@go-to-k/cdkd 0.278.22 → 0.278.23

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-CkuG2VD5.js";
+import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-D7KckQ5N.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BBsW05cu.js";
+import { t as ASGProvider } from "./asg-provider-ir7DmsIU.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -52,7 +52,7 @@ import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPo
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
-import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
+import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
 import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$11, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
@@ -33046,10 +33046,10 @@ var GlueProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		switch (resourceType) {
-			case "AWS::Glue::Database": return this.updateDatabase(logicalId, physicalId, resourceType, properties);
-			case "AWS::Glue::Table": return this.updateTable(logicalId, physicalId, resourceType, properties);
+			case "AWS::Glue::Database": return this.updateDatabase(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::Glue::Table": return this.updateTable(logicalId, physicalId, resourceType, properties, previousProperties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -33082,16 +33082,19 @@ var GlueProvider = class {
 			throw new ProvisioningError(`Failed to create Glue Database ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateDatabase(logicalId, physicalId, resourceType, properties) {
+	async updateDatabase(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Glue Database ${logicalId}: ${physicalId}`);
 		const databaseInput = properties["DatabaseInput"];
 		if (!databaseInput) throw new ProvisioningError(`DatabaseInput is required for Glue Database update ${logicalId}`, resourceType, logicalId, physicalId);
 		const catalogId = properties["CatalogId"];
+		const liveParameters = await this.readLiveDatabaseParameters(logicalId, resourceType, physicalId, catalogId);
 		try {
+			const builtDatabaseInput = this.buildDatabaseInput(databaseInput, physicalId);
+			this.preserveAwsManagedParameters(builtDatabaseInput, databaseInput["Parameters"], (previousProperties?.["DatabaseInput"])?.["Parameters"], liveParameters);
 			await this.getClient().send(new UpdateDatabaseCommand({
 				...catalogId !== void 0 && { CatalogId: catalogId },
 				Name: physicalId,
-				DatabaseInput: this.buildDatabaseInput(databaseInput, physicalId)
+				DatabaseInput: builtDatabaseInput
 			}));
 			this.logger.debug(`Successfully updated Glue Database ${logicalId}`);
 			return {
@@ -33151,7 +33154,7 @@ var GlueProvider = class {
 			throw new ProvisioningError(`Failed to create Glue Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateTable(logicalId, physicalId, resourceType, properties) {
+	async updateTable(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Glue Table ${logicalId}: ${physicalId}`);
 		const [databaseName, tableName] = physicalId.split("|");
 		if (!databaseName || !tableName) throw new ProvisioningError(`Invalid Glue Table physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
@@ -33160,11 +33163,15 @@ var GlueProvider = class {
 		const catalogId = properties["CatalogId"];
 		const updateIcebergKey = findIcebergTableInputKey(properties);
 		if (updateIcebergKey !== void 0) this.logger.warn(icebergTableInputRefusalMessage(logicalId, updateIcebergKey, "update"));
+		const live = await this.readLiveTableState(logicalId, resourceType, physicalId, databaseName, tableName, catalogId);
 		try {
+			const builtTableInput = this.buildTableInput(tableInput, tableName);
+			this.preserveAwsManagedParameters(builtTableInput, tableInput["Parameters"], (previousProperties?.["TableInput"])?.["Parameters"], live.parameters);
 			await this.getClient().send(new UpdateTableCommand$1({
-				CatalogId: catalogId,
+				...catalogId !== void 0 && { CatalogId: catalogId },
 				DatabaseName: databaseName,
-				TableInput: this.buildTableInput(tableInput, tableName)
+				TableInput: builtTableInput,
+				...live.versionId !== void 0 && { VersionId: live.versionId }
 			}));
 			this.logger.debug(`Successfully updated Glue Table ${logicalId}`);
 			return {
@@ -33173,7 +33180,13 @@ var GlueProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update Glue Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			let message = `Failed to update Glue Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`;
+			if (error instanceof ConcurrentModificationException) {
+				message += ". Another writer changed the table between cdkd's pre-update read and its UpdateTable call.";
+				message += live.versionId !== void 0 ? ` cdkd sent the version it read (${live.versionId}) as a precondition and AWS rejected the write, rather than let it put back the AWS-managed Parameters read a moment earlier — which for an Apache Iceberg table would have pinned it to an older metadata_location (an effective snapshot rollback).` : " AWS returned no VersionId on the pre-update read, so cdkd could not attach a precondition; AWS rejected the write on its own.";
+				message += ` Re-run the deploy to pick up the current values.`;
+			}
+			throw new ProvisioningError(message, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async deleteTable(logicalId, physicalId, resourceType, _properties, context) {
@@ -33200,6 +33213,150 @@ var GlueProvider = class {
 		}
 	}
 	/**
+	* Merge AWS-AUTHORED `Parameters` back into a full-replace update payload
+	* (issue [#1461](https://github.com/go-to-k/cdkd/issues/1461)).
