@go-to-k/cdkd 0.280.40 → 0.280.42

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigObject, $t as AssemblyReader, A as green, At as runDockerForeground, B as disableInstanceApiTermination, Bt as resolveCaptureObservedState, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackTerminationProtectionError, Ct as getBootstrapMarkerKey, D as bold, Dt as buildDockerImage, E as formatResourceLine, Et as validateContainerRepoName, F as clearOnUpdateRemoval, Ft as synthesisStatusMessage, G as WAFv2WebACLProvider, Gt as stateBucketExistenceConfirmed, H as IntrinsicFunctionResolver, Ht as resolveStateBucketWithDefault, I as ProviderRegistry, It as getDefaultStateBucketName, J as assertRegionMatch, Jt as CFN_TEMPLATE_URL_LIMIT, K as normalizeAwsTagsToCfn, Kt as warnDeprecatedNoPrefixCliFlag, L as findActionableSilentDrops, Lt as getLegacyStateBucketName, M as yellow, Mt as AssetManifestLoader, N as IAMRoleProvider, Nt as getDockerImageBySourceHash, O as cyan, On as normalizeAwsError, Ot as formatDockerLoginError, P as collectInlinePolicyNamesManagedBySiblings, Pt as Synthesizer, Q as requireConfigArray, Qt as expectedOwnerParam, R as CloudControlProvider, Rt as resolveApp, S as extractDeploymentEventError, Sn as StackHasActiveImportsError, St as ensureAssetStorage, T as renderStatefulReason, Tt as validateAssetBucketName, U as cfnRefValueFromPhysicalId, Ut as resolveStateBucketWithDefaultAndSource, V as isTerminationProtectionPropagationError, Vt as resolveSkipPrefix, W as refStateLookupFromResource, Wt as resolveUseCdkBootstrapAssets, X as readConfigString, Xt as findLargeInlineResources, Y as configStringRefusal, Yt as MIGRATE_TMP_PREFIX, Z as replayWarn, Zt as uploadCfnTemplate, _ as createPreDeleteFinalSnapshot, _n as NestedStackChildDirectDestroyError, _t as createAssetRedirectResolver, a as DeploymentEventsStore, an as resetAwsClients, at as isRetryableTransientError, b as unsupportedFinalSnapshotError, bn as ResourceTimeoutError, bt as AssetModeResolver, c as replayFailedOperations, cn as CdkdError, ct as TemplateParser, d as IMPLICIT_DELETE_DEPENDENCIES, dn as DeployCancelledError, dt as rebuildClientForBucketRegion, en as processStackMessages, et as requireConfigString, f as computeImplicitDeleteEdges, fn as LocalInvokeBuildError$1, ft as shouldRetainResource, g as ccRoutedFinalSnapshotError, gn as MissingCdkCliError, gt as buildAssetRedirectMap, h as buildFinalSnapshotIdentifier, ht as WorkGraph, i as DeploymentEventsReader, in as getAwsClients, it as withRetry, j as red, jt as runDockerStreaming, k as gray, kn as withErrorHandling, kt as getDockerCmd, l as replayRollback, lt as LockManager, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalStartServiceError, mt as stringifyValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveBucketRegion, nt as DiffCalculator, o as planFailedOps, on as setAwsClients, ot as isThrottlingError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalMigrateError, pt as AssetPublisher, q as resolveExplicitPhysicalId, qt as CFN_TEMPLATE_BODY_LIMIT, r as DeployEngine, rn as AwsClients, rt as describeTypeWithThrottleRetry, s as planRollback, st as DagBuilder, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as applyRoleArnIfSet, u as withResourceDeadline, ut as S3StateBackend, v as isFinalSnapshotError, vn as PartialFailureError, vt as loadPublishableAssetManifest, w as isStatefulRecreateTargetSync, wt as parseBootstrapMarker, x as makeCanonicalizePropertiesFn, xn as ResourceUpdateNotSupportedError, xt as BOOTSTRAP_MARKER_PREFIX, y as refusesFinalSnapshot, yn as ProvisioningError, yt as rewriteTemplateAssetReferences, z as slowCcOperationTimeoutMs, zt as resolveAutoAssetStorage } from "./deploy-engine-CU47_nau.js";
+import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-CuwZzHlM.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-BOGjxxxb.js";
+import { t as ASGProvider } from "./asg-provider-a9iV8VG_.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -67,7 +67,7 @@ import AdmZip from "adm-zip";
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$14, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3vectors";
 import { ListTagsForResourceCommand as ListTagsForResourceCommand$18, S3ControlClient, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23 } from "@aws-sdk/client-s3-control";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24 } from "@aws-sdk/client-s3tables";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetNamespaceCommand as GetNamespaceCommand$1, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$24, UntagResourceCommand as UntagResourceCommand$24 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -22724,13 +22724,33 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	* Users adopting an existing API Gateway should pass
 	* `--resource <logicalId>=<physicalId>` for each sub-resource; the
 	* physical id format follows what `create()` returns for the same
-	* type (e.g. `<restApiId>|<resourceId>` for `AWS::ApiGateway::Resource`).
