@go-to-k/cdkd 0.144.0 → 0.145.1

package/dist/cli.js

@@ -27405,7 +27405,17 @@ var EFSProvider = class {
 * Membership grows as each follow-up PR lands. Keep alphabetical
 * to minimize merge conflicts when multiple follow-ups race.
 */
-const SUPPORTED_UPDATE_DESTINATIONS = new Set(["ExtendedS3DestinationConfiguration", "RedshiftDestinationConfiguration"]);
+const SUPPORTED_UPDATE_DESTINATIONS = new Set([
+	"AmazonOpenSearchServerlessDestinationConfiguration",
+	"AmazonopensearchserviceDestinationConfiguration",
+	"ElasticsearchDestinationConfiguration",
+	"ExtendedS3DestinationConfiguration",
+	"HttpEndpointDestinationConfiguration",
+	"IcebergDestinationConfiguration",
+	"RedshiftDestinationConfiguration",
+	"SnowflakeDestinationConfiguration",
+	"SplunkDestinationConfiguration"
+]);
 /**
 * SDK Provider for AWS Kinesis Firehose resources
 *
@@ -27609,18 +27619,85 @@ var FirehoseProvider = class {
 	*     `CloudWatchLoggingOptions`, `Username` / `Password` /
 	*     `RoleARN` / `ClusterJDBCURL`.
 	*
-	* Other destination types (`S3DestinationConfiguration`,
-	* `HttpEndpointDestinationConfiguration`,
-	* `ElasticsearchDestinationConfiguration`,
-	* `AmazonopensearchserviceDestinationConfiguration`,
-	* `SplunkDestinationConfiguration`,
-	* `AmazonOpenSearchServerlessDestinationConfiguration`,
-	* `IcebergDestinationConfiguration`,
-	* `SnowflakeDestinationConfiguration`) stay rejected with a tightened
-	* error message naming the AWS API. Each one is a follow-up to (#549)
-	* — AWS provides `UpdateDestination` for them too, but the per-shape
-	* reverse-mappers are deep and each warrants its own focused PR.
-	* Re-deploy with `cdkd deploy --replace` until they land.
+	*   - `SplunkDestinationConfiguration` (#549) — same flow as
+	*     Redshift: `DescribeDeliveryStream` recovers VersionId +
+	*     DestinationId, then `UpdateDestinationCommand` issues the
+	*     diff with a `SplunkDestinationUpdate` payload produced by
+	*     {@link mapSplunkConfigToUpdate}. Handles `HECEndpoint`,
+	*     `HECEndpointType`, `HECToken`,
+	*     `HECAcknowledgmentTimeoutInSeconds`, `RetryOptions`,
+	*     `S3BackupMode`, `S3Configuration` → `S3Update`,
+	*     `ProcessingConfiguration`, `CloudWatchLoggingOptions`,
+	*     `BufferingHints`, `SecretsManagerConfiguration`. Splunk has
+	*     no S3 backup destination shape (no `S3BackupConfiguration`
+	*     field) — unlike Redshift / ExtendedS3.
+	*
+	*   - `AmazonopensearchserviceDestinationConfiguration` (#549) —
+	*     `AmazonopensearchserviceDestinationUpdate` payload produced
+	*     by {@link mapAmazonopensearchserviceConfigToUpdate}. Handles
+	*     `RoleARN`, `DomainARN`, `ClusterEndpoint`, `IndexName`,
+	*     `TypeName`, `IndexRotationPeriod`, `BufferingHints`,
+	*     `RetryOptions`, `S3Configuration` → `S3Update`,
+	*     `ProcessingConfiguration`, `CloudWatchLoggingOptions`,
+	*     `DocumentIdOptions`. `VpcConfiguration` is read-only on
+	*     AWS-side Update — diffs to that field will not be forwarded
+	*     and surface on the next `cdkd drift` run.
+	*
+	*   - `AmazonOpenSearchServerlessDestinationConfiguration` (#549) —
+	*     `AmazonOpenSearchServerlessDestinationUpdate` payload
+	*     produced by {@link mapAmazonOpenSearchServerlessConfigToUpdate}.
