@go-to-k/cdkd 0.278.29 → 0.278.31

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as withRetry, $t as getAwsClients, A as red, At as synthesisStatusMessage, B as isTerminationProtectionPropagationError, Bt as stateBucketExistenceConfirmed, C as isStatefulRecreateTargetSync, Cn as normalizeAwsError, Ct as formatDockerLoginError, D as cyan, Dt as AssetManifestLoader, E as bold, Et as runDockerStreaming, F as ProviderRegistry, Ft as resolveCaptureObservedState, G as normalizeAwsTagsToCfn, Gt as findLargeInlineResources, H as cfnRefValueFromPhysicalId, Ht as CFN_TEMPLATE_BODY_LIMIT, I as findActionableSilentDrops, It as resolveSkipPrefix, J as readConfigString, Jt as AssemblyReader, K as resolveExplicitPhysicalId, Kt as uploadCfnTemplate, L as CloudControlProvider, Lt as resolveStateBucketWithDefault, M as IAMRoleProvider, Mt as getLegacyStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveApp, O as gray, Ot as getDockerImageBySourceHash, P as clearOnUpdateRemoval, Pt as resolveAutoAssetStorage, Q as describeTypeWithThrottleRetry, Qt as AwsClients, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefaultAndSource, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as buildDockerImage, T as formatResourceLine, Tt as runDockerForeground, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_URL_LIMIT, V as IntrinsicFunctionResolver, Vt as warnDeprecatedNoPrefixCliFlag, W as WAFv2WebACLProvider, Wt as MIGRATE_TMP_PREFIX, X as applyRoleArnIfSet, Y as requireConfigString, Yt as processStackMessages, Z as DiffCalculator, Zt as resolveBucketRegion, _ as createPreDeleteFinalSnapshot, _n as StackHasActiveImportsError, _t as ensureAssetStorage, a as DeploymentEventsStore, at as S3StateBackend, b as unsupportedFinalSnapshotError, bt as validateAssetBucketName, c as replayFailedOperations, cn as LocalMigrateError, ct as AssetPublisher, d as IMPLICIT_DELETE_DEPENDENCIES, dn as MissingCdkCliError, dt as buildAssetRedirectMap, en as resetAwsClients, et as isRetryableTransientError, f as computeImplicitDeleteEdges, fn as NestedStackChildDirectDestroyError, ft as createAssetRedirectResolver, g as ccRoutedFinalSnapshotError, gn as ResourceUpdateNotSupportedError, gt as BOOTSTRAP_MARKER_PREFIX, h as buildFinalSnapshotIdentifier, hn as ResourceTimeoutError, ht as AssetModeResolver, i as DeploymentEventsReader, it as LockManager, j as yellow, jt as getDefaultStateBucketName, k as green, kt as Synthesizer, l as replayRollback, ln as LocalStartServiceError, lt as stringifyValue, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ProvisioningError, mt as rewriteTemplateAssetReferences, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as DagBuilder, o as planFailedOps, on as DeployCancelledError, ot as rebuildClientForBucketRegion, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as PartialFailureError, pt as loadPublishableAssetManifest, q as assertRegionMatch, qt as expectedOwnerParam, r as DeployEngine, rn as CdkdError, rt as TemplateParser, s as planRollback, sn as LocalInvokeBuildError$1, st as shouldRetainResource, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as setAwsClients, tt as isThrottlingError, u as withResourceDeadline, ut as WorkGraph, v as isFinalSnapshotError, vn as StackTerminationProtectionError, vt as getBootstrapMarkerKey, w as renderStatefulReason, wn as withErrorHandling, wt as getDockerCmd, x as extractDeploymentEventError, xt as validateContainerRepoName, y as refusesFinalSnapshot, yt as parseBootstrapMarker, z as disableInstanceApiTermination, zt as resolveUseCdkBootstrapAssets } from "./deploy-engine-B3AUwwq_.js";
