@go-to-k/cdkd 0.290.35 → 0.290.37

package/dist/{program-COiS7GZJ.js → program-CUOo1x11.js}

@@ -1,8 +1,8 @@
-import { $ as isExportAliasCollision, $i as StackTerminationProtectionError, $n as maskSecretsInText, $r as stripControlChars, $t as withSharedDrainBudget, A as makeCanonicalizePropertiesFn, Ai as resolveBucketRegion, An as refuseMalformedResourcesForDestroy, Ar as AssetModeResolver, At as getAccountInfo, B as isWarmThroughputDecrease, Bi as DeployCancelledError, Bn as TemplateParser, Br as buildDenyExternalAccessPolicy, Bt as assertRegionMatch, C as PRE_DELETE_SNAPSHOT_TYPES, Ci as expectedOwnerParam, Cn as malformedStateRefusalMessage, Cr as AssetPublisher, Ct as disableInstanceApiTermination, D as isFinalSnapshotError, Di as AssemblyReader, Dn as refuseMalformedOutputs, Dr as createAssetRedirectResolver, Dt as carriesFetchableDynamicReference, E as createPreDeleteFinalSnapshot, Ei as derivePartitionAndUrlSuffix, En as refuseMalformedNestedChildOutputs, Er as buildAssetRedirectMap, Et as carriesDynamicReference, F as isStatefulRecreateTargetForReplace, Fn as findActionableSilentDrops, Fr as isCrossRegionRedirect, Ft as refStateLookupFromResource, G as cyan, Gn as carriesSecretMask, Gr as dockerSpawnEnvWithSensitive, Gt as configStringRefusal, H as toFiniteNumber, Hi as IntrinsicResolutionRefusalError, Hn as STATE_SOURCED_CROSS_GENERATION_RULES, Hr as describeDockerCapturedOutput, Ht as coerceCfnInteger, I as isStatefulRecreateTargetSync, Ii as CdkdError, In as findSilentDropProperties, Ir as parseBootstrapMarker, It as isSettledInstanceState, J as red, Ji as PartialFailureError, Jn as errorCauseChain, Jr as partitionSensitiveEnv, Jt as requireConfigArray, K as gray, Ki as MalformedProducerRecordRefusalError, Kn as createSecretMasker, Kr as formatDockerLoginError, Kt as readConfigString, L as renderStatefulReason, Ln as describeTypeWithThrottleRetry, Lr as readBootstrapMarkerBody, Lt as WAFv2WebACLProvider, M as makeSiblingClaimReader, Mi as getAwsClients, Mn as repairMalformedOutputsForReadOnly, Mr as assertAssetBucketRegion, Mt as isNamelessDynamicReferenceError, N as planOrphanAdoption, Ni as resetAwsClients, Nn as repairMalformedResourcePropertiesForReadOnly, Nr as ensureAssetStorage, Nt as isUnboundTemplateParameter, O as refusesFinalSnapshot, Oi as processStackMessages, On as refuseMalformedOutputsForDestroy, Or as loadPublishableAssetManifest, Ot as cfnRefValueFromPhysicalId, P as MULTI_REGION_RECREATE_BLOCKED_TYPES, Pi as setAwsClients, Pn as repairMalformedResourcesForReadOnly, Pr as getBootstrapMarkerKey, Pt as parameterTypeMayLoseSecretIdentity, Q as exportAliasCollisionScrubWarning, Qi as StackHasActiveImportsError, Qn as maskSecretsInError, Qr as escapeRegExp, Qt as producerRegionsFromState, R as WARM_THROUGHPUT_MEMBERS, Ri as CrossAccountSecretRefusalError, Rn as withRetry, Rr as validateAssetBucketName, Rt as normalizeAwsTagsToCfn, S as ATOMIC_FINAL_SNAPSHOT_TYPES, Si as decodeListingKey, Sn as malformedResourcesWarning, Sr as shouldRetainResource, St as deleteSkipReason, T as ccRoutedFinalSnapshotError, Ti as canonicalizeRegion, Tn as refuseDivergentRecordRegionForDestroy, Tr as WorkGraph, Tt as IntrinsicFunctionResolver, U as formatResourceLine, Ui as LocalInvokeBuildError$1, Un as STATE_SOURCED_READBACK_RULES, Ur as describeDockerExecFailure, Ut as configBooleanRefusal, V as toCfnInteger, Vi as DynamicReferenceRegionAmbiguousError, Vn as STATE_SOURCED_BASELINE_RULES, Vr as buildDockerImage, Vt as coerceCfnBoolean, W as bold, Wi as LocalStartServiceError, Wn as TEMPLATE_SOURCED_RULES, Wr as describeDockerFailure, Wt as configIntegerRefusal, X as collectDeclaredOutputNames, Xi as ResourceTimeoutError, Xn as isSingleDynamicReferenceToken, Xr as runDockerForeground, Xt as requireConfigString, Y as yellow, Yi as ProvisioningError, Yn as identityKeyFor, Yr as redactDockerArgvValues, Yt as requireConfigObject, Z as collectPublishedOutputNames, Zi as ResourceUpdateNotSupportedError, Zn as markSameGenerationBag, Zr as runDockerStreaming, Zt as classifyReplaySecretRegion, _ as bagHoldsSecretExpression, _i as CFN_TEMPLATE_URL_LIMIT, _n as malformedLocalOutputsWarning, _r as importableOutputKeys, _t as CloudControlProvider, a as DeploymentEventsStore, aa as withErrorHandling, ai as getLegacyStateBucketName, an as applyRoleArnIfSet, ar as S3StateBackend, at as collectInlinePolicyNamesManagedBySiblings, b as mergeNoChangeOutputs, bi as uploadCfnTemplate, bn as malformedRenderedContainersWarning, br as orphansAfterRollback, bt as UNSPECIFIED_SKIP_REASON, c as replayFailedOperations, ca as isThrottlingError, ci as resolveCaptureObservedState, cn as callerEnvCredentials, cr as buildForceUnlockCommand, ct as wouldReturnToSdkProvider, d as updatePartialMessage, da as markRedactedCause, di as resolveStateBucketWithDefaultAndSource, dn as INTRINSIC_KEYS, dr as formatLockExpiry, dt as maskerOrIdentity, ei as AssetManifestLoader, en as s3BucketArn, er as recordMaskOnlyValue, et as secretBearing, f as updatePartialReason, fa as retryClassificationText, fi as resolveUseCdkBootstrapAssets, fn as STATE_RESOURCES_MALFORMED, fr as shellQuote, ft as beginCommandInterruptScope, g as computeImplicitDeleteEdges, gi as CFN_TEMPLATE_BODY_LIMIT, gn as malformedExportSourceWarning, gr as hasReadableExportSet, gt as startInterruptWatch, h as IMPLICIT_DELETE_DEPENDENCIES, hi as ssmResolvedValueType, hn as malformedExportNamesWarning, hr as exportNamesCarriedFrom, ht as isInterruptedWaitError, i as DeploymentEventsReader, ia as normalizeAwsError, ii as getDefaultStateBucketName, in as s3BucketWebsiteUrl, ir as LockManager, it as IAMRoleProvider, j as extractDeploymentEventError, ji as AwsClients, jn as refuseMalformedState, jr as BOOTSTRAP_MARKER_PREFIX, jt as isImpossibleEmptyStoredAttribute, k as unsupportedFinalSnapshotError, kn as refuseMalformedResourcePropertiesForOrphan, kr as rewriteTemplateAssetReferences, kt as coerceParameterTypedValue, l as replayRollback, la as isTransientServerError, li as resolveSkipPrefix, ln as envCredentialsAreAssumedRole, lr as buildLockContentionMessage, lt as createMaskedRetryLogger, m as maskingRetryLogger, ma as safeStringify, mi as warnDeprecatedNoPrefixCliFlag, mn as hasReadableResources, mr as DEFAULT_STATE_PREFIX, mt as interruptWatchListenerCount, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as Synthesizer, nn as s3BucketDualStackDomainName, nr as redactSecretsForState, nt as secretSafeKeyDisplay, o as planFailedOps, oa as isMarkedNonRetryable, oi as resolveApp, on as AWS_CREDENTIAL_ENV_KEYS, or as rebuildClientForBucketRegion, ot as clearOnUpdateRemoval, p as withResourceDeadline, pa as describeAwsFailure, pi as stateBucketExistenceConfirmed, pn as hasReadableOutputs, pr as CUSTOM_RESOURCE_RESPONSE_PREFIX, pt as endCommandInterruptScope, q as green, qi as NestedStackChildDirectDestroyError, qn as dynamicReferenceTokens, qr as getDockerCmd, qt as replayWarn, r as DeployEngine, ri as synthesisStatusMessage, rn as s3BucketRegionalDomainName, rr as scrubResourceRecord, rt as getCurrentResourceSecrets, s as planRollback, sa as isRetryableTransientError, si as resolveAutoAssetStorage, sn as applyCallerIdentityCredentials, sr as UNREPRODUCIBLE_LOCK_CLAUSE, st as ProviderRegistry, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as SynthesisError, ti as getDockerImageBySourceHash, tn as s3BucketDomainName, tr as recoverMaskedOutput, tt as secretBearingStateKeyWarning, u as resolveReplacementOldType, ua as markNonRetryable, ui as resolveStateBucketWithDefault, un as DiffCalculator, ur as forceQuitRecoveryClause, ut as maskDeep, v as isSecretBearingReferenceString, vi as MIGRATE_TMP_PREFIX, vn as malformedOutputsRefusalMessage, vr as importableOutputs, vt as isWaitAbandonedError, w as buildFinalSnapshotIdentifier, wi as PARTITION_TABLE, wn as producerRecordKey, wr as stringifyValue, wt as isTerminationProtectionPropagationError, x as bindingSkippedOutputs, xi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, xn as malformedResourcePropertiesWarning, xr as orphansCarriedFrom, xt as deleteIndeterminateGuards, y as keptWholeReasonText, yi as findLargeInlineResources, yn as malformedOutputsWarning, yr as isReadableBag, yt as slowCcOperationTimeoutMs, z as coerceWarmThroughput$1, zn as DagBuilder, zr as validateContainerRepoName, zt as resolveExplicitPhysicalId } from "./deploy-engine-DhZtBBq0.js";