+	*     Simpler than the service variant — `RoleARN`,
+	*     `CollectionEndpoint`, `IndexName`, `BufferingHints`,
+	*     `RetryOptions`, `S3Configuration` → `S3Update`,
+	*     `ProcessingConfiguration`, `CloudWatchLoggingOptions`.
+	*
+	*   - `HttpEndpointDestinationConfiguration` (#549) —
+	*     `HttpEndpointDestinationUpdate` payload produced by
+	*     {@link mapHttpEndpointConfigToUpdate}. Handles
+	*     `EndpointConfiguration`, `BufferingHints`,
+	*     `CloudWatchLoggingOptions`, `RequestConfiguration`,
+	*     `ProcessingConfiguration`, `RoleARN`, `RetryOptions`,
+	*     `S3BackupMode`, `S3Configuration` → `S3Update`,
+	*     `SecretsManagerConfiguration`.
+	*
+	*   - `ElasticsearchDestinationConfiguration` (#549) —
+	*     `ElasticsearchDestinationUpdate` payload produced by
+	*     {@link mapElasticsearchConfigToUpdate}. Legacy variant of
+	*     `Amazonopensearchservice*`; same field shape sans
+	*     `VpcConfiguration` (also read-only on Update).
+	*
+	*   - `IcebergDestinationConfiguration` (#549) —
+	*     `IcebergDestinationUpdate` payload produced by
+	*     {@link mapIcebergConfigToUpdate}. Handles
+	*     `DestinationTableConfigurationList`,
+	*     `SchemaEvolutionConfiguration`,
+	*     `TableCreationConfiguration`, `BufferingHints`,
+	*     `CloudWatchLoggingOptions`, `ProcessingConfiguration`,
+	*     `S3BackupMode`, `RetryOptions`, `RoleARN`, `AppendOnly`,
+	*     `CatalogConfiguration`, `S3Configuration`. **Quirk**: the
+	*     SDK Update shape's S3 field is named `S3Configuration` (full
+	*     `S3DestinationConfiguration` shape), NOT `S3Update` — unlike
+	*     every other destination type. The reverse-mapper forwards it
+	*     verbatim without renaming.
+	*
+	*   - `SnowflakeDestinationConfiguration` (#549) —
+	*     `SnowflakeDestinationUpdate` payload produced by
+	*     {@link mapSnowflakeConfigToUpdate}. Handles many connector
+	*     credentials (`AccountUrl` / `PrivateKey` / `KeyPassphrase` /
+	*     `User` / `Database` / `Schema` / `Table` /
+	*     `SnowflakeRoleConfiguration`) plus the standard suite
+	*     (`DataLoadingOption`, `MetaDataColumnName`,
+	*     `ContentColumnName`, `CloudWatchLoggingOptions`,
+	*     `ProcessingConfiguration`, `RoleARN`, `RetryOptions`,
+	*     `S3BackupMode`, `S3Configuration` → `S3Update`,
+	*     `SecretsManagerConfiguration`, `BufferingHints`).
+	*
+	* The legacy `S3DestinationConfiguration` (deprecated by AWS in
+	* favor of `ExtendedS3DestinationConfiguration`) stays rejected
+	* with a tightened error — CDK constructs always emit Extended.
+	* Templates that still pin the legacy shape should migrate to
+	* Extended; in-place update of the deprecated shape isn't a
+	* priority follow-up.