+	* type. Note this is NOT uniformly a composite: `create()` returns a
+	* BARE `resourceId` for `AWS::ApiGateway::Resource` (the parent
+	* `RestApiId` is read from the recorded properties by every other
+	* method), while `AWS::ApiGateway::Method` genuinely is
+	* `<restApiId>|<resourceId>|<httpMethod>`.
+	*
+	* `import()` otherwise honours the supplied id verbatim, so a composite
+	* passed for a type whose provider stores a SCALAR would be written to
+	* state and then fed to the API as a resource id (issue #1663). That is
+	* not merely a failed call: `deleteResource` treats `NotFoundException`
+	* as an idempotent success, so the bad id would be reported as deleted
+	* while the resource stayed live in AWS — a silent orphan, the same class
+	* as issues #1651 / #1658. So the one type whose stored shape is
+	* unambiguously scalar refuses a composite up front, where the user can
+	* still act on it.
 	*/
 	async import(input) {
-		if (input.knownPhysicalId) return {
-			physicalId: input.knownPhysicalId,
-			attributes: {}
-		};
+		if (input.knownPhysicalId) {
+			if (input.resourceType === "AWS::ApiGateway::Resource" && input.knownPhysicalId.includes("|")) {
+				this.logger.warn(`AWS::ApiGateway::Resource ${input.logicalId}: '${input.knownPhysicalId}' looks like a composite, but cdkd stores a BARE resourceId for this type (the parent RestApiId comes from the template). Adopting it would send the whole string to the API as a resource id, and the delete path would then report success on the NotFound. Pass just the resourceId.`);
+				return null;
+			}
+			return {
+				physicalId: input.knownPhysicalId,
+				attributes: {}
+			};
+		}
 		return null;
 	}
 };
@@ -48418,6 +48438,66 @@ var S3DirectoryBucketProvider = class {
 //#endregion
 //#region src/provisioning/providers/s3-tables-provider.ts
 /**
+* Parse cdkd's composite namespace physicalId `<tableBucketARN>|<namespace>`.
+*
+* Returns `undefined` for any other shape. Exactly two non-empty segments are
+* required: every other method on the provider splits the stored id on `|` and
+* indexes segments 0 and 1, so a wrong-arity id recorded verbatim produces a
+* state row that cannot be updated, deleted or read back (issue #1668).
+*/
+function parseNamespaceCompositeId(physicalId) {
+	const parts = physicalId.split("|");
+	if (parts.length !== 2) return void 0;
+	const [tableBucketARN, namespace] = parts;
+	if (!tableBucketARN || !namespace) return void 0;
+	return {
+		tableBucketARN,
+		namespace
+	};
+}
+/** Parse cdkd's composite table physicalId `<tableBucketARN>|<namespace>|<name>`. */
+function parseTableCompositeId(physicalId) {
+	const parts = physicalId.split("|");
+	if (parts.length !== 3) return void 0;
+	const [tableBucketARN, namespace, name] = parts;
+	if (!tableBucketARN || !namespace || !name) return void 0;
+	return {
+		tableBucketARN,
+		namespace,
+		name
+	};
+}
+/** Read a non-blank string property, tolerating a malformed properties bag. */
+function readStringProperty$1(properties, key) {
+	const value = properties?.[key];
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+/**
+* Rebuild a table's identity from what `GetTable` returned.