+import { $ as withRetry, $t as getAwsClients, A as red, At as synthesisStatusMessage, B as isTerminationProtectionPropagationError, Bt as stateBucketExistenceConfirmed, C as isStatefulRecreateTargetSync, Cn as normalizeAwsError, Ct as formatDockerLoginError, D as cyan, Dt as AssetManifestLoader, E as bold, Et as runDockerStreaming, F as ProviderRegistry, Ft as resolveCaptureObservedState, G as normalizeAwsTagsToCfn, Gt as findLargeInlineResources, H as cfnRefValueFromPhysicalId, Ht as CFN_TEMPLATE_BODY_LIMIT, I as findActionableSilentDrops, It as resolveSkipPrefix, J as readConfigString, Jt as AssemblyReader, K as resolveExplicitPhysicalId, Kt as uploadCfnTemplate, L as CloudControlProvider, Lt as resolveStateBucketWithDefault, M as IAMRoleProvider, Mt as getLegacyStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveApp, O as gray, Ot as getDockerImageBySourceHash, P as clearOnUpdateRemoval, Pt as resolveAutoAssetStorage, Q as describeTypeWithThrottleRetry, Qt as AwsClients, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefaultAndSource, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as buildDockerImage, T as formatResourceLine, Tt as runDockerForeground, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_URL_LIMIT, V as IntrinsicFunctionResolver, Vt as warnDeprecatedNoPrefixCliFlag, W as WAFv2WebACLProvider, Wt as MIGRATE_TMP_PREFIX, X as applyRoleArnIfSet, Y as requireConfigString, Yt as processStackMessages, Z as DiffCalculator, Zt as resolveBucketRegion, _ as createPreDeleteFinalSnapshot, _n as StackHasActiveImportsError, _t as ensureAssetStorage, a as DeploymentEventsStore, at as S3StateBackend, b as unsupportedFinalSnapshotError, bt as validateAssetBucketName, c as replayFailedOperations, cn as LocalMigrateError, ct as AssetPublisher, d as IMPLICIT_DELETE_DEPENDENCIES, dn as MissingCdkCliError, dt as buildAssetRedirectMap, en as resetAwsClients, et as isRetryableTransientError, f as computeImplicitDeleteEdges, fn as NestedStackChildDirectDestroyError, ft as createAssetRedirectResolver, g as ccRoutedFinalSnapshotError, gn as ResourceUpdateNotSupportedError, gt as BOOTSTRAP_MARKER_PREFIX, h as buildFinalSnapshotIdentifier, hn as ResourceTimeoutError, ht as AssetModeResolver, i as DeploymentEventsReader, it as LockManager, j as yellow, jt as getDefaultStateBucketName, k as green, kt as Synthesizer, l as replayRollback, ln as LocalStartServiceError, lt as stringifyValue, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ProvisioningError, mt as rewriteTemplateAssetReferences, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as DagBuilder, o as planFailedOps, on as DeployCancelledError, ot as rebuildClientForBucketRegion, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as PartialFailureError, pt as loadPublishableAssetManifest, q as assertRegionMatch, qt as expectedOwnerParam, r as DeployEngine, rn as CdkdError, rt as TemplateParser, s as planRollback, sn as LocalInvokeBuildError$1, st as shouldRetainResource, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as setAwsClients, tt as isThrottlingError, u as withResourceDeadline, ut as WorkGraph, v as isFinalSnapshotError, vn as StackTerminationProtectionError, vt as getBootstrapMarkerKey, w as renderStatefulReason, wn as withErrorHandling, wt as getDockerCmd, x as extractDeploymentEventError, xt as validateContainerRepoName, y as refusesFinalSnapshot, yt as parseBootstrapMarker, z as disableInstanceApiTermination, zt as resolveUseCdkBootstrapAssets } from "./deploy-engine-ChGbsbXm.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-g1CP9a99.js";
+import { t as ASGProvider } from "./asg-provider-BP1bo1ac.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -13691,8 +13691,8 @@ function extractLocalDeletionProtection(props, region) {
 */
 function derivePerCallProvisionedThroughput(properties, region, source = "min") {
 	return {
-		ReadCapacityUnits: deriveReadCapacityUnits(asRecord((properties["Replicas"] ?? []).find((r) => r["Region"] === region)?.["ReadProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS,
-		WriteCapacityUnits: deriveWriteCapacityUnits(asRecord(properties["WriteProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS
+		ReadCapacityUnits: deriveReadCapacityUnits(asRecord$1((properties["Replicas"] ?? []).find((r) => r["Region"] === region)?.["ReadProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS,
+		WriteCapacityUnits: deriveWriteCapacityUnits(asRecord$1(properties["WriteProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS
 	};
 }
 /**
@@ -13757,7 +13757,7 @@ const DESCRIBE_SCALABLE_TARGETS_BATCH = 50;
 */
 function collectAutoScalingTargets(properties, localRegion) {
 	const specs = [];
-	const tableWrite = asRecord(asRecord(properties["WriteProvisionedThroughputSettings"])?.["WriteCapacityAutoScalingSettings"]);
+	const tableWrite = asRecord$1(asRecord$1(properties["WriteProvisionedThroughputSettings"])?.["WriteCapacityAutoScalingSettings"]);
 	if (tableWrite) specs.push({
 		dimension: "dynamodb:table:WriteCapacityUnits",
 		region: localRegion,
@@ -13765,10 +13765,10 @@ function collectAutoScalingTargets(properties, localRegion) {
 	});
 	const cfnIndexes = properties["GlobalSecondaryIndexes"];
 	if (Array.isArray(cfnIndexes)) for (const entry of cfnIndexes) {
-		const gsi = asRecord(entry);
+		const gsi = asRecord$1(entry);
 		const indexName = gsi?.["IndexName"];
 		if (!gsi || typeof indexName !== "string") continue;
-		const indexWrite = asRecord(asRecord(gsi["WriteProvisionedThroughputSettings"])?.["WriteCapacityAutoScalingSettings"]);
+		const indexWrite = asRecord$1(asRecord$1(gsi["WriteProvisionedThroughputSettings"])?.["WriteCapacityAutoScalingSettings"]);
 		if (indexWrite) specs.push({
 			dimension: "dynamodb:index:WriteCapacityUnits",
 			indexName,
@@ -13778,10 +13778,10 @@ function collectAutoScalingTargets(properties, localRegion) {
 	}
 	const replicas = properties["Replicas"];
 	if (Array.isArray(replicas)) for (const replicaEntry of replicas) {
-		const replica = asRecord(replicaEntry);
+		const replica = asRecord$1(replicaEntry);
 		const region = replica?.["Region"];
 		if (!replica || typeof region !== "string") continue;
-		const replicaRead = asRecord(asRecord(replica["ReadProvisionedThroughputSettings"])?.["ReadCapacityAutoScalingSettings"]);
+		const replicaRead = asRecord$1(asRecord$1(replica["ReadProvisionedThroughputSettings"])?.["ReadCapacityAutoScalingSettings"]);
 		if (replicaRead) specs.push({
 			dimension: "dynamodb:table:ReadCapacityUnits",
 			region,
@@ -13790,10 +13790,10 @@ function collectAutoScalingTargets(properties, localRegion) {
 		const replicaIndexes = replica["GlobalSecondaryIndexes"];
 		if (!Array.isArray(replicaIndexes)) continue;
 		for (const entry of replicaIndexes) {
-			const replicaIndex = asRecord(entry);
+			const replicaIndex = asRecord$1(entry);
 			const indexName = replicaIndex?.["IndexName"];
 			if (!replicaIndex || typeof indexName !== "string") continue;
-			const indexRead = asRecord(asRecord(replicaIndex["ReadProvisionedThroughputSettings"])?.["ReadCapacityAutoScalingSettings"]);
+			const indexRead = asRecord$1(asRecord$1(replicaIndex["ReadProvisionedThroughputSettings"])?.["ReadCapacityAutoScalingSettings"]);
 			if (indexRead) specs.push({
 				dimension: "dynamodb:index:ReadCapacityUnits",
 				indexName,
@@ -13805,7 +13805,7 @@ function collectAutoScalingTargets(properties, localRegion) {
 	return specs;
 }
 /** Narrow an unknown CFn sub-object to a record (or `undefined`). */
-function asRecord(value) {
+function asRecord$1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 /**
@@ -13849,7 +13849,7 @@ function deriveWriteCapacityUnits(settings, source = "min") {
 	if (!settings) return void 0;
 	const literal = toFiniteNumber(settings["WriteCapacityUnits"]);
 	if (literal !== void 0) return literal;
-	const autoScaling = asRecord(settings["WriteCapacityAutoScalingSettings"]);
+	const autoScaling = asRecord$1(settings["WriteCapacityAutoScalingSettings"]);
 	if (!autoScaling) return void 0;
 	return pickAutoScalingCapacity(autoScaling, source);
 }
