled: true,
-				StreamViewType: table.StreamSpecification.StreamViewType
-			};
+			if (table.StreamSpecification?.StreamEnabled && table.StreamSpecification.StreamViewType) {
+				const streamBlock = {
+					StreamEnabled: true,
+					StreamViewType: table.StreamSpecification.StreamViewType
+				};
+				result["StreamSpecification"] = streamBlock;
+				await this.readStreamMembers(physicalId, table.LatestStreamArn, properties?.["StreamSpecification"], streamBlock);
+			}
 			const bagInformative = desiredBagIsInformative(properties);
 			if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) {
 				const desiredByName = desiredIndexEntriesByName(properties?.["GlobalSecondaryIndexes"]);
@@ -21001,15 +21647,31 @@ var DynamoDBTableProvider = class {
 			}
 			try {
 				const ciResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({ TableName: physicalId }));
-				const status = ciResp.ContributorInsightsStatus;
-				if (status === "ENABLED" || status === "DISABLED") {
-					const cspec = { Enabled: status === "ENABLED" };
-					if (status === "ENABLED" && ciResp.ContributorInsightsMode !== void 0) cspec["Mode"] = ciResp.ContributorInsightsMode;
-					result["ContributorInsightsSpecification"] = cspec;
-				}
+				const cspec = reverseMapTableContributorInsights(ciResp.ContributorInsightsStatus, ciResp.ContributorInsightsMode);
+				if (cspec !== void 0) result["ContributorInsightsSpecification"] = cspec;
 			} catch (err) {
 				this.logger.debug(`Could not read ContributorInsights for ${physicalId}: ${describeAwsFailure(err).detail}`);
 			}
+			const emittedGsis = result["GlobalSecondaryIndexes"];
+			if (bagInformative && Array.isArray(emittedGsis)) {
+				const desiredByName = desiredIndexEntriesByName(properties?.["GlobalSecondaryIndexes"]);
+				for (const emitted of emittedGsis) {
+					const indexName = emitted["IndexName"];
+					if (typeof indexName !== "string") continue;
+					const desiredEntry = desiredByName.get(indexName);
+					if (!indexDeclaresContributorInsights(desiredEntry)) continue;
+					try {
+						const indexResp = await this.dynamoDBClient.send(new DescribeContributorInsightsCommand({
+							TableName: physicalId,
+							IndexName: indexName
+						}));
+						const block = reverseMapIndexContributorInsights(indexResp.ContributorInsightsStatus, indexResp.ContributorInsightsMode, desiredEntry?.[CONTRIBUTOR_INSIGHTS_KEY]);
+						if (block !== void 0) emitted[CONTRIBUTOR_INSIGHTS_KEY] = block;
+					} catch (err) {
+						this.logger.debug(`Could not read ContributorInsights for index ${indexName} of ${physicalId}: ${describeAwsFailure(err).detail}`);
+					}
+				}
+			}
 			return result;
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$1) return void 0;
@@ -21017,6 +21679,92 @@ var DynamoDBTableProvider = class {
 		}
 	}
 	/**
+	* How long an eventually-consistent stream-member read that does NOT match
+	* the declaration is re-asked before it is believed: one entry per extra
+	* attempt.
+	*/
+	streamMemberRereadDelaysMs = [
+		500,
+		1e3,
+		2e3
+	];
+	/** Run `read`, re-asking after each configured delay until `settled` accepts the answer. */
+	async reAskUntilSettled(read, settled) {
+		let answer = await read();
+		for (const delayMs of this.streamMemberRereadDelaysMs) {
+			if (settled(answer)) break;
+			await new Promise((resolve) => setTimeout(resolve, delayMs));
+			answer = await read();
+		}
+		return answer;
+	}
+	/**
+	* Read `StreamSpecification.ResourcePolicy` / `.Tags` (issue #3458) off the
+	* table's CURRENT stream arn into `streamBlock`.
+	*
+	* One API call per member, so each is GATED on the desired block declaring a
+	* member cdkd would send — the same reader the write plan runs. The gate is
+	* also what keeps an undeclared member out of an `observedProperties`
+	* baseline, which is compared by the UNION of both sides' keys.
+	*
+	* No policy (`PolicyNotFoundException`) and an empty user tag set emit
+	* NOTHING: that is "absent" in the template's own spelling, which a
+	* declared member then reports as drift (a declared EMPTY list is the one
+	* exception, and reads back as the empty list it is). `aws:`-prefixed system tags are
+	* dropped like the table-level ones, and the list needs no unordered path —
+	* the comparator sorts every `{Key, ...}` list on both sides. Any other
+	* failed read omits the member and says why at debug level, like the sibling
+	* reads of this method.
+	*
+	* Both reads are EVENTUALLY consistent — right after a write they can answer
+	* "absent" or with the PREVIOUS value (their command docs say so) — and the
+	* deploy captures `observedProperties` right after the writes. So an answer
+	* that does not match the DECLARED member is re-asked a few times before it
+	* is believed, or a lagging read would freeze a baseline the settled stream
+	* can never equal. A member that really drifted costs those few seconds per
+	* drift run.
