@go-to-k/cdkd 0.46.1 → 0.48.0

package/dist/cli.js

@@ -629,6 +629,10 @@ var deployOptions = [
   new Option("--dry-run", "Show changes without applying").default(false),
   new Option("--skip-assets", "Skip asset publishing").default(false),
   new Option("--no-rollback", "Skip rollback on deployment failure"),
+  new Option(
+    "--no-capture-observed-state",
+    "Skip capturing AWS-current properties after each create/update (adds a fire-and-forget readCurrentState per resource so cdkd drift can compare against the real deploy-time AWS snapshot instead of the template). On by default. Disable when deploy speed matters more than rich drift detection \u2014 falls back to comparing against template properties (the pre-v3 behavior)."
+  ),
   noWaitOption,
   aggressiveVpcParallelOption,
   new Option(
@@ -1351,6 +1355,16 @@ function resolveApp(cliApp) {
   const cdkJson = loadCdkJson();
   return cdkJson?.app ?? void 0;
 }
+function resolveCaptureObservedState(cliValue) {
+  if (cliValue === false)
+    return false;
+  const cdkJson = loadCdkJson();
+  const cdkdContext = cdkJson?.context?.["cdkd"];
+  const v = cdkdContext?.["captureObservedState"];
+  if (typeof v === "boolean")
+    return v;
+  return true;
+}
 function resolveStateBucketWithSource(cliBucket) {
   if (cliBucket)
     return { bucket: cliBucket, source: "cli-flag" };
@@ -3727,8 +3741,8 @@ import {
 } from "@aws-sdk/client-s3";
 
 // src/types/state.ts
-var STATE_SCHEMA_VERSION_LEGACY = 1;
-var STATE_SCHEMA_VERSION_CURRENT = 2;
+var STATE_SCHEMA_VERSION_CURRENT = 3;
+var STATE_SCHEMA_VERSIONS_READABLE = [1, 2, 3];
 
 // src/utils/aws-region-resolver.ts
 import { GetBucketLocationCommand, S3Client as S3Client3 } from "@aws-sdk/client-s3";
@@ -4237,9 +4251,9 @@ var S3StateBackend = class {
       );
     }
     const v = parsed.version;
-    if (v !== STATE_SCHEMA_VERSION_LEGACY && v !== STATE_SCHEMA_VERSION_CURRENT && v !== void 0) {
+    if (v !== void 0 && !STATE_SCHEMA_VERSIONS_READABLE.includes(v)) {
       throw new StateError(
-        `Unsupported state schema version ${String(v)} for stack '${stackName}'. This cdkd binary supports versions ${String(STATE_SCHEMA_VERSION_LEGACY)} and ${String(STATE_SCHEMA_VERSION_CURRENT)}. Upgrade cdkd to a version that supports schema ${String(v)}.`
+        `Unsupported state schema version ${String(v)} for stack '${stackName}'. This cdkd binary supports versions ${STATE_SCHEMA_VERSIONS_READABLE.join(", ")}. Upgrade cdkd to a version that supports schema ${String(v)}.`
       );
     }
     return parsed;
@@ -9167,8 +9181,7 @@ var IAMRoleProvider = class {
         marker = tagsResp.Marker;
       }
       const tags = normalizeAwsTagsToCfn(collected);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
     } catch (err) {
       if (!(err instanceof NoSuchEntityException))
         throw err;
@@ -12191,8 +12204,7 @@ var S3BucketProvider = class {
     try {
       const resp = await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: physicalId }));
       const tags = normalizeAwsTagsToCfn(resp.TagSet);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
     } catch (err) {
       const e = err;
       if (e.name !== "NoSuchTagSet") {
@@ -12878,8 +12890,7 @@ var SQSQueueProvider = class {
         new ListQueueTagsCommand({ QueueUrl: physicalId })
       );
       const tags = normalizeAwsTagsToCfn(tagsResp.Tags);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
     } catch (err) {
       if (err instanceof QueueDoesNotExist)
         return void 0;
@@ -13571,8 +13582,7 @@ var SNSTopicProvider = class {
         new ListTagsForResourceCommand({ ResourceArn: physicalId })
       );
       const tags = normalizeAwsTagsToCfn(tagsResp.Tags);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