 	*
 	* Destination-type SWITCHES (e.g. ExtendedS3 → Redshift) are immutable
 	* on AWS; cdkd surfaces `ResourceUpdateNotSupportedError` so the caller
@@ -27648,6 +27725,41 @@ var FirehoseProvider = class {
 			const prevDest = previousProperties[activeDest] ?? {};
 			if (JSON.stringify(nextDest) !== JSON.stringify(prevDest)) await this.applyRedshiftDestinationUpdate(physicalId, nextDest);
 		}
+		if (activeDest === "SplunkDestinationConfiguration") {
+			const nextDest = properties[activeDest] ?? {};
+			const prevDest = previousProperties[activeDest] ?? {};
+			if (JSON.stringify(nextDest) !== JSON.stringify(prevDest)) await this.applySplunkDestinationUpdate(physicalId, nextDest);
+		}
+		if (activeDest === "AmazonopensearchserviceDestinationConfiguration") {
+			const nextDest = properties[activeDest] ?? {};
+			const prevDest = previousProperties[activeDest] ?? {};
+			if (JSON.stringify(nextDest) !== JSON.stringify(prevDest)) await this.applyAmazonopensearchserviceDestinationUpdate(physicalId, nextDest);
+		}
+		if (activeDest === "AmazonOpenSearchServerlessDestinationConfiguration") {
+			const nextDest = properties[activeDest] ?? {};
+			const prevDest = previousProperties[activeDest] ?? {};
+			if (JSON.stringify(nextDest) !== JSON.stringify(prevDest)) await this.applyAmazonOpenSearchServerlessDestinationUpdate(physicalId, nextDest);
+		}
+		if (activeDest === "HttpEndpointDestinationConfiguration") {
+			const nextDest = properties[activeDest] ?? {};
+			const prevDest = previousProperties[activeDest] ?? {};
+			if (JSON.stringify(nextDest) !== JSON.stringify(prevDest)) await this.applyHttpEndpointDestinationUpdate(physicalId, nextDest);
+		}
+		if (activeDest === "ElasticsearchDestinationConfiguration") {
+			const nextDest = properties[activeDest] ?? {};
+			const prevDest = previousProperties[activeDest] ?? {};
+			if (JSON.stringify(nextDest) !== JSON.stringify(prevDest)) await this.applyElasticsearchDestinationUpdate(physicalId, nextDest);
+		}
+		if (activeDest === "IcebergDestinationConfiguration") {
+			const nextDest = properties[activeDest] ?? {};
+			const prevDest = previousProperties[activeDest] ?? {};
+			if (JSON.stringify(nextDest) !== JSON.stringify(prevDest)) await this.applyIcebergDestinationUpdate(physicalId, nextDest);
+		}
+		if (activeDest === "SnowflakeDestinationConfiguration") {
+			const nextDest = properties[activeDest] ?? {};
+			const prevDest = previousProperties[activeDest] ?? {};
+			if (JSON.stringify(nextDest) !== JSON.stringify(prevDest)) await this.applySnowflakeDestinationUpdate(physicalId, nextDest);
+		}
 		const desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
 		return {
 			physicalId,
@@ -27889,6 +28001,304 @@ var FirehoseProvider = class {
 		return result;
 	}
 	/**
+	* Recover `CurrentDeliveryStreamVersionId` + `DestinationId` from
+	* `DescribeDeliveryStream` and issue `UpdateDestination` with the new
+	* Splunk shape. The reverse-mapper at
+	* {@link mapSplunkConfigToUpdate} produces the
+	* `SplunkDestinationUpdate` payload — only fields present in the
+	* input are forwarded so omitted CFn keys don't clobber AWS-side
+	* state. Mirrors {@link applyRedshiftDestinationUpdate} (#549).
+	*/
+	async applySplunkDestinationUpdate(physicalId, nextConfig) {
+		const desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
+		const currentVersionId = desc?.VersionId;
+		const destinationId = (desc?.Destinations?.[0])?.DestinationId;
+		if (!currentVersionId || !destinationId) throw new ProvisioningError(`DescribeDeliveryStream for ${physicalId} did not return VersionId or DestinationId; UpdateDestination cannot proceed.`, "AWS::KinesisFirehose::DeliveryStream", physicalId);
+		await this.getClient().send(new UpdateDestinationCommand({
+			DeliveryStreamName: physicalId,
+			CurrentDeliveryStreamVersionId: currentVersionId,
+			DestinationId: destinationId,
+			SplunkDestinationUpdate: this.mapSplunkConfigToUpdate(nextConfig)
+		}));
+	}
+	/**
+	* Map CFn `SplunkDestinationConfiguration` to the
+	* `SplunkDestinationUpdate` shape used by AWS
+	* `UpdateDestinationCommand` (#549). Every field is `!== undefined`
+	* gated so omitted CFn keys do not clobber AWS-side state. The CFn
+	* `S3Configuration` field is mapped through
+	* {@link mapS3ConfigToUpdate} into the SDK-side `S3Update` slot.
