@go-to-k/cdkd 0.280.39 → 0.280.41

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-BXVYshtP.js";
+import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-D3j4WK7_.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DPYPr-Op.js";
+import { t as ASGProvider } from "./asg-provider-Bdmv1zQr.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -22724,13 +22724,33 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	* Users adopting an existing API Gateway should pass
 	* `--resource <logicalId>=<physicalId>` for each sub-resource; the
 	* physical id format follows what `create()` returns for the same
-	* type (e.g. `<restApiId>|<resourceId>` for `AWS::ApiGateway::Resource`).
+	* type. Note this is NOT uniformly a composite: `create()` returns a
+	* BARE `resourceId` for `AWS::ApiGateway::Resource` (the parent
+	* `RestApiId` is read from the recorded properties by every other
+	* method), while `AWS::ApiGateway::Method` genuinely is
+	* `<restApiId>|<resourceId>|<httpMethod>`.
+	*
+	* `import()` otherwise honours the supplied id verbatim, so a composite
+	* passed for a type whose provider stores a SCALAR would be written to
+	* state and then fed to the API as a resource id (issue #1663). That is
+	* not merely a failed call: `deleteResource` treats `NotFoundException`
+	* as an idempotent success, so the bad id would be reported as deleted
+	* while the resource stayed live in AWS — a silent orphan, the same class
+	* as issues #1651 / #1658. So the one type whose stored shape is
+	* unambiguously scalar refuses a composite up front, where the user can
+	* still act on it.
 	*/
 	async import(input) {
-		if (input.knownPhysicalId) return {
-			physicalId: input.knownPhysicalId,
-			attributes: {}
-		};
+		if (input.knownPhysicalId) {
+			if (input.resourceType === "AWS::ApiGateway::Resource" && input.knownPhysicalId.includes("|")) {
+				this.logger.warn(`AWS::ApiGateway::Resource ${input.logicalId}: '${input.knownPhysicalId}' looks like a composite, but cdkd stores a BARE resourceId for this type (the parent RestApiId comes from the template). Adopting it would send the whole string to the API as a resource id, and the delete path would then report success on the NotFound. Pass just the resourceId.`);
+				return null;
+			}
+			return {
+				physicalId: input.knownPhysicalId,
+				attributes: {}
+			};
+		}
 		return null;
 	}
 };
@@ -37386,6 +37406,97 @@ var AppSyncProvider = class {
 function importableString(value) {
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
+/** The one pseudo parameter whose value IS the Glue API's `CatalogId` default. */
+const ACCOUNT_ID_PSEUDO_PARAMETER = "AWS::AccountId";
+const ACCOUNT_ID_SUB_TEMPLATE = "${AWS::AccountId}";
+/**
+* Is this unresolved intrinsic PROVABLY the caller's own account id?
+*
+* `@aws-cdk/aws-glue-alpha` sets `catalogId: Stack.of(this).account`, which
+* renders as `{Ref: AWS::AccountId}` (or an `Fn::Sub` wrapper) for an
+* environment-agnostic stack. A pseudo parameter is never in the import
+* overrides map, so a `cdkd import`-written state record holds the intrinsic
+* verbatim — but its resolved value is exactly what OMITTING `CatalogId` gives
+* the Glue API, so dropping it is not a loss and a NotFound afterwards is
+* ordinary idempotency, not the silent-leak shape.
+*
+* Kept deliberately narrow. An intrinsic object has exactly ONE key, and only
+* the two account-id spellings qualify: `{Ref: SomeParam}`, `Fn::ImportValue`,
+* an `Fn::Sub` of anything else, and every other shape stay UNUSABLE, because
+* their resolved value could be any catalog at all.