+	*
+	* `cdkd drift --revert` replays through `update()`, where the read-back is
+	* the PREVIOUS side and {@link planStreamMemberOps} derives the restore.
+	*/
+	async readStreamMembers(tableName, streamArn, desiredBlock, streamBlock) {
+		if (streamArn === void 0 || streamArn === "") return;
+		if (streamDeclaresPolicy(desiredBlock)) try {
+			const livePolicy = await this.reAskUntilSettled(async () => {
+				try {
+					return (await this.dynamoDBClient.send(new GetResourcePolicyCommand({ ResourceArn: streamArn }))).Policy;
+				} catch (err) {
+					if (err instanceof PolicyNotFoundException) return void 0;
+					throw err;
+				}
+			}, (answer) => streamPolicyMatchesDeclared(answer, desiredBlock));
+			const member = reverseMapStreamPolicy(livePolicy, desiredBlock);
+			if (member !== void 0) streamBlock[STREAM_POLICY_KEY] = member;
+		} catch (err) {
+			this.logger.debug(`Could not read the stream ResourcePolicy for ${tableName}: ${describeAwsFailure(err).detail}`);
+		}
+		if (streamDeclaresTags(desiredBlock)) try {
+			const listOnce = async () => {
+				const liveTags = [];
+				let nextToken;
+				do {
+					const response = await this.dynamoDBClient.send(new ListTagsOfResourceCommand({
+						ResourceArn: streamArn,
+						NextToken: nextToken
+					}));
+					liveTags.push(...response.Tags ?? []);
+					nextToken = response.NextToken;
+				} while (nextToken !== void 0 && nextToken !== "");
+				return normalizeAwsTagsToCfn(liveTags);
+			};
+			const tags = await this.reAskUntilSettled(listOnce, (answer) => streamTagsMatchDeclared(answer, desiredBlock));
+			const declared = desiredBlock[STREAM_TAGS_KEY];
+			if (tags.length > 0 || Array.isArray(declared) && declared.length === 0) streamBlock[STREAM_TAGS_KEY] = tags;
+		} catch (err) {
+			this.logger.debug(`Could not read the stream Tags for ${tableName}: ${describeAwsFailure(err).detail}`);
+		}
+	}
+	/**
 	* Adopt an existing DynamoDB table into cdkd state.
 	*
 	* Lookup order:
@@ -84981,8 +85729,394 @@ function createForceUnlockCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/cli/commands/import-deployed-parameters.ts
+/**
+* UNVERIFIABLE INPUTS for `cdkd import`'s observed-baseline refusal (issue
+* [#2854](https://github.com/go-to-k/cdkd/issues/2854)).
+*
+* `cdkd import` accepts no parameter values, so every template parameter is
+* bound to its `Default`. When the resources were deployed by a CloudFormation
+* stack, the value CloudFormation actually used can differ — and the ordinary
+* secret-carrying shape is a placeholder `Default` (`CHANGEME`) over a DEPLOYED
+* value of `{{resolve:secretsmanager:...}}`. The persisted `properties` then
+* spell no reference anywhere, the position-based redaction of the observed
+* capture has no evidence, and the decrypted readback would be persisted.
+*
+* The remedy here is deliberately PREMISE-INDEPENDENT. It never looks for a
+* `{{resolve:` opener in what `DescribeStacks` returns (AWS documents
+* `ParameterValue` as "the input value", which says the reference comes back
+* literally, but nothing in this module relies on it). It asks one question —
+* "is the deployed value PROVABLY the value this import bound?" — and treats
+* every other answer as divergent: a literal reference, the `****` a `NoEcho`
+* parameter is masked to, a value AWS resolved, a parameter missing from the
+* response, a `DescribeStacks` that failed. All of those differ from the bound
+* placeholder, so all of them refuse.
+*
+* THE DEPLOYED VALUES ARE COMPARISON-ONLY. They are never bound into the
+* resolve, never logged, never put in an error message, and never persisted:
+* binding them is the one design that would leak if AWS ever returned a
+* resolved value. {@link DeployedParameters} holds them in a `#private` field so
+* that a stray `JSON.stringify` / `util.inspect` / template literal of the
+* object renders nothing, and an SDK failure is reported by its error NAME
+* alone, because an SDK message can echo request input.
+*
+* TAINT THROUGH ANOTHER RESOURCE'S ATTRIBUTES IS FOLLOWED within one stack: the
+* walk records the target of every `Fn::GetAtt` / `${A.Attr}`, and the caller
+* closes the refused set over those targets, so a resource reading an attribute
+* of a refused resource (`{Fn::GetAtt: [SsmParam, Value]}` into a Lambda
+* environment — what CDK's `param.stringValue` emits) is refused with it. A
+* plain `Ref` of a resource is NOT followed: it yields the physical id, and a
+* secret used as a resource NAME is already disclosed by the identifier itself.
+*
+* KNOWN RESIDUAL, not followed: taint ACROSS the nested-stack boundary. A
+* parent property reading `Fn::GetAtt: [Child, Outputs.X]`, where the child's
+* output derives from a divergent CHILD parameter, is judged on the parent's
+* own parameters only — the root is resolved before any child is read.