+	* Splunk has no `S3BackupConfiguration` field (unlike Redshift /
+	* ExtendedS3).
+	*/
+	mapSplunkConfigToUpdate(config) {
+		const result = {};
+		if (config["HECEndpoint"] !== void 0) result.HECEndpoint = config["HECEndpoint"];
+		if (config["HECEndpointType"] !== void 0) result.HECEndpointType = config["HECEndpointType"];
+		if (config["HECToken"] !== void 0) result.HECToken = config["HECToken"];
+		if (config["HECAcknowledgmentTimeoutInSeconds"] !== void 0) result.HECAcknowledgmentTimeoutInSeconds = config["HECAcknowledgmentTimeoutInSeconds"];
+		if (config["RetryOptions"] !== void 0) result.RetryOptions = config["RetryOptions"];
+		if (config["S3BackupMode"] !== void 0) result.S3BackupMode = config["S3BackupMode"];
+		if (config["S3Configuration"] !== void 0) result.S3Update = this.mapS3ConfigToUpdate(config["S3Configuration"]);
+		if (config["ProcessingConfiguration"] !== void 0) result.ProcessingConfiguration = config["ProcessingConfiguration"];
+		if (config["CloudWatchLoggingOptions"] !== void 0) result.CloudWatchLoggingOptions = config["CloudWatchLoggingOptions"];
+		if (config["BufferingHints"] !== void 0) result.BufferingHints = config["BufferingHints"];
+		if (config["SecretsManagerConfiguration"] !== void 0) result.SecretsManagerConfiguration = config["SecretsManagerConfiguration"];
+		return result;
+	}
+	/**
+	* Apply UpdateDestination for `AmazonopensearchserviceDestinationConfiguration` (#549).
+	* Mirrors {@link applyRedshiftDestinationUpdate}.
+	*/
+	async applyAmazonopensearchserviceDestinationUpdate(physicalId, nextConfig) {
+		const desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
+		const currentVersionId = desc?.VersionId;
+		const destinationId = desc?.Destinations?.[0]?.DestinationId;
+		if (!currentVersionId || !destinationId) throw new ProvisioningError(`DescribeDeliveryStream for ${physicalId} did not return VersionId or DestinationId; UpdateDestination cannot proceed.`, "AWS::KinesisFirehose::DeliveryStream", physicalId);
+		await this.getClient().send(new UpdateDestinationCommand({
+			DeliveryStreamName: physicalId,
+			CurrentDeliveryStreamVersionId: currentVersionId,
+			DestinationId: destinationId,
+			AmazonopensearchserviceDestinationUpdate: this.mapAmazonopensearchserviceConfigToUpdate(nextConfig)
+		}));
+	}
+	/**
+	* Map CFn `AmazonopensearchserviceDestinationConfiguration` to the
+	* `AmazonopensearchserviceDestinationUpdate` shape (#549). Every field
+	* `!== undefined` gated. CFn `S3Configuration` → SDK `S3Update`.
+	* `VpcConfiguration` is intentionally NOT included — the SDK Update
+	* shape has no field for it (AWS treats Vpc placement as immutable
+	* post-create). VpcConfiguration-only diffs will surface on the next
+	* `cdkd drift` run if the user re-applies a different Vpc on the
+	* console side.
+	*/
+	mapAmazonopensearchserviceConfigToUpdate(config) {
+		const result = {};
+		const roleArn = config["RoleARN"] ?? config["RoleArn"];
+		if (roleArn !== void 0) result.RoleARN = roleArn;
+		const domainArn = config["DomainARN"] ?? config["DomainArn"];
+		if (domainArn !== void 0) result.DomainARN = domainArn;
+		if (config["ClusterEndpoint"] !== void 0) result.ClusterEndpoint = config["ClusterEndpoint"];
+		if (config["IndexName"] !== void 0) result.IndexName = config["IndexName"];
+		if (config["TypeName"] !== void 0) result.TypeName = config["TypeName"];
+		if (config["IndexRotationPeriod"] !== void 0) result.IndexRotationPeriod = config["IndexRotationPeriod"];
+		if (config["BufferingHints"] !== void 0) result.BufferingHints = config["BufferingHints"];
+		if (config["RetryOptions"] !== void 0) result.RetryOptions = config["RetryOptions"];
+		if (config["S3Configuration"] !== void 0) result.S3Update = this.mapS3ConfigToUpdate(config["S3Configuration"]);
+		if (config["ProcessingConfiguration"] !== void 0) result.ProcessingConfiguration = config["ProcessingConfiguration"];
+		if (config["CloudWatchLoggingOptions"] !== void 0) result.CloudWatchLoggingOptions = config["CloudWatchLoggingOptions"];
+		if (config["DocumentIdOptions"] !== void 0) result.DocumentIdOptions = config["DocumentIdOptions"];
+		return result;
+	}
+	/**
+	* Apply UpdateDestination for `AmazonOpenSearchServerlessDestinationConfiguration` (#549).
