@go-to-k/cdkd 0.278.26 → 0.278.28

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isThrottlingError, $t as setAwsClients, A as red, At as getLegacyStateBucketName, B as isTerminationProtectionPropagationError, Bt as CFN_TEMPLATE_BODY_LIMIT, C as isStatefulRecreateTargetSync, Ct as runDockerForeground, D as cyan, Dt as Synthesizer, E as bold, Et as getDockerImageBySourceHash, F as ProviderRegistry, Ft as resolveStateBucketWithDefault, G as normalizeAwsTagsToCfn, Gt as expectedOwnerParam, H as cfnRefValueFromPhysicalId, Ht as MIGRATE_TMP_PREFIX, I as findActionableSilentDrops, It as resolveStateBucketWithDefaultAndSource, J as applyRoleArnIfSet, K as resolveExplicitPhysicalId, Kt as AssemblyReader, L as CloudControlProvider, Lt as resolveUseCdkBootstrapAssets, M as IAMRoleProvider, Mt as resolveAutoAssetStorage, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveCaptureObservedState, O as gray, Ot as synthesisStatusMessage, P as clearOnUpdateRemoval, Pt as resolveSkipPrefix, Q as isRetryableTransientError, Qt as resetAwsClients, R as slowCcOperationTimeoutMs, Rt as stateBucketExistenceConfirmed, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as withErrorHandling, St as getDockerCmd, T as formatResourceLine, Tt as AssetManifestLoader, U as refStateLookupFromResource, Ut as findLargeInlineResources, V as IntrinsicFunctionResolver, Vt as CFN_TEMPLATE_URL_LIMIT, W as WAFv2WebACLProvider, Wt as uploadCfnTemplate, X as describeTypeWithThrottleRetry, Xt as AwsClients, Y as DiffCalculator, Yt as resolveBucketRegion, Z as withRetry, Zt as getAwsClients, _ as createPreDeleteFinalSnapshot, _t as parseBootstrapMarker, a as DeploymentEventsStore, an as LocalInvokeBuildError$1, at as shouldRetainResource, b as unsupportedFinalSnapshotError, bt as buildDockerImage, c as replayFailedOperations, ct as WorkGraph, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PartialFailureError, dt as loadPublishableAssetManifest, et as DagBuilder, f as computeImplicitDeleteEdges, fn as ProvisioningError, ft as rewriteTemplateAssetReferences, g as ccRoutedFinalSnapshotError, gn as StackTerminationProtectionError, gt as getBootstrapMarkerKey, h as buildFinalSnapshotIdentifier, hn as StackHasActiveImportsError, ht as ensureAssetStorage, i as DeploymentEventsReader, in as DeployCancelledError, it as rebuildClientForBucketRegion, j as yellow, jt as resolveApp, k as green, kt as getDefaultStateBucketName, l as replayRollback, ln as MissingCdkCliError, lt as buildAssetRedirectMap, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ResourceUpdateNotSupportedError, mt as BOOTSTRAP_MARKER_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as LockManager, o as planFailedOps, on as LocalMigrateError, ot as AssetPublisher, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as ResourceTimeoutError, pt as AssetModeResolver, q as assertRegionMatch, qt as processStackMessages, r as DeployEngine, rt as S3StateBackend, s as planRollback, sn as LocalStartServiceError, st as stringifyValue, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as CdkdError, tt as TemplateParser, u as withResourceDeadline, un as NestedStackChildDirectDestroyError, ut as createAssetRedirectResolver, v as isFinalSnapshotError, vt as validateAssetBucketName, w as renderStatefulReason, wt as runDockerStreaming, x as extractDeploymentEventError, xn as normalizeAwsError, xt as formatDockerLoginError, y as refusesFinalSnapshot, yt as validateContainerRepoName, z as disableInstanceApiTermination, zt as warnDeprecatedNoPrefixCliFlag } from "./deploy-engine-BsHkBRtK.js";