+*/
+/**
+* What CloudFormation reports a stack was deployed with. Opaque on purpose:
+* the only question it answers is {@link DeployedParameters.provablyEquals}.
+*/
+var DeployedParameters = class DeployedParameters {
+	#entries;
+	constructor(entries) {
+		this.#entries = entries;
+	}
+	/** `DescribeStacks` answered; `entries` is its `Parameters` list. */
+	static fromDescribeStacks(parameters) {
+		const entries = /* @__PURE__ */ new Map();
+		for (const parameter of parameters) {
+			if (typeof parameter.ParameterKey !== "string") continue;
+			entries.set(parameter.ParameterKey, {
+				value: parameter.ParameterValue,
+				resolvedValue: parameter.ResolvedValue
+			});
+		}
+		return new DeployedParameters(entries);
+	}
+	/** The deployed values could not be read: NOTHING is provable. */
+	static unavailable() {
+		return new DeployedParameters(void 0);
+	}
+	/**
+	* Whether the deployed value of `name` is provably the value the import
+	* BOUND. The deployed string goes through the SAME coercion the resolver
+	* applied to the bound one (`Number`, `CommaDelimitedList`, `List<...>`), so
+	* `'1'` equals a bound `1` and `'a, b'` equals a bound `['a', 'b']`. For an
+	* SSM-typed parameter the resolver binds the RESOLVED value, so that is the
+	* side compared — `ParameterValue` is only the key there.
+	*/
+	provablyEquals(name, type, bound) {
+		const entry = this.#entries?.get(name);
+		if (entry === void 0 || typeof type !== "string") return false;
+		const ssmType = type.startsWith("AWS::SSM::Parameter::Value");
+		const deployed = ssmType ? entry.resolvedValue : entry.value;
+		if (typeof deployed !== "string") return false;
+		const comparedType = ssmType ? ssmResolvedValueType(type) : type;
+		return stableEquals(comparedType === void 0 ? deployed : coerceParameterTypedValue(deployed, comparedType), bound);
+	}
+};
+/** Structural equality for the scalar / scalar-array values a parameter binds to. */
+function stableEquals(a, b) {
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((element, index) => stableEquals(element, b[index]));
+	}
+	if (typeof a === "string" && typeof b === "number") return Number.isFinite(b) && a === String(b);
+	if (typeof a === "number" || typeof b === "number") return typeof a === "number" && typeof b === "number" && Number.isFinite(a) && a === b;
+	if (typeof a === "string" && typeof b === "boolean") return a === String(b);
+	return typeof a === "string" && typeof b === "string" && a === b;
+}
+async function readDeployedParameters(cfnStackName, cfnClient, logger, displayName, options) {
+	try {
+		const stack = (await cfnClient.send(new DescribeStacksCommand({ StackName: cfnStackName }))).Stacks?.[0];
+		if (!stack) {
+			logger.warn(unavailableWarning(displayName, "the stack was not returned"));
+			return DeployedParameters.unavailable();
+		}
+		return DeployedParameters.fromDescribeStacks(stack.Parameters ?? []);
+	} catch (err) {
+		if (options?.absentStackIsNoSource === true && err instanceof Error && err.name === "ValidationError" && /does not exist/i.test(err.message)) return;
+		const name = err instanceof Error && /^[A-Za-z0-9_.]{1,80}$/.test(err.name) ? err.name : "error";
+		logger.warn(unavailableWarning(displayName, name));
+		return DeployedParameters.unavailable();
+	}
+}
+function unavailableWarning(displayName, reason) {
+	return `Could not read the deployed parameter values of CloudFormation stack '${displayName}' (${reason}). 'cdkd import' needs the cloudformation:DescribeStacks permission to prove that a template parameter was deployed with its 'Default'; without it every resource that depends on a template parameter is imported WITHOUT an observed drift baseline. Review 'cdkd diff' before the next 'cdkd deploy'.`;
+}
+/**
+* The declared parameters whose deployed value is NOT provably the bound one.
+* A parameter the import could not bind at all (no `Default`, an unreferenced
+* or failed SSM default, the empty fallback bag) is divergent by definition.
+*/
+function divergentParameterNames(template, bound, deployed) {
+	const divergent = /* @__PURE__ */ new Set();
+	const declared = template.Parameters;
+	if (declared === void 0 || declared === null || typeof declared !== "object") return divergent;
+	for (const [name, definition] of Object.entries(declared)) {
+		const record = definition !== null && typeof definition === "object" ? definition : void 0;
+		const type = record?.["Type"];
+		const noEcho = record?.["NoEcho"];
+		if (noEcho === true || typeof noEcho === "string" && noEcho.toLowerCase() === "true") {
+			divergent.add(name);
+			continue;
+		}
+		if (!Object.hasOwn(bound, name) || !deployed.provablyEquals(name, type, bound[name])) divergent.add(name);
+	}
+	return divergent;
+}
+/**
+* Every intrinsic the dependence walk knows how to read. An `Fn::`-prefixed
+* key OUTSIDE this list is unclassifiable: it may name a parameter in a way
+* the generic recursion cannot see, so the walk fails closed on it.