+*
+* Deliberately NOT from the template: a CDK-synthesized `TableBucketARN` is an
+* `Fn::GetAtt` object at import time (full intrinsic resolution runs after
+* `provider.import()`), so a template-side read is `undefined` on exactly the
+* `--migrate-from-cloudformation` path this exists to serve.
+*
+* The bucket ARN is the table ARN's prefix — S3 Tables ARNs are
+* `arn:<p>:s3tables:<region>:<acct>:bucket/<bucket>` and
+* `…:bucket/<bucket>/table/<id>` — so it is recovered by trimming at the last
+* `/table/` segment. `namespace` comes back as a single-element list.
+*/
+function tableIdentityFromGetTable(tableARN, namespace, name) {
+	const cut = tableARN.lastIndexOf("/table/");
+	if (cut <= 0) return void 0;
+	const tableBucketARN = tableARN.slice(0, cut);
+	const ns = namespace?.[0];
+	if (!tableBucketARN || !ns || !name) return void 0;
+	return {
+		tableBucketARN,
+		namespace: ns,
+		name
+	};
+}
+/**
 * SDK Provider for AWS S3 Tables resources
 *
 * Supports:
@@ -48695,11 +48775,57 @@ var S3TablesProvider = class {
 			Namespace: namespaceName
 		};
 	}
-	async readTableCurrentState(physicalId) {
+	/**
+	* Recover a table's `(bucketARN, namespace, name)` from EITHER id shape.
+	*
+	* cdkd's composite carries all three. CloudFormation's physicalId for this
+	* type is the bare `TableARN` (single-field `primaryIdentifier`), and that
+	* form reaches the SDK path in two ways worth tolerating rather than
+	* rejecting:
+	*
+	* - every state row written by `cdkd import` before issue #1668, which
+	*   stored the CFn id verbatim; and
+	* - a CC-ROUTED table imported by this version, which deliberately records
+	*   the ARN because Cloud Control's Identifier is the ARN — while
+	*   `destroy` / `drift` route on `provisionedBy` ALONE (no properties), and
+	*   `cdkd import` records `'sdk'`, so those paths land HERE with an ARN.
+	*
+	* Tolerating both is what makes the route-detection at import time
+	* imprecision-proof: whichever shape is stored, every SDK path works.
+	* `GetTable` accepts `tableArn` and returns the parts.
+	*/
+	async resolveTableParts(physicalId) {
+		const composite = parseTableCompositeId(physicalId);
+		if (composite) return composite;
 		const parts = physicalId.split("|");
-		if (parts.length < 3) return void 0;
-		const [tableBucketARN, namespace, name] = parts;
-		if (!tableBucketARN || !namespace || !name) return void 0;
+		if (parts.length > 3) {
+			const [tableBucketARN, namespace, name] = parts;
+			if (tableBucketARN && namespace && name) return {
+				tableBucketARN,
+				namespace,
+				name
+			};
+		}
+		if (physicalId.includes("|") || !physicalId.startsWith("arn:")) return "unparseable";
+		try {
+			const resp = await this.getClient().send(new GetTableCommand$1({ tableArn: physicalId }));
+			if (!resp.tableARN) return "unparseable";
+			return tableIdentityFromGetTable(resp.tableARN, resp.namespace, resp.name) ?? "unparseable";
+		} catch (err) {
+			if (err instanceof NotFoundException$6) return "not-found";
+			throw err;
+		}
+	}
+	async readTableCurrentState(physicalId) {
+		let resolved;
+		try {
+			resolved = await this.resolveTableParts(physicalId);
+		} catch (err) {
+			this.logger.warn(`S3 Tables Table ${physicalId}: could not resolve its identity for drift (${err instanceof Error ? err.message : String(err)}); reporting drift as unknown.`);
+			return;
+		}
+		if (resolved === "not-found" || resolved === "unparseable") return void 0;
+		const { tableBucketARN, namespace, name } = resolved;
 		let resp;
 		try {
 			resp = await this.getClient().send(new GetTableCommand$1({
@@ -48768,44 +48894,163 @@ var S3TablesProvider = class {
 		} while (token);
 		return null;
 	}
+	/**
+	* Adopt an existing namespace (issue #1668).
