@go-to-k/cdkd 0.278.21 → 0.278.23

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-dvS1K_ET.js";
+import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-D7KckQ5N.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BN1QMZlz.js";
+import { t as ASGProvider } from "./asg-provider-ir7DmsIU.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, InvalidParameterException, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
@@ -52,7 +52,7 @@ import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPo
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
-import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
+import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
 import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$11, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
@@ -4868,7 +4868,7 @@ function coerceCfnBoolean(value) {
 * S3's CreateBucket is synchronous - no polling needed, unlike CC API which
 * requires async polling (1s→1.5s→2.25s...) adding seconds per resource.
 */
-var S3BucketProvider = class {
+var S3BucketProvider = class S3BucketProvider {
 	s3Client;
 	logger = getLogger().child("S3BucketProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::S3::Bucket", /* @__PURE__ */ new Set([
@@ -5142,6 +5142,7 @@ var S3BucketProvider = class {
 	* - BucketKeyEnabled
 	*/
 	async applyBucketEncryption(bucketName, encryptionConfig) {
+		if (!Array.isArray(encryptionConfig?.ServerSideEncryptionConfiguration)) throw new Error(`BucketEncryption.ServerSideEncryptionConfiguration must be an array (got ${encryptionConfig?.ServerSideEncryptionConfiguration === void 0 ? "undefined" : typeof encryptionConfig.ServerSideEncryptionConfiguration}) — check for an unresolved intrinsic or a mis-nested template value`);
 		const rules = encryptionConfig.ServerSideEncryptionConfiguration.map((rule) => {
 			const byDefault = rule["ServerSideEncryptionByDefault"];
 			return {
@@ -5525,30 +5526,91 @@ var S3BucketProvider = class {
 		this.logger.debug(`Applied object lock configuration to bucket ${bucketName}`);
 	}
 	/**
-	* Apply additional bucket configuration after creation
+	* Apply additional bucket configuration after creation.
+	*
+	* `options.skipDiffManaged` is passed by `update()` for the three
+	* sub-configs that moved onto the diff path (`VersioningConfiguration` /
+	* `OwnershipControls` / `BucketEncryption`, issue #1466). They stay here for
+	* CREATE — where there is no previous side to diff against — but on UPDATE
+	* they must go through `applySubConfigDiffs` so a REMOVED property is reset
+	* to the CloudFormation default instead of silently surviving. Applying them
+	* in both places would double-PUT.
 	*/
-	async applyConfiguration(bucketName, properties, skipTags = false) {
+	async applyConfiguration(bucketName, properties, options = {}) {
+		const { skipTags = false, skipDiffManaged = false } = options;
 		const versioningConfig = properties["VersioningConfiguration"];
-		if (versioningConfig) await this.applyVersioning(bucketName, versioningConfig);
+		if (!skipDiffManaged && versioningConfig) await this.applyVersioning(bucketName, versioningConfig);
 		const tags = properties["Tags"];
 		if (!skipTags && tags && Array.isArray(tags) && tags.length > 0) await this.applyTags(bucketName, tags);
 		const ownershipControls = properties["OwnershipControls"];
-		if (ownershipControls?.Rules) {
-			await this.s3Client.send(new PutBucketOwnershipControlsCommand({
-				Bucket: bucketName,
-				OwnershipControls: { Rules: ownershipControls.Rules.map((r) => ({ ObjectOwnership: r.ObjectOwnership })) }
-			}));
-			this.logger.debug(`Applied ownership controls to bucket ${bucketName}`);
-		}
+		const normalizedOwnership = S3BucketProvider.emptyListConfigToUndefined(ownershipControls, "Rules");
+		if (!skipDiffManaged && normalizedOwnership !== void 0) await this.applyOwnershipControls(bucketName, normalizedOwnership);
 		const publicAccessBlock = properties["PublicAccessBlockConfiguration"];
 		if (publicAccessBlock) await this.applyPublicAccessBlockConfiguration(bucketName, publicAccessBlock);
-		const bucketEncryption = properties["BucketEncryption"];
-		if (bucketEncryption?.ServerSideEncryptionConfiguration && Array.isArray(bucketEncryption.ServerSideEncryptionConfiguration) && bucketEncryption.ServerSideEncryptionConfiguration.length > 0) await this.applyBucketEncryption(bucketName, bucketEncryption);
+		const normalizedEncryption = S3BucketProvider.emptyListConfigToUndefined(properties["BucketEncryption"], "ServerSideEncryptionConfiguration");
+		if (!skipDiffManaged && normalizedEncryption !== void 0) await this.applyBucketEncryption(bucketName, normalizedEncryption);
+	}
+	/**
+	* CFn property: OwnershipControls
+	* SDK: PutBucketOwnershipControls
+	*/
+	async applyOwnershipControls(bucketName, ownershipControls) {
+		if (!Array.isArray(ownershipControls?.Rules)) throw new Error(`OwnershipControls.Rules must be an array (got ${ownershipControls?.Rules === void 0 ? "undefined" : typeof ownershipControls.Rules}) — check for an unresolved intrinsic or a mis-nested template value`);
+		await this.s3Client.send(new PutBucketOwnershipControlsCommand({
+			Bucket: bucketName,
+			OwnershipControls: { Rules: ownershipControls.Rules.map((r) => ({ ObjectOwnership: r.ObjectOwnership })) }
+		}));
+		this.logger.debug(`Applied ownership controls to bucket ${bucketName}`);
+	}
+	/**
+	* Normalize an "empty container" sub-config value to `undefined` so the diff
+	* path cannot mistake a placeholder for a real value.