+*/
+const KNOWN_INTRINSICS = /* @__PURE__ */ new Set([
+	"Fn::GetAtt",
+	"Fn::Join",
+	"Fn::Sub",
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::If",
+	"Fn::Equals",
+	"Fn::And",
+	"Fn::Or",
+	"Fn::Not",
+	"Fn::ImportValue",
+	"Fn::GetStackOutput",
+	"Fn::FindInMap",
+	"Fn::Base64",
+	"Fn::GetAZs",
+	"Fn::Cidr"
+]);
+/** `${Name}` / `${Name.Attr}` in an `Fn::Sub` string; `${!Literal}` is an escape. */
+const SUB_VARIABLE = /\$\{([^!}][^}]*)\}/g;
+/**
+* Which names (parameters, but also resources and pseudo parameters — the
+* caller intersects with the divergent set) the RAW `Properties` of a resource
+* depend on, plus its resource-level `Condition`.
+*
+* Generic by design: instead of modelling each intrinsic's argument grammar it
+* recurses into EVERY value, so a `Ref` nested in an `Fn::Join` / `Fn::Select`
+* / `Fn::Split` operand, an `Fn::FindInMap` key, or an `Fn::Sub` variable-map
+* value is found without being named. Only the three forms that name something
+* by BARE STRING need their own arm: `Ref`, `Fn::Sub`'s template text, and a
+* condition name (`Fn::If`'s first argument, and `Condition` inside the
+* `Conditions` section), which is followed transitively through
+* `template.Conditions`.
+*
+* May throw `RangeError` on a bag deeper than the call stack; the caller wraps
+* it fail-closed, like the discard walk beside it.
+*/
+function collectParameterDependencies(properties, resourceCondition, template) {
+	const names = /* @__PURE__ */ new Set();
+	const attributeTargets = /* @__PURE__ */ new Set();
+	const visitedConditions = /* @__PURE__ */ new Set();
+	let unclassifiable = false;
+	const conditions = template.Conditions !== null && typeof template.Conditions === "object" ? template.Conditions : {};
+	const followCondition = (name) => {
+		if (typeof name !== "string") {
+			unclassifiable = true;
+			return;
+		}
+		if (visitedConditions.has(name)) return;
+		visitedConditions.add(name);
+		if (!Object.hasOwn(conditions, name)) {
+			unclassifiable = true;
+			return;
+		}
+		walk(conditions[name], true);
+	};
+	const walk = (node, inConditions) => {
+		if (node === null || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const element of node) walk(element, inConditions);
+			return;
+		}
+		for (const [key, value] of Object.entries(node)) {
+			if (key === "Ref") {
+				if (typeof value === "string") names.add(value);
+				else unclassifiable = true;
+				continue;
+			}
+			if (key === "Fn::Sub") {
+				const text = Array.isArray(value) ? value[0] : value;
+				if (typeof text !== "string" || Array.isArray(value) && value.length !== 2) unclassifiable = true;
+				else for (const match of text.matchAll(SUB_VARIABLE)) {
+					const variable = (match[1] ?? "").trim();
+					names.add(variable);
+					const dot = variable.indexOf(".");
+					if (dot > 0) {
+						names.add(variable.slice(0, dot));
+						attributeTargets.add(variable.slice(0, dot));
+					}
+				}
+				if (Array.isArray(value)) walk(value[1], inConditions);
+				continue;
+			}
+			if (key === "Fn::GetAtt") {
+				const target = Array.isArray(value) ? value[0] : value;
+				if (typeof target === "string") {
+					const dot = target.indexOf(".");
+					const logicalId = Array.isArray(value) || dot <= 0 ? target : target.slice(0, dot);
+					names.add(logicalId);
+					attributeTargets.add(logicalId);
+				} else unclassifiable = true;
+				walk(value, inConditions);
+				continue;
+			}
+			if (key === "Fn::If") {
+				if (Array.isArray(value) && value.length === 3) {
+					followCondition(value[0]);
+					walk(value[1], inConditions);
+					walk(value[2], inConditions);
+				} else unclassifiable = true;
+				continue;
+			}
+			if (key === "Condition" && inConditions) {
+				followCondition(value);
+				continue;
+			}
+			if (key.startsWith("Fn::") && !KNOWN_INTRINSICS.has(key)) unclassifiable = true;
+			walk(value, inConditions);
+		}
+	};
+	walk(properties, false);
+	if (resourceCondition !== void 0) followCondition(resourceCondition);
+	return {
+		names,
+		attributeTargets,
+		unclassifiable
+	};
+}
+/**
+* The divergent parameters that ANYTHING in the template names. A declared
+* parameter nothing names cannot have shaped a resource — and CDK's
+* `BootstrapVersion` is exactly that on every default-synthesized stack: SSM
+* typed, never bound by the resolver because nothing references it, hence
+* always "divergent". Left in, it would arm the unclassifiable-shape refusal on
+* stacks whose every real parameter is proven.