+import { $ as yellow, $i as NestedStackChildDirectDestroyError, $n as identityKeyFor, $r as getDockerCmd, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Ai as PARTITION_TABLE, An as refuseMalformedNestedChildOutputs, Ar as stringifyValue, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as setAwsClients, Bn as findSilentDropProperties, Br as getBootstrapMarkerKey, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ci as CFN_TEMPLATE_URL_LIMIT, Cn as malformedOutputsWarning, Cr as importableOutputKeys, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Di as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Dn as malformedStateRefusalMessage, Dr as orphansCarriedFrom, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ei as uploadCfnTemplate, En as malformedResourcesWarning, Er as orphansAfterRollback, Et as deleteSkipReason, F as extractDeploymentEventError, Fn as refuseMalformedState, Fr as rewriteTemplateAssetReferences, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Gn as STATE_SOURCED_BASELINE_RULES, Gr as validateContainerRepoName, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Hi as CdkdError, Hn as withRetry, Hr as parseBootstrapMarker, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ii as resolveBucketRegion, In as repairMalformedOutputsForReadOnly, Ir as AssetModeResolver, It as isNamelessDynamicReferenceError, J as bold, Ji as IntrinsicResolutionRefusalError, Jn as TEMPLATE_SOURCED_RULES, Jr as describeDockerCapturedOutput, Jt as configIntegerRefusal, K as toFiniteNumber, Ki as DeployCancelledError, Kn as STATE_SOURCED_CROSS_GENERATION_RULES, Kr as buildDenyExternalAccessPolicy, Kt as coerceCfnInteger, L as planOrphanAdoption, Li as AwsClients, Ln as repairMalformedResourcePropertiesForReadOnly, Lr as BOOTSTRAP_MARKER_PREFIX, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Mi as derivePartitionAndUrlSuffix, Mn as refuseMalformedOutputsForDestroy, Mr as buildAssetRedirectMap, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Ni as AssemblyReader, Nn as refuseMalformedResourcePropertiesForOrphan, Nr as createAssetRedirectResolver, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oi as decodeListingKey, On as producerRecordKey, Or as shouldRetainResource, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pi as processStackMessages, Pn as refuseMalformedResourcesForDestroy, Pr as loadPublishableAssetManifest, Pt as getAccountInfo, Q as red, Qi as MalformedProducerRecordRefusalError, Qn as errorCauseChain, Qr as formatDockerLoginError, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ri as getAwsClients, Rn as repairMalformedResourcesForReadOnly, Rr as assertAssetBucketRegion, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Si as CFN_TEMPLATE_BODY_LIMIT, Sn as malformedOutputsRefusalMessage, Sr as hasUnverifiableParameterRefusal, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ti as findLargeInlineResources, Tn as malformedResourcePropertiesWarning, Tr as isReadableBag, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Un as DagBuilder, Ur as readBootstrapMarkerBody, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vn as describeTypeWithThrottleRetry, Vr as isCrossRegionRedirect, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as CrossAccountSecretRefusalError, Wn as TemplateParser, Wr as validateAssetBucketName, Wt as assertRegionMatch, X as gray, Xi as LocalStartServiceError, Xn as createSecretMasker, Xr as describeDockerFailure, Xt as readConfigString, Y as cyan, Yi as LocalInvokeBuildError$1, Yn as carriesSecretMask, Yr as describeDockerExecFailure, Yt as configStringRefusal, Z as green, Zn as dynamicReferenceTokens, Zr as dockerSpawnEnvWithSensitive, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as markRedactedCause, _i as resolveStateBucketWithDefaultAndSource, _n as hasReadableOutputs, _r as CUSTOM_RESOURCE_RESPONSE_PREFIX, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as StackTerminationProtectionError, ai as stripControlChars, an as s3BucketDomainName, ar as recoverMaskedOutput, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as safeStringify, bi as warnDeprecatedNoPrefixCliFlag, bn as malformedExportSourceWarning, br as hasReadableExportSet, bt as startInterruptWatch, c as replayFailedOperations, ci as Synthesizer, cn as s3BucketWebsiteUrl, cr as LockManager, ct as IAMRoleProvider, d as updatePartialMessage, da as withErrorHandling, di as getLegacyStateBucketName, dn as applyCallerIdentityCredentials, dr as UNREPRODUCIBLE_LOCK_CLAUSE, dt as ProviderRegistry, ea as PartialFailureError, ei as partitionSensitiveEnv, en as requireConfigString, er as isSingleDynamicReferenceToken, et as collectDeclaredOutputNames, f as updatePartialReason, fa as isMarkedNonRetryable, fi as resolveApp, fn as callerEnvCredentials, fr as buildForceUnlockCommand, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as markNonRetryable, gi as resolveStateBucketWithDefault, gn as STATE_RESOURCES_MALFORMED, gr as shellQuote, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as isTransientServerError, hi as resolveSkipPrefix, hn as INTRINSIC_KEYS, hr as formatLockExpiry, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as StackHasActiveImportsError, ii as escapeRegExp, in as s3BucketArn, ir as recordMaskOnlyValue, it as secretBearing, j as isFinalSnapshotError, ji as canonicalizeRegion, jn as refuseMalformedOutputs, jr as WorkGraph, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ki as expectedOwnerParam, kn as refuseDivergentRecordRegionForDestroy, kr as AssetPublisher, kt as IntrinsicFunctionResolver, l as replayRollback, li as synthesisStatusMessage, ln as applyRoleArnIfSet, lr as S3StateBackend, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as isThrottlingError, mi as resolveCaptureObservedState, mn as DiffCalculator, mr as forceQuitRecoveryClause, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as ResourceTimeoutError, ni as runDockerForeground, nn as producerRegionsFromState, nr as maskSecretsInError, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oi as AssetManifestLoader, on as s3BucketDualStackDomainName, or as redactSecretsForState, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as isRetryableTransientError, pi as resolveAutoAssetStorage, pn as envCredentialsAreAssumedRole, pr as buildLockContentionMessage, pt as createMaskedRetryLogger, q as formatResourceLine, qi as DynamicReferenceRegionAmbiguousError, qn as STATE_SOURCED_READBACK_RULES, qr as buildDockerImage, qt as configBooleanRefusal, r as DeployEngine, ra as ResourceUpdateNotSupportedError, ri as runDockerStreaming, rn as withSharedDrainBudget, rr as maskSecretsInText, rt as isExportAliasCollision, s as planRollback, sa as SynthesisError, si as getDockerImageBySourceHash, sn as s3BucketRegionalDomainName, sr as scrubResourceRecord, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as ProvisioningError, ti as redactDockerArgvValues, tn as classifyReplaySecretRegion, tr as markSameGenerationBag, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as normalizeAwsError, ui as getDefaultStateBucketName, un as AWS_CREDENTIAL_ENV_KEYS, ur as rebuildClientForBucketRegion, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as retryClassificationText, vi as resolveUseCdkBootstrapAssets, vn as hasReadableResources, vr as DEFAULT_STATE_PREFIX, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wi as MIGRATE_TMP_PREFIX, wn as malformedRenderedContainersWarning, wr as importableOutputs, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as ssmResolvedValueType, xn as malformedLocalOutputsWarning, xr as hasReasonlessBaselineRefusal, xt as CloudControlProvider, y as keptWholeReasonText, ya as describeAwsFailure, yi as stateBucketExistenceConfirmed, yn as malformedExportNamesWarning, yr as exportNamesCarriedFrom, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, zi as resetAwsClients, zn as findActionableSilentDrops, zr as ensureAssetStorage, zt as refStateLookupFromResource } from "./deploy-engine-pVC4fG22.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-BX4pJk0T.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-BIpCWEQx.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BguZAQtF.js";
+import { t as getCdkdVersion } from "./version-COEQwjCP.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CXLgFrPg.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12,7 +12,7 @@ import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesComman
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCodeSigningConfigCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCodeSigningConfigCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, GetRuntimeManagementConfigCommand, LambdaClient, ListTagsCommand, PublishLayerVersionCommand, PutFunctionCodeSigningConfigCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, PutRuntimeManagementConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupRulesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
-import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
+import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PolicyNotFoundException, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStackEventsCommand, DescribeStackResourcesCommand, DescribeStacksCommand, ExecuteChangeSetCommand, GetTemplateCommand, UpdateStackCommand, waitUntilChangeSetCreateComplete, waitUntilStackDeleteComplete, waitUntilStackImportComplete, waitUntilStackUpdateComplete } from "@aws-sdk/client-cloudformation";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteMethodCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetDeploymentCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
 import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
@@ -7137,7 +7137,7 @@ function manualBucketDeletionClause(bucketName, maskSecrets) {
 * disagree about what an `Id` is.
 */
 function configItemId(item) {
-	if (!isPlainObject$1(item)) return void 0;
+	if (!isPlainObject$2(item)) return void 0;
 	const id = item["Id"];
 	if (typeof id === "string") return id;
 	if (typeof id === "number" && Number.isFinite(id)) return String(id);
@@ -7157,7 +7157,7 @@ function configItemId(item) {
 function declaresBucketObjectLock(properties) {
 	return properties["ObjectLockEnabled"] === true || properties["ObjectLockEnabled"] === "true";
 }
-function isPlainObject$1(value) {
+function isPlainObject$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -7192,7 +7192,7 @@ function isFlattenedDestination(dest) {
 * via the critic's `--providers-dir=` seam.
 */
 function s3BucketDestinationPath(dest, destinationPath) {
-	return isPlainObject$1(dest) && isFlattenedDestination(dest) ? destinationPath : `${destinationPath}.S3BucketDestination`;
+	return isPlainObject$2(dest) && isFlattenedDestination(dest) ? destinationPath : `${destinationPath}.S3BucketDestination`;
 }
 /**
 * The FLATTENED CFn `Destination` block cdkd actually SENDS for `declared`
@@ -7231,9 +7231,9 @@ function s3BucketDestinationPath(dest, destinationPath) {
 *   resolver's own refusal to report).