+	*
+	* `readCurrentState` always-emits placeholder shapes for un-configured
+	* features (`BucketEncryption: { ServerSideEncryptionConfiguration: [] }`,
+	* and the `OwnershipControls: { Rules: [] }` added with issue #1466), and a
+	* `cdkd drift --revert` round-trip feeds those back through `update()`.
+	*
+	* The rule is "empty container == not declared", applied to BOTH sides. Per
+	* pairing that means:
+	*   empty desired  + absent previous -> no call (without this, a Put with an
+	*                                      empty list, which both APIs reject)
+	*   absent desired + empty previous  -> no call (without this, a Delete
+	*                                      against a bucket that never had it)
+	*   empty desired  + REAL previous   -> Delete. This one is NOT suppressed
+	*                                      and must not be: it is a genuine
+	*                                      declared -> not-declared transition,
+	*                                      which is exactly what CloudFormation
+	*                                      removes.
+	*
+	* "Empty" is deliberately NARROW. Only two shapes fold to `undefined`:
+	* a block with NO keys at all (`{}`), and a block whose list key holds an
+	* empty array. Everything else — a non-object, an array where the object
+	* belongs (wrong nesting), a block whose list key is absent but which
+	* carries OTHER keys, or a non-array list (an unresolved intrinsic) — is
+	* MALFORMED, not empty, and passes through so the apply call refuses it by
+	* name. Folding any of those to `undefined` would emit a Delete and
+	* silently downgrade a live bucket (KMS -> AES256) while the template still
+	* declares the config.
+	*
+	* NOTE this helper does NOT cover `VersioningConfiguration` (it has no list
+	* key), and that property is NOT malformed-shape-refused anywhere: a
+	* malformed value there still resolves to 'Suspended', matching `main`.
+	* That pre-existing gap is tracked in issue #1471 — see the note in
+	* `applySubConfigDiffs` for why guarding it is not as simple as it looks.
+	*/
+	static emptyListConfigToUndefined(config, listKey) {
+		if (config === void 0 || config === null) return void 0;
+		if (typeof config !== "object" || Array.isArray(config)) return config;
+		const list = config[listKey];
+		if (list === void 0 || list === null) return Object.keys(config).length === 0 ? void 0 : config;
+		if (Array.isArray(list) && list.length === 0) return void 0;
+		return config;
 	}
 	/**
 	* Diff CFn-shape sub-config values between previous and new state.
 	*
-	* Three transitions:
+	* Four transitions:
 	* - undefined -> defined  (value differs from previous, OR previous undefined): Put
 	* - defined -> undefined: Delete
 	* - defined -> defined (different): Put
@@ -5593,13 +5655,33 @@ var S3BucketProvider = class {
 	* Apply the diff between previous and new sub-configs, issuing Put / Delete
 	* SDK calls only for differing keys. Called from `update()`.
 	*
-	* Versioning / PublicAccessBlock / Tags / OwnershipControls / BucketEncryption
-	* stay on `applyConfiguration` (the unconditional always-PUT path) because
-	* their AWS APIs don't have a clean "delete" counterpart and they
-	* round-trip safely as no-ops when state == AWS-current. The 12 sub-configs
-	* below DO have proper Put/Delete pairs so the diff path is preferable.