+*
+* "Names" is the UNION of this module's walk and `TemplateParser`'s reference
+* scan — the same scan the resolver uses to decide an SSM-typed parameter is
+* unreferenced — so the two cannot disagree about `BootstrapVersion`. An
+* unclassifiable shape does NOT keep the whole set here: CloudFormation names a
+* parameter only through `Ref`, `Fn::Sub` text or a condition, and the generic
+* recursion reads those inside any intrinsic, known or not. A walk that THROWS
+* keeps the whole set (fail closed).
+*/
+function reachableDivergentParameters(template, divergent, rawBags) {
+	if (divergent.size === 0) return /* @__PURE__ */ new Set();
+	try {
+		const roots = [
+			rawBags,
+			template.Resources,
+			template.Outputs,
+			template.Conditions
+		];
+		const named = new Set(collectParameterDependencies(roots, void 0, template).names);
+		const parser = new TemplateParser();
+		for (const root of roots) {
+			if (root === null || typeof root !== "object") continue;
+			for (const name of parser.extractReferences(root)) named.add(name);
+		}
+		return new Set([...divergent].filter((name) => named.has(name)));
+	} catch {
+		return new Set(divergent);
+	}
+}
+/** Whether any DECLARED parameter is named by anything in the template. */
+function namesAnyDeclaredParameter(template) {
+	const declared = template.Parameters;
+	if (declared === null || typeof declared !== "object") return false;
+	const names = new Set(Object.keys(declared));
+	return names.size > 0 && reachableDivergentParameters(template, names, []).size > 0;
+}
+/**
+* The per-stack ARM 4 verdict. Each resource is judged on its TEMPLATE
+* definition (`Properties` + `Condition`) AND on the raw bag the state record
+* carries, unioned: a record preserved by a selective merge holds a previous
+* run's RESOLVED literal (`Value: 'CHANGEME'`), which names no parameter, so
+* judging it on the state bag alone would leave nothing to carry to the
+* freshly imported resource that reads its attribute. Template resources that
+* are not in state at all are judged too, for the same reason.
+*
+* Seeds are direct dependents and unclassifiable bags (a bag that cannot be
+* read cannot be vouched for, and neither can what reads its attributes); the
+* refused set is then closed over ATTRIBUTE reads, to a fixpoint.
+*/
+function computeParameterTaint(template, stateBags, divergent) {
+	const refused = /* @__PURE__ */ new Set();
+	const unclassifiable = /* @__PURE__ */ new Set();
+	const parametersHit = /* @__PURE__ */ new Set();
+	if (divergent.size === 0) return {
+		refused,
+		unclassifiable,
+		parametersHit
+	};
+	const templateResources = template.Resources !== null && typeof template.Resources === "object" ? template.Resources : {};
+	const readers = /* @__PURE__ */ new Map();
+	for (const logicalId of /* @__PURE__ */ new Set([...Object.keys(templateResources), ...stateBags.keys()])) {
+		const definition = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+		const record = definition !== null && typeof definition === "object" ? definition : {};
+		try {
+			const dependencies = collectParameterDependencies([record["Properties"], stateBags.get(logicalId)], record["Condition"], template);
+			readers.set(logicalId, new Set(dependencies.attributeTargets));
+			const hits = [...dependencies.names].filter((name) => divergent.has(name));
+			for (const name of hits) parametersHit.add(name);
+			if (hits.length > 0) refused.add(logicalId);
+			else if (dependencies.unclassifiable) {
+				refused.add(logicalId);
+				unclassifiable.add(logicalId);
+			}
+		} catch {
+			refused.add(logicalId);
+			unclassifiable.add(logicalId);
+		}
+	}
+	for (let grew = refused.size > 0; grew;) {
+		grew = false;
+		for (const [logicalId, targets] of readers) {
+			if (refused.has(logicalId)) continue;
+			if (![...targets].some((target) => refused.has(target))) continue;
+			refused.add(logicalId);
+			grew = true;
+		}
+	}
+	return {
+		refused,
+		unclassifiable,
+		parametersHit
+	};
+}
+
 //#endregion
 //#region src/cli/commands/import.ts
+/**
+* What {@link resolveImportedProperties} refused, as ONE value (issue #3462).
+*
+* It is still the set of logical ids whose observed baseline must not be
+* captured — every existing reader calls `.has()` — and it additionally carries
+* the two facts `captureObservedForImportedResources` needs to write, keep or
+* clear `ResourceState.observedBaselineRefusalReason`. They travel ON the set
+* rather than beside it, and the capture's parameter is THIS type, so a call
+* site that copies the ids into a plain `Set` — dropping both facts, and with
+* them the reason every deploy-side guard keys on — does not compile.
+*/
+var ObservedBaselineRefusals = class extends Set {
+	/**
+	* The subset ARM 4 named — directly, through an attribute read, or as an
+	* unclassifiable bag — whether or not another arm refused it too.