     } catch (err) {
       if (err instanceof NotFoundException)
         return void 0;
@@ -14858,8 +14868,7 @@ var LambdaFunctionProvider = class {
           result["VpcConfig"] = vpc;
       }
       const tags = normalizeAwsTagsToCfn(resp.Tags);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
       return result;
     } catch (err) {
       if (err instanceof ResourceNotFoundException)
@@ -16431,8 +16440,7 @@ var DynamoDBTableProvider = class {
             new ListTagsOfResourceCommand({ ResourceArn: table.TableArn })
           );
           const tags = normalizeAwsTagsToCfn(tagsResp.Tags);
-          if (tags.length > 0)
-            result["Tags"] = tags;
+          result["Tags"] = tags;
         } catch (err) {
           if (err instanceof ResourceNotFoundException6)
             return void 0;
@@ -16797,8 +16805,7 @@ var LogsLogGroupProvider = class {
             new ListTagsForResourceCommand2({ resourceArn: arnForTags })
           );
           const tags = normalizeAwsTagsToCfn(tagsResp.tags);
-          if (tags.length > 0)
-            result["Tags"] = tags;
+          result["Tags"] = tags;
         } catch (err) {
           if (err instanceof ResourceNotFoundException7)
             return void 0;
@@ -17180,8 +17187,7 @@ var CloudWatchAlarmProvider = class {
           new ListTagsForResourceCommand3({ ResourceARN: alarm.AlarmArn })
         );
         const tags = normalizeAwsTagsToCfn(tagsResp.Tags);
-        if (tags.length > 0)
-          result["Tags"] = tags;
+        result["Tags"] = tags;
       } catch (err) {
         this.logger.debug(
           `CloudWatch ListTagsForResource(${alarm.AlarmArn}) failed: ${err instanceof Error ? err.message : String(err)}`
@@ -17555,8 +17561,7 @@ var SecretsManagerSecretProvider = class {
         });
       }
       const tags = normalizeAwsTagsToCfn(resp.Tags);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
       return result;
     } catch (err) {
       if (err instanceof ResourceNotFoundException8)
@@ -17918,8 +17923,7 @@ var SSMParameterProvider = class {
         })
       );
       const tags = normalizeAwsTagsToCfn(tagsResp.TagList);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
     } catch {
     }
     return result;
@@ -18331,8 +18335,7 @@ var EventBridgeRuleProvider = class {
         new ListTagsForResourceCommand5({ ResourceARN: physicalId })
       );
       const tags = normalizeAwsTagsToCfn(tagsResp.Tags);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
     } catch (err) {
       if (!(err instanceof ResourceNotFoundException9)) {
         throw err;
@@ -18748,8 +18751,7 @@ var EventBridgeBusProvider = class {
             new ListTagsForResourceCommand6({ ResourceARN: resp.Arn })
           );
           const tags = normalizeAwsTagsToCfn(tagsResp.Tags);
-          if (tags.length > 0)
-            result["Tags"] = tags;
+          result["Tags"] = tags;
         } catch (err) {
           if (err instanceof ResourceNotFoundException10)
             return void 0;
@@ -23055,8 +23057,7 @@ var ApiGatewayV2Provider = class {
       if (resp.CorsConfiguration)
         result["CorsConfiguration"] = resp.CorsConfiguration;
       const tags = normalizeAwsTagsToCfn(resp.Tags);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
       return result;
     } catch (err) {
       if (err instanceof NotFoundException4)
@@ -24582,8 +24583,7 @@ var StepFunctionsProvider = class {
         new ListTagsForResourceCommand8({ resourceArn: physicalId })
       );
       const tags = normalizeAwsTagsToCfn(tagsResp.tags);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
     } catch (err) {
       if (!(err instanceof StateMachineDoesNotExist))
         throw err;
@@ -25475,8 +25475,7 @@ var ECSProvider = class {