+import { $ as withRetry, $t as getAwsClients, A as red, At as synthesisStatusMessage, B as isTerminationProtectionPropagationError, Bt as stateBucketExistenceConfirmed, C as isStatefulRecreateTargetSync, Cn as normalizeAwsError, Ct as formatDockerLoginError, D as cyan, Dt as AssetManifestLoader, E as bold, Et as runDockerStreaming, F as ProviderRegistry, Ft as resolveCaptureObservedState, G as normalizeAwsTagsToCfn, Gt as findLargeInlineResources, H as cfnRefValueFromPhysicalId, Ht as CFN_TEMPLATE_BODY_LIMIT, I as findActionableSilentDrops, It as resolveSkipPrefix, J as readConfigString, Jt as AssemblyReader, K as resolveExplicitPhysicalId, Kt as uploadCfnTemplate, L as CloudControlProvider, Lt as resolveStateBucketWithDefault, M as IAMRoleProvider, Mt as getLegacyStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveApp, O as gray, Ot as getDockerImageBySourceHash, P as clearOnUpdateRemoval, Pt as resolveAutoAssetStorage, Q as describeTypeWithThrottleRetry, Qt as AwsClients, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefaultAndSource, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as buildDockerImage, T as formatResourceLine, Tt as runDockerForeground, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_URL_LIMIT, V as IntrinsicFunctionResolver, Vt as warnDeprecatedNoPrefixCliFlag, W as WAFv2WebACLProvider, Wt as MIGRATE_TMP_PREFIX, X as applyRoleArnIfSet, Y as requireConfigString, Yt as processStackMessages, Z as DiffCalculator, Zt as resolveBucketRegion, _ as createPreDeleteFinalSnapshot, _n as StackHasActiveImportsError, _t as ensureAssetStorage, a as DeploymentEventsStore, at as S3StateBackend, b as unsupportedFinalSnapshotError, bt as validateAssetBucketName, c as replayFailedOperations, cn as LocalMigrateError, ct as AssetPublisher, d as IMPLICIT_DELETE_DEPENDENCIES, dn as MissingCdkCliError, dt as buildAssetRedirectMap, en as resetAwsClients, et as isRetryableTransientError, f as computeImplicitDeleteEdges, fn as NestedStackChildDirectDestroyError, ft as createAssetRedirectResolver, g as ccRoutedFinalSnapshotError, gn as ResourceUpdateNotSupportedError, gt as BOOTSTRAP_MARKER_PREFIX, h as buildFinalSnapshotIdentifier, hn as ResourceTimeoutError, ht as AssetModeResolver, i as DeploymentEventsReader, it as LockManager, j as yellow, jt as getDefaultStateBucketName, k as green, kt as Synthesizer, l as replayRollback, ln as LocalStartServiceError, lt as stringifyValue, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ProvisioningError, mt as rewriteTemplateAssetReferences, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as DagBuilder, o as planFailedOps, on as DeployCancelledError, ot as rebuildClientForBucketRegion, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as PartialFailureError, pt as loadPublishableAssetManifest, q as assertRegionMatch, qt as expectedOwnerParam, r as DeployEngine, rn as CdkdError, rt as TemplateParser, s as planRollback, sn as LocalInvokeBuildError$1, st as shouldRetainResource, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as setAwsClients, tt as isThrottlingError, u as withResourceDeadline, ut as WorkGraph, v as isFinalSnapshotError, vn as StackTerminationProtectionError, vt as getBootstrapMarkerKey, w as renderStatefulReason, wn as withErrorHandling, wt as getDockerCmd, x as extractDeploymentEventError, xt as validateContainerRepoName, y as refusesFinalSnapshot, yt as parseBootstrapMarker, z as disableInstanceApiTermination, zt as resolveUseCdkBootstrapAssets } from "./deploy-engine-Dcg1nH3d.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-DLScqiT2.js";
+import { t as ASGProvider } from "./asg-provider-BJnh483x.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4936,7 +4936,7 @@ var S3BucketProvider = class S3BucketProvider {
 	* Apply versioning configuration if specified
 	*/
 	async applyVersioning(bucketName, versioningConfig) {
-		const status = versioningConfig["Status"] || "Suspended";
+		const status = readConfigString(versioningConfig, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration");
 		await this.s3Client.send(new PutBucketVersioningCommand({
 			Bucket: bucketName,
 			VersioningConfiguration: { Status: status }
@@ -5045,7 +5045,7 @@ var S3BucketProvider = class S3BucketProvider {
 		const rules = lifecycleConfig.Rules.map((rule) => {
 			const sdkRule = {
 				ID: rule["Id"],
-				Status: rule["Status"] || "Enabled",
+				Status: readConfigString(rule, "Status", "Enabled", "AWS::S3::Bucket LifecycleConfiguration.Rules[]"),