+	*/
+	unverifiableParameter = /* @__PURE__ */ new Set();
+	/**
+	* Whether this run HAD deployed parameter values to compare against. Only
+	* then does "ARM 4 did not name it" mean the placeholder was PROVEN; without
+	* a source it means nothing was judged at all.
+	*/
+	hadDeployedParameterSource = false;
+};
 async function importCommand(stackArg, options) {
 	const logger = getLogger();
 	if (options.verbose) {
@@ -85183,7 +86317,8 @@ async function importCommand(stackArg, options) {
 				}
 			}
 			const stackState = buildStackState(stackInfo.stackName, targetRegion, rows, templateParser, stateTemplate, existingState, selectiveMode);
-			await captureObservedForImportedResources(stackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger)), rebuiltLogicalIdsFrom(rows, stateTemplate));
+			const deployedParameters = !namesAnyDeclaredParameter(stateTemplate) ? void 0 : migrationCfnStackName !== void 0 ? await readDeployedParameters(migrationCfnStackName, awsClients.cloudFormation, logger, displaySafe(migrationCfnStackName)) : await readDeployedParameters(stackInfo.stackName, awsClients.cloudFormation, logger, displaySafe(stackInfo.stackName), { absentStackIsNoSource: true });
+			await captureObservedForImportedResources(stackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger, deployedParameters)), rebuiltLogicalIdsFrom(rows, stateTemplate));
 			const saveOptions = {};
 			if (existingEtag) saveOptions.expectedEtag = existingEtag;
 			if (migrationPending) saveOptions.migrateLegacy = true;
@@ -85203,7 +86338,8 @@ async function importCommand(stackArg, options) {
 				lockOwner: owner,
 				accountId: accountIdForNestedSynth,
 				logger,
-				assetRedirect
+				assetRedirect,
+				cfnClient: awsClients.cloudFormation
 			});
 			if (migrationCfnStackName) {
 				const orphaned = resources.length - importedRows.length;
@@ -85540,6 +86676,8 @@ function rebuiltLogicalIdsFrom(rows, template) {
 * import flow never derives outputs (they're computed at deploy time from
 * each resource's attributes), so even an auto-mode rebuild has no reason
 * to wipe them.
+*
+* Exported for unit testing — internal to the command flow otherwise.
 */
 function buildStackState(stackName, region, rows, templateParser, template, existingState, selectiveMode) {
 	const resources = selectiveMode && existingState ? { ...existingState.resources } : {};
@@ -85558,7 +86696,11 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 			properties: tmplResource.Properties ?? {},
 			attributes: rowAttributes ?? priorAttributes ?? {},
 			dependencies: deps,
-			provisionedBy: "sdk"
+			provisionedBy: "sdk",
+			...prior && prior.physicalId === row.physicalId && hasUnverifiableParameterRefusal(prior) && {
+				observedBaselineRefused: true,
+				observedBaselineRefusalReason: "unverifiable-parameter"
+			}
 		};
 	}
 	return {
@@ -85651,7 +86793,7 @@ function defaultOnlyParameterTemplate(template) {
 * the clear.
 *
 * The predicate is deliberately CONSERVATIVE — it over-refuses — and that is a
-* decision a review round paid for. Three arms:
+* decision a review round paid for. Four arms:
 *
 *  - **Resolution THREW** — refuse, unconditionally. A throw means the
 *    resolver could not finish, so nothing about the persisted bag is
@@ -85692,6 +86834,15 @@ function defaultOnlyParameterTemplate(template) {
 *    opener text and no intrinsic anywhere, because every way a discarded
 *    subtree could have SOURCED a reference is an intrinsic.
 *
+*  - **An UNVERIFIABLE INPUT** (ARM 4, issue
+*    [#2854](https://github.com/go-to-k/cdkd/issues/2854)). The raw bag
+*    depends on a template parameter whose DEPLOYED value — read from the
+*    backing CloudFormation stack's `DescribeStacks`, root and every nested
+*    child alike — is not provably the `Default` this import bound. Runs only
+*    when `deployedParameters` is supplied; the comparison, the dependence
+*    walk and the comparison-only rule for the deployed values live in
+*    `import-deployed-parameters.ts`.
+*
 * The cost of a false refusal is one resource's drift baseline until its next
 * deploy; the cost of a false pass is a plaintext secret in `state.json`. So an
 * unmeasurable bag refuses too.