+	* PublicAccessBlockConfiguration and Tags stay on `applyConfiguration` /
+	* `applyTagDiff`. `PublicAccessBlockConfiguration` is deliberately NOT on the
+	* diff path: a live CloudFormation A/B (issue #1466) confirmed CFn ALSO
+	* leaves the block in place when the property is removed, so cdkd is at
+	* parity and adding an `onRemove` here would CREATE a divergence.
+	*
+	* VersioningConfiguration / OwnershipControls / BucketEncryption used to sit
+	* on that always-PUT path too, on the assumption that their APIs had no clean
+	* "delete" counterpart. That was wrong in all three cases and made removal a
+	* silent no-op (issue #1466): the same A/B showed CFn suspends versioning,
+	* deletes ownership controls, and resets encryption to the SSE-S3 default.
+	* They are now diffed here like every other Put/Delete pair.
 	*/
 	async applySubConfigDiffs(bucketName, properties, previousProperties) {
+		const previousVersioning = previousProperties["VersioningConfiguration"];
+		const nextVersioning = properties["VersioningConfiguration"];
+		const versioningChanged = JSON.stringify(previousVersioning ?? null) !== JSON.stringify(nextVersioning ?? null);
+		const desiredVersioningStatus = nextVersioning == null ? "Suspended" : nextVersioning["Status"] || "Suspended";
+		if (versioningChanged && nextVersioning != null && desiredVersioningStatus !== "Suspended") await this.applyVersioning(bucketName, nextVersioning);
+		await this.diffSubConfig(bucketName, S3BucketProvider.emptyListConfigToUndefined(previousProperties["OwnershipControls"], "Rules"), S3BucketProvider.emptyListConfigToUndefined(properties["OwnershipControls"], "Rules"), async (cfg) => this.applyOwnershipControls(bucketName, cfg), async () => {
+			await this.s3Client.send(new DeleteBucketOwnershipControlsCommand({ Bucket: bucketName }));
+			this.logger.debug(`Deleted ownership controls on bucket ${bucketName}`);
+		});
+		await this.diffSubConfig(bucketName, S3BucketProvider.emptyListConfigToUndefined(previousProperties["BucketEncryption"], "ServerSideEncryptionConfiguration"), S3BucketProvider.emptyListConfigToUndefined(properties["BucketEncryption"], "ServerSideEncryptionConfiguration"), async (cfg) => this.applyBucketEncryption(bucketName, cfg), async () => {
+			await this.s3Client.send(new DeleteBucketEncryptionCommand({ Bucket: bucketName }));
+			this.logger.debug(`Deleted bucket encryption on bucket ${bucketName}`);
+		});
 		await this.diffSubConfig(bucketName, previousProperties["LifecycleConfiguration"], properties["LifecycleConfiguration"], async (cfg) => {
 			if (!cfg.Rules || !Array.isArray(cfg.Rules) || cfg.Rules.length === 0) return;
 			await this.applyLifecycleConfiguration(bucketName, cfg);
@@ -5660,6 +5742,14 @@ var S3BucketProvider = class {
 			}));
 			this.logger.debug(`Deleted inventory configuration ${id} on bucket ${bucketName}`);
 		});
+		if (versioningChanged && desiredVersioningStatus === "Suspended") {
+			const hasObjectLock = (p) => {
+				if (p["ObjectLockEnabled"] === true || p["ObjectLockEnabled"] === "true") return true;
+				return p["ObjectLockConfiguration"]?.["ObjectLockEnabled"] === "Enabled";
+			};
+			if (hasObjectLock(properties) || hasObjectLock(previousProperties)) this.logger.warn(`Bucket ${bucketName}: versioning would be suspended (VersioningConfiguration removed or set to Suspended), but the bucket has Object Lock enabled and S3 does not allow suspending versioning on it. Leaving versioning enabled.`);
+			else await this.applyVersioning(bucketName, { Status: "Suspended" });
+		}
 	}
 	/**
 	* Apply ALL sub-configs unconditionally on initial create. Used by
@@ -5752,7 +5842,10 @@ var S3BucketProvider = class {
 			};
 		}
 		try {
-			await this.applyConfiguration(physicalId, properties, true);
+			await this.applyConfiguration(physicalId, properties, {
+				skipTags: true,
+				skipDiffManaged: true
+			});
 			await this.applySubConfigDiffs(physicalId, properties, previousProperties);
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 			const attributes = await this.buildAttributes(physicalId);
@@ -5804,7 +5897,8 @@ var S3BucketProvider = class {
 	* returns `undefined`.