+*/
+function isAccountIdPseudoParameter(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	if (keys.length !== 1) return false;
+	const bag = value;
+	if (keys[0] === "Ref") return bag["Ref"] === ACCOUNT_ID_PSEUDO_PARAMETER;
+	if (keys[0] === "Fn::Sub") {
+		const arg = bag["Fn::Sub"];
+		if (typeof arg === "string") return arg === ACCOUNT_ID_SUB_TEMPLATE;
+		return Array.isArray(arg) && arg[0] === ACCOUNT_ID_SUB_TEMPLATE;
+	}
+	return false;
+}
+/**
+* Coerce a template-borne `CatalogId` into the string the Glue API wants, or
+* `undefined` when no usable value is present (issue
+* [#1675](https://github.com/go-to-k/cdkd/issues/1675)).
+*
+* This is {@link importableString} plus a NUMBER arm, and the number arm is
+* load-bearing rather than defensive: `cdkd import --migrate-from-cloudformation`
+* reads the stack's ORIGINAL template (`cfn-stack-prefetch.ts`), where an
+* unquoted YAML `CatalogId: 123456789012` parses as a JSON number. Rejecting it
+* as "not a string" would drop the field and silently retarget the call at the
+* account's DEFAULT catalog — which on a DELETE can destroy a same-named
+* resource that happens to live there. `Number.isFinite` keeps `NaN` /
+* `Infinity` out (they fall through to the unusable arm, where they are
+* reported); a non-integer is stringified and AWS rejects it loudly, which is
+* the right failure.
+*
+* The coercion lives HERE rather than inside `importableString`: that helper is
+* shared with `DatabaseName` / `TableInput.Name` reads, where a number is a
+* malformed template rather than a YAML scalar to recover.
+*/
+function catalogIdForApi(value) {
+	if (typeof value === "number" && Number.isFinite(value)) return String(value);
+	return importableString(value);
+}
+function deleteCatalogId(properties) {
+	const raw = properties?.["CatalogId"];
+	const catalogId = catalogIdForApi(raw);
+	return {
+		catalogId,
+		declaredButUnusable: catalogId === void 0 && raw != null && !isAccountIdPseudoParameter(raw)
+	};
+}
+/** Human-readable name for the catalog a call addressed, for log messages. */
+function describeCatalog(catalogId) {
+	return catalogId === void 0 ? "this account's default Data Catalog" : `Data Catalog ${catalogId}`;
+}
+/**
+* Report the `EntityNotFoundException` arm of a Glue delete, at the severity
+* the evidence supports (issue #1675).
+*
+* With a correctly-targeted delete a NotFound means the resource is already
+* gone and the skip is ordinary idempotency — debug. When the template DECLARED
+* a `CatalogId` that {@link deleteCatalogId} could not use, cdkd addressed the
+* DEFAULT catalog instead, so a NotFound is equally consistent with "the
+* resource is alive in the declared catalog" — that is the silent-leak shape,
+* and it gets a warning.
+*
+* BOTH arms name the catalog actually addressed. A LITERAL-but-wrong
+* `CatalogId` (a typo, a stale account id) is otherwise indistinguishable from
+* an already-deleted resource in the log, and it takes the debug arm.