+	*
+	* `UpdateTable` / `UpdateDatabase` replace `TableInput` / `DatabaseInput`
+	* **wholesale**: whatever the payload omits is erased. `Parameters` is a
+	* general-purpose bag that AWS itself writes into, so keys with NO template
+	* representation were wiped by the first unrelated edit. For an Apache
+	* Iceberg table that is not cosmetic — `table_type: ICEBERG` and
+	* `metadata_location` are what make the table readable as Iceberg by
+	* Athena / Spark / EMR, and losing them silently degrades it to a plain
+	* external table pointing at Iceberg data files. Verified live 2026-08-10
+	* in us-east-1: a deploy changing only `TableInput.Description` left
+	* `Table.Parameters` as `null`. The same exposure covers a Glue crawler's
+	* `classification`, `EXTERNAL`, `comment`, and Lake Formation markers.
+	*
+	* The merge is keyed on **"present in NEITHER template side"**, not on
+	* "absent from the desired side" — the latter would make user-authored
+	* parameters unremovable, i.e. the mirror image of the bug:
+	*
+	* | key in desired | key in previous | outcome                              |
+	* | -------------- | --------------- | ------------------------------------ |
+	* | yes            | (either)        | the user's value wins                |
+	* | no             | yes             | the USER REMOVED it -> stays removed |
+	* | no             | no              | AWS-AUTHORED -> preserved from live  |
+	*
+	* That keeps this provider on the repo's established clear-on-removal
+	* position (docs/provider-development.md §2a, issue #1155): a removal the
+	* user expressed in the template still reaches AWS. Glue's update APIs are
+	* full-replace, so removal needs no explicit reset sentinel — omitting the
+	* key IS the reset, and the only thing this helper adds back is the set of
+	* keys the user never authored in the first place. The generalized rule for
+	* any full-replace update API lives in docs/provider-development.md §2b.
+	*
+	* Audited siblings that do NOT get this treatment: `JobUpdate`'s
+	* `DefaultArguments` / `NonOverridableArguments`, `ConnectionInput`'s
+	* `ConnectionProperties`, `WorkflowUpdate.DefaultRunProperties` and
+	* `Crawler.Configuration` are purely USER-authored bags — AWS does not
+	* write into them, so merging live values back would only resurrect
+	* console-side additions and break `cdkd drift --revert`.
+	*
+	* `desiredParameters` / `previousParameters` are the raw CFn-side maps
+	* (their KEY SET is all that matters here; `buildTableInput` already
+	* stringified the desired VALUES into `built.Parameters`).
+	*/
+	preserveAwsManagedParameters(built, desiredParameters, previousParameters, liveParameters) {
+		if (!liveParameters || Object.keys(liveParameters).length === 0) return;
+		const desiredKeys = parameterKeySet(desiredParameters);
+		const previousKeys = parameterKeySet(previousParameters);
+		const awsAuthored = {};
+		for (const [key, value] of Object.entries(liveParameters)) {
+			if (desiredKeys.has(key) || previousKeys.has(key)) continue;
+			awsAuthored[key] = value;
+		}
+		if (Object.keys(awsAuthored).length === 0) return;
+		built.Parameters = {
+			...awsAuthored,
+			...built.Parameters ?? {}
+		};
+	}
+	/**
+	* The live table state {@link preserveAwsManagedParameters} needs: its
+	* current `Parameters` plus the `VersionId` that pins them.
+	*
+	* A missing table returns empty rather than throwing: `UpdateTable` is about
+	* to surface the real, more actionable error. Any OTHER failure is fatal by
+	* design — degrading to "skip the merge" would silently reinstate the very
+	* wipe this read exists to prevent, and the wrapped cause keeps a transient
+	* throttle retryable by the deploy engine's outer `withRetry` (every
+	* `provider.update()` call site wraps it, including both rollback arms since
+	* this issue).
+	*
+	* **Why `VersionId` matters and why it is SCOPED.** Reading `Parameters`
+	* here and writing them back in the next call opens a TOCTOU window: an
+	* Apache Iceberg commit from Spark / Athena / EMR landing in between would
+	* be undone by writing back the `metadata_location` we read, pinning the
+	* table to an older snapshot — silent data-visibility loss, strictly worse
+	* than the bug this read fixes. `UpdateTableRequest.VersionId` is AWS's
+	* optimistic-concurrency token for exactly this
+	* (`ConcurrentModificationException` is a documented `UpdateTable` error),
+	* so the caller sends the version it read and a concurrent commit makes the
+	* update fail loudly instead of silently rolling back.