@@ -85706,8 +86857,22 @@ function defaultOnlyParameterTemplate(template) {
 * issue and none of them proven to be all of them:
 *
 *  - a parameter binds to a placeholder `Default` while the DEPLOYED value was
-*    the reference, so no opener exists in any template this walk is handed --
-*    [#2854](https://github.com/go-to-k/cdkd/issues/2854);
+*    the reference, so no opener exists in any template this walk is handed
+*    ([#2854](https://github.com/go-to-k/cdkd/issues/2854)). ARM 4 below
+*    refuses this when a CloudFormation stack backs the import (its
+*    `DescribeStacks` parameters are the comparison); what REMAINS is an
+*    import with NO CloudFormation stack, where no deployed-parameter source
+*    exists, taint across the nested-stack `Outputs` boundary
+*    (`import-deployed-parameters.ts` states it). The NEXT DEPLOY and a
+*    source-less RE-IMPORT used to be on this list
+*    ([#3462](https://github.com/go-to-k/cdkd/issues/3462)): both bind the
+*    same placeholder `Default`, so both now honour
+*    `ResourceState.observedBaselineRefusalReason`, which this arm's verdict
+*    is recorded as. A binary older than that field still clears the marker on
+*    any UPDATE. ARM 4 also WIDENS the population of
+*    [#2872](https://github.com/go-to-k/cdkd/issues/2872): a record preserved
+*    by a selective merge that a pre-#2854 import already gave a plaintext
+*    baseline is now refused, and a refusal leaves that old baseline in place;
 *  - `redactSecretsForState` cannot PAIR the readback against the source at a
 *    position the source carries NO leaf for -- an observed KEY beside a paired
 *    one -- so there is nothing to refuse from and the value scan has no needle
@@ -85732,15 +86897,17 @@ function defaultOnlyParameterTemplate(template) {
 * deployer, which is where the structural remedy for all of the above lives.
 *
 * The set is returned rather than recorded on the state, because it describes
-* THIS run's resolution and nothing downstream of the save has any use for it.
+* THIS run's resolution; `captureObservedForImportedResources` turns it into
+* the two record fields that DO outlive the run.
 *
 * Exported for unit testing — internal to the command flow otherwise. The
 * masking this walk applies (issue #2803) is only provable against the REAL
 * resolver, since the plaintext reaches the message through the resolver's
 * own throw rather than through anything this function writes.
 */
-async function resolveImportedProperties(stackState, template, region, stateBackend, logger) {
-	const unsafeObservedBaselineLogicalIds = /* @__PURE__ */ new Set();
+async function resolveImportedProperties(stackState, template, region, stateBackend, logger, deployedParameters) {
+	const unsafeObservedBaselineLogicalIds = new ObservedBaselineRefusals();
+	unsafeObservedBaselineLogicalIds.hadDeployedParameterSource = deployedParameters !== void 0;
 	const entries = Object.entries(stackState.resources ?? {});
 	if (entries.length === 0) return unsafeObservedBaselineLogicalIds;
 	const resolver = new IntrinsicFunctionResolver(region);
@@ -85767,6 +86934,24 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		logger.debug(`Template condition evaluation failed during import-time property resolution: ${err instanceof Error ? err.message : String(err)} — continuing without conditions.`);
 	}
 	const unboundParameterNames = Object.keys(template.Parameters ?? {}).filter((name) => isUnboundTemplateParameter(name, template, parameters));
+	let divergentParameters;
+	if (deployedParameters !== void 0) try {
+		divergentParameters = reachableDivergentParameters(template, divergentParameterNames(template, parameters, deployedParameters), entries.map(([, resource]) => resource.properties));
+	} catch {
+		divergentParameters = new Set(Object.keys(template.Parameters ?? {}));
+	}
+	let parameterTaint;
+	if (divergentParameters !== void 0 && divergentParameters.size > 0) try {
+		parameterTaint = computeParameterTaint(template, new Map(entries.map(([logicalId, resource]) => [logicalId, resource.properties])), divergentParameters);
+	} catch (err) {
+		logger.debug(`observed-baseline parameter-dependence walk failed for '${displaySafe(stackState.stackName)}': ${err instanceof Error ? err.name : typeof err} — refusing every baseline in the stack fail-closed.`);
+		const all = new Set(entries.map(([logicalId]) => logicalId));
+		parameterTaint = {
+			refused: all,
+			unclassifiable: all,
+			parametersHit: /* @__PURE__ */ new Set()
+		};
+	}
 	const baseContext = {
 		template,
 		resources: stackState.resources,
@@ -85790,7 +86975,9 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 			threw = true;
 		}
 		if (recordedSecretValues.size > 0 && resource.attributes !== void 0) resource.attributes = redactSecretsForState(resource.attributes, recordedSecretValues);
-		if (threw) {
+		const dependsOnDivergent = parameterTaint?.refused.has(logicalId) === true;
+		if (dependsOnDivergent) unsafeObservedBaselineLogicalIds.unverifiableParameter.add(logicalId);
+		if (threw || dependsOnDivergent) {
 			unsafeObservedBaselineLogicalIds.add(logicalId);
 			continue;
 		}
@@ -85805,6 +86992,15 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		}
 		if (rawOpeners === void 0 || persistedOpeners === void 0 || persistedOpeners < rawOpeners || discardsNonInertSubtree) unsafeObservedBaselineLogicalIds.add(logicalId);
 	}
+	if (parameterTaint !== void 0) {
+		const inState = new Set(entries.map(([logicalId]) => logicalId));
+		const refusedHere = [...parameterTaint.refused].filter((id) => inState.has(id));