@@ -13865,7 +13865,7 @@ function deriveReadCapacityUnits(settings, source = "min") {
 	if (!settings) return void 0;
 	const literal = toFiniteNumber(settings["ReadCapacityUnits"]);
 	if (literal !== void 0) return literal;
-	const autoScaling = asRecord(settings["ReadCapacityAutoScalingSettings"]);
+	const autoScaling = asRecord$1(settings["ReadCapacityAutoScalingSettings"]);
 	if (!autoScaling) return void 0;
 	return pickAutoScalingCapacity(autoScaling, source);
 }
@@ -13918,16 +13918,16 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 	const cfnIndexes = rawIndexes ?? [];
 	if (cfnIndexes.length === 0) return [];
 	const replicas = properties["Replicas"] ?? [];
-	const localReplicaIndexes = (Array.isArray(replicas) ? replicas.find((r) => asRecord(r)?.["Region"] === region) : void 0)?.["GlobalSecondaryIndexes"] ?? [];
+	const localReplicaIndexes = (Array.isArray(replicas) ? replicas.find((r) => asRecord$1(r)?.["Region"] === region) : void 0)?.["GlobalSecondaryIndexes"] ?? [];
 	const localByName = /* @__PURE__ */ new Map();
 	if (Array.isArray(localReplicaIndexes)) for (const entry of localReplicaIndexes) {
-		const record = asRecord(entry);
+		const record = asRecord$1(entry);
 		const name = record?.["IndexName"];
 		if (record && typeof name === "string") localByName.set(name, record);
 	}
 	const result = [];
 	for (const entry of cfnIndexes) {
-		const gsi = asRecord(entry);
+		const gsi = asRecord$1(entry);
 		if (!gsi) {
 			result.push(entry);
 			continue;
@@ -13940,17 +13940,17 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 			Projection: gsi["Projection"]
 		};
 		if (gsi["WarmThroughput"] !== void 0) sdk.WarmThroughput = gsi["WarmThroughput"];
-		const explicitProvisioned = asRecord(gsi["ProvisionedThroughput"]);
-		const explicitOnDemand = asRecord(gsi["OnDemandThroughput"]);
+		const explicitProvisioned = asRecord$1(gsi["ProvisionedThroughput"]);
+		const explicitOnDemand = asRecord$1(gsi["OnDemandThroughput"]);
 		if (explicitProvisioned) sdk.ProvisionedThroughput = explicitProvisioned;
 		else if (billingMode === "PROVISIONED") sdk.ProvisionedThroughput = {
-			ReadCapacityUnits: deriveReadCapacityUnits(asRecord(localEntry?.["ReadProvisionedThroughputSettings"]), source) ?? deriveReadCapacityUnits(asRecord(gsi["ReadProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS,
-			WriteCapacityUnits: deriveWriteCapacityUnits(asRecord(gsi["WriteProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS
+			ReadCapacityUnits: deriveReadCapacityUnits(asRecord$1(localEntry?.["ReadProvisionedThroughputSettings"]), source) ?? deriveReadCapacityUnits(asRecord$1(gsi["ReadProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS,
+			WriteCapacityUnits: deriveWriteCapacityUnits(asRecord$1(gsi["WriteProvisionedThroughputSettings"]), source) ?? DEFAULT_CAPACITY_UNITS
 		};
 		if (explicitOnDemand) sdk.OnDemandThroughput = explicitOnDemand;
 		else if (billingMode !== "PROVISIONED") {
-			const maxWrite = toFiniteNumber(asRecord(gsi["WriteOnDemandThroughputSettings"])?.["MaxWriteRequestUnits"]);
-			const maxRead = toFiniteNumber(asRecord(localEntry?.["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"]) ?? toFiniteNumber(asRecord(gsi["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"]);
+			const maxWrite = toFiniteNumber(asRecord$1(gsi["WriteOnDemandThroughputSettings"])?.["MaxWriteRequestUnits"]);
+			const maxRead = toFiniteNumber(asRecord$1(localEntry?.["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"]) ?? toFiniteNumber(asRecord$1(gsi["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"]);
 			if (maxWrite !== void 0 || maxRead !== void 0) sdk.OnDemandThroughput = {
 				...maxRead !== void 0 && { MaxReadRequestUnits: maxRead },
 				...maxWrite !== void 0 && { MaxWriteRequestUnits: maxWrite }
@@ -13972,7 +13972,7 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 * is issue #1440 one level up from where the member test looks.