 */
 function effectiveS3BucketDestination(declared, sentFormat) {
-	if (!isPlainObject$1(declared)) return declared;
+	if (!isPlainObject$2(declared)) return declared;
 	const bag = isFlattenedDestination(declared) ? declared : declared["S3BucketDestination"];
-	if (!isPlainObject$1(bag)) return declared;
+	if (!isPlainObject$2(bag)) return declared;
 	if (!bag["BucketArn"] && !bag["Bucket"]) return declared;
 	const out = {};
 	const bucketArn = bag["BucketArn"] ?? bag["Bucket"];
@@ -7364,7 +7364,7 @@ function effectiveInventoryItem(item, sent) {
 	const scheduleContainerUsable = configStringRefusal(declaredSchedule, "Frequency", INVENTORY_DEFAULT_SCHEDULE_FREQUENCY, "AWS::S3::Bucket InventoryConfigurations[].Schedule") === void 0;
 	const canFoldSchedule = sent?.frequency !== void 0 || scheduleFrequencyUsable || !declaresScheduleFrequency && scheduleContainerUsable;
 	if (canFoldSchedule) {
-		const declaredFrequency = declaresScheduleFrequency ? item["ScheduleFrequency"] : isPlainObject$1(declaredSchedule) && declaredSchedule["Frequency"] !== void 0 ? declaredSchedule["Frequency"] : INVENTORY_DEFAULT_SCHEDULE_FREQUENCY;
+		const declaredFrequency = declaresScheduleFrequency ? item["ScheduleFrequency"] : isPlainObject$2(declaredSchedule) && declaredSchedule["Frequency"] !== void 0 ? declaredSchedule["Frequency"] : INVENTORY_DEFAULT_SCHEDULE_FREQUENCY;
 		const frequency = sent?.frequency ?? declaredFrequency;
 		if (!Object.is(item["ScheduleFrequency"], frequency)) patch["ScheduleFrequency"] = frequency;
 	}
@@ -7395,9 +7395,9 @@ function effectiveInventoryItem(item, sent) {
 */
 function effectiveAnalyticsItem(item, sent) {
 	const storageClassAnalysis = item["StorageClassAnalysis"];
-	if (!isPlainObject$1(storageClassAnalysis)) return item;
+	if (!isPlainObject$2(storageClassAnalysis)) return item;
 	const dataExport = storageClassAnalysis["DataExport"];
-	if (!isPlainObject$1(dataExport)) return item;
+	if (!isPlainObject$2(dataExport)) return item;
 	const patch = {};
 	const outputSchemaVersion = sent?.outputSchemaVersion ?? declaredOrDefault(dataExport, "OutputSchemaVersion", ANALYTICS_DEFAULT_OUTPUT_SCHEMA_VERSION);
 	if (!Object.is(dataExport["OutputSchemaVersion"], outputSchemaVersion)) patch["OutputSchemaVersion"] = outputSchemaVersion;
@@ -7513,7 +7513,7 @@ const EVENTBRIDGE_DEFAULT_ENABLED = true;
 * correct once every declared-but-unusable value has been refused.
 */
 function eventBridgeEnabledOf(eb) {
-	const declared = isPlainObject$1(eb) ? eb["EventBridgeEnabled"] : void 0;
+	const declared = isPlainObject$2(eb) ? eb["EventBridgeEnabled"] : void 0;
 	return coerceCfnBoolean(declared) ?? EVENTBRIDGE_DEFAULT_ENABLED;
 }
 /** The notification families whose empty declaration is never SENT (issue #1759). */
@@ -7620,7 +7620,7 @@ function foldNotificationEvents(item) {
 *   handling).
 */
 function effectiveNotificationConfiguration(config) {
-	if (!isPlainObject$1(config)) return config;
+	if (!isPlainObject$2(config)) return config;
 	let out = config;
 	for (const [listKey, aliases] of NOTIFICATION_ARN_ALIASES) out = canonicalizeItemList(out, listKey, (item) => foldNotificationEvents(foldToleratedAliases(item, aliases)));
 	out = dropEmptyNotificationFamilies(out);
@@ -7677,8 +7677,8 @@ function foldEventBridgeConfiguration(config) {
 	if (eb === void 0) return config;
 	if (eb !== null && configBooleanRefusal(eb, "EventBridgeEnabled", EVENTBRIDGE_CONFIG_PATH)) return config;
 	const enabled = eb === null ? false : eventBridgeEnabledOf(eb);
-	const declared = isPlainObject$1(eb) ? eb["EventBridgeEnabled"] : void 0;
-	if (isPlainObject$1(eb) && Object.keys(eb).length === 1 && Object.is(declared, enabled)) return config;
+	const declared = isPlainObject$2(eb) ? eb["EventBridgeEnabled"] : void 0;
+	if (isPlainObject$2(eb) && Object.keys(eb).length === 1 && Object.is(declared, enabled)) return config;
 	return {
 		...config,
 		[EVENTBRIDGE_CONFIG_KEY]: { EventBridgeEnabled: enabled }
@@ -7758,7 +7758,7 @@ function deepSameValue(a, b) {
 		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((element, index) => deepSameValue(element, b[index]));
 	}
-	if (isPlainObject$1(a) && isPlainObject$1(b)) {
+	if (isPlainObject$2(a) && isPlainObject$2(b)) {
 		const keysA = Object.keys(a);
 		if (keysA.length !== Object.keys(b).length) return false;
 		return keysA.every((key) => key in b && deepSameValue(a[key], b[key]));
@@ -7833,9 +7833,9 @@ function foldLegacySingularTransitions(rule) {
 	let out;
 	for (const [pluralKey, singularKey] of LEGACY_SINGULAR_TRANSITIONS) {
 		const singular = rule[singularKey];
-		const hasSingular = isPlainObject$1(singular);
+		const hasSingular = isPlainObject$2(singular);
 		const plural = rule[pluralKey];
-		const needsFilter = Array.isArray(plural) && plural.some((element) => !isPlainObject$1(element));
+		const needsFilter = Array.isArray(plural) && plural.some((element) => !isPlainObject$2(element));
 		if (!hasSingular && !needsFilter) continue;
 		let collided = false;
 		const merged = mergeLegacySingular(plural, hasSingular ? singular : void 0, () => {
@@ -7943,7 +7943,7 @@ function foldLifecycleExpiration(rule) {
 		const iso = cfnDateToIso(expiration);
 		if (iso === void 0) return rule;
 		date = iso;
-	} else if (isPlainObject$1(expiration)) {
+	} else if (isPlainObject$2(expiration)) {
 		if (expiration["Days"] !== void 0) days = expiration["Days"];
 		if (expiration["Date"]) {
 			const iso = cfnDateToIso(expiration["Date"]);
@@ -7991,10 +7991,10 @@ function foldNoncurrentVersionExpiration(rule) {
 	const legacy = rule["NoncurrentVersionExpirationInDays"];
 	if (legacy === void 0) return rule;
 	const declaredObject = rule["NoncurrentVersionExpiration"];
-	if (declaredObject !== void 0 && !isPlainObject$1(declaredObject)) return rule;
+	if (declaredObject !== void 0 && !isPlainObject$2(declaredObject)) return rule;
 	const out = { ...rule };
 	delete out["NoncurrentVersionExpirationInDays"];
-	if (isPlainObject$1(declaredObject)) return out;
+	if (isPlainObject$2(declaredObject)) return out;
 	const days = coerceCfnNumber(legacy);
 	if (days === void 0) return rule;
 	out["NoncurrentVersionExpiration"] = { NoncurrentDays: days };
@@ -8089,10 +8089,10 @@ function foldLifecycleScope(rule, useFilterForm) {
 * @returns `config` BY IDENTITY when the declared bag IS what goes on the wire.
 */
 function effectiveLifecycleConfiguration(config) {
-	if (!isPlainObject$1(config)) return config;
+	if (!isPlainObject$2(config)) return config;
 	const rules = config["Rules"];
 	if (!Array.isArray(rules)) return config;
-	const objectRules = rules.filter(isPlainObject$1);
+	const objectRules = rules.filter(isPlainObject$2);
 	if (objectRules.length !== rules.length || objectRules.length === 0) return config;
 	if (objectRules.some(lifecycleRuleRefused)) return config;
 	const useFilterForm = lifecycleUsesFilterForm(objectRules);
@@ -8178,7 +8178,7 @@ function canonicalizeItemList(properties, key, fold) {
 	if (!Array.isArray(list)) return properties;
 	let changed = false;
 	const mapped = list.map((element) => {
-		if (!isPlainObject$1(element)) return element;
+		if (!isPlainObject$2(element)) return element;
 		const next = fold(element);
 		if (next !== element) changed = true;
 		return next;
@@ -8198,7 +8198,7 @@ function describeValue$1(value, maskSecrets = (text) => text) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return `a string ${JSON.stringify(maskDeep(value, maskSecrets))}`;
-	if (isPlainObject$1(value)) return `an object with keys [${Object.keys(value).map((key) => maskSecrets(key)).join(", ")}]`;
+	if (isPlainObject$2(value)) return `an object with keys [${Object.keys(value).map((key) => maskSecrets(key)).join(", ")}]`;
 	return `a ${typeof value} (${maskSecrets(String(value))})`;
 }
 /**
@@ -8223,8 +8223,8 @@ function coerceCfnNumber(value) {
 * StorageClass collision, and say so rather than dropping in silence.
 */
 function mergeLegacySingular(plural, singular, onCollision) {
-	const out = (Array.isArray(plural) ? plural : []).filter(isPlainObject$1);
-	if (!isPlainObject$1(singular)) return out;
+	const out = (Array.isArray(plural) ? plural : []).filter(isPlainObject$2);
+	if (!isPlainObject$2(singular)) return out;
 	const sc = singular["StorageClass"];
 	if (typeof sc === "string" && out.some((e) => e["StorageClass"] === sc)) {
 		onCollision(sc);
@@ -8722,7 +8722,7 @@ var S3BucketProvider = class S3BucketProvider {
 				if (!(exp?.["Days"] !== void 0 || exp?.["Date"] !== void 0)) sdkRule.Expiration = { ExpiredObjectDeleteMarker: true };
 				else this.logger.warn(`Lifecycle rule '${rule["Id"] ?? "<unnamed>"}' on ${bucketName} sets ExpiredObjectDeleteMarker alongside an expiration Days/Date; S3 forbids combining them, so the delete-marker cleanup was not applied.`);
 			}
-			const nve = isPlainObject$1(rule["NoncurrentVersionExpiration"]) ? rule["NoncurrentVersionExpiration"] : void 0;
+			const nve = isPlainObject$2(rule["NoncurrentVersionExpiration"]) ? rule["NoncurrentVersionExpiration"] : void 0;
 			const legacyNveDays = rule["NoncurrentVersionExpirationInDays"];
 			if (nve) sdkRule.NoncurrentVersionExpiration = {
 				NoncurrentDays: nve["NoncurrentDays"],
@@ -8747,7 +8747,7 @@ var S3BucketProvider = class S3BucketProvider {
 			const singularTransition = rule["Transition"];
 			const allTransitions = mergeLegacySingular(transitions, singularTransition, (sc) => this.logger.warn(`Lifecycle rule '${rule["Id"] ?? "<unnamed>"}' on ${bucketName} declares both Transitions and the legacy Transition for storage class ${sc}; S3 rejects duplicates, so the legacy singular was ignored.`));
 			if (allTransitions.length > 0) sdkRule.Transitions = allTransitions.map(toSdkTransition);
-			const abort = isPlainObject$1(rule["AbortIncompleteMultipartUpload"]) ? rule["AbortIncompleteMultipartUpload"] : void 0;
+			const abort = isPlainObject$2(rule["AbortIncompleteMultipartUpload"]) ? rule["AbortIncompleteMultipartUpload"] : void 0;
 			if (abort) sdkRule.AbortIncompleteMultipartUpload = { DaysAfterInitiation: abort["DaysAfterInitiation"] };
 			const { prefix, tagFilters, sizeGt, sizeLt } = lifecycleRuleScope(rule);
 			const hasTags = tagFilters != null && tagFilters.length > 0;
@@ -9081,10 +9081,10 @@ var S3BucketProvider = class S3BucketProvider {
 			throw new Error(message);
 		};
 		if (dest === void 0 || dest === null) return;
-		if (!isPlainObject$1(dest)) return drop(`${destinationPath} must be an object (got ${describeValue$1(dest, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		if (!isPlainObject$2(dest)) return drop(`${destinationPath} must be an object (got ${describeValue$1(dest, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
 		const bag = isFlattenedDestination(dest) ? dest : dest["S3BucketDestination"];
 		if (bag === void 0 || bag === null) return drop(`${destinationPath} carries neither a bucket (BucketArn / Bucket) nor a nested S3BucketDestination object (got ${describeValue$1(dest, maskSecrets)}) — the destination would otherwise be dropped from the request with no error`);
-		if (!isPlainObject$1(bag)) return drop(`${nestedPath} must be an object (got ${describeValue$1(bag, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		if (!isPlainObject$2(bag)) return drop(`${nestedPath} must be an object (got ${describeValue$1(bag, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
 		if (!bag["BucketArn"] && !bag["Bucket"]) return drop(`${bag === dest ? destinationPath : nestedPath} has no destination bucket (BucketArn / Bucket) (got ${describeValue$1(bag, maskSecrets)}) — the request would be rejected by S3, or silently carry no destination`);
 		return bag;
 	}
@@ -17153,6 +17153,301 @@ function reverseMapIndexContributorInsights(status, mode, declaredBlock) {
 	return block;
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-stream-members.ts
+/**
+* The two `AWS::DynamoDB::Table` `StreamSpecification` members that are NOT
+* members of the SDK's `StreamSpecification`: `ResourcePolicy`
+* (`{ PolicyDocument }`, the resource-based policy of the STREAM) and `Tags`
+* (issue [#3458](https://github.com/go-to-k/cdkd/issues/3458)).