+	* Mirrors {@link applyRedshiftDestinationUpdate}.
+	*/
+	async applyAmazonOpenSearchServerlessDestinationUpdate(physicalId, nextConfig) {
+		const desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
+		const currentVersionId = desc?.VersionId;
+		const destinationId = desc?.Destinations?.[0]?.DestinationId;
+		if (!currentVersionId || !destinationId) throw new ProvisioningError(`DescribeDeliveryStream for ${physicalId} did not return VersionId or DestinationId; UpdateDestination cannot proceed.`, "AWS::KinesisFirehose::DeliveryStream", physicalId);
+		await this.getClient().send(new UpdateDestinationCommand({
+			DeliveryStreamName: physicalId,
+			CurrentDeliveryStreamVersionId: currentVersionId,
+			DestinationId: destinationId,
+			AmazonOpenSearchServerlessDestinationUpdate: this.mapAmazonOpenSearchServerlessConfigToUpdate(nextConfig)
+		}));
+	}
+	/**
+	* Map CFn `AmazonOpenSearchServerlessDestinationConfiguration` to the
+	* `AmazonOpenSearchServerlessDestinationUpdate` shape (#549). Every
+	* field `!== undefined` gated. CFn `S3Configuration` → SDK `S3Update`.
+	* Simpler than the service variant — no VpcConfiguration / TypeName /
+	* IndexRotationPeriod / DocumentIdOptions.
+	*/
+	mapAmazonOpenSearchServerlessConfigToUpdate(config) {
+		const result = {};
+		const roleArn = config["RoleARN"] ?? config["RoleArn"];
+		if (roleArn !== void 0) result.RoleARN = roleArn;
+		if (config["CollectionEndpoint"] !== void 0) result.CollectionEndpoint = config["CollectionEndpoint"];
+		if (config["IndexName"] !== void 0) result.IndexName = config["IndexName"];
+		if (config["BufferingHints"] !== void 0) result.BufferingHints = config["BufferingHints"];
+		if (config["RetryOptions"] !== void 0) result.RetryOptions = config["RetryOptions"];
+		if (config["S3Configuration"] !== void 0) result.S3Update = this.mapS3ConfigToUpdate(config["S3Configuration"]);
+		if (config["ProcessingConfiguration"] !== void 0) result.ProcessingConfiguration = config["ProcessingConfiguration"];
+		if (config["CloudWatchLoggingOptions"] !== void 0) result.CloudWatchLoggingOptions = config["CloudWatchLoggingOptions"];
+		return result;
+	}
+	/**
+	* Apply UpdateDestination for `HttpEndpointDestinationConfiguration` (#549).
+	* Mirrors {@link applyRedshiftDestinationUpdate}.
+	*/
+	async applyHttpEndpointDestinationUpdate(physicalId, nextConfig) {
+		const desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
+		const currentVersionId = desc?.VersionId;
+		const destinationId = desc?.Destinations?.[0]?.DestinationId;
+		if (!currentVersionId || !destinationId) throw new ProvisioningError(`DescribeDeliveryStream for ${physicalId} did not return VersionId or DestinationId; UpdateDestination cannot proceed.`, "AWS::KinesisFirehose::DeliveryStream", physicalId);
+		await this.getClient().send(new UpdateDestinationCommand({
+			DeliveryStreamName: physicalId,
+			CurrentDeliveryStreamVersionId: currentVersionId,
+			DestinationId: destinationId,
+			HttpEndpointDestinationUpdate: this.mapHttpEndpointConfigToUpdate(nextConfig)
+		}));
+	}
+	/**
+	* Map CFn `HttpEndpointDestinationConfiguration` to the
+	* `HttpEndpointDestinationUpdate` shape (#549). Every field
+	* `!== undefined` gated. CFn `S3Configuration` → SDK `S3Update`.
