@go-to-k/cdkd 0.278.20 → 0.278.21

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-Bv3IEbrU.js";
+import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-dvS1K_ET.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-OB2CvUwn.js";
+import { t as ASGProvider } from "./asg-provider-BN1QMZlz.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -33019,13 +33019,14 @@ var GlueProvider = class {
 		const tableName = tableInput["Name"] ?? properties["Name"];
 		if (!tableName) throw new ProvisioningError(`TableInput.Name or top-level Name is required for Glue Table ${logicalId}`, resourceType, logicalId);
 		const catalogId = properties["CatalogId"];
+		assertIcebergTableInputAbsent(logicalId, resourceType, properties);
 		const openTableFormatInput = properties["OpenTableFormatInput"];
 		try {
 			await this.getClient().send(new CreateTableCommand$1({
 				CatalogId: catalogId,
 				DatabaseName: databaseName,
 				TableInput: this.buildTableInput(tableInput, tableName),
-				...openTableFormatInput !== void 0 && { OpenTableFormatInput: toSdkOpenTableFormatInput(openTableFormatInput) }
+				...openTableFormatInput !== void 0 && { OpenTableFormatInput: openTableFormatInput }
 			}));
 			const physicalId = `${databaseName}|${tableName}`;
 			this.logger.debug(`Successfully created Glue Table ${logicalId}: ${physicalId}`);
@@ -33045,6 +33046,8 @@ var GlueProvider = class {
 		const tableInput = properties["TableInput"];
 		if (!tableInput) throw new ProvisioningError(`TableInput is required for Glue Table update ${logicalId}`, resourceType, logicalId, physicalId);
 		const catalogId = properties["CatalogId"];
+		const updateIcebergKey = findIcebergTableInputKey(properties);
+		if (updateIcebergKey !== void 0) this.logger.warn(icebergTableInputRefusalMessage(logicalId, updateIcebergKey, "update"));
 		try {
 			await this.getClient().send(new UpdateTableCommand$1({
 				CatalogId: catalogId,
@@ -33600,32 +33603,100 @@ function sleep$1(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 /**
-* Convert the CFn `AWS::Glue::Table.OpenTableFormatInput` blob to the SDK
-* `OpenTableFormatInput` shape.
-*
-* Every key matches the SDK model except one: CFn's
-* `IcebergInput.IcebergTableInput` is the SDK's
-* `IcebergInput.CreateIcebergTableInput` (@aws-sdk/client-glue `models_1.d.ts`
-* `IcebergInput`). The AWS SDK v3 serializer drops unknown members, so leaving
-* the CFn spelling in place silently discarded the ENTIRE Iceberg table spec
-* (`Location` / `Schema` / `PartitionSpec` / `WriteOrder` / `Properties`) while
-* `CreateTable` still reported success. The renamed object's own members match
-* CFn 1:1, so this is a single key rename.
-*
-* Non-object inputs (an unresolved intrinsic) pass through untouched so AWS
-* surfaces the real validation error.
-*/
-function toSdkOpenTableFormatInput(input) {
-	const iceberg = input["IcebergInput"];
-	if (typeof iceberg !== "object" || iceberg === null || Array.isArray(iceberg) || !("IcebergTableInput" in iceberg)) return input;
-	const { IcebergTableInput: icebergTableInput, ...rest } = iceberg;
-	return {
-		...input,
-		IcebergInput: {
-			...rest,
-			CreateIcebergTableInput: icebergTableInput
-		}
-	};
+* Both spellings of the Iceberg table spec cdkd refuses inside
+* `OpenTableFormatInput.IcebergInput`: the CFn registry schema's
+* `IcebergTableInput` and `@aws-sdk/client-glue`'s `CreateIcebergTableInput`.
+* A hand-written template can carry either, and neither is deployable, so the
+* pre-flight matches both and names whichever it found.
+*/
+const ICEBERG_TABLE_INPUT_KEYS = ["IcebergTableInput", "CreateIcebergTableInput"];
+/**
+* Return whichever {@link ICEBERG_TABLE_INPUT_KEYS} spelling the template
+* carries under `OpenTableFormatInput.IcebergInput`, or `undefined`.
+*
+* Non-object shapes at either level (an unresolved intrinsic) are treated as
+* "absent" so AWS surfaces the real validation error rather than this refusal.
+*/
+function findIcebergTableInputKey(properties) {
+	const openTableFormatInput = properties["OpenTableFormatInput"];
+	if (typeof openTableFormatInput !== "object" || openTableFormatInput === null || Array.isArray(openTableFormatInput)) return;
+	const iceberg = openTableFormatInput["IcebergInput"];
+	if (typeof iceberg !== "object" || iceberg === null || Array.isArray(iceberg)) return;
+	return ICEBERG_TABLE_INPUT_KEYS.find((key) => key in iceberg);
+}
+/**
+* PRE-FLIGHT REFUSAL of `AWS::Glue::Table`
+* `OpenTableFormatInput.IcebergInput.IcebergTableInput` (issue #1454).
+*
+* **This is a deliberate PARITY DIVERGENCE, and it was a conscious choice.**
+* cdkd's compatibility target is CloudFormation, and CloudFormation does not
+* validate this property — it forwards it and lets the deploy roll back. cdkd
+* refuses it EARLIER and with a better message instead. The justification is
+* that no user is losing a working deployment: the live probe on issue #1408
+* (2026-08-09, us-east-1 — 5 raw `glue:CreateTable` shapes plus 5
+* `AWS::Glue::Table` CloudFormation stacks) proved the property is undeployable
+* on BOTH paths.