+	*
+	* It is sent UNCONDITIONALLY whenever this read returned a version, and the
+	* earlier attempt to scope it to "only when the merge wrote back live
+	* values" was wrong on both counts. Wrong on SAFETY: the merge also reports
+	* nothing-written-back when the live read came back EMPTY, and that update
+	* still ships a wholesale `TableInput` replace — so a commit landing in the
+	* window would have been wiped with no guard at all, i.e. #1461 surviving
+	* its own fix. Wrong on its PREMISE: this read runs milliseconds before the
+	* send on every update, so a pure template push (`cdkd drift --revert`, the
+	* case the scoping was meant to protect) carries a FRESH version too. An
+	* unconditional guard therefore cannot fire spuriously — it fires only when
+	* somebody else genuinely wrote in between, which is exactly when a revert
+	* should stop and be re-run against current values rather than clobber a
+	* change it never saw.
+	*
+	* The precondition's real-AWS semantics are pinned by the `data-analytics`
+	* integ, which advances a table's version out of band and asserts cdkd's
+	* update is REFUSED — without that, "AWS silently ignores a stale VersionId"
+	* would make this guard a placebo.
+	*/
+	async readLiveTableState(logicalId, resourceType, physicalId, databaseName, tableName, catalogId) {
+		try {
+			const resp = await this.getClient().send(new GetTableCommand({
+				...catalogId !== void 0 && { CatalogId: catalogId },
+				DatabaseName: databaseName,
+				Name: tableName
+			}));
+			return {
+				parameters: resp.Table?.Parameters,
+				versionId: resp.Table?.VersionId
+			};
+		} catch (error) {
+			if (error instanceof EntityNotFoundException) return {
+				parameters: void 0,
+				versionId: void 0
+			};
+			throw new ProvisioningError(preUpdateReadFailureMessage("Table", "glue:GetTable", logicalId, error), resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+		}
+	}
+	/**
+	* `Database.Parameters` as AWS currently holds them, for
+	* {@link preserveAwsManagedParameters}. Same not-found / fail-closed
+	* contract as {@link readLiveTableState}.
+	*
+	* There is NO `VersionId` analogue here: `UpdateDatabaseRequest` has no such
+	* member (verified against `@aws-sdk/client-glue`), so the database merge
+	* carries the TOCTOU exposure the table merge closes. It is far narrower in
+	* practice — nothing commits to a Glue DATABASE out of band the way an
+	* Iceberg engine commits to a table — but it is real, and is written up in
+	* docs/supported-resources.md rather than left implicit.
+	*/
+	async readLiveDatabaseParameters(logicalId, resourceType, physicalId, catalogId) {
+		try {
+			return (await this.getClient().send(new GetDatabaseCommand({
+				...catalogId !== void 0 && { CatalogId: catalogId },
+				Name: physicalId
+			}))).Database?.Parameters;
+		} catch (error) {
+			if (error instanceof EntityNotFoundException) return void 0;
+			throw new ProvisioningError(preUpdateReadFailureMessage("Database", "glue:GetDatabase", logicalId, error), resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+		}
+	}
+	/**
 	* Build DatabaseInput for Glue API from CFn template properties.
 	*
 	* Used by both `createDatabase` and `updateDatabase` so the same
@@ -33213,7 +33370,7 @@ var GlueProvider = class {
 		const result = { Name: databaseInput["Name"] ?? fallbackName };
 		if (databaseInput["Description"] !== void 0) result.Description = databaseInput["Description"];
 		if (databaseInput["LocationUri"] !== void 0) result.LocationUri = databaseInput["LocationUri"];
-		if (databaseInput["Parameters"] !== void 0) result.Parameters = databaseInput["Parameters"];
+		if (databaseInput["Parameters"] !== void 0) result.Parameters = stringifyParameterValues(databaseInput["Parameters"]);
 		return result;
 	}
 	/**
@@ -33223,12 +33380,7 @@ var GlueProvider = class {
 		const result = { Name: tableInput["Name"] ?? fallbackName };
 		if (tableInput["Description"] !== void 0) result.Description = tableInput["Description"];
 		if (tableInput["TableType"] !== void 0) result.TableType = tableInput["TableType"];
-		if (tableInput["Parameters"] !== void 0) {
-			const rawParams = tableInput["Parameters"];
-			const params = {};
-			for (const [k, v] of Object.entries(rawParams)) params[k] = String(v);
-			result.Parameters = params;
-		}
+		if (tableInput["Parameters"] !== void 0) result.Parameters = stringifyParameterValues(tableInput["Parameters"]);
 		if (tableInput["Owner"] !== void 0) result.Owner = tableInput["Owner"];
 		if (tableInput["Retention"] !== void 0) result.Retention = tableInput["Retention"];
 		if (tableInput["ViewOriginalText"] !== void 0) result.ViewOriginalText = tableInput["ViewOriginalText"];
@@ -33300,10 +33452,11 @@ var GlueProvider = class {
 	* the provider's `create()` only handles Database/Table; CC API picks
 	* up drift detection for the rest.