 				Prefix: useFilterForm ? void 0 : rule["Prefix"]
 			};
 			const expiration = rule["ExpirationInDays"] || rule["ExpirationDate"] || rule["Expiration"];
@@ -5168,7 +5168,8 @@ var S3BucketProvider = class S3BucketProvider {
 	* SDK: PutBucketLogging with BucketLoggingStatus.LoggingEnabled
 	*/
 	async applyLoggingConfiguration(bucketName, loggingConfig) {
-		if (!loggingConfig || !loggingConfig["DestinationBucketName"]) {
+		const destinationBucket = readConfigString(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration");
+		if (!loggingConfig || destinationBucket === "") {
 			await this.s3Client.send(new PutBucketLoggingCommand({
 				Bucket: bucketName,
 				BucketLoggingStatus: {}
@@ -5179,8 +5180,8 @@ var S3BucketProvider = class S3BucketProvider {
 		await this.s3Client.send(new PutBucketLoggingCommand({
 			Bucket: bucketName,
 			BucketLoggingStatus: { LoggingEnabled: {
-				TargetBucket: loggingConfig["DestinationBucketName"],
-				TargetPrefix: loggingConfig["LogFilePrefix"] || ""
+				TargetBucket: destinationBucket,
+				TargetPrefix: readConfigString(loggingConfig, "LogFilePrefix", "", "AWS::S3::Bucket LoggingConfiguration")
 			} }
 		}));
 		this.logger.debug(`Applied logging configuration to bucket ${bucketName}`);
@@ -5358,11 +5359,11 @@ var S3BucketProvider = class S3BucketProvider {
 				const dest = dataExport["Destination"];
 				const s3Dest = dest?.["BucketAccountId"] || dest?.["BucketArn"] || dest?.["Format"] ? dest : dest?.["S3BucketDestination"];
 				analyticsConfig.StorageClassAnalysis = { DataExport: {
-					OutputSchemaVersion: dataExport["OutputSchemaVersion"] || "V_1",
+					OutputSchemaVersion: readConfigString(dataExport, "OutputSchemaVersion", "V_1", "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport"),
 					Destination: s3Dest ? { S3BucketDestination: {
 						Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
 						BucketAccountId: s3Dest["BucketAccountId"],
-						Format: s3Dest["Format"] || "CSV",
+						Format: readConfigString(s3Dest, "Format", "CSV", "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport.Destination.S3BucketDestination"),
 						Prefix: s3Dest["Prefix"]
 					} } : void 0
 				} };
@@ -5387,7 +5388,7 @@ var S3BucketProvider = class S3BucketProvider {
 			const tierings = config["Tierings"];
 			const itConfig = {
 				Id: id,
-				Status: config["Status"] || "Enabled",
+				Status: readConfigString(config, "Status", "Enabled", "AWS::S3::Bucket IntelligentTieringConfigurations[]"),
 				Tierings: (tierings || []).map((t) => ({
 					AccessTier: t["AccessTier"],
 					Days: t["Days"]
@@ -5425,12 +5426,12 @@ var S3BucketProvider = class S3BucketProvider {
 			const inventoryConfig = {
 				Id: id,
 				IsEnabled: config["Enabled"] ?? true,
-				IncludedObjectVersions: config["IncludedObjectVersions"] || "All",
-				Schedule: { Frequency: config["ScheduleFrequency"] ?? config["Schedule"]?.["Frequency"] ?? "Weekly" },
+				IncludedObjectVersions: readConfigString(config, "IncludedObjectVersions", "All", "AWS::S3::Bucket InventoryConfigurations[]"),
+				Schedule: { Frequency: config["ScheduleFrequency"] !== void 0 ? requireConfigString(config["ScheduleFrequency"], "Weekly", "AWS::S3::Bucket InventoryConfigurations[].ScheduleFrequency") : readConfigString(config["Schedule"], "Frequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[].Schedule") },
 				Destination: { S3BucketDestination: s3Dest ? {
 					Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
 					AccountId: s3Dest["BucketAccountId"],
-					Format: s3Dest["Format"] || "CSV",
+					Format: readConfigString(s3Dest, "Format", "CSV", "AWS::S3::Bucket InventoryConfigurations[].Destination.S3BucketDestination"),
 					Prefix: s3Dest["Prefix"]
 				} : void 0 },
 				OptionalFields: config["OptionalFields"],
@@ -5462,7 +5463,7 @@ var S3BucketProvider = class S3BucketProvider {
 					const dest = rule["Destination"];
 					const sdkRule = {
 						ID: rule["Id"],
-						Status: rule["Status"] || "Enabled",