+	* `EndpointConfiguration` (Url / Name / AccessKey) and
+	* `SecretsManagerConfiguration` are both pass-through (AWS accepts
+	* either auth mode on Update).
+	*/
+	mapHttpEndpointConfigToUpdate(config) {
+		const result = {};
+		if (config["EndpointConfiguration"] !== void 0) result.EndpointConfiguration = config["EndpointConfiguration"];
+		if (config["BufferingHints"] !== void 0) result.BufferingHints = config["BufferingHints"];
+		if (config["CloudWatchLoggingOptions"] !== void 0) result.CloudWatchLoggingOptions = config["CloudWatchLoggingOptions"];
+		if (config["RequestConfiguration"] !== void 0) result.RequestConfiguration = config["RequestConfiguration"];
+		if (config["ProcessingConfiguration"] !== void 0) result.ProcessingConfiguration = config["ProcessingConfiguration"];
+		const roleArn = config["RoleARN"] ?? config["RoleArn"];
+		if (roleArn !== void 0) result.RoleARN = roleArn;
+		if (config["RetryOptions"] !== void 0) result.RetryOptions = config["RetryOptions"];
+		if (config["S3BackupMode"] !== void 0) result.S3BackupMode = config["S3BackupMode"];
+		if (config["S3Configuration"] !== void 0) result.S3Update = this.mapS3ConfigToUpdate(config["S3Configuration"]);
+		if (config["SecretsManagerConfiguration"] !== void 0) result.SecretsManagerConfiguration = config["SecretsManagerConfiguration"];
+		return result;
+	}
+	/**
+	* Apply UpdateDestination for `ElasticsearchDestinationConfiguration` (#549).
+	* Mirrors {@link applyRedshiftDestinationUpdate}. Elasticsearch is the
+	* legacy variant — AWS still accepts it for stacks that pre-date the
+	* Amazonopensearchservice rename.
+	*/
+	async applyElasticsearchDestinationUpdate(physicalId, nextConfig) {
+		const desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
+		const currentVersionId = desc?.VersionId;
+		const destinationId = desc?.Destinations?.[0]?.DestinationId;
+		if (!currentVersionId || !destinationId) throw new ProvisioningError(`DescribeDeliveryStream for ${physicalId} did not return VersionId or DestinationId; UpdateDestination cannot proceed.`, "AWS::KinesisFirehose::DeliveryStream", physicalId);
+		await this.getClient().send(new UpdateDestinationCommand({
+			DeliveryStreamName: physicalId,
+			CurrentDeliveryStreamVersionId: currentVersionId,
+			DestinationId: destinationId,
+			ElasticsearchDestinationUpdate: this.mapElasticsearchConfigToUpdate(nextConfig)
+		}));
+	}
+	/**
+	* Map CFn `ElasticsearchDestinationConfiguration` to the
+	* `ElasticsearchDestinationUpdate` shape (#549). Every field
+	* `!== undefined` gated. CFn `S3Configuration` → SDK `S3Update`.
+	* Field set mirrors {@link mapAmazonopensearchserviceConfigToUpdate}
+	* — Elasticsearch is the legacy variant of the same destination.