       }));
     }
     const tags = normalizeAwsTagsToCfn(c.tags);
-    if (tags.length > 0)
-      result["Tags"] = tags;
+    result["Tags"] = tags;
     return result;
   }
   async readCurrentStateService(physicalId) {
@@ -25546,8 +25545,7 @@ var ECSProvider = class {
       result["ServiceRegistries"] = s.serviceRegistries;
     }
     const tags = normalizeAwsTagsToCfn(s.tags);
-    if (tags.length > 0)
-      result["Tags"] = tags;
+    result["Tags"] = tags;
     return result;
   }
   async readCurrentStateTaskDefinition(physicalId) {
@@ -25598,8 +25596,7 @@ var ECSProvider = class {
       result["ContainerDefinitions"] = td.containerDefinitions;
     }
     const tags = normalizeAwsTagsToCfn(resp.tags);
-    if (tags.length > 0)
-      result["Tags"] = tags;
+    result["Tags"] = tags;
     return result;
   }
   /**
@@ -26389,8 +26386,7 @@ var ELBv2Provider = class {
       const resp = await this.getClient().send(new DescribeTagsCommand({ ResourceArns: [arn] }));
       const tagDesc = resp.TagDescriptions?.[0];
       const tags = normalizeAwsTagsToCfn(tagDesc?.Tags);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
     } catch (err) {
       this.logger.debug(
         `ELBv2 DescribeTags(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`
@@ -27302,8 +27298,7 @@ var RDSProvider = class {
         new ListTagsForResourceCommand10({ ResourceName: arn })
       );
       const tags = normalizeAwsTagsToCfn(tagsResp.TagList);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
     } catch (err) {
       this.logger.debug(
         `RDS ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`
@@ -28601,8 +28596,7 @@ var WAFv2WebACLProvider = class {
         new ListTagsForResourceCommand12({ ResourceARN: physicalId })
       );
       const tags = normalizeAwsTagsToCfn(tagsResp.TagInfoForResource?.TagList);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
     } catch (err) {
       this.logger.debug(
         `WAFv2 ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`
@@ -29733,8 +29727,7 @@ var ElastiCacheProvider = class {
         new ListTagsForResourceCommand14({ ResourceName: arn })
       );
       const tags = normalizeAwsTagsToCfn(tagsResp.TagList);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
     } catch (err) {
       this.logger.debug(
         `ElastiCache ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`
@@ -30307,8 +30300,7 @@ var ServiceDiscoveryProvider = class {
         new ListTagsForResourceCommand15({ ResourceARN: arn })
       );
       const tags = normalizeAwsTagsToCfn(tagsResp.Tags);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
     } catch (err) {
       this.logger.debug(
         `ServiceDiscovery ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`
@@ -31032,8 +31024,7 @@ var AppSyncProvider = class {
         result["LogConfig"] = log;
     }
     const tags = normalizeAwsTagsToCfn(api.tags);
-    if (tags.length > 0)
-      result["Tags"] = tags;
+    result["Tags"] = tags;
     return result;
   }
   async readDataSource(physicalId) {
@@ -32332,8 +32323,7 @@ var KMSProvider = class {
           new ListResourceTagsCommand({ KeyId: md.KeyId })
         );
         const tags = normalizeAwsTagsToCfn(tagsResp.Tags);
-        if (tags.length > 0)
-          result["Tags"] = tags;
+        result["Tags"] = tags;
       } catch (err) {
         if (err instanceof NotFoundException5)
           return void 0;
@@ -32777,8 +32767,7 @@ var KinesisStreamProvider = class {
         new ListTagsForStreamCommand({ StreamName: physicalId })
       );
       const tags = normalizeAwsTagsToCfn(tagsResp.Tags);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
     } catch (err) {
       if (err instanceof ResourceNotFoundException13)