+*
+* `CreateTable` / `UpdateTable` take only `{ StreamEnabled, StreamViewType }`,
+* so a block carrying either member deployed green with neither applied — a
+* template granting access to a table's stream left the stream with no policy.
+* CloudFormation applies both against the STREAM arn (`LatestStreamArn`),
+* re-applies both after a `StreamViewType` change (which mints a NEW arn), and
+* REMOVES both when the member leaves a block whose stream stays (measured on
+* real CloudFormation; the measurements are on the issue).
+*
+* Pure, so the write plan, the create-time refusal and the drift read-back
+* gate cannot answer "does this block declare the member" differently.
+*/
+/** The CFn property holding both members. */
+const STREAM_SPECIFICATION_KEY = "StreamSpecification";
+/** The stream's resource-based policy member. */
+const STREAM_POLICY_KEY = "ResourcePolicy";
+/** The stream's tag-list member. */
+const STREAM_TAGS_KEY = "Tags";
+const POLICY_PATH = `${STREAM_SPECIFICATION_KEY}.${STREAM_POLICY_KEY}`;
+const TAGS_PATH = `${STREAM_SPECIFICATION_KEY}.${STREAM_TAGS_KEY}`;
+function isPlainObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The message a `config-shape` guard would throw, or `undefined`. */
+function refusalOf(guard) {
+	try {
+		guard();
+		return;
+	} catch (error) {
+		return describeAwsFailure(error).detail;
+	}
+}
+/** The members of a `StreamSpecification` block, or none for a non-object. */
+function blockMembers(block) {
+	return isPlainObject$1(block) ? block : {};
+}
+/**
+* Read `StreamSpecification.ResourcePolicy`.
+*
+* The CFn shape is `{ PolicyDocument: <object | JSON string> }` and the
+* document is REQUIRED, so a block without one is unreadable rather than "no
+* policy": reading it as absent would DELETE the live policy on an update.
+*/
+function readStreamPolicy(block) {
+	const value = blockMembers(block)[STREAM_POLICY_KEY];
+	if (value === void 0 || value === null) return { kind: "absent" };
+	const containerRefusal = refusalOf(() => requireConfigObject(value, POLICY_PATH));
+	if (containerRefusal !== void 0) return {
+		kind: "unusable",
+		reason: containerRefusal
+	};
+	const documentPath = `${POLICY_PATH}.PolicyDocument`;
+	const document = value["PolicyDocument"];
+	if (typeof document === "string") return document.trim() === "" ? {
+		kind: "unusable",
+		reason: `${documentPath} must not be a blank string`
+	} : {
+		kind: "usable",
+		document
+	};
+	if (document === void 0 || document === null) return {
+		kind: "unusable",
+		reason: `${documentPath} is required when ${POLICY_PATH} is declared`
+	};
+	const documentRefusal = refusalOf(() => requireConfigObject(document, documentPath));
+	if (documentRefusal !== void 0) return {
+		kind: "unusable",
+		reason: documentRefusal
+	};
+	return {
+		kind: "usable",
+		document: JSON.stringify(document)
+	};
+}
+/**
+* Read `StreamSpecification.Tags`.
+*
+* Refusals name an entry by POSITION, never by its key: the key is a RESOLVED
+* template value, and a copy embedded here would reach only the substring
+* mask, which ignores a value shorter than its minimum needle.
+*
+* ONE unreadable entry makes the whole list unusable. Filtering it out would
+* send a list nobody declared, and on an update would untag a key the
+* unreadable entry may well have named.
+*/
+function readStreamTags(block) {
+	const value = blockMembers(block)[STREAM_TAGS_KEY];
+	if (value === void 0 || value === null) return { kind: "absent" };
+	if (!Array.isArray(value)) return {
+		kind: "unusable",
+		reason: `${TAGS_PATH} must be an array of {Key, Value} entries`
+	};
+	const tags = /* @__PURE__ */ new Map();
+	for (const [position, entry] of value.entries()) {
+		const entryPath = `${TAGS_PATH}[${position}]`;
+		const refusal = refusalOf(() => requireConfigObject(entry, entryPath)) ?? configStringRefusal(entry, "Key", "required", entryPath) ?? configStringRefusal(entry, "Value", "", entryPath);
+		if (refusal !== void 0) return {
+			kind: "unusable",
+			reason: refusal
+		};
+		const { Key: key, Value: tagValue } = entry;
+		if (typeof key !== "string") return {
+			kind: "unusable",
+			reason: `${entryPath}.Key is required`
+		};
+		tags.set(key, typeof tagValue === "string" ? tagValue : "");
+	}
+	return {
+		kind: "usable",
+		tags
+	};
+}
+/**
+* Every refusal a CREATE must raise before `CreateTable` goes out. A create has
+* no live setting to leave alone, so an unreadable member there is a template
+* error, not a skip — and refusing after the table exists would create it only
+* to delete it again.
+*/
+function streamMemberRefusals(block) {
+	const refusals = [];
+	const policy = readStreamPolicy(block);
+	if (policy.kind === "unusable") refusals.push(policy.reason);
+	const tags = readStreamTags(block);
+	if (tags.kind === "unusable") refusals.push(tags.reason);
+	return refusals;
+}
+/**
+* The calls one update (or create) needs against the CURRENT stream arn.
+*
+* `freshStream` says the arn the calls will address was minted by THIS
+* operation — a create, an update-time enable, or the disable / re-enable a
+* `StreamViewType` change is applied as. A fresh stream holds nothing, so the
+* previous side is irrelevant there: every readable declared member is
+* applied, and nothing is deleted. Otherwise the stream is the one the previous
+* side was applied to, and the plan is the difference. `contentsUnknown` is
+* the third case: a live stream this operation did NOT mint and the previous
+* side does not describe (a re-run after a deploy that enabled the stream,
+* applied a policy, and failed before state recorded any of it). It may hold a
+* policy, so it is never planned as empty: a policy the desired side does not
+* declare is deleted, and a declared one is always put.
+*
+* On a stream the previous side describes:
+*
+* - a member `absent` with a DECLARED previous is a template REMOVAL and is
+*   removed (CloudFormation does the same). Because the rule is symmetric in
+*   its two sides, a rollback — which replays `update()` with the sides SWAPPED
+*   — restores the old policy and tags through the same arms, a view-type
+*   change included (the rollback mints yet another arn, and `freshStream`
+*   applies the old members to it).
+* - an `unusable` member reaches this plan only from a STATE-borne caller (a
+*   rollback replay, `drift --revert`): the provider refuses it on the template
+*   path before any call. It reports through `onUnusable` and the live setting
+*   is left alone rather than overwritten with a guess: no call on a stream
+*   that stays, and the PREVIOUS member carried over onto a fresh one.
+* - an `unusable` PREVIOUS tag list cannot say which keys cdkd applied, so a
+*   removal against it untags nothing.
+*
+* ORDER is part of the contract, because a resource policy is an access grant
+* and can condition on `aws:ResourceTag`: `deletePolicy` comes FIRST and
+* `putPolicy` LAST. A policy that CHANGES together with the tags is therefore
+* deleted before the first tag call and put back after the last, so neither
+* the old policy nor the new one is ever evaluated against the other side's
+* tag set — also when a call in between fails. The price is a window with NO
+* policy, which drops that policy's `Deny` statements along with its grants;
+* nothing here is atomic, and that window is the narrower of the two hazards.
+* An UNCHANGED policy stays in place across a tag-only change: both sides
+* declare it, and the two tag calls cannot be made one.
+*
+* The caller asks only while the DESIRED side has a stream: a disabled stream
+* is gone and takes both members with it, so nothing addresses its dead arn.