+	*/
+	mapElasticsearchConfigToUpdate(config) {
+		const result = {};
+		const roleArn = config["RoleARN"] ?? config["RoleArn"];
+		if (roleArn !== void 0) result.RoleARN = roleArn;
+		const domainArn = config["DomainARN"] ?? config["DomainArn"];
+		if (domainArn !== void 0) result.DomainARN = domainArn;
+		if (config["ClusterEndpoint"] !== void 0) result.ClusterEndpoint = config["ClusterEndpoint"];
+		if (config["IndexName"] !== void 0) result.IndexName = config["IndexName"];
+		if (config["TypeName"] !== void 0) result.TypeName = config["TypeName"];
+		if (config["IndexRotationPeriod"] !== void 0) result.IndexRotationPeriod = config["IndexRotationPeriod"];
+		if (config["BufferingHints"] !== void 0) result.BufferingHints = config["BufferingHints"];
+		if (config["RetryOptions"] !== void 0) result.RetryOptions = config["RetryOptions"];
+		if (config["S3Configuration"] !== void 0) result.S3Update = this.mapS3ConfigToUpdate(config["S3Configuration"]);
+		if (config["ProcessingConfiguration"] !== void 0) result.ProcessingConfiguration = config["ProcessingConfiguration"];
+		if (config["CloudWatchLoggingOptions"] !== void 0) result.CloudWatchLoggingOptions = config["CloudWatchLoggingOptions"];
+		if (config["DocumentIdOptions"] !== void 0) result.DocumentIdOptions = config["DocumentIdOptions"];
+		return result;
+	}
+	/**
+	* Apply UpdateDestination for `IcebergDestinationConfiguration` (#549).
+	* Mirrors {@link applyRedshiftDestinationUpdate}.
+	*/
+	async applyIcebergDestinationUpdate(physicalId, nextConfig) {
+		const desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
+		const currentVersionId = desc?.VersionId;
+		const destinationId = desc?.Destinations?.[0]?.DestinationId;
+		if (!currentVersionId || !destinationId) throw new ProvisioningError(`DescribeDeliveryStream for ${physicalId} did not return VersionId or DestinationId; UpdateDestination cannot proceed.`, "AWS::KinesisFirehose::DeliveryStream", physicalId);
+		await this.getClient().send(new UpdateDestinationCommand({
+			DeliveryStreamName: physicalId,
+			CurrentDeliveryStreamVersionId: currentVersionId,
+			DestinationId: destinationId,
+			IcebergDestinationUpdate: this.mapIcebergConfigToUpdate(nextConfig)
+		}));
+	}
+	/**
+	* Map CFn `IcebergDestinationConfiguration` to the
+	* `IcebergDestinationUpdate` shape (#549). Every field
+	* `!== undefined` gated. **Quirk vs every other destination**: the
+	* SDK Update shape's S3 field is `S3Configuration` (a full
+	* `S3DestinationConfiguration`), NOT `S3Update`. Iceberg is a newer
+	* destination type and AWS chose to keep the field name aligned with
+	* the create shape; this reverse-mapper forwards it verbatim.
+	*/
+	mapIcebergConfigToUpdate(config) {
+		const result = {};
+		if (config["DestinationTableConfigurationList"] !== void 0) result.DestinationTableConfigurationList = config["DestinationTableConfigurationList"];
+		if (config["SchemaEvolutionConfiguration"] !== void 0) result.SchemaEvolutionConfiguration = config["SchemaEvolutionConfiguration"];
+		if (config["TableCreationConfiguration"] !== void 0) result.TableCreationConfiguration = config["TableCreationConfiguration"];
+		if (config["BufferingHints"] !== void 0) result.BufferingHints = config["BufferingHints"];
+		if (config["CloudWatchLoggingOptions"] !== void 0) result.CloudWatchLoggingOptions = config["CloudWatchLoggingOptions"];
+		if (config["ProcessingConfiguration"] !== void 0) result.ProcessingConfiguration = config["ProcessingConfiguration"];
+		if (config["S3BackupMode"] !== void 0) result.S3BackupMode = config["S3BackupMode"];
+		if (config["RetryOptions"] !== void 0) result.RetryOptions = config["RetryOptions"];
+		const roleArn = config["RoleARN"] ?? config["RoleArn"];
+		if (roleArn !== void 0) result.RoleARN = roleArn;
+		if (config["AppendOnly"] !== void 0) result.AppendOnly = config["AppendOnly"];
+		if (config["CatalogConfiguration"] !== void 0) result.CatalogConfiguration = config["CatalogConfiguration"];
+		if (config["S3Configuration"] !== void 0) result.S3Configuration = this.mapS3DestinationConfiguration(config["S3Configuration"]);
+		return result;
+	}
+	/**
+	* Apply UpdateDestination for `SnowflakeDestinationConfiguration` (#549).