+						Status: readConfigString(rule, "Status", "Enabled", "AWS::S3::Bucket ReplicationConfiguration.Rules[]"),
 						Priority: rule["Priority"],
 						Destination: {
 							Bucket: dest["Bucket"],
@@ -5539,7 +5540,7 @@ var S3BucketProvider = class S3BucketProvider {
 	async applyConfiguration(bucketName, properties, options = {}) {
 		const { skipTags = false, skipDiffManaged = false } = options;
 		const versioningConfig = properties["VersioningConfiguration"];
-		if (!skipDiffManaged && versioningConfig) await this.applyVersioning(bucketName, versioningConfig);
+		if (!skipDiffManaged && versioningConfig != null) await this.applyVersioning(bucketName, versioningConfig);
 		const tags = properties["Tags"];
 		if (!skipTags && tags && Array.isArray(tags) && tags.length > 0) await this.applyTags(bucketName, tags);
 		const ownershipControls = properties["OwnershipControls"];
@@ -5594,10 +5595,10 @@ var S3BucketProvider = class S3BucketProvider {
 	* declares the config.
 	*
 	* NOTE this helper does NOT cover `VersioningConfiguration` (it has no list
-	* key), and that property is NOT malformed-shape-refused anywhere: a
-	* malformed value there still resolves to 'Suspended', matching `main`.
-	* That pre-existing gap is tracked in issue #1471 — see the note in
-	* `applySubConfigDiffs` for why guarding it is not as simple as it looks.
+	* key). That property is malformed-shape-refused separately, by
+	* `readConfigString` in `applyVersioning` + `applySubConfigDiffs`
+	* (issue #1471) — same outcome, different mechanism, because a versioning
+	* block has an inner FIELD to validate rather than a list to measure.
 	*/
 	static emptyListConfigToUndefined(config, listKey) {
 		if (config === void 0 || config === null) return void 0;
@@ -5672,7 +5673,7 @@ var S3BucketProvider = class S3BucketProvider {
 		const previousVersioning = previousProperties["VersioningConfiguration"];
 		const nextVersioning = properties["VersioningConfiguration"];
 		const versioningChanged = JSON.stringify(previousVersioning ?? null) !== JSON.stringify(nextVersioning ?? null);
-		const desiredVersioningStatus = nextVersioning == null ? "Suspended" : nextVersioning["Status"] || "Suspended";
+		const desiredVersioningStatus = readConfigString(nextVersioning, "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration");
 		if (versioningChanged && nextVersioning != null && desiredVersioningStatus !== "Suspended") await this.applyVersioning(bucketName, nextVersioning);
 		await this.diffSubConfig(bucketName, S3BucketProvider.emptyListConfigToUndefined(previousProperties["OwnershipControls"], "Rules"), S3BucketProvider.emptyListConfigToUndefined(properties["OwnershipControls"], "Rules"), async (cfg) => this.applyOwnershipControls(bucketName, cfg), async () => {
 			await this.s3Client.send(new DeleteBucketOwnershipControlsCommand({ Bucket: bucketName }));
@@ -5763,7 +5764,7 @@ var S3BucketProvider = class S3BucketProvider {
 		const lifecycleConfig = properties["LifecycleConfiguration"];
 		if (lifecycleConfig?.Rules && Array.isArray(lifecycleConfig.Rules) && lifecycleConfig.Rules.length > 0) await this.applyLifecycleConfiguration(bucketName, lifecycleConfig);
 		const loggingConfig = properties["LoggingConfiguration"];
-		if (loggingConfig?.["DestinationBucketName"]) await this.applyLoggingConfiguration(bucketName, loggingConfig);
+		if (readConfigString(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") !== "") await this.applyLoggingConfiguration(bucketName, loggingConfig);
 		const websiteConfig = properties["WebsiteConfiguration"];
 		if (websiteConfig) await this.applyWebsiteConfiguration(bucketName, websiteConfig);
 		const accelerateConfig = properties["AccelerateConfiguration"];
@@ -15276,7 +15277,7 @@ var SecretsManagerSecretProvider = class {
 		const excludeLowercase = config["ExcludeLowercase"];
 		const excludeNumbers = config["ExcludeNumbers"];
 		const excludePunctuation = config["ExcludePunctuation"];
-		const excludeCharacters = config["ExcludeCharacters"] || "";