         return void 0;
@@ -33978,8 +33967,7 @@ var FirehoseProvider = class {
         new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: physicalId })
       );
       const tags = normalizeAwsTagsToCfn(tagsResp.Tags);
-      if (tags.length > 0)
-        result["Tags"] = tags;
+      result["Tags"] = tags;
     } catch (err) {
       if (err instanceof ResourceNotFoundException14)
         return void 0;
@@ -34396,8 +34384,7 @@ var CloudTrailProvider = class {
           new ListTagsCommand3({ ResourceIdList: [trail.TrailARN] })
         );
         const tags = normalizeAwsTagsToCfn(tagsResp.ResourceTagList?.[0]?.TagsList);
-        if (tags.length > 0)
-          result["Tags"] = tags;
+        result["Tags"] = tags;
       } catch (err) {
         this.logger.debug(
           `CloudTrail ListTags(${trail.TrailARN}) failed: ${err instanceof Error ? err.message : String(err)}`
@@ -34861,8 +34848,7 @@ var CodeBuildProvider = class {
         result["Environment"] = env;
     }
     const tags = normalizeAwsTagsToCfn(project.tags);
-    if (tags.length > 0)
-      result["Tags"] = tags;
+    result["Tags"] = tags;
     return result;
   }
   async import(input) {
@@ -36457,8 +36443,7 @@ var ECRProvider = class {
           new ListTagsForResourceCommand18({ resourceArn: r.repositoryArn })
         );
         const tags = normalizeAwsTagsToCfn(tagsResp.tags);
-        if (tags.length > 0)
-          result["Tags"] = tags;
+        result["Tags"] = tags;
       } catch (err) {
         if (!(err instanceof RepositoryNotFoundException))
           throw err;
@@ -36947,10 +36932,23 @@ var DeployEngine = class {
     this.options.noRollback = options.noRollback ?? false;
     this.options.resourceWarnAfterMs = options.resourceWarnAfterMs ?? DEFAULT_RESOURCE_WARN_AFTER_MS;
     this.options.resourceTimeoutMs = options.resourceTimeoutMs ?? DEFAULT_RESOURCE_TIMEOUT_MS;
+    this.options.captureObservedState = options.captureObservedState ?? true;
   }
   logger = getLogger().child("DeployEngine");
   resolver;
   interrupted = false;
+  /**
+   * In-flight `provider.readCurrentState` promises kicked off after a
+   * successful CREATE / UPDATE. The deploy critical path does NOT
+   * `await` these; instead they're drained at the end of `doDeploy`
+   * (success path only) and the resolved values are merged into
+   * `ResourceState.observedProperties` before the final state save.
+   *
+   * Each Promise resolves to the AWS-current snapshot, or `undefined`
+   * if the provider does not implement `readCurrentState` or the call
+   * threw — never rejects, so an unhandled-rejection cannot escape.
+   */
+  observedCaptureTasks = /* @__PURE__ */ new Map();
   /**
    * Target region for this stack. Required — load-bearing for the
    * region-prefixed S3 state key and recorded in state.json for
@@ -36963,6 +36961,61 @@ var DeployEngine = class {
   async deploy(stackName, template) {
     return withStackName(stackName, () => this.doDeploy(stackName, template));
   }
+  /**
+   * Kick off `provider.readCurrentState` for a freshly-created/updated
+   * resource without blocking the deploy critical path. The promise
+   * lands in `observedCaptureTasks` keyed by `logicalId`; the deploy's
+   * success-path drain (`drainObservedCaptures`) awaits the full set
+   * and merges the resolved values into `ResourceState.observedProperties`
+   * before the final state save.
+   *
+   * Errors are swallowed at the Promise level — readCurrentState
+   * failing must not fail the deploy. The map entry resolves to
+   * `undefined` for failures and for providers without
+   * `readCurrentState`; both translate to "no observedProperties" at
+   * the merge step, which is fine: drift falls back to comparing
+   * against `properties`.