+	*
+	* cdkd's physicalId is `<tableBucketARN>|<namespaceName>` and so is
+	* CloudFormation's — the registry declares a two-field
+	* `primaryIdentifier` (`/properties/TableBucketARN` + `/properties/Namespace`,
+	* verified live us-east-1 2026-08-12) and Cloud Control joins a multi-part
+	* identifier with `|`. So the two agree and no foreign form has to be
+	* accepted; what was missing is that a WRONG-ARITY id was recorded verbatim,
+	* after which every other method on this provider — which all split the
+	* stored id on `|` — failed against a state row that looked adopted.
+	*
+	* A wrong-arity override is REFUSED rather than silently replaced with the
+	* template's identity: `knownPhysicalId` is documented as ground truth
+	* (`ResourceImportInput`), so quietly adopting a different resource than the
+	* one the user named would be worse than declining. An unverifiable
+	* namespace returns `null` (`skipped-not-found`), which is loud and leaves
+	* state clean.
+	*
+	* NOTE this now issues an AWS call where it previously made none, so
+	* `s3tables:GetNamespace` is newly required, and a path that could not fail
+	* before can now report `failed` on a non-`NotFound` error (throttle, IAM).
+	*/
 	async importNamespace(input) {
-		if (input.knownPhysicalId) return {
-			physicalId: input.knownPhysicalId,
+		if (!input.knownPhysicalId) return null;
+		const identity = parseNamespaceCompositeId(input.knownPhysicalId);
+		if (!identity) {
+			this.logger.warn(`S3 Tables Namespace ${input.logicalId}: physical id '${input.knownPhysicalId}' is not '<tableBucketARN>|<namespace>'. CloudFormation uses the same two-field composite for this type, so this id names no namespace cdkd can verify; skipping import.`);
+			return null;
+		}
+		try {
+			await this.getClient().send(new GetNamespaceCommand$1({
+				tableBucketARN: identity.tableBucketARN,
+				namespace: identity.namespace
+			}));
+		} catch (err) {
+			if (err instanceof NotFoundException$6) return null;
+			throw err;
+		}
+		return {
+			physicalId: `${identity.tableBucketARN}|${identity.namespace}`,
 			attributes: {}
 		};
-		return null;
 	}
+	/**
+	* Adopt an existing table (issue #1668).
+	*
+	* Unlike the namespace above, the two id shapes DISAGREE here: cdkd's
+	* physicalId is `<tableBucketARN>|<namespace>|<name>` while the registry
+	* declares a SINGLE-field `primaryIdentifier` of `/properties/TableARN`
+	* (verified live us-east-1 2026-08-12), so CloudFormation's physicalId is
+	* the table ARN. An auto-mode / `--migrate-from-cloudformation` import
+	* merges CFn-derived ids into the overrides, so that ARN was landing in
+	* state verbatim and every later update / delete / read then failed to parse
+	* it — the #1651 class on a second type.
+	*
+	* **The identity is resolved from AWS, not from the template.** An earlier
+	* draft rebuilt the composite out of `Properties.TableBucketARN` /
+	* `Namespace` / `TableName`, and that is INERT for the case this exists to
+	* fix: in a CDK-synthesized template `TableBucketARN` is
+	* `{"Fn::GetAtt": ["TableBucket", "TableBucketARN"]}`, `import.ts`
+	* pre-substitutes only single-key `{Ref}` before calling a provider, and
+	* full intrinsic resolution runs AFTER every `provider.import()`. So the
+	* template read yielded `undefined` on exactly the
+	* `--migrate-from-cloudformation` path that supplies the bare ARN, turning a
+	* corrupt adoption into a non-adoption instead of canonicalizing it.
+	*
+	* `GetTable` accepts `tableArn` directly and returns `name` + `namespace`,
+	* so the ARN resolves its own identity with no template involvement. The
+	* bucket ARN is the table ARN's prefix (`<bucketArn>/table/<id>`); when the
+	* template DOES carry a literal `TableBucketARN` it is cross-checked, and a
+	* disagreement is refused rather than guessed at.