+		const excludeCharacters = readConfigString(config, "ExcludeCharacters", "", "AWS::SecretsManager::Secret GenerateSecretString");
 		let chars = "";
 		if (!excludeUppercase) chars += "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
 		if (!excludeLowercase) chars += "abcdefghijklmnopqrstuvwxyz";
@@ -33105,10 +33106,10 @@ var GlueProvider = class {
 		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::Glue::Database": return this.createDatabase(logicalId, resourceType, properties);
-			case "AWS::Glue::Table": return this.createTable(logicalId, resourceType, properties);
+			case "AWS::Glue::Table": return this.createTable(logicalId, resourceType, properties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
@@ -33191,7 +33192,7 @@ var GlueProvider = class {
 			throw new ProvisioningError(`Failed to delete Glue Database ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async createTable(logicalId, resourceType, properties) {
+	async createTable(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Glue Table ${logicalId}`);
 		const databaseName = properties["DatabaseName"];
 		if (!databaseName) throw new ProvisioningError(`DatabaseName is required for Glue Table ${logicalId}`, resourceType, logicalId);
@@ -33200,7 +33201,10 @@ var GlueProvider = class {
 		const tableName = tableInput["Name"] ?? properties["Name"];
 		if (!tableName) throw new ProvisioningError(`TableInput.Name or top-level Name is required for Glue Table ${logicalId}`, resourceType, logicalId);
 		const catalogId = properties["CatalogId"];
-		assertIcebergTableInputAbsent(logicalId, resourceType, properties);
+		enforceIcebergTableInputAbsent(logicalId, resourceType, properties, {
+			warn: (message) => this.logger.warn(message),
+			replayingState: context?.replayingState === true
+		});
 		const openTableFormatInput = properties["OpenTableFormatInput"];
 		try {
 			await this.getClient().send(new CreateTableCommand$1({
@@ -33990,15 +33994,35 @@ function findIcebergTableInputKey(properties) {
 * produce a late, cryptic AWS error. Failing fast with the working shape spelled
 * out is strictly more useful.
 *
-* **CREATE only — update WARNS instead.** See the comment at the `updateTable`
-* call site: rollback replays from cdkd STATE, and a table created by a
-* pre-#1390 build carries the key in its state record, so refusing on update
-* would make such a table unrollbackable with no template-side remedy. cdkd
-* does not wire Glue's update-only `UpdateOpenTableFormatInput` shape and
-* `buildTableInput` is an explicit allow-list, so warning there forwards
-* nothing and loses no protection. One rollback arm is still exposed — the
-* reverse-replacement re-create replays a state record through `create()`;
-* see issue #1463 and the note at the `updateTable` call site.
+* **TEMPLATE creates only — every STATE REPLAY warns instead.** The refusal is
+* conditioned on the ORIGIN of the properties, not on the operation name:
+*
+* - `update()` warns unconditionally. Rollback replays from cdkd STATE, and a
+*   table created by a pre-#1390 build carries the key in its state record, so
+*   refusing there would make such a table unrollbackable with no
+*   template-side remedy. cdkd does not wire Glue's update-only
+*   `UpdateOpenTableFormatInput` shape and `buildTableInput` is an explicit
+*   allow-list, so warning forwards nothing and loses no protection.
+* - `create()` warns when {@link CreateContext.replayingState} is set — the
+*   rollback executor's reverse-replacement arm, which revives the OLD
+*   resource from `previousState.properties` (issue #1463). Same reasoning:
+*   the user cannot edit a state record from the template. Unlike the update
+*   path this one DOES forward the value, so the re-created table is degraded
+*   in exactly the way the original was (the CFn spelling is dropped by the
+*   SDK serializer per #1390; the SDK spelling is sent and Glue rejects it) —
+*   the warning says so, and the fix-forward is a `cdkd deploy`.