 */
 function isUnresolvedIntrinsicBlock(value) {
-	const record = asRecord(value);
+	const record = asRecord$1(value);
 	if (!record) return false;
 	const keys = Object.keys(record);
 	return keys.length > 0 && keys.every((k) => k === "Ref" || k.startsWith("Fn::"));
@@ -14014,19 +14014,19 @@ function collectRawOnDemandDeclarations(properties, region) {
 	const rawIndexes = properties["GlobalSecondaryIndexes"];
 	if (!Array.isArray(rawIndexes)) return out;
 	const replicas = properties["Replicas"];
-	const localReplicaIndexes = asRecord(Array.isArray(replicas) ? replicas.find((r) => asRecord(r)?.["Region"] === region) : void 0)?.["GlobalSecondaryIndexes"];
+	const localReplicaIndexes = asRecord$1(Array.isArray(replicas) ? replicas.find((r) => asRecord$1(r)?.["Region"] === region) : void 0)?.["GlobalSecondaryIndexes"];
 	const localByName = /* @__PURE__ */ new Map();
 	if (Array.isArray(localReplicaIndexes)) for (const entry of localReplicaIndexes) {
-		const record = asRecord(entry);
+		const record = asRecord$1(entry);
 		const name = record?.["IndexName"];
 		if (record && typeof name === "string") localByName.set(name, record);
 	}
 	for (const entry of rawIndexes) {
-		const gsi = asRecord(entry);
+		const gsi = asRecord$1(entry);
 		const name = gsi?.["IndexName"];
 		if (!gsi || typeof name !== "string") continue;
 		const localEntry = localByName.get(name);
-		const explicitOnDemand = asRecord(gsi["OnDemandThroughput"]);
+		const explicitOnDemand = asRecord$1(gsi["OnDemandThroughput"]);
 		if (explicitOnDemand) {
 			out.set(name, {
 				readDeclared: explicitOnDemand["MaxReadRequestUnits"] !== void 0,
@@ -14037,8 +14037,8 @@ function collectRawOnDemandDeclarations(properties, region) {
 		const readBlocks = [localEntry?.["ReadOnDemandThroughputSettings"], gsi["ReadOnDemandThroughputSettings"]];
 		const writeBlock = gsi["WriteOnDemandThroughputSettings"];
 		out.set(name, {
-			readDeclared: readBlocks.some((block) => asRecord(block)?.["MaxReadRequestUnits"] !== void 0 || isUnresolvedIntrinsicBlock(block)),
-			writeDeclared: asRecord(writeBlock)?.["MaxWriteRequestUnits"] !== void 0 || isUnresolvedIntrinsicBlock(writeBlock)
+			readDeclared: readBlocks.some((block) => asRecord$1(block)?.["MaxReadRequestUnits"] !== void 0 || isUnresolvedIntrinsicBlock(block)),
+			writeDeclared: asRecord$1(writeBlock)?.["MaxWriteRequestUnits"] !== void 0 || isUnresolvedIntrinsicBlock(writeBlock)
 		});
 	}
 	return out;
@@ -14066,13 +14066,13 @@ function collectRawOnDemandDeclarations(properties, region) {
 function toSdkReplicaGlobalSecondaryIndexes(replicaIndexes) {
 	if (!Array.isArray(replicaIndexes) || replicaIndexes.length === 0) return void 0;
 	return replicaIndexes.map((entry) => {
-		const cfn = asRecord(entry);
+		const cfn = asRecord$1(entry);
 		if (!cfn) return entry;
 		const sdk = { IndexName: cfn["IndexName"] };
-		const explicitProvisioned = asRecord(cfn["ProvisionedThroughputOverride"]);
-		const explicitOnDemand = asRecord(cfn["OnDemandThroughputOverride"]);
-		const readCapacity = deriveReadCapacityUnits(asRecord(cfn["ReadProvisionedThroughputSettings"]));
-		const maxReadRequestUnits = toFiniteNumber(asRecord(cfn["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"]);
+		const explicitProvisioned = asRecord$1(cfn["ProvisionedThroughputOverride"]);
+		const explicitOnDemand = asRecord$1(cfn["OnDemandThroughputOverride"]);
+		const readCapacity = deriveReadCapacityUnits(asRecord$1(cfn["ReadProvisionedThroughputSettings"]));
+		const maxReadRequestUnits = toFiniteNumber(asRecord$1(cfn["ReadOnDemandThroughputSettings"])?.["MaxReadRequestUnits"]);
 		if (explicitProvisioned) sdk.ProvisionedThroughputOverride = explicitProvisioned;
 		else if (readCapacity !== void 0) sdk.ProvisionedThroughputOverride = { ReadCapacityUnits: readCapacity };