+*/
+function planStreamMemberOps(desiredBlock, previousBlock, options, onUnusable) {
+	let desiredPolicy = readStreamPolicy(desiredBlock);
+	let desiredTags = readStreamTags(desiredBlock);
+	if (desiredPolicy.kind === "unusable") onUnusable(desiredPolicy.reason);
+	if (desiredTags.kind === "unusable") onUnusable(desiredTags.reason);
+	let previousPolicy = readStreamPolicy(previousBlock);
+	let previousTags = readStreamTags(previousBlock);
+	if (options.freshStream) {
+		if (desiredPolicy.kind === "unusable" && previousPolicy.kind === "usable") desiredPolicy = previousPolicy;
+		if (desiredTags.kind === "unusable" && previousTags.kind === "usable") desiredTags = previousTags;
+		previousPolicy = { kind: "absent" };
+		previousTags = { kind: "absent" };
+	} else if (options.contentsUnknown === true) {
+		previousPolicy = {
+			kind: "unusable",
+			reason: ""
+		};
+		previousTags = { kind: "absent" };
+	}
+	const tagOps = [];
+	if (desiredTags.kind !== "unusable") {
+		const desired = desiredTags.kind === "usable" ? desiredTags.tags : /* @__PURE__ */ new Map();
+		const previous = previousTags.kind === "usable" ? previousTags.tags : /* @__PURE__ */ new Map();
+		const keysToRemove = [...previous.keys()].filter((key) => !desired.has(key));
+		if (keysToRemove.length > 0) tagOps.push({
+			kind: "untag",
+			keys: keysToRemove
+		});
+		const tagsToSet = [...desired].filter(([key, value]) => previous.get(key) !== value).map(([Key, Value]) => ({
+			Key,
+			Value
+		}));
+		if (tagsToSet.length > 0) tagOps.push({
+			kind: "tag",
+			tags: tagsToSet
+		});
+	}
+	const policyPut = desiredPolicy.kind === "usable" && !(previousPolicy.kind === "usable" && samePolicyDocument(previousPolicy.document, desiredPolicy.document));
+	const policyDelete = previousPolicy.kind !== "absent" && (desiredPolicy.kind === "absent" || policyPut && tagOps.length > 0);
+	const ops = [];
+	if (policyDelete) ops.push({ kind: "deletePolicy" });
+	ops.push(...tagOps);
+	if (policyPut && desiredPolicy.kind === "usable") ops.push({
+		kind: "putPolicy",
+		document: desiredPolicy.document
+	});
+	return ops;
+}
+/** Two policy JSON strings saying the same thing, whatever their key order. */
+function samePolicyDocument(left, right) {
+	if (left === right) return true;
+	try {
+		return canonicalJson$1(JSON.parse(left)) === canonicalJson$1(JSON.parse(right));
+	} catch {
+		return false;
+	}
+}
+/** The drift read-back gates: one API call each, so each is asked separately. */
+function streamDeclaresPolicy(desiredBlock) {
+	return readStreamPolicy(desiredBlock).kind === "usable";
+}
+/** See {@link streamDeclaresPolicy}. */
+function streamDeclaresTags(desiredBlock) {
+	return readStreamTags(desiredBlock).kind === "usable";
+}
+/**
+* Re-shape a `GetResourcePolicy` answer into the CFn member, in the DECLARED
+* spelling of `PolicyDocument`: a template may carry the document as an object
+* or as a JSON string, and the comparator does not convert between them.
+* `undefined` when AWS holds no policy.
+*/
+function reverseMapStreamPolicy(livePolicy, desiredBlock) {
+	if (livePolicy === void 0 || livePolicy === "") return void 0;
+	const declared = blockMembers(blockMembers(desiredBlock)[STREAM_POLICY_KEY])["PolicyDocument"];
+	let parsed;
+	try {
+		parsed = JSON.parse(livePolicy);
+	} catch {
+		return { PolicyDocument: livePolicy };
+	}
+	if (typeof declared !== "string") return { PolicyDocument: parsed };
+	let declaredParsed;
+	try {
+		declaredParsed = JSON.parse(declared);
+	} catch {
+		return { PolicyDocument: livePolicy };
+	}
+	return { PolicyDocument: canonicalJson$1(declaredParsed) === canonicalJson$1(parsed) ? declared : livePolicy };
+}
+/**
+* Does the live policy say what the DECLARED one says? The read-back's
+* "settled" test: `GetResourcePolicy` is eventually consistent and can answer
+* with the PREVIOUS policy right after a put, so an answer that differs from
+* the declaration is re-asked before it is believed.
+*/
+function streamPolicyMatchesDeclared(livePolicy, desiredBlock) {
+	const declared = readStreamPolicy(desiredBlock);
+	if (declared.kind !== "usable" || livePolicy === void 0) return false;
+	try {
+		return canonicalJson$1(JSON.parse(livePolicy)) === canonicalJson$1(JSON.parse(declared.document));
+	} catch {
+		return false;
+	}
+}
+/** The tag twin of {@link streamPolicyMatchesDeclared}, over USER tags. */
+function streamTagsMatchDeclared(liveTags, desiredBlock) {
+	const declared = readStreamTags(desiredBlock);
+	if (declared.kind !== "usable" || liveTags.length !== declared.tags.size) return false;
+	return liveTags.every((tag) => declared.tags.get(tag.Key) === tag.Value);
+}
+/** A key-order-independent serialization. */
+function canonicalJson$1(value) {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson$1).join(",")}]`;
+	if (isPlainObject$1(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson$1(value[key])}`).join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+}
+
 //#endregion
 //#region src/provisioning/dynamodb-index-busy-delete.ts
 /**
@@ -19249,6 +19544,8 @@ var DynamoDBTableProvider = class {
 			if (context?.replayingState !== true) {
 				const [refusal] = contributorInsightsRefusals(properties["ContributorInsightsSpecification"], properties["GlobalSecondaryIndexes"]);
 				if (refusal !== void 0) throw new Error(`${refusal}. Fix the template value`);
+				const [streamRefusal] = streamMemberRefusals(properties["StreamSpecification"]);
+				if (streamRefusal !== void 0) throw new Error(`${streamRefusal}. Fix the template value`);
 			}
 			const createParams = {
 				TableName: tableName,
@@ -19293,6 +19590,7 @@ var DynamoDBTableProvider = class {
 			await this.applyKinesisStreamingDestination(tableName, properties["KinesisStreamSpecification"], void 0, maskSecrets);
 			await this.applyContributorInsights(tableName, properties["ContributorInsightsSpecification"], void 0, maskSecrets);
 			await this.applyIndexContributorInsights(tableName, properties["GlobalSecondaryIndexes"], void 0, maskSecrets);
+			await this.applyStreamMembers(logicalId, resourceType, tableName, tableInfo.streamArn, properties["StreamSpecification"], void 0, true, maskSecrets);
 			this.logger.debug(`Successfully created DynamoDB table ${logicalId}: ${tableName}`);
 			return {
 				physicalId: tableName,
@@ -19328,6 +19626,10 @@ var DynamoDBTableProvider = class {
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		debug(`Updating DynamoDB table ${logicalId}: ${maskSecrets(physicalId)}`);
 		try {
+			if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true && JSON.stringify(properties["StreamSpecification"]) !== JSON.stringify(previousProperties["StreamSpecification"])) {
+				const [streamRefusal] = streamMemberRefusals(properties["StreamSpecification"]);
+				if (streamRefusal !== void 0) throw new ProvisioningError(`${streamRefusal}. Nothing was applied to DynamoDB table ${logicalId}; fix the template value`, resourceType, logicalId, physicalId);
+			}
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
 			let latestStreamArn = table?.LatestStreamArn;
 			if (table?.TableArn) await this.applyTagDiff(table.TableArn, previousProperties["Tags"], properties["Tags"]);
@@ -19479,6 +19781,10 @@ var DynamoDBTableProvider = class {
 			if (JSON.stringify(properties["StreamSpecification"]) !== JSON.stringify(previousProperties["StreamSpecification"])) {
 				const newViewType = this.extractStreamViewType(properties["StreamSpecification"]);
 				const prevViewType = this.extractStreamViewType(previousProperties["StreamSpecification"]);
+				const liveStream = table?.StreamSpecification;
+				const preUpdateStreamArn = table?.LatestStreamArn;
+				let mintedStream = false;
+				let contentsUnknown = false;
 				if (newViewType && prevViewType && newViewType !== prevViewType) {
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
@@ -19493,9 +19799,11 @@ var DynamoDBTableProvider = class {
 						}
 					}));
 					await this.waitForTableActiveAfterUpdate(physicalId);
-					latestStreamArn = reenable.TableDescription?.LatestStreamArn ?? await this.describeLatestStreamArn(physicalId);
+					latestStreamArn = await this.resolveMintedStreamArn(physicalId, reenable.TableDescription?.LatestStreamArn, preUpdateStreamArn);
+					mintedStream = true;
 					this.logger.debug(`Changed StreamViewType on DynamoDB table ${physicalId} to ${newViewType}`);
-				} else if (newViewType) {
+				} else if (newViewType && liveStream?.StreamEnabled === true && liveStream.StreamViewType === newViewType) contentsUnknown = prevViewType !== newViewType;
+				else if (newViewType) {
 					const enable = await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
 						StreamSpecification: {
@@ -19504,7 +19812,8 @@ var DynamoDBTableProvider = class {
 						}
 					}));
 					await this.waitForTableActiveAfterUpdate(physicalId);
-					latestStreamArn = enable.TableDescription?.LatestStreamArn ?? await this.describeLatestStreamArn(physicalId);
+					latestStreamArn = await this.resolveMintedStreamArn(physicalId, enable.TableDescription?.LatestStreamArn, preUpdateStreamArn);
+					mintedStream = true;
 					this.logger.debug(`Enabled DynamoDB Stream on table ${physicalId} (${newViewType})`);
 				} else {
 					await this.dynamoDBClient.send(new UpdateTableCommand({
@@ -19515,6 +19824,7 @@ var DynamoDBTableProvider = class {
 					latestStreamArn = void 0;
 					this.logger.debug(`Disabled DynamoDB Stream on table ${physicalId}`);
 				}
+				if (newViewType) await this.applyStreamMembers(logicalId, resourceType, physicalId, latestStreamArn, properties["StreamSpecification"], previousProperties["StreamSpecification"], mintedStream, maskSecrets, mintedStream ? preUpdateStreamArn : void 0, contentsUnknown);
 			}
 			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"], gsiHandledByBillingFlip, currentLiveIndexNames, currentLiveIndexByName, liveCapacityComparable, effectiveBillingMode === "PAY_PER_REQUEST", maskSecrets);
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"], maskSecrets);
@@ -19745,15 +20055,16 @@ var DynamoDBTableProvider = class {
 	* Backoff: ~2s,4s,8s,16s,30s,30s... bounded to ~2min total, which comfortably
 	* covers the few-second PITR-enable window.