+* - Every deploy-engine `create()` refuses: the CREATE branch, the
+*   property-driven replacement, the `--recreate-via-*` destroy-then-create,
+*   the `--replace` delete-first fallback, and the update-failure replacement.
+*   All are driven by freshly resolved TEMPLATE properties, so the user CAN
+*   fix the input and a fast, actionable refusal is strictly better.
+*
+* The asymmetry constrains where this provider may re-create. `GlueProvider`
+* must never call `this.create()` from inside its own `update()` the way ACM /
+* IAM / Lambda-permission / SNS-subscription do: those internal re-creates
+* forward `update()`'s `properties` — a STATE record during a rollback replay —
+* and `update()` has no context parameter to carry the flag, so this refusal
+* would fire on a replay with no way to detect it.
 *
 * **Known bypass: the sticky Cloud Control route.** This is a GlueProvider
 * pre-flight, so it only runs on the SDK route. When a table's state record
@@ -34019,19 +34043,23 @@ function findIcebergTableInputKey(properties) {
 * relaxed, the rename MUST be restored in the same change — otherwise the
 * silent-drop bug of #1390 comes straight back.
 */
-function assertIcebergTableInputAbsent(logicalId, resourceType, properties, physicalId) {
+function enforceIcebergTableInputAbsent(logicalId, resourceType, properties, options) {
 	const key = findIcebergTableInputKey(properties);
 	if (key === void 0) return;
-	throw new ProvisioningError(icebergTableInputRefusalMessage(logicalId, key, "create"), resourceType, logicalId, physicalId);
+	if (options.replayingState) {
+		options.warn(icebergTableInputRefusalMessage(logicalId, key, "create-replay"));
+		return;
+	}
+	throw new ProvisioningError(icebergTableInputRefusalMessage(logicalId, key, "create"), resourceType, logicalId);
 }
 /**
-* The shared #1454 message body, so the CREATE refusal and the UPDATE warning
-* cannot drift apart. `mode` only changes the lead clause — everything after it
-* (the probe evidence and the working shape) is identical, because the user's
-* next action is the same either way.
+* The shared #1454 message body, so the CREATE refusal, the UPDATE warning and
+* the rollback-replay CREATE warning cannot drift apart. `mode` only changes
+* the lead clause — everything after it (the probe evidence and the working
+* shape) is identical, because the user's next action is the same either way.
 */
 function icebergTableInputRefusalMessage(logicalId, key, mode) {
-	return `AWS::Glue::Table ${logicalId}: OpenTableFormatInput.IcebergInput.${key} ${mode === "create" ? `cannot be deployed by AWS in any shape, so cdkd refuses it before calling Glue (issue #1454).` : "cannot be deployed by AWS in any shape and is IGNORED on update — cdkd does not wire Glue's update-only UpdateOpenTableFormatInput shape, so it forwards nothing here and only warns (issue #1454). A CREATE of this table would be refused outright."}\n  Live-probed 2026-08-09 in us-east-1 (issue #1408): glue:CreateTable — the API cdkd calls — rejects every Iceberg table spec ("Location information cannot be null while creating an iceberg table" without a TableInput.StorageDescriptor, "Table metadata information present at multiple parts of input request" with one), and CloudFormation rolls the same template back with "Table metadata is expected only via TableInput or via IcebergTableInputProperties inside OpenTableFormatInput" — a property name that exists in neither the CFn registry schema (IcebergInput.IcebergTableInput) nor @aws-sdk/client-glue (IcebergInput.CreateIcebergTableInput).\n  Working shape — put the table metadata in TableInput and leave IcebergInput carrying only the create-time directive:\n    TableInput: { Name, TableType: 'EXTERNAL_TABLE', StorageDescriptor: { Location: 's3://your-bucket/prefix/', Columns: [...] } }\n    OpenTableFormatInput: { IcebergInput: { MetadataOperation: 'CREATE' } }   // Version: '2' is also accepted\n  Glue then writes the Iceberg metadata itself — the created table comes back with Parameters.table_type = ICEBERG and a populated Parameters.metadata_location.`;