 	*
 	* Coverage: `BucketName`, `VersioningConfiguration`, `BucketEncryption`,
-	* `PublicAccessBlockConfiguration`, `Tags`, plus all 12 sub-configs:
+	* `OwnershipControls`, `PublicAccessBlockConfiguration`, `Tags`, plus all 12
+	* sub-configs:
 	* `LifecycleConfiguration`, `CorsConfiguration`, `WebsiteConfiguration`,
 	* `LoggingConfiguration`, `NotificationConfiguration`,
 	* `ReplicationConfiguration`, `ObjectLockConfiguration`,
@@ -5820,9 +5914,10 @@ var S3BucketProvider = class {
 			if (err instanceof NoSuchBucket || e.name === "NotFound" || e.name === "NoSuchBucket" || e.$metadata?.httpStatusCode === 404) return;
 			throw err;
 		}
-		const [versioning, encryption, pab, tags, lifecycle, cors, website, logging, notification, replication, objectLock, accelerate, metrics, analytics, intelligentTier, inventory] = await Promise.all([
+		const [versioning, encryption, ownership, pab, tags, lifecycle, cors, website, logging, notification, replication, objectLock, accelerate, metrics, analytics, intelligentTier, inventory] = await Promise.all([
 			this.readVersioning(physicalId),
 			this.readEncryption(physicalId),
+			this.readOwnershipControls(physicalId),
 			this.readPublicAccessBlock(physicalId),
 			this.readTags(physicalId),
 			this.readLifecycle(physicalId),
@@ -5842,6 +5937,7 @@ var S3BucketProvider = class {
 			BucketName: physicalId,
 			VersioningConfiguration: versioning,
 			BucketEncryption: encryption,
+			OwnershipControls: ownership,
 			PublicAccessBlockConfiguration: pab,
 			Tags: tags,
 			LifecycleConfiguration: lifecycle,
@@ -5861,6 +5957,22 @@ var S3BucketProvider = class {
 	async readVersioning(bucket) {
 		return { Status: (await this.s3Client.send(new GetBucketVersioningCommand({ Bucket: bucket }))).Status ?? "Suspended" };
 	}
+	/**
+	* OwnershipControls { Rules: [{ ObjectOwnership }] }. Always emit a
+	* placeholder (empty `Rules`) so a console-side change on a bucket that
+	* declares the property surfaces as drift. Added with issue #1466 — without
+	* a read here, `cdkd drift` could not see ownership controls at all, which
+	* is why the removal bug that issue fixes produced no signal from ANY
+	* command.
+	*/
+	async readOwnershipControls(bucket) {
+		try {
+			return { Rules: ((await this.s3Client.send(new GetBucketOwnershipControlsCommand({ Bucket: bucket }))).OwnershipControls?.Rules ?? []).map((r) => ({ ObjectOwnership: r.ObjectOwnership })) };
+		} catch (err) {
+			if (err.name === "OwnershipControlsNotFoundError") return { Rules: [] };
+			throw err;
+		}
+	}
 	async readEncryption(bucket) {
 		try {
 			return { ServerSideEncryptionConfiguration: ((await this.s3Client.send(new GetBucketEncryptionCommand({ Bucket: bucket }))).ServerSideEncryptionConfiguration?.Rules ?? []).map((rule) => {
@@ -32934,10 +33046,10 @@ var GlueProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		switch (resourceType) {
-			case "AWS::Glue::Database": return this.updateDatabase(logicalId, physicalId, resourceType, properties);
-			case "AWS::Glue::Table": return this.updateTable(logicalId, physicalId, resourceType, properties);
+			case "AWS::Glue::Database": return this.updateDatabase(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::Glue::Table": return this.updateTable(logicalId, physicalId, resourceType, properties, previousProperties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -32970,16 +33082,19 @@ var GlueProvider = class {
 			throw new ProvisioningError(`Failed to create Glue Database ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateDatabase(logicalId, physicalId, resourceType, properties) {
+	async updateDatabase(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Glue Database ${logicalId}: ${physicalId}`);
 		const databaseInput = properties["DatabaseInput"];
 		if (!databaseInput) throw new ProvisioningError(`DatabaseInput is required for Glue Database update ${logicalId}`, resourceType, logicalId, physicalId);
 		const catalogId = properties["CatalogId"];
+		const liveParameters = await this.readLiveDatabaseParameters(logicalId, resourceType, physicalId, catalogId);
 		try {
+			const builtDatabaseInput = this.buildDatabaseInput(databaseInput, physicalId);