+*
+* - **The raw `glue:CreateTable` API — the call cdkd itself makes** — rejects
+*   every `CreateIcebergTableInput` shape: without a
+*   `TableInput.StorageDescriptor` it fails `Location information cannot be
+*   null while creating an iceberg table`, and with one it fails `Table
+*   metadata information present at multiple parts of input request`. The
+*   spec's own `Location` is never read. So this is NOT merely cdkd declining
+*   what CloudFormation declines — cdkd's own path cannot deploy it either.
+* - **CloudFormation** rolls back all three variants with `Table metadata is
+*   expected only via TableInput or via IcebergTableInputProperties inside
+*   OpenTableFormatInput` — naming a property that exists in NEITHER the CFn
+*   registry schema (`IcebergInput.IcebergTableInput`) NOR
+*   `@aws-sdk/client-glue` (`IcebergInput.CreateIcebergTableInput`). That
+*   three-way contract mismatch is an AWS-side bug.
+*
+* Because there is no shape in which the property works, forwarding it can only
+* produce a late, cryptic AWS error. Failing fast with the working shape spelled
+* out is strictly more useful.
+*
+* **CREATE only — update WARNS instead.** See the comment at the `updateTable`
+* call site: rollback replays from cdkd STATE, and a table created by a
+* pre-#1390 build carries the key in its state record, so refusing on update
+* would make such a table unrollbackable with no template-side remedy. cdkd
+* does not wire Glue's update-only `UpdateOpenTableFormatInput` shape and
+* `buildTableInput` is an explicit allow-list, so warning there forwards
+* nothing and loses no protection. One rollback arm is still exposed — the
+* reverse-replacement re-create replays a state record through `create()`;
+* see issue #1463 and the note at the `updateTable` call site.
+*
+* **Known bypass: the sticky Cloud Control route.** This is a GlueProvider
+* pre-flight, so it only runs on the SDK route. When a table's state record
+* carries `provisionedBy: 'cc-api'`, `ProviderRegistry.getProviderFor` sticky-
+* routes it to `CloudControlProvider`, which forwards the property to
+* CloudFormation and gets AWS's rollback instead of this message. That route is
+* opt-in only (`--recreate-via-cc-api`, or a legacy state record) —
+* `AWS::Glue::Table` has an empty `silentDrop` map, so no ordinary deploy takes
+* it. The outcome there is still a failure, just a later and less helpful one,
+* which is why this is documented rather than duplicated into the CC provider.
+*
+* **WARNING before relaxing this refusal.** cdkd used to RENAME the CFn
+* `IcebergTableInput` to the SDK's `CreateIcebergTableInput` (issue #1390); that
+* rename existed because the AWS SDK v3 serializer DROPS unknown members, so the
+* CFn spelling silently discarded the entire Iceberg spec while `CreateTable`
+* reported success. The rename was removed here as unreachable once this
+* refusal landed. If AWS ever ships a deployable shape and this check is
+* relaxed, the rename MUST be restored in the same change — otherwise the
+* silent-drop bug of #1390 comes straight back.
+*/
+function assertIcebergTableInputAbsent(logicalId, resourceType, properties, physicalId) {
+	const key = findIcebergTableInputKey(properties);
+	if (key === void 0) return;
+	throw new ProvisioningError(icebergTableInputRefusalMessage(logicalId, key, "create"), resourceType, logicalId, physicalId);
+}
+/**
+* The shared #1454 message body, so the CREATE refusal and the UPDATE warning
+* cannot drift apart. `mode` only changes the lead clause — everything after it
+* (the probe evidence and the working shape) is identical, because the user's
+* next action is the same either way.
+*/
+function icebergTableInputRefusalMessage(logicalId, key, mode) {
+	return `AWS::Glue::Table ${logicalId}: OpenTableFormatInput.IcebergInput.${key} ${mode === "create" ? `cannot be deployed by AWS in any shape, so cdkd refuses it before calling Glue (issue #1454).` : "cannot be deployed by AWS in any shape and is IGNORED on update — cdkd does not wire Glue's update-only UpdateOpenTableFormatInput shape, so it forwards nothing here and only warns (issue #1454). A CREATE of this table would be refused outright."}\n  Live-probed 2026-08-09 in us-east-1 (issue #1408): glue:CreateTable — the API cdkd calls — rejects every Iceberg table spec ("Location information cannot be null while creating an iceberg table" without a TableInput.StorageDescriptor, "Table metadata information present at multiple parts of input request" with one), and CloudFormation rolls the same template back with "Table metadata is expected only via TableInput or via IcebergTableInputProperties inside OpenTableFormatInput" — a property name that exists in neither the CFn registry schema (IcebergInput.IcebergTableInput) nor @aws-sdk/client-glue (IcebergInput.CreateIcebergTableInput).\n  Working shape — put the table metadata in TableInput and leave IcebergInput carrying only the create-time directive:\n    TableInput: { Name, TableType: 'EXTERNAL_TABLE', StorageDescriptor: { Location: 's3://your-bucket/prefix/', Columns: [...] } }\n    OpenTableFormatInput: { IcebergInput: { MetadataOperation: 'CREATE' } }   // Version: '2' is also accepted\n  Glue then writes the Iceberg metadata itself — the created table comes back with Parameters.table_type = ICEBERG and a populated Parameters.metadata_location.`;
 }
 /**
 * Build the SDK `EncryptionConfiguration` from the CFn-shape input
@@ -65415,7 +65486,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.20");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.21");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;