 	*/
-	async retryOnTransientControlPlane(op, label, maxAttempts = 8) {
+	async retryOnTransientControlPlane(op, label, maxAttempts = 8, options = {}) {
 		let delayMs = 2e3;
 		for (let attempt = 1;; attempt++) try {
 			return await op();
 		} catch (error) {
 			const msg = describeAwsFailure(error).detail;
 			const name = error instanceof Error ? error.name : "";
-			if (!(/being enabled|being updated|please retry later|backups are being/i.test(msg) || name === "ResourceInUseException" || name === "LimitExceededException") || attempt >= maxAttempts) throw error;
-			this.logger.debug(`Transient error on "${label}" (attempt ${attempt}/${maxAttempts}): ${msg} — retrying in ${delayMs}ms`);
+			if (!(/being enabled|being updated|please retry later|backups are being/i.test(msg) || name === "ResourceInUseException" || name === "LimitExceededException" || options.alsoTransient?.(error) === true) || attempt >= maxAttempts) throw error;
+			const retryLine = `Transient error on "${label}" (attempt ${attempt}/${maxAttempts}): ${msg} — retrying in ${delayMs}ms`;
+			this.logger.debug(options.maskSecrets ? options.maskSecrets(retryLine) : retryLine);
 			await new Promise((resolve) => setTimeout(resolve, delayMs));
 			delayMs = Math.min(delayMs * 2, 3e4);
 		}
@@ -19929,6 +20240,90 @@ var DynamoDBTableProvider = class {
 		return typeof viewType === "string" && viewType.length > 0 ? viewType : void 0;
 	}
 	/**
+	* Apply `StreamSpecification.ResourcePolicy` / `.Tags` (issue
+	* [#3458](https://github.com/go-to-k/cdkd/issues/3458)) against the STREAM
+	* arn. Neither is a member of the SDK's `StreamSpecification`, so until this
+	* existed both were dropped on `CreateTable` / `UpdateTable`: the deploy was
+	* green and the stream had no policy.
+	*
+	* `streamArn` must be the table's CURRENT `LatestStreamArn` — after a
+	* `StreamViewType` change that is the arn the re-enable minted, never the
+	* recorded one. What to call, in which order, and the removal / rollback /
+	* unreadable-member rules live on {@link planStreamMemberOps}.
+	*
+	* A plan with calls to make and no arn to make them against — or, when this
+	* operation minted the stream, only the `deadStreamArn` read before it —
+	* fails LOUDLY: a
+	* silent skip would record the policy in state as applied, the next deploy
+	* would see no difference, and the grant would stay missing for good.
+	*
+	* The policy text is never logged: it names principals and can carry a
+	* resolved secret in a condition value.
+	*/
+	async applyStreamMembers(logicalId, resourceType, tableName, streamArn, desiredBlock, previousBlock, freshStream, maskSecrets, deadStreamArn, contentsUnknown = false) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		const debug = (message) => this.logger.debug(maskSecrets(message));
+		const ops = planStreamMemberOps(desiredBlock, previousBlock, {
+			freshStream,
+			contentsUnknown
+		}, (reason) => warn(`DynamoDB table ${tableName}: ${reason}, so that member of the stream was left as it is. The value came from a recorded state, which a template edit cannot reach.`));
+		if (ops.length === 0) return;
+		if (streamArn === void 0 || streamArn === "" || streamArn === deadStreamArn) throw new ProvisioningError(`Cannot apply StreamSpecification.ResourcePolicy / Tags for DynamoDB table ${logicalId}: DescribeTable returned no ${deadStreamArn === void 0 ? "" : "new "}LatestStreamArn`, resourceType, logicalId, tableName);
+		for (const op of ops) {
+			await this.sendStreamMemberOp(streamArn, op, freshStream, maskSecrets);
+			debug(`Applied ${op.kind} to the stream of DynamoDB table ${tableName}`);
+		}
+	}
+	/** Issue ONE {@link StreamMemberOp} against the stream arn. */
+	async sendStreamMemberOp(streamArn, op, freshStream, maskSecrets) {
+		const target = maskSecrets(streamArn);
+		const retryOptions = {
+			maskSecrets,
+			...freshStream ? { alsoTransient: (error) => error instanceof ResourceNotFoundException$1 } : {}
+		};
+		const send = (call, label) => this.retryOnTransientControlPlane(call, label, void 0, retryOptions);
+		switch (op.kind) {
+			case "deletePolicy":
+				try {
+					await send(() => this.dynamoDBClient.send(new DeleteResourcePolicyCommand({ ResourceArn: streamArn })), `delete the stream ResourcePolicy of ${target}`);
+				} catch (error) {
+					if (!(error instanceof PolicyNotFoundException)) throw error;
+				}
+				return;
+			case "untag":
+				await send(() => this.dynamoDBClient.send(new UntagResourceCommand$2({
+					ResourceArn: streamArn,
+					TagKeys: op.keys
+				})), `untag the stream ${target}`);
+				return;
+			case "tag":
+				await send(() => this.dynamoDBClient.send(new TagResourceCommand$2({
+					ResourceArn: streamArn,
+					Tags: op.tags
+				})), `tag the stream ${target}`);
+				return;
+			case "putPolicy":
+				await send(() => this.dynamoDBClient.send(new PutResourcePolicyCommand({
+					ResourceArn: streamArn,
+					Policy: op.document
+				})), `put the stream ResourcePolicy of ${target}`);
+				return;
+		}
+	}
+	/**
+	* The arn of the stream an enabling `UpdateTable` just minted.
+	*
+	* The arn that call echoes is believed only when it DIFFERS from the one read
+	* before the update: DynamoDB keeps reporting a disabled stream's arn as
+	* `LatestStreamArn`, so an echo equal to it (or no echo) is re-read from
+	* `DescribeTable` after the ACTIVE wait. Shared by the enable and the
+	* view-type arms — a table whose stream was disabled by an earlier deploy is
+	* in the same state as one mid view-type change.
+	*/
+	async resolveMintedStreamArn(tableName, echoedArn, preUpdateArn) {
+		return echoedArn !== void 0 && echoedArn !== preUpdateArn ? echoedArn : this.describeLatestStreamArn(tableName);
+	}
+	/**
 	* Fetch the table's current `LatestStreamArn` via DescribeTable. Used as a
 	* fallback when an UpdateTable that enabled a stream did not echo the ARN
 	* back in its TableDescription, so `Fn::GetAtt [Table, StreamArn]` still
@@ -21115,9 +21510,12 @@ var DynamoDBTableProvider = class {
 	* shape differences are wrapping:
 	*  - BillingMode lives under `BillingModeSummary.BillingMode` in the API
 	*    response, but the CFn property is a flat `BillingMode` string.
-	*  - StreamSpecification's CFn shape includes only `StreamViewType`; the
-	*    API response carries `StreamEnabled` too. We surface both since the
-	*    drift comparator only descends into keys present in state.
+	*  - StreamSpecification's CFn shape is `StreamViewType`, `ResourcePolicy`
+	*    and `Tags`; the API response carries `StreamEnabled` and
+	*    `StreamViewType` only. `StreamEnabled` is surfaced too, since the
+	*    comparator descends a `properties` baseline by the keys state holds.
+	*    `ResourcePolicy` / `Tags` (issue #3458) live on the STREAM arn and are
+	*    read from it, each only when the desired block declares that member.
 	*  - GSI / LSI in the API response include `IndexStatus`, `Backfilling`,
 	*    `ItemCount`, `IndexArn` and sizing fields cdkd never sets. They used to
 	*    be forwarded VERBATIM under a comment claiming "the comparator filters
@@ -21173,10 +21571,14 @@ var DynamoDBTableProvider = class {
 				if (table.WarmThroughput.WriteUnitsPerSecond !== void 0) wt["WriteUnitsPerSecond"] = table.WarmThroughput.WriteUnitsPerSecond;
 				if (Object.keys(wt).length > 0) result["WarmThroughput"] = wt;
 			}
-			if (table.StreamSpecification?.StreamEnabled && table.StreamSpecification.StreamViewType) result["StreamSpecification"] = {
-				StreamEnabled: true,
-				StreamViewType: table.StreamSpecification.StreamViewType
-			};
+			if (table.StreamSpecification?.StreamEnabled && table.StreamSpecification.StreamViewType) {
+				const streamBlock = {
+					StreamEnabled: true,
+					StreamViewType: table.StreamSpecification.StreamViewType
+				};
+				result["StreamSpecification"] = streamBlock;
+				await this.readStreamMembers(physicalId, table.LatestStreamArn, properties?.["StreamSpecification"], streamBlock);
+			}
 			const bagInformative = desiredBagIsInformative(properties);
 			if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) {
 				const desiredByName = desiredIndexEntriesByName(properties?.["GlobalSecondaryIndexes"]);
@@ -21277,6 +21679,92 @@ var DynamoDBTableProvider = class {
 		}
 	}
 	/**
+	* How long an eventually-consistent stream-member read that does NOT match
+	* the declaration is re-asked before it is believed: one entry per extra
+	* attempt.
+	*/
+	streamMemberRereadDelaysMs = [
+		500,
+		1e3,
+		2e3
+	];
+	/** Run `read`, re-asking after each configured delay until `settled` accepts the answer. */
+	async reAskUntilSettled(read, settled) {
+		let answer = await read();
+		for (const delayMs of this.streamMemberRereadDelaysMs) {
+			if (settled(answer)) break;
+			await new Promise((resolve) => setTimeout(resolve, delayMs));
+			answer = await read();
+		}
+		return answer;
+	}
+	/**
+	* Read `StreamSpecification.ResourcePolicy` / `.Tags` (issue #3458) off the
+	* table's CURRENT stream arn into `streamBlock`.
+	*
+	* One API call per member, so each is GATED on the desired block declaring a
+	* member cdkd would send — the same reader the write plan runs. The gate is
+	* also what keeps an undeclared member out of an `observedProperties`
+	* baseline, which is compared by the UNION of both sides' keys.
+	*
+	* No policy (`PolicyNotFoundException`) and an empty user tag set emit
+	* NOTHING: that is "absent" in the template's own spelling, which a
+	* declared member then reports as drift (a declared EMPTY list is the one
+	* exception, and reads back as the empty list it is). `aws:`-prefixed system tags are
+	* dropped like the table-level ones, and the list needs no unordered path —
+	* the comparator sorts every `{Key, ...}` list on both sides. Any other
+	* failed read omits the member and says why at debug level, like the sibling
+	* reads of this method.
+	*
+	* Both reads are EVENTUALLY consistent — right after a write they can answer
+	* "absent" or with the PREVIOUS value (their command docs say so) — and the
+	* deploy captures `observedProperties` right after the writes. So an answer
+	* that does not match the DECLARED member is re-asked a few times before it
+	* is believed, or a lagging read would freeze a baseline the settled stream
+	* can never equal. A member that really drifted costs those few seconds per
+	* drift run.
+	*
+	* `cdkd drift --revert` replays through `update()`, where the read-back is
+	* the PREVIOUS side and {@link planStreamMemberOps} derives the restore.