+	*/
 	async importTable(input) {
-		if (input.knownPhysicalId) {
-			const parts = input.knownPhysicalId.split("|");
-			if (parts.length >= 3) try {
-				await this.getClient().send(new GetTableCommand$1({
-					tableBucketARN: parts[0],
-					namespace: parts[1],
-					name: parts[2]
-				}));
-				return {
-					physicalId: input.knownPhysicalId,
-					attributes: {}
-				};
-			} catch (err) {
-				if (err instanceof NotFoundException$6) return null;
-				throw err;
-			}
+		const known = input.knownPhysicalId;
+		if (!known) return null;
+		const composite = parseTableCompositeId(known);
+		const request = composite ? {
+			tableBucketARN: composite.tableBucketARN,
+			namespace: composite.namespace,
+			name: composite.name
+		} : !known.includes("|") && known.startsWith("arn:") ? { tableArn: known } : void 0;
+		if (!request) {
+			this.logger.warn(`S3 Tables Table ${input.logicalId}: physical id '${known}' is neither cdkd's '<tableBucketARN>|<namespace>|<name>' composite nor a table ARN (CloudFormation's physicalId for this type), so it names no table cdkd can verify; skipping import.`);
+			return null;
+		}
+		let response;
+		try {
+			response = await this.getClient().send(new GetTableCommand$1(request));
+		} catch (err) {
+			if (err instanceof NotFoundException$6) return null;
+			throw err;
+		}
+		const tableARN = response.tableARN;
+		if (!tableARN) {
+			this.logger.warn(`S3 Tables Table ${input.logicalId}: GetTable returned no tableARN for '${known}', so the table's identity cannot be confirmed; skipping import.`);
+			return null;
+		}
+		const identity = composite ?? tableIdentityFromGetTable(tableARN, response.namespace, response.name);
+		if (!identity) {
+			this.logger.warn(`S3 Tables Table ${input.logicalId}: GetTable('${known}') did not return a usable namespace / name / bucket-ARN prefix; skipping import.`);
+			return null;
+		}
+		const mismatch = [
+			[
+				"TableBucketARN",
+				readStringProperty$1(input.properties, "TableBucketARN"),
+				identity.tableBucketARN
+			],
+			[
+				"Namespace",
+				readStringProperty$1(input.properties, "Namespace"),
+				identity.namespace
+			],
+			[
+				"TableName",
+				readStringProperty$1(input.properties, "TableName") ?? readStringProperty$1(input.properties, "Name"),
+				identity.name
+			]
+		].find(([key, declared, resolved]) => {
+			if (!declared) return false;
+			if (key === "TableBucketARN" && !declared.startsWith("arn:")) return false;
+			return (declared.includes("|") ? declared.split("|").pop() ?? declared : declared) !== resolved;
+		});
+		if (mismatch) {
+			const [key, declared, resolved] = mismatch;
+			this.logger.warn(`S3 Tables Table ${input.logicalId}: the supplied physical id '${known}' resolves to ${key} '${resolved}', but the template declares '${declared}'; refusing to adopt a different table than the one the template describes.`);
+			return null;
+		}
+		if (findSilentDropProperties("AWS::S3Tables::Table", input.properties).length > 0) {
+			this.logger.debug(`S3 Tables Table ${input.logicalId}: template carries a Cloud-Control-routing property, recording the bare TableARN (CC's identifier) rather than cdkd's composite.`);
 			return {
-				physicalId: input.knownPhysicalId,
-				attributes: {}
+				physicalId: tableARN,
+				attributes: { TableARN: tableARN }
 			};
 		}
-		return null;
+		return {
+			physicalId: `${identity.tableBucketARN}|${identity.namespace}|${identity.name}`,
+			attributes: { TableARN: tableARN }
+		};
 	}
 	async deleteTable(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting S3 Tables Table ${logicalId}: ${physicalId}`);
-		const parts = physicalId.split("|");
-		if (parts.length < 3) throw new ProvisioningError(`Invalid physical ID format for S3 Tables Table ${logicalId}: ${physicalId}`, resourceType, logicalId, physicalId);
-		const tableBucketARN = parts[0];
-		const namespace = parts[1];
-		const name = parts[2];
+		let resolved;
+		try {