+			this.preserveAwsManagedParameters(builtDatabaseInput, databaseInput["Parameters"], (previousProperties?.["DatabaseInput"])?.["Parameters"], liveParameters);
 			await this.getClient().send(new UpdateDatabaseCommand({
 				...catalogId !== void 0 && { CatalogId: catalogId },
 				Name: physicalId,
-				DatabaseInput: this.buildDatabaseInput(databaseInput, physicalId)
+				DatabaseInput: builtDatabaseInput
 			}));
 			this.logger.debug(`Successfully updated Glue Database ${logicalId}`);
 			return {
@@ -33039,7 +33154,7 @@ var GlueProvider = class {
 			throw new ProvisioningError(`Failed to create Glue Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateTable(logicalId, physicalId, resourceType, properties) {
+	async updateTable(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Glue Table ${logicalId}: ${physicalId}`);
 		const [databaseName, tableName] = physicalId.split("|");
 		if (!databaseName || !tableName) throw new ProvisioningError(`Invalid Glue Table physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
@@ -33048,11 +33163,15 @@ var GlueProvider = class {
 		const catalogId = properties["CatalogId"];
 		const updateIcebergKey = findIcebergTableInputKey(properties);
 		if (updateIcebergKey !== void 0) this.logger.warn(icebergTableInputRefusalMessage(logicalId, updateIcebergKey, "update"));
+		const live = await this.readLiveTableState(logicalId, resourceType, physicalId, databaseName, tableName, catalogId);
 		try {
+			const builtTableInput = this.buildTableInput(tableInput, tableName);
+			this.preserveAwsManagedParameters(builtTableInput, tableInput["Parameters"], (previousProperties?.["TableInput"])?.["Parameters"], live.parameters);
 			await this.getClient().send(new UpdateTableCommand$1({
-				CatalogId: catalogId,
+				...catalogId !== void 0 && { CatalogId: catalogId },
 				DatabaseName: databaseName,
-				TableInput: this.buildTableInput(tableInput, tableName)
+				TableInput: builtTableInput,
+				...live.versionId !== void 0 && { VersionId: live.versionId }
 			}));
 			this.logger.debug(`Successfully updated Glue Table ${logicalId}`);
 			return {
@@ -33061,7 +33180,13 @@ var GlueProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Glue Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			let message = `Failed to update Glue Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`;
+			if (error instanceof ConcurrentModificationException) {
+				message += ". Another writer changed the table between cdkd's pre-update read and its UpdateTable call.";
+				message += live.versionId !== void 0 ? ` cdkd sent the version it read (${live.versionId}) as a precondition and AWS rejected the write, rather than let it put back the AWS-managed Parameters read a moment earlier — which for an Apache Iceberg table would have pinned it to an older metadata_location (an effective snapshot rollback).` : " AWS returned no VersionId on the pre-update read, so cdkd could not attach a precondition; AWS rejected the write on its own.";
+				message += ` Re-run the deploy to pick up the current values.`;
+			}
+			throw new ProvisioningError(message, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteTable(logicalId, physicalId, resourceType, _properties, context) {
@@ -33088,6 +33213,150 @@ var GlueProvider = class {
 		}
 	}
 	/**
+	* Merge AWS-AUTHORED `Parameters` back into a full-replace update payload
+	* (issue [#1461](https://github.com/go-to-k/cdkd/issues/1461)).
+	*
+	* `UpdateTable` / `UpdateDatabase` replace `TableInput` / `DatabaseInput`
+	* **wholesale**: whatever the payload omits is erased. `Parameters` is a
+	* general-purpose bag that AWS itself writes into, so keys with NO template
+	* representation were wiped by the first unrelated edit. For an Apache
+	* Iceberg table that is not cosmetic — `table_type: ICEBERG` and
+	* `metadata_location` are what make the table readable as Iceberg by
+	* Athena / Spark / EMR, and losing them silently degrades it to a plain
+	* external table pointing at Iceberg data files. Verified live 2026-08-10
+	* in us-east-1: a deploy changing only `TableInput.Description` left
+	* `Table.Parameters` as `null`. The same exposure covers a Glue crawler's
+	* `classification`, `EXTERNAL`, `comment`, and Lake Formation markers.