+*/
+function logCatalogScopedDeleteSkip(logger, target, kind, logicalId, physicalId) {
+	const where = describeCatalog(target.catalogId);
+	if (!target.declaredButUnusable) {
+		logger.debug(`Glue ${kind} ${physicalId} does not exist in ${where}, skipping deletion`);
+		return;
+	}
+	logger.warn(`Glue ${kind} ${logicalId} (${physicalId}) was not found, so cdkd skipped its deletion — but the recorded CatalogId is not a usable value (likely an unresolved intrinsic), so the delete targeted ${where}. If the resource lives in a different Data Catalog it still exists. cdkd cannot retry this delete: the state record is dropped once the destroy completes, so check the intended catalog (aws glue get-${kind.toLowerCase()} --catalog-id <id> ...) and delete the resource there by hand.`);
+}
 function resolveTableIdentity(input) {
 	const { knownPhysicalId, templateDatabaseName, templateTableName } = input;
 	let databaseName;
@@ -37517,17 +37628,18 @@ var GlueProvider = class {
 	}
 	async deleteDatabase(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting Glue Database ${logicalId}: ${physicalId}`);
+		const target = deleteCatalogId(properties);
+		if (target.declaredButUnusable) this.logger.debug(`Glue Database ${logicalId}: CatalogId is not a usable value (likely an unresolved intrinsic), so DeleteDatabase targets ${describeCatalog(target.catalogId)}.`);
 		try {
-			const catalogId = properties?.["CatalogId"];
 			await this.getClient().send(new DeleteDatabaseCommand({
 				Name: physicalId,
-				...catalogId && { CatalogId: catalogId }
+				...target.catalogId !== void 0 && { CatalogId: target.catalogId }
 			}));
 			this.logger.debug(`Successfully deleted Glue Database ${logicalId}`);
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Glue Database ${physicalId} does not exist, skipping deletion`);
+				logCatalogScopedDeleteSkip(this.logger, target, "Database", logicalId, physicalId);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -37602,15 +37714,18 @@ var GlueProvider = class {
 			throw new ProvisioningError(message, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async deleteTable(logicalId, physicalId, resourceType, _properties, context) {
+	async deleteTable(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting Glue Table ${logicalId}: ${physicalId}`);
 		const [databaseName, tableName] = physicalId.split("|");
 		if (!databaseName || !tableName) {
 			this.logger.warn(`Invalid Glue Table physical ID format: ${physicalId}, skipping`);
 			return;
 		}
+		const target = deleteCatalogId(properties);
+		if (target.declaredButUnusable) this.logger.debug(`Glue Table ${logicalId}: CatalogId is not a usable value (likely an unresolved intrinsic), so DeleteTable targets ${describeCatalog(target.catalogId)}.`);
 		try {
 			await this.getClient().send(new DeleteTableCommand$1({
+				...target.catalogId !== void 0 && { CatalogId: target.catalogId },
 				DatabaseName: databaseName,
 				Name: tableName
 			}));
@@ -37618,7 +37733,7 @@ var GlueProvider = class {
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Glue Table ${physicalId} does not exist, skipping deletion`);
+				logCatalogScopedDeleteSkip(this.logger, target, "Table", logicalId, physicalId);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -37965,7 +38080,7 @@ var GlueProvider = class {
 	* up drift detection for the rest.
 	*/
 	async readCurrentState(physicalId, _logicalId, resourceType, properties) {
-		const catalogId = properties?.["CatalogId"];
+		const catalogId = catalogIdForApi(properties?.["CatalogId"]);
 		switch (resourceType) {
 			case "AWS::Glue::Database": return this.readDatabase(physicalId, catalogId);
 			case "AWS::Glue::Table": return this.readTable(physicalId, catalogId);
@@ -38050,7 +38165,7 @@ var GlueProvider = class {
 	}
 	async importDatabase(input) {
 		const explicitName = input.knownPhysicalId ?? importableString(input.properties["DatabaseInput"]?.["Name"]);
-		const catalogId = importableString(input.properties["CatalogId"]);
+		const catalogId = catalogIdForApi(input.properties["CatalogId"]);
 		if (explicitName) try {
 			await this.getClient().send(new GetDatabaseCommand({
 				Name: explicitName,
@@ -38070,7 +38185,7 @@ var GlueProvider = class {