 	*/
-	async readCurrentState(physicalId, _logicalId, resourceType) {
+	async readCurrentState(physicalId, _logicalId, resourceType, properties) {
+		const catalogId = properties?.["CatalogId"];
 		switch (resourceType) {
-			case "AWS::Glue::Database": return this.readDatabase(physicalId);
-			case "AWS::Glue::Table": return this.readTable(physicalId);
+			case "AWS::Glue::Database": return this.readDatabase(physicalId, catalogId);
+			case "AWS::Glue::Table": return this.readTable(physicalId, catalogId);
 			default: return;
 		}
 	}
@@ -33321,10 +33474,13 @@ var GlueProvider = class {
 		if (resourceType === "AWS::Glue::Table") return ["OpenTableFormatInput"];
 		return [];
 	}
-	async readDatabase(physicalId) {
+	async readDatabase(physicalId, catalogId) {
 		let db;
 		try {
-			db = (await this.getClient().send(new GetDatabaseCommand({ Name: physicalId }))).Database;
+			db = (await this.getClient().send(new GetDatabaseCommand({
+				...catalogId !== void 0 && { CatalogId: catalogId },
+				Name: physicalId
+			}))).Database;
 		} catch (err) {
 			if (err instanceof EntityNotFoundException) return void 0;
 			throw err;
@@ -33339,12 +33495,13 @@ var GlueProvider = class {
 		if (db.Name !== void 0) result["DatabaseName"] = db.Name;
 		return result;
 	}
-	async readTable(physicalId) {
+	async readTable(physicalId, catalogId) {
 		const [databaseName, tableName] = physicalId.split("|");
 		if (!databaseName || !tableName) return void 0;
 		let table;
 		try {
 			table = (await this.getClient().send(new GetTableCommand({
+				...catalogId !== void 0 && { CatalogId: catalogId },
 				DatabaseName: databaseName,
 				Name: tableName
 			}))).Table;
@@ -34161,6 +34318,35 @@ function buildJobCommonFields(p) {
 	return r;
 }
 /**
+* CFn `Parameters` map -> the SDK's `Record<string, string>`. CDK may deliver
+* booleans / numbers; the SDK member is string-valued.
+*/
+function stringifyParameterValues(raw) {
+	const params = {};
+	for (const [k, v] of Object.entries(raw ?? {})) params[k] = String(v);
+	return params;
+}
+/**
+* Key set of a CFn-side `Parameters` map, for
+* {@link GlueProvider.preserveAwsManagedParameters}.
+*
+* A non-object (absent, or an unresolved intrinsic) contributes NO keys — so
+* a template that declares no `Parameters` at all can never be mistaken for
+* one that removed a key, and every live key stays preserved.
+*/
+function parameterKeySet(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return /* @__PURE__ */ new Set();
+	return new Set(Object.keys(value));
+}
+/**
+* Message for a failed pre-update `Get*` read (issue #1461). Names the IAM
+* action so a permission gap is one line away from fixed, and says what the
+* read is FOR so the failure does not read as gratuitous.
+*/
+function preUpdateReadFailureMessage(kind, iamAction, logicalId, error) {
+	return `Failed to read the current Glue ${kind} ${logicalId} before update: ${error instanceof Error ? error.message : String(error)}. cdkd reads the live ${kind.toLowerCase()} so AWS-managed Parameters (Apache Iceberg's table_type / metadata_location, a crawler's classification, Lake Formation markers) survive an update that Glue applies as a full replace. Grant ${iamAction} to the deploy identity — proceeding without the read would silently erase them.`;
+}
+/**
 * Coerce a CFn-delivered numeric property (often a string like `"10"`) to a
 * JS number at the SDK wire boundary. Non-finite / unparseable inputs are
 * returned unchanged so AWS surfaces a clear validation error rather than
@@ -65598,7 +65784,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.22");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.23");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;