+	*
+	* The merge is keyed on **"present in NEITHER template side"**, not on
+	* "absent from the desired side" — the latter would make user-authored
+	* parameters unremovable, i.e. the mirror image of the bug:
+	*
+	* | key in desired | key in previous | outcome                              |
+	* | -------------- | --------------- | ------------------------------------ |
+	* | yes            | (either)        | the user's value wins                |
+	* | no             | yes             | the USER REMOVED it -> stays removed |
+	* | no             | no              | AWS-AUTHORED -> preserved from live  |
+	*
+	* That keeps this provider on the repo's established clear-on-removal
+	* position (docs/provider-development.md §2a, issue #1155): a removal the
+	* user expressed in the template still reaches AWS. Glue's update APIs are
+	* full-replace, so removal needs no explicit reset sentinel — omitting the
+	* key IS the reset, and the only thing this helper adds back is the set of
+	* keys the user never authored in the first place. The generalized rule for
+	* any full-replace update API lives in docs/provider-development.md §2b.
+	*
+	* Audited siblings that do NOT get this treatment: `JobUpdate`'s
+	* `DefaultArguments` / `NonOverridableArguments`, `ConnectionInput`'s
+	* `ConnectionProperties`, `WorkflowUpdate.DefaultRunProperties` and
+	* `Crawler.Configuration` are purely USER-authored bags — AWS does not
+	* write into them, so merging live values back would only resurrect
+	* console-side additions and break `cdkd drift --revert`.
+	*
+	* `desiredParameters` / `previousParameters` are the raw CFn-side maps
+	* (their KEY SET is all that matters here; `buildTableInput` already
+	* stringified the desired VALUES into `built.Parameters`).
+	*/
+	preserveAwsManagedParameters(built, desiredParameters, previousParameters, liveParameters) {
+		if (!liveParameters || Object.keys(liveParameters).length === 0) return;
+		const desiredKeys = parameterKeySet(desiredParameters);
+		const previousKeys = parameterKeySet(previousParameters);
+		const awsAuthored = {};
+		for (const [key, value] of Object.entries(liveParameters)) {
+			if (desiredKeys.has(key) || previousKeys.has(key)) continue;
+			awsAuthored[key] = value;
+		}
+		if (Object.keys(awsAuthored).length === 0) return;
+		built.Parameters = {
+			...awsAuthored,
+			...built.Parameters ?? {}
+		};
+	}
+	/**
+	* The live table state {@link preserveAwsManagedParameters} needs: its
+	* current `Parameters` plus the `VersionId` that pins them.
+	*
+	* A missing table returns empty rather than throwing: `UpdateTable` is about
+	* to surface the real, more actionable error. Any OTHER failure is fatal by
+	* design — degrading to "skip the merge" would silently reinstate the very
+	* wipe this read exists to prevent, and the wrapped cause keeps a transient
+	* throttle retryable by the deploy engine's outer `withRetry` (every
+	* `provider.update()` call site wraps it, including both rollback arms since
+	* this issue).
+	*
+	* **Why `VersionId` matters and why it is SCOPED.** Reading `Parameters`
+	* here and writing them back in the next call opens a TOCTOU window: an
+	* Apache Iceberg commit from Spark / Athena / EMR landing in between would
+	* be undone by writing back the `metadata_location` we read, pinning the
+	* table to an older snapshot — silent data-visibility loss, strictly worse
+	* than the bug this read fixes. `UpdateTableRequest.VersionId` is AWS's
+	* optimistic-concurrency token for exactly this
+	* (`ConcurrentModificationException` is a documented `UpdateTable` error),
+	* so the caller sends the version it read and a concurrent commit makes the
+	* update fail loudly instead of silently rolling back.