+	*/
+	async readStreamMembers(tableName, streamArn, desiredBlock, streamBlock) {
+		if (streamArn === void 0 || streamArn === "") return;
+		if (streamDeclaresPolicy(desiredBlock)) try {
+			const livePolicy = await this.reAskUntilSettled(async () => {
+				try {
+					return (await this.dynamoDBClient.send(new GetResourcePolicyCommand({ ResourceArn: streamArn }))).Policy;
+				} catch (err) {
+					if (err instanceof PolicyNotFoundException) return void 0;
+					throw err;
+				}
+			}, (answer) => streamPolicyMatchesDeclared(answer, desiredBlock));
+			const member = reverseMapStreamPolicy(livePolicy, desiredBlock);
+			if (member !== void 0) streamBlock[STREAM_POLICY_KEY] = member;
+		} catch (err) {
+			this.logger.debug(`Could not read the stream ResourcePolicy for ${tableName}: ${describeAwsFailure(err).detail}`);
+		}
+		if (streamDeclaresTags(desiredBlock)) try {
+			const listOnce = async () => {
+				const liveTags = [];
+				let nextToken;
+				do {
+					const response = await this.dynamoDBClient.send(new ListTagsOfResourceCommand({
+						ResourceArn: streamArn,
+						NextToken: nextToken
+					}));
+					liveTags.push(...response.Tags ?? []);
+					nextToken = response.NextToken;
+				} while (nextToken !== void 0 && nextToken !== "");
+				return normalizeAwsTagsToCfn(liveTags);
+			};
+			const tags = await this.reAskUntilSettled(listOnce, (answer) => streamTagsMatchDeclared(answer, desiredBlock));
+			const declared = desiredBlock[STREAM_TAGS_KEY];
+			if (tags.length > 0 || Array.isArray(declared) && declared.length === 0) streamBlock[STREAM_TAGS_KEY] = tags;
+		} catch (err) {
+			this.logger.debug(`Could not read the stream Tags for ${tableName}: ${describeAwsFailure(err).detail}`);
+		}
+	}
+	/**
 	* Adopt an existing DynamoDB table into cdkd state.
 	*
 	* Lookup order:
@@ -65944,7 +66432,7 @@ function templateUsesSub(templateValue) {
 * The leaf predicate answers `false` for a non-string, and an output's `Value`
 * is very often an OBJECT: `secret.secretValueFromJson(...)` renders the
 * secret's ARN as a `Ref`, so the value is an `Fn::Join` / `Fn::Sub` — which
-* CLAUDE.md's #1916 note calls the DOMINANT CDK shape, not an edge case.
+* AGENTS.md's #1916 note calls the DOMINANT CDK shape, not an edge case.
 * Feeding the raw value to the leaf predicate therefore reported "no secret
 * here" for exactly the templates most likely to have one, which silently
 * disarmed BOTH signals built on it: the export-alias decision below (issue
@@ -85273,6 +85761,10 @@ function createForceUnlockCommand() {
 * object renders nothing, and an SDK failure is reported by its error NAME
 * alone, because an SDK message can echo request input.
 *
+* THE DEPENDENCE WALK ITSELF lives in `src/analyzer/parameter-dependence.ts`
+* (`cdkd deploy` reads it too, issue #3468); this module keeps the half that
+* touches AWS and the deployed values.
+*
 * TAINT THROUGH ANOTHER RESOURCE'S ATTRIBUTES IS FOLLOWED within one stack: the
 * walk records the target of every `Fn::GetAtt` / `${A.Attr}`, and the caller
 * closes the refused set over those targets, so a resource reading an attribute
@@ -85379,232 +85871,33 @@ function divergentParameterNames(template, bound, deployed) {
 	}
 	return divergent;
 }
-/**
-* Every intrinsic the dependence walk knows how to read. An `Fn::`-prefixed
-* key OUTSIDE this list is unclassifiable: it may name a parameter in a way
-* the generic recursion cannot see, so the walk fails closed on it.
-*/
-const KNOWN_INTRINSICS = /* @__PURE__ */ new Set([
-	"Fn::GetAtt",
-	"Fn::Join",
-	"Fn::Sub",
-	"Fn::Select",
-	"Fn::Split",
-	"Fn::If",
-	"Fn::Equals",
-	"Fn::And",
-	"Fn::Or",
-	"Fn::Not",
-	"Fn::ImportValue",
-	"Fn::GetStackOutput",
-	"Fn::FindInMap",
-	"Fn::Base64",
-	"Fn::GetAZs",
-	"Fn::Cidr"
-]);
-/** `${Name}` / `${Name.Attr}` in an `Fn::Sub` string; `${!Literal}` is an escape. */
-const SUB_VARIABLE = /\$\{([^!}][^}]*)\}/g;
-/**
-* Which names (parameters, but also resources and pseudo parameters — the
-* caller intersects with the divergent set) the RAW `Properties` of a resource
-* depend on, plus its resource-level `Condition`.
-*
-* Generic by design: instead of modelling each intrinsic's argument grammar it
-* recurses into EVERY value, so a `Ref` nested in an `Fn::Join` / `Fn::Select`
-* / `Fn::Split` operand, an `Fn::FindInMap` key, or an `Fn::Sub` variable-map
-* value is found without being named. Only the three forms that name something
-* by BARE STRING need their own arm: `Ref`, `Fn::Sub`'s template text, and a
-* condition name (`Fn::If`'s first argument, and `Condition` inside the
-* `Conditions` section), which is followed transitively through
-* `template.Conditions`.
-*
-* May throw `RangeError` on a bag deeper than the call stack; the caller wraps
-* it fail-closed, like the discard walk beside it.
-*/
-function collectParameterDependencies(properties, resourceCondition, template) {
-	const names = /* @__PURE__ */ new Set();
-	const attributeTargets = /* @__PURE__ */ new Set();
-	const visitedConditions = /* @__PURE__ */ new Set();
-	let unclassifiable = false;
-	const conditions = template.Conditions !== null && typeof template.Conditions === "object" ? template.Conditions : {};
-	const followCondition = (name) => {
-		if (typeof name !== "string") {
-			unclassifiable = true;
-			return;
-		}
-		if (visitedConditions.has(name)) return;
-		visitedConditions.add(name);
-		if (!Object.hasOwn(conditions, name)) {
-			unclassifiable = true;
-			return;
-		}
-		walk(conditions[name], true);
-	};
-	const walk = (node, inConditions) => {
-		if (node === null || typeof node !== "object") return;
-		if (Array.isArray(node)) {
-			for (const element of node) walk(element, inConditions);
-			return;
-		}
-		for (const [key, value] of Object.entries(node)) {
-			if (key === "Ref") {
-				if (typeof value === "string") names.add(value);
-				else unclassifiable = true;
-				continue;
-			}
-			if (key === "Fn::Sub") {
-				const text = Array.isArray(value) ? value[0] : value;
-				if (typeof text !== "string" || Array.isArray(value) && value.length !== 2) unclassifiable = true;
-				else for (const match of text.matchAll(SUB_VARIABLE)) {
-					const variable = (match[1] ?? "").trim();
-					names.add(variable);
-					const dot = variable.indexOf(".");
-					if (dot > 0) {
-						names.add(variable.slice(0, dot));
-						attributeTargets.add(variable.slice(0, dot));
-					}
-				}
-				if (Array.isArray(value)) walk(value[1], inConditions);
-				continue;
-			}
-			if (key === "Fn::GetAtt") {
-				const target = Array.isArray(value) ? value[0] : value;
-				if (typeof target === "string") {
-					const dot = target.indexOf(".");
-					const logicalId = Array.isArray(value) || dot <= 0 ? target : target.slice(0, dot);
-					names.add(logicalId);
-					attributeTargets.add(logicalId);
-				} else unclassifiable = true;
-				walk(value, inConditions);
-				continue;
-			}
-			if (key === "Fn::If") {
-				if (Array.isArray(value) && value.length === 3) {
-					followCondition(value[0]);
-					walk(value[1], inConditions);
-					walk(value[2], inConditions);
-				} else unclassifiable = true;
-				continue;
-			}
-			if (key === "Condition" && inConditions) {
-				followCondition(value);
-				continue;
-			}
-			if (key.startsWith("Fn::") && !KNOWN_INTRINSICS.has(key)) unclassifiable = true;
-			walk(value, inConditions);
-		}
-	};
-	walk(properties, false);
-	if (resourceCondition !== void 0) followCondition(resourceCondition);
-	return {
-		names,
-		attributeTargets,
-		unclassifiable
-	};
-}
-/**
-* The divergent parameters that ANYTHING in the template names. A declared
-* parameter nothing names cannot have shaped a resource — and CDK's
-* `BootstrapVersion` is exactly that on every default-synthesized stack: SSM
-* typed, never bound by the resolver because nothing references it, hence
-* always "divergent". Left in, it would arm the unclassifiable-shape refusal on
-* stacks whose every real parameter is proven.
-*
-* "Names" is the UNION of this module's walk and `TemplateParser`'s reference
-* scan — the same scan the resolver uses to decide an SSM-typed parameter is
-* unreferenced — so the two cannot disagree about `BootstrapVersion`. An
-* unclassifiable shape does NOT keep the whole set here: CloudFormation names a
-* parameter only through `Ref`, `Fn::Sub` text or a condition, and the generic
-* recursion reads those inside any intrinsic, known or not. A walk that THROWS
-* keeps the whole set (fail closed).
-*/
-function reachableDivergentParameters(template, divergent, rawBags) {
-	if (divergent.size === 0) return /* @__PURE__ */ new Set();
-	try {
-		const roots = [
-			rawBags,
-			template.Resources,
-			template.Outputs,
-			template.Conditions
-		];
-		const named = new Set(collectParameterDependencies(roots, void 0, template).names);
-		const parser = new TemplateParser();
-		for (const root of roots) {
-			if (root === null || typeof root !== "object") continue;
-			for (const name of parser.extractReferences(root)) named.add(name);
-		}
-		return new Set([...divergent].filter((name) => named.has(name)));
-	} catch {
-		return new Set(divergent);
-	}
-}
-/** Whether any DECLARED parameter is named by anything in the template. */
-function namesAnyDeclaredParameter(template) {
-	const declared = template.Parameters;
-	if (declared === null || typeof declared !== "object") return false;
-	const names = new Set(Object.keys(declared));
-	return names.size > 0 && reachableDivergentParameters(template, names, []).size > 0;
-}
-/**
-* The per-stack ARM 4 verdict. Each resource is judged on its TEMPLATE
-* definition (`Properties` + `Condition`) AND on the raw bag the state record
-* carries, unioned: a record preserved by a selective merge holds a previous
-* run's RESOLVED literal (`Value: 'CHANGEME'`), which names no parameter, so
-* judging it on the state bag alone would leave nothing to carry to the
-* freshly imported resource that reads its attribute. Template resources that
-* are not in state at all are judged too, for the same reason.
-*
-* Seeds are direct dependents and unclassifiable bags (a bag that cannot be
-* read cannot be vouched for, and neither can what reads its attributes); the
-* refused set is then closed over ATTRIBUTE reads, to a fixpoint.