+			resolved = await this.resolveTableParts(physicalId);
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to resolve S3 Tables Table ${logicalId} (${physicalId}): ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+		if (resolved === "not-found") {
+			assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+			this.logger.debug(`S3 Tables Table ${physicalId} does not exist, skipping deletion`);
+			return;
+		}
+		if (resolved === "unparseable") throw new ProvisioningError(`Invalid physical ID format for S3 Tables Table ${logicalId}: ${physicalId} (expected '<tableBucketARN>|<namespace>|<name>' or a table ARN)`, resourceType, logicalId, physicalId);
+		const { tableBucketARN, namespace, name } = resolved;
 		try {
 			await this.getClient().send(new DeleteTableCommand$2({
 				tableBucketARN,
@@ -48923,10 +49168,10 @@ var S3TablesProvider = class {
 		const upserts = {};
 		for (const [k, v] of Object.entries(next)) if (prev[k] !== v) upserts[k] = v;
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
-		const parts = physicalId.split("|");
-		if (parts.length < 3) throw new ProvisioningError(`applyTableTagsDiff: cannot derive table ARN from physicalId '${physicalId}' (expected '<bucketArn>|<namespace>|<name>') — refusing to silently drop the tag update`, resourceType, logicalId, physicalId);
-		const [tableBucketARN, namespace, name] = parts;
-		if (!tableBucketARN || !namespace || !name) throw new ProvisioningError(`applyTableTagsDiff: cannot derive table ARN from malformed physicalId '${physicalId}' (empty part after split) — refusing to silently drop the tag update`, resourceType, logicalId, physicalId);
+		const resolvedParts = await this.resolveTableParts(physicalId);
+		if (resolvedParts === "not-found") throw new ProvisioningError(`applyTableTagsDiff: table '${physicalId}' no longer exists (state is out of sync) — refusing to silently drop the tag update`, resourceType, logicalId, physicalId);
+		if (resolvedParts === "unparseable") throw new ProvisioningError(`applyTableTagsDiff: cannot derive table ARN from physicalId '${physicalId}' (expected '<bucketArn>|<namespace>|<name>' or a table ARN) — refusing to silently drop the tag update`, resourceType, logicalId, physicalId);
+		const { tableBucketARN, namespace, name } = resolvedParts;
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
@@ -55631,13 +55876,29 @@ const COMPOSITE_ID_SPLITTERS = {
 			HttpMethod: parts[2]
 		} };
 	},
-	"AWS::ApiGateway::Resource": (id) => {
-		const parts = id.split("|");
-		if (parts.length !== 2) throw new Error(`expected 2 parts (restApiId|resourceId), got ${parts.length}: '${id}'`);
-		return { resourceIdentifier: {
-			RestApiId: parts[0],
-			ResourceId: parts[1]
-		} };
+	"AWS::ApiGateway::Resource": (physicalId, properties) => {
+		if (!physicalId.trim()) throw new Error("empty physical id for AWS::ApiGateway::Resource (expected a resourceId)");
+		const parts = physicalId.split("|");
+		if (parts.length > 2) throw new Error(`expected a bare resourceId or 'restApiId|resourceId', got ${parts.length} parts: '${physicalId}'`);
+		if (parts.length === 2) {
+			const [restApiId, resourceId] = parts;
+			if (!restApiId || !resourceId) throw new Error(`empty part in 'restApiId|resourceId': '${physicalId}'`);
+			return {
+				resourceIdentifier: {
+					RestApiId: restApiId,
+					ResourceId: resourceId
+				},
+				propertiesOverlay: { RestApiId: restApiId }
+			};
+		}
+		const restApiId = readStringProperty(properties, "RestApiId", "AWS::ApiGateway::Resource");
+		return {
+			resourceIdentifier: {
+				RestApiId: restApiId,
+				ResourceId: physicalId
+			},
+			propertiesOverlay: { RestApiId: restApiId }
+		};
 	},
 	"AWS::EC2::VPCGatewayAttachment": (id) => {
 		const parts = id.split("|");
@@ -71670,7 +71931,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.40");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.42");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;