+	*
+	* It is sent UNCONDITIONALLY whenever this read returned a version, and the
+	* earlier attempt to scope it to "only when the merge wrote back live
+	* values" was wrong on both counts. Wrong on SAFETY: the merge also reports
+	* nothing-written-back when the live read came back EMPTY, and that update
+	* still ships a wholesale `TableInput` replace — so a commit landing in the
+	* window would have been wiped with no guard at all, i.e. #1461 surviving
+	* its own fix. Wrong on its PREMISE: this read runs milliseconds before the
+	* send on every update, so a pure template push (`cdkd drift --revert`, the
+	* case the scoping was meant to protect) carries a FRESH version too. An
+	* unconditional guard therefore cannot fire spuriously — it fires only when
+	* somebody else genuinely wrote in between, which is exactly when a revert
+	* should stop and be re-run against current values rather than clobber a
+	* change it never saw.
+	*
+	* The precondition's real-AWS semantics are pinned by the `data-analytics`
+	* integ, which advances a table's version out of band and asserts cdkd's
+	* update is REFUSED — without that, "AWS silently ignores a stale VersionId"
+	* would make this guard a placebo.
+	*/
+	async readLiveTableState(logicalId, resourceType, physicalId, databaseName, tableName, catalogId) {
+		try {
+			const resp = await this.getClient().send(new GetTableCommand({
+				...catalogId !== void 0 && { CatalogId: catalogId },
+				DatabaseName: databaseName,
+				Name: tableName
+			}));
+			return {
+				parameters: resp.Table?.Parameters,
+				versionId: resp.Table?.VersionId
+			};
+		} catch (error) {
+			if (error instanceof EntityNotFoundException) return {
+				parameters: void 0,
+				versionId: void 0
+			};
+			throw new ProvisioningError(preUpdateReadFailureMessage("Table", "glue:GetTable", logicalId, error), resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+		}
+	}
+	/**
+	* `Database.Parameters` as AWS currently holds them, for
+	* {@link preserveAwsManagedParameters}. Same not-found / fail-closed
+	* contract as {@link readLiveTableState}.
+	*
+	* There is NO `VersionId` analogue here: `UpdateDatabaseRequest` has no such
+	* member (verified against `@aws-sdk/client-glue`), so the database merge
+	* carries the TOCTOU exposure the table merge closes. It is far narrower in
+	* practice — nothing commits to a Glue DATABASE out of band the way an
+	* Iceberg engine commits to a table — but it is real, and is written up in
+	* docs/supported-resources.md rather than left implicit.
+	*/
+	async readLiveDatabaseParameters(logicalId, resourceType, physicalId, catalogId) {
+		try {
+			return (await this.getClient().send(new GetDatabaseCommand({
+				...catalogId !== void 0 && { CatalogId: catalogId },
+				Name: physicalId
+			}))).Database?.Parameters;
+		} catch (error) {
+			if (error instanceof EntityNotFoundException) return void 0;
+			throw new ProvisioningError(preUpdateReadFailureMessage("Database", "glue:GetDatabase", logicalId, error), resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+		}
+	}
+	/**
 	* Build DatabaseInput for Glue API from CFn template properties.
 	*
 	* Used by both `createDatabase` and `updateDatabase` so the same
@@ -33101,7 +33370,7 @@ var GlueProvider = class {
 		const result = { Name: databaseInput["Name"] ?? fallbackName };
 		if (databaseInput["Description"] !== void 0) result.Description = databaseInput["Description"];
 		if (databaseInput["LocationUri"] !== void 0) result.LocationUri = databaseInput["LocationUri"];
-		if (databaseInput["Parameters"] !== void 0) result.Parameters = databaseInput["Parameters"];
+		if (databaseInput["Parameters"] !== void 0) result.Parameters = stringifyParameterValues(databaseInput["Parameters"]);
 		return result;
 	}
 	/**
@@ -33111,12 +33380,7 @@ var GlueProvider = class {
 		const result = { Name: tableInput["Name"] ?? fallbackName };
 		if (tableInput["Description"] !== void 0) result.Description = tableInput["Description"];
 		if (tableInput["TableType"] !== void 0) result.TableType = tableInput["TableType"];
-		if (tableInput["Parameters"] !== void 0) {
-			const rawParams = tableInput["Parameters"];
-			const params = {};
-			for (const [k, v] of Object.entries(rawParams)) params[k] = String(v);
-			result.Parameters = params;
-		}
+		if (tableInput["Parameters"] !== void 0) result.Parameters = stringifyParameterValues(tableInput["Parameters"]);
 		if (tableInput["Owner"] !== void 0) result.Owner = tableInput["Owner"];
 		if (tableInput["Retention"] !== void 0) result.Retention = tableInput["Retention"];
 		if (tableInput["ViewOriginalText"] !== void 0) result.ViewOriginalText = tableInput["ViewOriginalText"];
@@ -33188,10 +33452,11 @@ var GlueProvider = class {
 	* the provider's `create()` only handles Database/Table; CC API picks
 	* up drift detection for the rest.