+	return `AWS::Glue::Table ${logicalId}: OpenTableFormatInput.IcebergInput.${key} ${mode === "create" ? `cannot be deployed by AWS in any shape, so cdkd refuses it before calling Glue (issue #1454).` : mode === "create-replay" ? "cannot be deployed by AWS in any shape, so cdkd normally refuses it before calling Glue (issue #1454) — but this create is REPLAYING a historical cdkd STATE record (a rollback reverse-replacement re-creating the OLD table), not your template, and refusing would leave that table unrestorable with no template-side remedy, only a hand-edit of state.json. cdkd therefore warns and proceeds (issue #1463). The re-created table is DEGRADED exactly as the original was: under the CFn spelling IcebergTableInput the AWS SDK serializer drops the unknown member (issue #1390), so the table comes back without its Iceberg metadata; under the SDK spelling CreateIcebergTableInput the value IS sent and Glue rejects the call, failing this one rollback operation. Either way, fix it forward with 'cdkd deploy' using the working shape below." : "cannot be deployed by AWS in any shape and is IGNORED on update — cdkd does not wire Glue's update-only UpdateOpenTableFormatInput shape, so it forwards nothing here and only warns (issue #1454). A CREATE of this table would be refused outright."}\n  Live-probed 2026-08-09 in us-east-1 (issue #1408): glue:CreateTable — the API cdkd calls — rejects every Iceberg table spec ("Location information cannot be null while creating an iceberg table" without a TableInput.StorageDescriptor, "Table metadata information present at multiple parts of input request" with one), and CloudFormation rolls the same template back with "Table metadata is expected only via TableInput or via IcebergTableInputProperties inside OpenTableFormatInput" — a property name that exists in neither the CFn registry schema (IcebergInput.IcebergTableInput) nor @aws-sdk/client-glue (IcebergInput.CreateIcebergTableInput).\n  Working shape — put the table metadata in TableInput and leave IcebergInput carrying only the create-time directive:\n    TableInput: { Name, TableType: 'EXTERNAL_TABLE', StorageDescriptor: { Location: 's3://your-bucket/prefix/', Columns: [...] } }\n    OpenTableFormatInput: { IcebergInput: { MetadataOperation: 'CREATE' } }   // Version: '2' is also accepted\n  Glue then writes the Iceberg metadata itself — the created table comes back with Parameters.table_type = ICEBERG and a populated Parameters.metadata_location.`;
 }
 /**
 * Build the SDK `EncryptionConfiguration` from the CFn-shape input
@@ -36093,7 +36121,8 @@ var KinesisStreamProvider = class {
 		this.logger.debug(`Creating Kinesis stream ${logicalId}`);
 		const streamName = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
 		try {
-			const streamMode = properties["StreamModeDetails"]?.["StreamMode"] || "PROVISIONED";
+			const streamModeDetails = properties["StreamModeDetails"];
+			const streamMode = readConfigString(streamModeDetails, "StreamMode", "PROVISIONED", "AWS::Kinesis::Stream StreamModeDetails");
 			const shardCount = streamMode === "PROVISIONED" ? Number(properties["ShardCount"] ?? 1) : void 0;
 			await this.getClient().send(new CreateStreamCommand({
 				StreamName: streamName,
@@ -36157,7 +36186,8 @@ var KinesisStreamProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Kinesis stream ${logicalId}: ${physicalId}`);
 		try {
-			const streamMode = properties["StreamModeDetails"]?.["StreamMode"] || "PROVISIONED";
+			const streamModeDetails = properties["StreamModeDetails"];
+			const streamMode = readConfigString(streamModeDetails, "StreamMode", "PROVISIONED", "AWS::Kinesis::Stream StreamModeDetails");
 			const oldStreamMode = previousProperties["StreamModeDetails"]?.["StreamMode"] || "PROVISIONED";
 			const modeChanged = oldStreamMode !== streamMode;
 			if (modeChanged) {
@@ -43460,7 +43490,7 @@ var S3DirectoryBucketProvider = class {
 	*/
 	async create(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating S3 Express Directory Bucket ${logicalId}`);
-		const dataRedundancy = properties["DataRedundancy"] || "SingleAvailabilityZone";
+		const dataRedundancy = requireConfigString(properties["DataRedundancy"], "SingleAvailabilityZone", "AWS::S3Express::DirectoryBucket DataRedundancy");
 		const azName = properties["LocationName"]?.replace(/--x-s3$/, "") || "us-east-1a";
 		const azId = await this.getAzId(azName);
 		let bucketName = properties["BucketName"];
@@ -65936,7 +65966,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.26");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.28");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;