+   */
+  kickOffObservedCapture(provider, logicalId, physicalId, resourceType, resolvedProps) {
+    if (this.options.captureObservedState !== true)
+      return;
+    if (!provider.readCurrentState)
+      return;
+    const promise = provider.readCurrentState(physicalId, logicalId, resourceType, resolvedProps).catch((err) => {
+      this.logger.debug(
+        `observedProperties capture for ${logicalId} (${resourceType}) failed: ${err instanceof Error ? err.message : String(err)} \u2014 drift will fall back to template properties for this resource until the next successful deploy.`
+      );
+      return void 0;
+    });
+    this.observedCaptureTasks.set(logicalId, promise);
+  }
+  /**
+   * Wait for every in-flight `readCurrentState` promise from the
+   * deploy's success path, then merge each resolved snapshot into the
+   * matching `ResourceState.observedProperties`. After this runs the
+   * map is drained so a subsequent deploy starts fresh.
+   *
+   * Called from `doDeploy` immediately before the final `saveState`.
+   * The rollback / failure paths intentionally do NOT call this — a
+   * failed deploy's partial state is already inconsistent, and waiting
+   * on potentially many in-flight reads would slow down the rollback
+   * itself.
+   */
+  async drainObservedCaptures(stateResources) {
+    if (this.observedCaptureTasks.size === 0)
+      return;
+    const entries = Array.from(this.observedCaptureTasks.entries());
+    this.observedCaptureTasks.clear();
+    const resolved = await Promise.all(entries.map(([, p]) => p));
+    for (let i = 0; i < entries.length; i++) {
+      const logicalId = entries[i][0];
+      const observed = resolved[i];
+      const target = stateResources[logicalId];
+      if (target && observed !== void 0) {
+        target.observedProperties = observed;
+      }
+    }
+  }
   async doDeploy(stackName, template) {
     const startTime = Date.now();
     this.logger.debug(`Starting deployment for stack: ${stackName}`);
@@ -37079,6 +37132,7 @@ var DeployEngine = class {
         progress,
         migrationPending
       );
+      await this.drainObservedCaptures(newState.resources);
       const newEtag = await this.stateBackend.saveState(stackName, this.stackRegion, newState);
       this.logger.debug(`State saved (ETag: ${newEtag})`);
       const durationMs = Date.now() - startTime;
@@ -37094,6 +37148,7 @@ var DeployEngine = class {
     } finally {
       renderer.stop();
       process.removeListener("SIGINT", sigintHandler);
+      this.observedCaptureTasks.clear();
       try {
         await this.lockManager.releaseLock(stackName, this.stackRegion);
         this.logger.debug("Lock released");
@@ -37647,6 +37702,13 @@ var DeployEngine = class {
           ...result.attributes && { attributes: result.attributes },
           ...dependencies && dependencies.length > 0 && { dependencies }
         };
+        this.kickOffObservedCapture(
+          provider,
+          logicalId,
+          result.physicalId,
+          resourceType,
+          resolvedProps
+        );
         if (counts)
           counts.created++;
         if (progress)
@@ -37725,6 +37787,13 @@ var DeployEngine = class {
             ...createResult.attributes && { attributes: createResult.attributes },
             ...dependencies && dependencies.length > 0 && { dependencies }
           };
+          this.kickOffObservedCapture(
+            provider,
+            logicalId,
+            createResult.physicalId,
+            resourceType,
+            resolvedProps
+          );
           if (counts)
             counts.updated++;
           if (progress)
@@ -37803,6 +37872,13 @@ var DeployEngine = class {
             ...result.attributes && { attributes: result.attributes },
             ...dependencies && dependencies.length > 0 && { dependencies }
           };
+          this.kickOffObservedCapture(
+            provider,
+            logicalId,
+            result.physicalId,
+            resourceType,
+            resolvedProps
+          );
           if (counts)
             counts.updated++;
           if (progress)
@@ -38281,6 +38357,7 @@ Deploying stack: ${stackInfo.stackName}${stackRegion !== baseRegion ? ` (region:
           concurrency: options.concurrency,
           dryRun: options.dryRun,
           noRollback: !options.rollback,
+          captureObservedState: resolveCaptureObservedState(options.captureObservedState),
           ...options.resourceWarnAfter?.globalMs !== void 0 && {