 		if (explicitOnDemand) sdk.OnDemandThroughputOverride = explicitOnDemand;
@@ -33237,6 +33237,7 @@ var GlueProvider = class {
 		try {
 			const builtTableInput = this.buildTableInput(tableInput, tableName);
 			this.preserveAwsManagedParameters(builtTableInput, tableInput["Parameters"], (previousProperties?.["TableInput"])?.["Parameters"], live.parameters);
+			this.preserveAwsManagedStorageDescriptor(builtTableInput, tableInput, previousProperties?.["TableInput"], live.storageDescriptor);
 			await this.getClient().send(new UpdateTableCommand$1({
 				...catalogId !== void 0 && { CatalogId: catalogId },
 				DatabaseName: databaseName,
@@ -33253,7 +33254,7 @@ var GlueProvider = class {
 			let message = `Failed to update Glue Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`;
 			if (error instanceof ConcurrentModificationException) {
 				message += ". Another writer changed the table between cdkd's pre-update read and its UpdateTable call.";
-				message += live.versionId !== void 0 ? ` cdkd sent the version it read (${live.versionId}) as a precondition and AWS rejected the write, rather than let it put back the AWS-managed Parameters read a moment earlier — which for an Apache Iceberg table would have pinned it to an older metadata_location (an effective snapshot rollback).` : " AWS returned no VersionId on the pre-update read, so cdkd could not attach a precondition; AWS rejected the write on its own.";
+				message += live.versionId !== void 0 ? ` cdkd sent the version it read (${live.versionId}) as a precondition and AWS rejected the write, rather than let it put back the AWS-managed Parameters and StorageDescriptor members read a moment earlier — which for an Apache Iceberg table would have pinned it to an older metadata_location (an effective snapshot rollback).` : " AWS returned no VersionId on the pre-update read, so cdkd could not attach a precondition; AWS rejected the write on its own.";
 				message += ` Re-run the deploy to pick up the current values.`;
 			}
 			throw new ProvisioningError(message, resourceType, logicalId, physicalId, cause);
@@ -33343,8 +33344,91 @@ var GlueProvider = class {
 		};
 	}
 	/**
-	* The live table state {@link preserveAwsManagedParameters} needs: its
-	* current `Parameters` plus the `VersionId` that pins them.
+	* Read-merge-write for out-of-band-authored `TableInput.StorageDescriptor`
+	* members (issue #1479) — the subtree sibling of
+	* {@link preserveAwsManagedParameters}, applied per SD MEMBER, with the two
+	* nested bags (`StorageDescriptor.Parameters`, `SerdeInfo.Parameters`)
+	* getting the same per-KEY rule one level down.
+	*
+	* Live probes (2026-08-10, us-east-1 — recorded on issue #1479) established
+	* WHO authors what, which is why this is per-member rather than a blanket
+	* merge:
+	*
+	* - A USER-authored `EXTERNAL_TABLE`: re-sending the template verbatim
+	*   reads back identical — the service itself authors only scalar defaults
+	*   (`Compressed: false`, `NumberOfBuckets: 0`, ...). Full-replace is
+	*   CORRECT for template-declared members, and `drift --revert` depends on
+	*   it to clear console-side edits.
+	* - A CRAWLER-populated table: the crawler authors `Columns`,
+	*   `InputFormat` / `OutputFormat`, `SerdeInfo` (incl. its `Parameters`
+	*   bag), and `StorageDescriptor.Parameters`; an UpdateTable restating only
+	*   a minimal template wiped ALL of them (`Columns` -> `[]`, `SerdeInfo`
+	*   gone) while reporting success.
+	* - An ICEBERG table: an UpdateTable omitting `Columns` was ACCEPTED and
+	*   wiped the catalog schema to `[]` (Glue re-derives Iceberg columns from
+	*   table metadata, so the catalog copy is metadata-authored between
+	*   engine commits).