+	* Mirrors {@link applyRedshiftDestinationUpdate}.
+	*/
+	async applySnowflakeDestinationUpdate(physicalId, nextConfig) {
+		const desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
+		const currentVersionId = desc?.VersionId;
+		const destinationId = desc?.Destinations?.[0]?.DestinationId;
+		if (!currentVersionId || !destinationId) throw new ProvisioningError(`DescribeDeliveryStream for ${physicalId} did not return VersionId or DestinationId; UpdateDestination cannot proceed.`, "AWS::KinesisFirehose::DeliveryStream", physicalId);
+		await this.getClient().send(new UpdateDestinationCommand({
+			DeliveryStreamName: physicalId,
+			CurrentDeliveryStreamVersionId: currentVersionId,
+			DestinationId: destinationId,
+			SnowflakeDestinationUpdate: this.mapSnowflakeConfigToUpdate(nextConfig)
+		}));
+	}
+	/**
+	* Map CFn `SnowflakeDestinationConfiguration` to the
+	* `SnowflakeDestinationUpdate` shape (#549). Every field
+	* `!== undefined` gated. CFn `S3Configuration` → SDK `S3Update`.
+	* Snowflake carries many connector-side credential / target-table
+	* fields (`AccountUrl` / `PrivateKey` / `KeyPassphrase` / `User` /
+	* `Database` / `Schema` / `Table`) all pass-through.
+	*/
+	mapSnowflakeConfigToUpdate(config) {
+		const result = {};
+		if (config["AccountUrl"] !== void 0) result.AccountUrl = config["AccountUrl"];
+		if (config["PrivateKey"] !== void 0) result.PrivateKey = config["PrivateKey"];
+		if (config["KeyPassphrase"] !== void 0) result.KeyPassphrase = config["KeyPassphrase"];
+		if (config["User"] !== void 0) result.User = config["User"];
+		if (config["Database"] !== void 0) result.Database = config["Database"];
+		if (config["Schema"] !== void 0) result.Schema = config["Schema"];
+		if (config["Table"] !== void 0) result.Table = config["Table"];
+		if (config["SnowflakeRoleConfiguration"] !== void 0) result.SnowflakeRoleConfiguration = config["SnowflakeRoleConfiguration"];
+		if (config["DataLoadingOption"] !== void 0) result.DataLoadingOption = config["DataLoadingOption"];
+		if (config["MetaDataColumnName"] !== void 0) result.MetaDataColumnName = config["MetaDataColumnName"];
+		if (config["ContentColumnName"] !== void 0) result.ContentColumnName = config["ContentColumnName"];
+		if (config["CloudWatchLoggingOptions"] !== void 0) result.CloudWatchLoggingOptions = config["CloudWatchLoggingOptions"];
+		if (config["ProcessingConfiguration"] !== void 0) result.ProcessingConfiguration = config["ProcessingConfiguration"];
+		const roleArn = config["RoleARN"] ?? config["RoleArn"];
+		if (roleArn !== void 0) result.RoleARN = roleArn;
+		if (config["RetryOptions"] !== void 0) result.RetryOptions = config["RetryOptions"];
+		if (config["S3BackupMode"] !== void 0) result.S3BackupMode = config["S3BackupMode"];
+		if (config["S3Configuration"] !== void 0) result.S3Update = this.mapS3ConfigToUpdate(config["S3Configuration"]);
+		if (config["SecretsManagerConfiguration"] !== void 0) result.SecretsManagerConfiguration = config["SecretsManagerConfiguration"];
+		if (config["BufferingHints"] !== void 0) result.BufferingHints = config["BufferingHints"];
+		return result;
+	}
+	/**
 	* Map CFn `S3DestinationConfiguration` to the `S3DestinationUpdate`
 	* shape used by AWS `UpdateDestinationCommand` (#477; consumed by
 	* {@link mapExtendedS3ConfigToUpdate} for the `S3BackupUpdate` field).
@@ -55565,7 +55975,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.144.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.145.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());