             resourceWarnAfterMs: options.resourceWarnAfter.globalMs
           },
@@ -38984,7 +39061,8 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
         continue;
       }
       const ignorePaths = provider.getDriftUnknownPaths ? provider.getDriftUnknownPaths(resource.resourceType) : [];
-      const changes = calculateResourceDrift(resource.properties ?? {}, aws, { ignorePaths });
+      const baseline = resource.observedProperties ?? resource.properties ?? {};
+      const changes = calculateResourceDrift(baseline, aws, { ignorePaths });
       if (changes.length === 0) {
         outcomes.push({ kind: "clean", logicalId, resourceType: resource.resourceType });
       } else {
@@ -39056,14 +39134,13 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
         const existing = resources[outcome.logicalId];
         if (!existing)
           continue;
-        const newProperties = JSON.parse(JSON.stringify(existing.properties ?? {}));
+        const hasObserved = existing.observedProperties !== void 0;
+        const baselineSource = hasObserved ? existing.observedProperties : existing.properties ?? {};
+        const newBaseline = JSON.parse(JSON.stringify(baselineSource));
         for (const change of outcome.changes) {
-          setAtPath(newProperties, change.path, change.awsValue);
+          setAtPath(newBaseline, change.path, change.awsValue);
         }
-        resources[outcome.logicalId] = {
-          ...existing,
-          properties: newProperties
-        };
+        resources[outcome.logicalId] = hasObserved ? { ...existing, observedProperties: newBaseline } : { ...existing, properties: newBaseline };
       }
       const newState = {
         ...report.state,
@@ -39130,13 +39207,14 @@ async function runRevert(reports, providerRegistry, stateConfig, awsClients, opt
           return;
         }
         const provider = providerRegistry.getProvider(outcome.resourceType);
+        const desiredProperties = stateResource.observedProperties ?? stateResource.properties ?? {};
         try {
           await withRetry(
             () => provider.update(
               outcome.logicalId,
               stateResource.physicalId,
               outcome.resourceType,
-              stateResource.properties ?? {},
+              desiredProperties,
               outcome.awsProperties
             ),
             outcome.logicalId,
@@ -42209,6 +42287,7 @@ async function importCommand(stackArg, options) {
         existingState,
         selectiveMode
       );
+      await captureObservedForImportedResources(stackState, providerRegistry, logger);
       const saveOptions = {};
       if (existingEtag) {
         saveOptions.expectedEtag = existingEtag;
@@ -42409,7 +42488,7 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
     };
   }
   return {
-    version: 2,
+    version: STATE_SCHEMA_VERSION_CURRENT,
     stackName,
     region,
     resources,
@@ -42502,6 +42581,33 @@ function createImportCommand() {
 function collectMultiple(value, previous) {
   return [...previous ?? [], value];
 }
+async function captureObservedForImportedResources(stackState, providerRegistry, logger) {
+  const entries = Object.entries(stackState.resources);
+  if (entries.length === 0)
+    return;
+  await Promise.all(
+    entries.map(async ([logicalId, resource]) => {
+      try {
+        const provider = providerRegistry.getProvider(resource.resourceType);
+        if (!provider.readCurrentState)
+          return;
+        const observed = await provider.readCurrentState(
+          resource.physicalId,
+          logicalId,
+          resource.resourceType,
+          resource.properties ?? {}
+        );
+        if (observed !== void 0) {
+          resource.observedProperties = observed;
+        }
+      } catch (err) {
+        logger.debug(
+          `observedProperties capture for imported ${logicalId} (${resource.resourceType}) failed: ${err instanceof Error ? err.message : String(err)} \u2014 drift will fall back to template properties for this resource until the next successful deploy.`
+        );
+      }
+    })
+  );
+}
 
 // src/cli/index.ts
 var SUBCOMMANDS = /* @__PURE__ */ new Set([
@@ -42531,7 +42637,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command14();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.46.1");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.48.0");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());