+	*
+	* The preservation key is the SAME "present in NEITHER template side" test
+	* as {@link preserveAwsManagedParameters}, per member:
+	*
+	* | member in desired | member in previous | outcome                            |
+	* | ----------------- | ------------------ | ---------------------------------- |
+	* | yes               | (either)           | template wins                      |
+	* | no                | yes                | the USER REMOVED it -> stays removed |
+	* | no                | no                 | out-of-band authored -> carried forward from live |
+	*
+	* A template that never declared `StorageDescriptor` on EITHER side (a
+	* crawler-managed table adopted into a minimal template) carries the whole
+	* live block forward. Deliberately scoped to the `StorageDescriptor`
+	* subtree per issue #1479 — the crawler also authors `PartitionKeys` /
+	* `Owner`, but widening beyond the issue's member set is a separate
+	* decision (recorded there).
+	*
+	* TOCTOU: the write rides the same unconditional `VersionId` precondition
+	* as the Parameters merge (see {@link readLiveTableState}), so a concurrent
+	* out-of-band write fails the update loudly instead of being clobbered.
+	*/
+	preserveAwsManagedStorageDescriptor(built, desiredTableInput, previousTableInput, liveSd) {
+		if (!liveSd || Object.keys(liveSd).length === 0) return;
+		const desiredSdRaw = desiredTableInput["StorageDescriptor"];
+		const previousSdRaw = asRecord(previousTableInput)?.["StorageDescriptor"];
+		if (desiredSdRaw === void 0 && previousSdRaw === void 0) {
+			built.StorageDescriptor = liveSd;
+			return;
+		}
+		const desiredKeys = parameterKeySet(desiredSdRaw);
+		const previousKeys = parameterKeySet(previousSdRaw);
+		const sdOut = { ...built.StorageDescriptor ?? {} };
+		for (const [member, liveValue] of Object.entries(liveSd)) {
+			if (liveValue === void 0) continue;
+			if (desiredKeys.has(member) || previousKeys.has(member)) continue;
+			sdOut[member] = liveValue;
+		}
+		const desiredSd = asRecord(desiredSdRaw);
+		const previousSd = asRecord(previousSdRaw);
+		if (desiredKeys.has("Parameters") || previousKeys.has("Parameters")) this.preserveAwsManagedParameters(sdOut, desiredSd?.["Parameters"], previousSd?.["Parameters"], liveSd.Parameters);
+		if (desiredKeys.has("SerdeInfo") && liveSd.SerdeInfo) {
+			const desiredSerde = asRecord(desiredSd?.["SerdeInfo"]);
+			const previousSerde = asRecord(previousSd?.["SerdeInfo"]);
+			const desiredSerdeKeys = parameterKeySet(desiredSerde);
+			const previousSerdeKeys = parameterKeySet(previousSerde);
+			const serdeOut = { ...sdOut["SerdeInfo"] ?? {} };
+			for (const [member, liveValue] of Object.entries(liveSd.SerdeInfo)) {
+				if (liveValue === void 0) continue;
+				if (desiredSerdeKeys.has(member) || previousSerdeKeys.has(member)) continue;
+				serdeOut[member] = liveValue;
+			}
+			if (desiredSerdeKeys.has("Parameters") || previousSerdeKeys.has("Parameters")) this.preserveAwsManagedParameters(serdeOut, desiredSerde?.["Parameters"], previousSerde?.["Parameters"], liveSd.SerdeInfo.Parameters);
+			if (Object.keys(serdeOut).length > 0) sdOut["SerdeInfo"] = serdeOut;
+		}
+		if (Object.keys(sdOut).length > 0) built.StorageDescriptor = sdOut;
+	}
+	/**
+	* The live table state the two merges need: its current `Parameters` (for
+	* {@link preserveAwsManagedParameters}), its `StorageDescriptor` (for
+	* {@link preserveAwsManagedStorageDescriptor}, issue #1479), plus the
+	* `VersionId` that pins both.
 	*
 	* A missing table returns empty rather than throwing: `UpdateTable` is about
 	* to surface the real, more actionable error. Any OTHER failure is fatal by
@@ -33393,11 +33477,13 @@ var GlueProvider = class {
 			}));
 			return {
 				parameters: resp.Table?.Parameters,
+				storageDescriptor: resp.Table?.StorageDescriptor,
 				versionId: resp.Table?.VersionId
 			};
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) return {
 				parameters: void 0,
+				storageDescriptor: void 0,
 				versionId: void 0
 			};
 			throw new ProvisioningError(preUpdateReadFailureMessage("Table", "glue:GetTable", logicalId, error), resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
@@ -34433,6 +34519,19 @@ function parameterKeySet(value) {
 	return new Set(Object.keys(value));
 }
 /**
+* Narrow an unknown template / state value to a plain object, or `undefined`.