 		const databaseName = importableString(input.properties["DatabaseName"]);
 		const tableInput = input.properties["TableInput"];
 		const templateTableName = importableString(tableInput?.["Name"]);
-		const catalogId = importableString(input.properties["CatalogId"]);
+		const catalogId = catalogIdForApi(input.properties["CatalogId"]);
 		const identity = resolveTableIdentity({
 			knownPhysicalId: input.knownPhysicalId,
 			templateDatabaseName: databaseName,
@@ -39338,16 +39453,17 @@ var GlueConnectionProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting Glue Connection ${logicalId}: ${physicalId}`);
-		const catalogId = properties?.["CatalogId"];
+		const target = deleteCatalogId(properties);
+		if (target.declaredButUnusable) this.logger.debug(`Glue Connection ${logicalId}: CatalogId is not a usable value (likely an unresolved intrinsic), so DeleteConnection targets ${describeCatalog(target.catalogId)}.`);
 		try {
 			await this.getClient().send(new DeleteConnectionCommand({
 				ConnectionName: physicalId,
-				...catalogId && { CatalogId: catalogId }
+				...target.catalogId !== void 0 && { CatalogId: target.catalogId }
 			}));
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Glue Connection ${physicalId} does not exist, skipping deletion`);
+				logCatalogScopedDeleteSkip(this.logger, target, "Connection", logicalId, physicalId);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -39358,12 +39474,12 @@ var GlueConnectionProvider = class {
 		if (attributeName === "Id" || attributeName === "Ref" || attributeName === "Name") return physicalId;
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType, properties) {
-		const catalogId = properties?.["CatalogId"];
+		const catalogId = catalogIdForApi(properties?.["CatalogId"]);
 		let conn;
 		try {
 			conn = (await this.getClient().send(new GetConnectionCommand({
 				Name: physicalId,
-				...catalogId && { CatalogId: catalogId }
+				...catalogId !== void 0 && { CatalogId: catalogId }
 			}))).Connection;
 		} catch (err) {
 			if (err instanceof EntityNotFoundException) return void 0;
@@ -39385,11 +39501,11 @@ var GlueConnectionProvider = class {
 	async import(input) {
 		const explicitName = input.knownPhysicalId ?? input.properties["ConnectionInput"]?.["Name"];
 		if (!explicitName) return null;
-		const catalogId = input.properties["CatalogId"];
+		const catalogId = catalogIdForApi(input.properties["CatalogId"]);
 		try {
 			await this.getClient().send(new GetConnectionCommand({
 				Name: explicitName,
-				...catalogId && { CatalogId: catalogId }
+				...catalogId !== void 0 && { CatalogId: catalogId }
 			}));
 			return {
 				physicalId: explicitName,
@@ -55535,13 +55651,29 @@ const COMPOSITE_ID_SPLITTERS = {
 			HttpMethod: parts[2]
 		} };
 	},
-	"AWS::ApiGateway::Resource": (id) => {
-		const parts = id.split("|");
-		if (parts.length !== 2) throw new Error(`expected 2 parts (restApiId|resourceId), got ${parts.length}: '${id}'`);
-		return { resourceIdentifier: {
-			RestApiId: parts[0],
-			ResourceId: parts[1]
-		} };
+	"AWS::ApiGateway::Resource": (physicalId, properties) => {
+		if (!physicalId.trim()) throw new Error("empty physical id for AWS::ApiGateway::Resource (expected a resourceId)");
+		const parts = physicalId.split("|");
+		if (parts.length > 2) throw new Error(`expected a bare resourceId or 'restApiId|resourceId', got ${parts.length} parts: '${physicalId}'`);
+		if (parts.length === 2) {
+			const [restApiId, resourceId] = parts;
+			if (!restApiId || !resourceId) throw new Error(`empty part in 'restApiId|resourceId': '${physicalId}'`);
+			return {
+				resourceIdentifier: {
+					RestApiId: restApiId,
+					ResourceId: resourceId
+				},
+				propertiesOverlay: { RestApiId: restApiId }
+			};
+		}
+		const restApiId = readStringProperty(properties, "RestApiId", "AWS::ApiGateway::Resource");
+		return {
+			resourceIdentifier: {
+				RestApiId: restApiId,
+				ResourceId: physicalId
+			},
+			propertiesOverlay: { RestApiId: restApiId }
+		};
 	},
 	"AWS::EC2::VPCGatewayAttachment": (id) => {
 		const parts = id.split("|");
@@ -71574,7 +71706,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.39");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.41");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;