+		const unreadable = refusedHere.filter((id) => parameterTaint.unclassifiable.has(id));
+		if (refusedHere.length > 0) {
+			const named = [...parameterTaint.parametersHit].sort().map((name) => displaySafe(name));
+			logger.warn(`${refusedHere.length} resource(s) in '${displaySafe(stackState.stackName)}' depend, directly or through another resource's attributes, on template parameter(s) whose deployed CloudFormation value could not be proven equal to the template 'Default' 'cdkd import' binds` + (named.length > 0 ? ` (${named.join(", ")})` : "") + (unreadable.length > 0 ? ` — ${unreadable.length} of them because their properties could not be checked for such a dependence` : "") + ". Their recorded properties hold the 'Default', NOT the deployed value, and no observed drift baseline was captured for them by this import (the live value may be a secret this import cannot position a redaction for). Review 'cdkd diff' before the next 'cdkd deploy'.");
+		}
+	}
 	return unsafeObservedBaselineLogicalIds;
 }
 /** The opener every dynamic reference starts with, secret-bearing or not. */
@@ -86161,15 +87357,20 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 	if (entries.length === 0) return;
 	await Promise.all(entries.map(async ([logicalId, resource]) => {
 		if (resource.observedBaselineRefused === true && !rebuiltLogicalIds.has(logicalId)) {
-			logger.debug(`observedProperties capture SKIPPED for preserved ${logicalId} (${resource.resourceType}): a previous 'cdkd import' run refused this record's baseline and this run did not re-import it, so its recorded properties are still the ones that refusal distrusted. Deploy a change to this resource to restore a baseline.`);
+			logger.debug(`observedProperties capture SKIPPED for preserved ${logicalId} (${resource.resourceType}): a previous 'cdkd import' run refused this record's baseline and this run did not re-import it, so its recorded properties are still the ones that refusal distrusted. Re-import it, or deploy a change to it, to restore a baseline — unless its refusal is an unverifiable-parameter one, which only a replacement or a proving re-import discharges.`);
 			return;
 		}
-		if (unsafeObservedBaselineLogicalIds.has(logicalId)) {
+		const refusals = unsafeObservedBaselineLogicalIds;
+		const parameterRefusalStands = refusals.unverifiableParameter.has(logicalId) || hasUnverifiableParameterRefusal(resource) && !refusals.hadDeployedParameterSource;
+		if (unsafeObservedBaselineLogicalIds.has(logicalId) || parameterRefusalStands) {
 			resource.observedBaselineRefused = true;
-			logger.debug(`observedProperties capture SKIPPED for imported ${logicalId} (${resource.resourceType}): the recorded properties no longer spell the template's dynamic reference, so they cannot position a redaction — capturing an AWS readback against them could persist a resolved secret in plaintext. Drift will compare against the recorded properties for this resource until the next successful deploy.`);
+			if (parameterRefusalStands) resource.observedBaselineRefusalReason = "unverifiable-parameter";
+			else delete resource.observedBaselineRefusalReason;
+			logger.debug(`observedProperties capture SKIPPED for imported ${logicalId} (${resource.resourceType}): the recorded properties cannot be shown to spell every dynamic reference the deployed resource was built from, so they cannot position a redaction — capturing an AWS readback against them could persist a resolved secret in plaintext. Drift will compare against the recorded properties for this resource until ${parameterRefusalStands ? `it is REPLACED, or re-imported while a CloudFormation stack can prove its parameters were deployed at their 'Default' — an in-place deploy binds the same 'Default' and cannot restore the baseline` : `the next successful deploy`}.`);
 			return;
 		}
 		delete resource.observedBaselineRefused;
+		delete resource.observedBaselineRefusalReason;
 		try {
 			const provider = providerRegistry.getProviderFor({
 				resourceType: resource.resourceType,
@@ -86349,7 +87550,8 @@ async function importNestedStackChildrenRecursive(args) {
 			childStackState.parentStack = parentStackName;
 			childStackState.parentLogicalId = childLogicalId;
 			childStackState.parentRegion = parentRegion;
-			await captureObservedForImportedResources(childStackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger)), rebuiltLogicalIdsFrom(rows, childTemplate));
+			const childDeployedParameters = namesAnyDeclaredParameter(childStateTemplate) ? await readDeployedParameters(childTreeNode.stackName, args.cfnClient, logger, displaySafe(childStackName)) : void 0;
+			await captureObservedForImportedResources(childStackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger, childDeployedParameters)), rebuiltLogicalIdsFrom(rows, childTemplate));
 			await stateBackend.saveState(childStackName, childRegion, childStackState);
 			logger.info(`✓ Nested stack state written: ${childStackName} (${childRegion}) — ${rows.filter((r) => r.outcome === "imported").length} resource(s) imported.`);
 			if (childTreeNode.nested.size > 0) await importNestedStackChildrenRecursive({
@@ -86365,7 +87567,8 @@ async function importNestedStackChildrenRecursive(args) {
 				lockOwner,
 				accountId,
 				logger,
-				assetRedirect
+				assetRedirect,
+				cfnClient: args.cfnClient
 			});
 		} finally {
 			await lockManager.releaseLock(childStackName, childRegion).catch((err) => {
@@ -96038,4 +97241,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Dh1J573K.js.map
+//# sourceMappingURL=program-DcMcqr70.js.map