 	*/
-	async readCurrentState(physicalId, _logicalId, resourceType) {
+	async readCurrentState(physicalId, _logicalId, resourceType, properties) {
+		const catalogId = properties?.["CatalogId"];
 		switch (resourceType) {
-			case "AWS::Glue::Database": return this.readDatabase(physicalId);
-			case "AWS::Glue::Table": return this.readTable(physicalId);
+			case "AWS::Glue::Database": return this.readDatabase(physicalId, catalogId);
+			case "AWS::Glue::Table": return this.readTable(physicalId, catalogId);
 			default: return;
 		}
 	}
@@ -33209,10 +33474,13 @@ var GlueProvider = class {
 		if (resourceType === "AWS::Glue::Table") return ["OpenTableFormatInput"];
 		return [];
 	}
-	async readDatabase(physicalId) {
+	async readDatabase(physicalId, catalogId) {
 		let db;
 		try {
-			db = (await this.getClient().send(new GetDatabaseCommand({ Name: physicalId }))).Database;
+			db = (await this.getClient().send(new GetDatabaseCommand({
+				...catalogId !== void 0 && { CatalogId: catalogId },
+				Name: physicalId
+			}))).Database;
 		} catch (err) {
 			if (err instanceof EntityNotFoundException) return void 0;
 			throw err;
@@ -33227,12 +33495,13 @@ var GlueProvider = class {
 		if (db.Name !== void 0) result["DatabaseName"] = db.Name;
 		return result;
 	}
-	async readTable(physicalId) {
+	async readTable(physicalId, catalogId) {
 		const [databaseName, tableName] = physicalId.split("|");
 		if (!databaseName || !tableName) return void 0;
 		let table;
 		try {
 			table = (await this.getClient().send(new GetTableCommand({
+				...catalogId !== void 0 && { CatalogId: catalogId },
 				DatabaseName: databaseName,
 				Name: tableName
 			}))).Table;
@@ -34049,6 +34318,35 @@ function buildJobCommonFields(p) {
 	return r;
 }
 /**
+* CFn `Parameters` map -> the SDK's `Record<string, string>`. CDK may deliver
+* booleans / numbers; the SDK member is string-valued.
+*/
+function stringifyParameterValues(raw) {
+	const params = {};
+	for (const [k, v] of Object.entries(raw ?? {})) params[k] = String(v);
+	return params;
+}
+/**
+* Key set of a CFn-side `Parameters` map, for
+* {@link GlueProvider.preserveAwsManagedParameters}.
+*
+* A non-object (absent, or an unresolved intrinsic) contributes NO keys — so
+* a template that declares no `Parameters` at all can never be mistaken for
+* one that removed a key, and every live key stays preserved.
+*/
+function parameterKeySet(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return /* @__PURE__ */ new Set();
+	return new Set(Object.keys(value));
+}
+/**
+* Message for a failed pre-update `Get*` read (issue #1461). Names the IAM
+* action so a permission gap is one line away from fixed, and says what the
+* read is FOR so the failure does not read as gratuitous.
+*/
+function preUpdateReadFailureMessage(kind, iamAction, logicalId, error) {
+	return `Failed to read the current Glue ${kind} ${logicalId} before update: ${error instanceof Error ? error.message : String(error)}. cdkd reads the live ${kind.toLowerCase()} so AWS-managed Parameters (Apache Iceberg's table_type / metadata_location, a crawler's classification, Lake Formation markers) survive an update that Glue applies as a full replace. Grant ${iamAction} to the deploy identity — proceeding without the read would silently erase them.`;
+}
+/**
 * Coerce a CFn-delivered numeric property (often a string like `"10"`) to a
 * JS number at the SDK wire boundary. Non-finite / unparseable inputs are
 * returned unchanged so AWS surfaces a clear validation error rather than
@@ -65486,7 +65784,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.21");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.23");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;