+* A malformed side (string / array / null) yields `undefined` and therefore
+* an empty key set — the tolerant treatment `parameterKeySet` already gives
+* bags, extended to the StorageDescriptor merge's containers. (An unresolved
+* intrinsic is itself a plain object, so it passes through and contributes
+* its `Fn::*`/`Ref` key — harmless here, since providers only ever see
+* resolved values.)
+*/
+function asRecord(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return;
+	return value;
+}
+/**
 * Message for a failed pre-update `Get*` read (issue #1461). Names the IAM
 * action so a permission gap is one line away from fixed, and says what the
 * read is FOR so the failure does not read as gratuitous.
@@ -48216,6 +48315,46 @@ function calculateResourceDrift(stateProperties, awsProperties, options) {
 	return drifts;
 }
 /**
+* Top-level keys of an `observedProperties` drift baseline that must NOT be
+* compared: keys the user never declared in the template (`declared` is the
+* state record's `properties` — the template intent) whose captured value was
+* EMPTY (absent container / `null` / `[]` / `{}`) at deploy time.
+*
+* WHY (issue #1498): the observed snapshot is captured per-resource right
+* after THAT resource settles, which is structurally BEFORE dependent sibling
+* resources run. A parent property that a separate resource type materializes
+* later — `AWS::ECS::ClusterCapacityProviderAssociations` populating
+* `Cluster.CapacityProviders`, `AWS::AutoScaling::LifecycleHook` populating
+* the ASG's `LifecycleHookSpecificationList`, standalone
+* `AWS::EC2::SecurityGroupIngress` rules populating the group's ingress list —
+* is therefore captured empty and later populated, producing PERMANENT
+* phantom drift on a fresh, untouched stack. Worse, `drift --revert` then
+* strips that sibling-managed configuration from AWS. AWS services author the
+* same shape asynchronously (ECS attaches the `AmazonECSManaged` tag + its
+* managed draining hook when a capacity provider binds an ASG).
+*
+* CloudFormation's drift detection only compares property values explicitly
+* set in the template, so none of this class fires there. Skipping exactly
+* the "undeclared AND captured-empty" keys restores that parity for the
+* phantom class while keeping the observed baseline's extra power: an
+* undeclared key captured with a REAL value (an AWS-side default such as a
+* cluster setting) is still compared, so a console-side change to it still
+* surfaces as drift.
+*
+* Returned keys are fed into `calculateResourceDrift`'s `ignorePaths`, so
+* they are excluded as whole subtrees from detection — and therefore from
+* `--revert` / `--accept`, which operate on the detected changes.
+*/
+function undeclaredEmptyObservedKeys(observed, declared) {
+	const keys = [];
+	for (const key of Object.keys(observed)) {
+		if (key in declared) continue;
+		const value = observed[key];
+		if (value === null || value === void 0 || Array.isArray(value) && value.length === 0 || isPlainObject(value) && Object.keys(value).length === 0) keys.push(key);
+	}
+	return keys;
+}
+/**
 * Thin alias over the shared {@link matchesPathPrefix} rule, kept as a named
 * function because "ignored" is what the path list means at these call sites.
 * Sharing the implementation with `getDriftUnorderedPaths` is deliberate: both
@@ -48627,8 +48766,10 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 			const ignorePaths = provider.getDriftUnknownPaths ? provider.getDriftUnknownPaths(resource.resourceType) : [];
 			const unorderedPaths = provider.getDriftUnorderedPaths ? provider.getDriftUnorderedPaths(resource.resourceType) : [];
 			const useObserved = resource.observedProperties !== void 0;
-			const changes = calculateResourceDrift(useObserved ? resource.observedProperties : resource.properties ?? {}, aws, {
-				ignorePaths,
+			const baseline = useObserved ? resource.observedProperties : resource.properties ?? {};
+			const observedIgnorePaths = useObserved ? undeclaredEmptyObservedKeys(resource.observedProperties, resource.properties ?? {}) : [];
+			const changes = calculateResourceDrift(baseline, aws, {
+				ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
 				unionWalkObjects: useObserved,
 				unorderedPaths
 			});
@@ -65966,7 +66107,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.29");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.31");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;