-*/
-function computeParameterTaint(template, stateBags, divergent) {
-	const refused = /* @__PURE__ */ new Set();
-	const unclassifiable = /* @__PURE__ */ new Set();
-	const parametersHit = /* @__PURE__ */ new Set();
-	if (divergent.size === 0) return {
-		refused,
-		unclassifiable,
-		parametersHit
-	};
-	const templateResources = template.Resources !== null && typeof template.Resources === "object" ? template.Resources : {};
-	const readers = /* @__PURE__ */ new Map();
-	for (const logicalId of /* @__PURE__ */ new Set([...Object.keys(templateResources), ...stateBags.keys()])) {
-		const definition = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
-		const record = definition !== null && typeof definition === "object" ? definition : {};
-		try {
-			const dependencies = collectParameterDependencies([record["Properties"], stateBags.get(logicalId)], record["Condition"], template);
-			readers.set(logicalId, new Set(dependencies.attributeTargets));
-			const hits = [...dependencies.names].filter((name) => divergent.has(name));
-			for (const name of hits) parametersHit.add(name);
-			if (hits.length > 0) refused.add(logicalId);
-			else if (dependencies.unclassifiable) {
-				refused.add(logicalId);
-				unclassifiable.add(logicalId);
-			}
-		} catch {
-			refused.add(logicalId);
-			unclassifiable.add(logicalId);
-		}
-	}
-	for (let grew = refused.size > 0; grew;) {
-		grew = false;
-		for (const [logicalId, targets] of readers) {
-			if (refused.has(logicalId)) continue;
-			if (![...targets].some((target) => refused.has(target))) continue;
-			refused.add(logicalId);
-			grew = true;
-		}
-	}
-	return {
-		refused,
-		unclassifiable,
-		parametersHit
-	};
-}
 
 //#endregion
 //#region src/cli/commands/import.ts
+/**
+* What {@link resolveImportedProperties} refused, as ONE value (issue #3462).
+*
+* It is still the set of logical ids whose observed baseline must not be
+* captured — every existing reader calls `.has()` — and it additionally carries
+* the two facts `captureObservedForImportedResources` needs to write, keep or
+* clear `ResourceState.observedBaselineRefusalReason`. They travel ON the set
+* rather than beside it, and the capture's parameter is THIS type, so a call
+* site that copies the ids into a plain `Set` — dropping both facts, and with
+* them the reason every deploy-side guard keys on — does not compile.
+*/
+var ObservedBaselineRefusals = class extends Set {
+	/**
+	* The subset ARM 4 named — directly, through an attribute read, or as an
+	* unclassifiable bag — whether or not another arm refused it too.
+	*/
+	unverifiableParameter = /* @__PURE__ */ new Set();
+	/**
+	* Whether this run HAD deployed parameter values to compare against. Only
+	* then does "ARM 4 did not name it" mean the placeholder was PROVEN; without
+	* a source it means nothing was judged at all.
+	*/
+	hadDeployedParameterSource = false;
+};
 async function importCommand(stackArg, options) {
 	const logger = getLogger();
 	if (options.verbose) {
@@ -86164,10 +86457,13 @@ function rebuiltLogicalIdsFrom(rows, template) {
 * import flow never derives outputs (they're computed at deploy time from
 * each resource's attributes), so even an auto-mode rebuild has no reason
 * to wipe them.
+*
+* Exported for unit testing — internal to the command flow otherwise.
 */
 function buildStackState(stackName, region, rows, templateParser, template, existingState, selectiveMode) {
 	const resources = selectiveMode && existingState ? { ...existingState.resources } : {};
 	const parameterNames = new Set(Object.keys(template.Parameters ?? {}));
+	let namesParameter;
 	for (const row of rows) {
 		if (row.outcome !== "imported" || !row.physicalId) continue;
 		const tmplResource = template.Resources[row.logicalId];
@@ -86182,9 +86478,14 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 			properties: tmplResource.Properties ?? {},
 			attributes: rowAttributes ?? priorAttributes ?? {},
 			dependencies: deps,
-			provisionedBy: "sdk"
+			provisionedBy: "sdk",
+			...prior && prior.physicalId === row.physicalId && (hasUnverifiableParameterRefusal(prior) || hasReasonlessBaselineRefusal(prior) && (namesParameter ??= resourcesNamingDeclaredParameter(template))(row.logicalId)) && {
+				observedBaselineRefused: true,
+				observedBaselineRefusalReason: "unverifiable-parameter"
+			}
 		};
 	}
+	if (namesParameter?.failedClosed !== void 0) getLogger().debug(`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every prior observed-baseline refusal recorded without a reason is carried as an unverifiable-parameter refusal.`);
 	return {
 		version: 10,
 		stackName,
@@ -86345,12 +86646,13 @@ function defaultOnlyParameterTemplate(template) {
 *    `DescribeStacks` parameters are the comparison); what REMAINS is an
 *    import with NO CloudFormation stack, where no deployed-parameter source
 *    exists, taint across the nested-stack `Outputs` boundary
-*    (`import-deployed-parameters.ts` states it), and the NEXT DEPLOY: the
-*    refusal marker is cleared by any UPDATE that rebuilds the record, and
-*    `cdkd deploy` binds the same placeholder `Default`, so an UPDATE that does
-*    not rewrite the placeholder-bound property captures the readback against
-*    it ([#3462](https://github.com/go-to-k/cdkd/issues/3462);
-*    `deploy-engine.ts` owns the fix). ARM 4 also WIDENS the population of
+*    (`import-deployed-parameters.ts` states it). The NEXT DEPLOY and a
+*    source-less RE-IMPORT used to be on this list
+*    ([#3462](https://github.com/go-to-k/cdkd/issues/3462)): both bind the
+*    same placeholder `Default`, so both now honour
+*    `ResourceState.observedBaselineRefusalReason`, which this arm's verdict
+*    is recorded as. A binary older than that field still clears the marker on
+*    any UPDATE. ARM 4 also WIDENS the population of
 *    [#2872](https://github.com/go-to-k/cdkd/issues/2872): a record preserved
 *    by a selective merge that a pre-#2854 import already gave a plaintext
 *    baseline is now refused, and a refusal leaves that old baseline in place;
@@ -86378,7 +86680,8 @@ function defaultOnlyParameterTemplate(template) {
 * deployer, which is where the structural remedy for all of the above lives.
 *
 * The set is returned rather than recorded on the state, because it describes
-* THIS run's resolution and nothing downstream of the save has any use for it.
+* THIS run's resolution; `captureObservedForImportedResources` turns it into
+* the two record fields that DO outlive the run.
 *
 * Exported for unit testing — internal to the command flow otherwise. The
 * masking this walk applies (issue #2803) is only provable against the REAL
@@ -86386,7 +86689,8 @@ function defaultOnlyParameterTemplate(template) {
 * own throw rather than through anything this function writes.
 */
 async function resolveImportedProperties(stackState, template, region, stateBackend, logger, deployedParameters) {
-	const unsafeObservedBaselineLogicalIds = /* @__PURE__ */ new Set();
+	const unsafeObservedBaselineLogicalIds = new ObservedBaselineRefusals();
+	unsafeObservedBaselineLogicalIds.hadDeployedParameterSource = deployedParameters !== void 0;
 	const entries = Object.entries(stackState.resources ?? {});
 	if (entries.length === 0) return unsafeObservedBaselineLogicalIds;
 	const resolver = new IntrinsicFunctionResolver(region);
@@ -86455,6 +86759,7 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		}
 		if (recordedSecretValues.size > 0 && resource.attributes !== void 0) resource.attributes = redactSecretsForState(resource.attributes, recordedSecretValues);
 		const dependsOnDivergent = parameterTaint?.refused.has(logicalId) === true;
+		if (dependsOnDivergent) unsafeObservedBaselineLogicalIds.unverifiableParameter.add(logicalId);
 		if (threw || dependsOnDivergent) {
 			unsafeObservedBaselineLogicalIds.add(logicalId);
 			continue;
@@ -86835,15 +87140,19 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 	if (entries.length === 0) return;
 	await Promise.all(entries.map(async ([logicalId, resource]) => {
 		if (resource.observedBaselineRefused === true && !rebuiltLogicalIds.has(logicalId)) {
-			logger.debug(`observedProperties capture SKIPPED for preserved ${logicalId} (${resource.resourceType}): a previous 'cdkd import' run refused this record's baseline and this run did not re-import it, so its recorded properties are still the ones that refusal distrusted. Deploy a change to this resource to restore a baseline.`);
+			logger.debug(`observedProperties capture SKIPPED for preserved ${logicalId} (${resource.resourceType}): a previous 'cdkd import' run refused this record's baseline and this run did not re-import it, so its recorded properties are still the ones that refusal distrusted. Re-import it, or deploy a change to it, to restore a baseline — unless its refusal is an unverifiable-parameter one, which only a replacement or a proving re-import discharges.`);
 			return;
 		}
-		if (unsafeObservedBaselineLogicalIds.has(logicalId)) {
+		const refusals = unsafeObservedBaselineLogicalIds;
+		const parameterRefusalStands = refusals.unverifiableParameter.has(logicalId) || hasUnverifiableParameterRefusal(resource) && !refusals.hadDeployedParameterSource;
+		if (unsafeObservedBaselineLogicalIds.has(logicalId) || parameterRefusalStands) {
 			resource.observedBaselineRefused = true;
-			logger.debug(`observedProperties capture SKIPPED for imported ${logicalId} (${resource.resourceType}): the recorded properties cannot be shown to spell every dynamic reference the deployed resource was built from, so they cannot position a redaction — capturing an AWS readback against them could persist a resolved secret in plaintext. Drift will compare against the recorded properties for this resource until the next successful deploy.`);
+			resource.observedBaselineRefusalReason = parameterRefusalStands ? "unverifiable-parameter" : "incomplete-resolution";
+			logger.debug(`observedProperties capture SKIPPED for imported ${logicalId} (${resource.resourceType}): the recorded properties cannot be shown to spell every dynamic reference the deployed resource was built from, so they cannot position a redaction — capturing an AWS readback against them could persist a resolved secret in plaintext. Drift will compare against the recorded properties for this resource until ${parameterRefusalStands ? `it is REPLACED, or re-imported while a CloudFormation stack can prove its parameters were deployed at their 'Default' — an in-place deploy binds the same 'Default' and cannot restore the baseline` : `the next successful deploy`}.`);
 			return;
 		}
 		delete resource.observedBaselineRefused;
+		delete resource.observedBaselineRefusalReason;
 		try {
 			const provider = providerRegistry.getProviderFor({
 				resourceType: resource.resourceType,
@@ -96714,4 +97023,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-COiS7GZJ.js.map
+//# sourceMappingURL=program-CUOo1x11.js.map