@go-to-k/cdkd 0.281.15 → 0.281.16

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as replayWarn, $t as findLargeInlineResources, A as green, At as buildDockerImage, B as slowCcOperationTimeoutMs, Bt as getLegacyStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceTimeoutError, Ct as AssetModeResolver, D as bold, Dt as parseBootstrapMarker, E as formatResourceLine, En as StackTerminationProtectionError, Et as getBootstrapMarkerKey, F as clearOnUpdateRemoval, Ft as AssetManifestLoader, G as getAccountInfo, Gt as resolveStateBucketWithDefault, H as isTerminationProtectionPropagationError, Ht as resolveAutoAssetStorage, I as ProviderRegistry, It as getDockerImageBySourceHash, J as normalizeAwsTagsToCfn, Jt as stateBucketExistenceConfirmed, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefaultAndSource, L as findActionableSilentDrops, Lt as Synthesizer, M as yellow, Mn as withErrorHandling, Mt as getDockerCmd, N as IAMRoleProvider, Nt as runDockerForeground, O as cyan, Ot as validateAssetBucketName, P as collectInlinePolicyNamesManagedBySiblings, Pt as runDockerStreaming, Q as readConfigString, Qt as MIGRATE_TMP_PREFIX, R as findSilentDropProperties, Rt as synthesisStatusMessage, S as extractDeploymentEventError, Sn as ProvisioningError, St as rewriteTemplateAssetReferences, T as renderStatefulReason, Tn as StackHasActiveImportsError, Tt as ensureAssetStorage, U as IntrinsicFunctionResolver, Ut as resolveCaptureObservedState, V as disableInstanceApiTermination, Vt as resolveApp, W as cfnRefValueFromPhysicalId, Wt as resolveSkipPrefix, X as assertRegionMatch, Xt as CFN_TEMPLATE_BODY_LIMIT, Y as resolveExplicitPhysicalId, Yt as warnDeprecatedNoPrefixCliFlag, Z as configStringRefusal, Zt as CFN_TEMPLATE_URL_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalStartServiceError, _t as stringifyValue, a as DeploymentEventsStore, an as resolveBucketRegion, at as DiffCalculator, b as unsupportedFinalSnapshotError, bn as NestedStackChildDirectDestroyError, bt as createAssetRedirectResolver, c as replayFailedOperations, cn as resetAwsClients, ct as isRetryableTransientError, d as IMPLICIT_DELETE_DEPENDENCIES, dn as CdkdError, dt as TemplateParser, en as uploadCfnTemplate, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as LockManager, g as ccRoutedFinalSnapshotError, gn as LocalMigrateError, gt as AssetPublisher, h as buildFinalSnapshotIdentifier, hn as LocalInvokeBuildError$1, ht as shouldRetainResource, i as DeploymentEventsReader, it as applyRoleArnIfSet, j as red, jn as normalizeAwsError, jt as formatDockerLoginError, k as gray, kt as validateContainerRepoName, l as replayRollback, ln as setAwsClients, lt as isThrottlingError, m as PRE_DELETE_SNAPSHOT_TYPES, mn as DeployCancelledError, mt as rebuildClientForBucketRegion, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AssemblyReader, nt as requireConfigString, o as planFailedOps, on as AwsClients, ot as describeTypeWithThrottleRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as S3StateBackend, q as WAFv2WebACLProvider, qt as resolveUseCdkBootstrapAssets, r as DeployEngine, rn as processStackMessages, rt as derivePartitionAndUrlSuffix, s as planRollback, sn as getAwsClients, st as withRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as expectedOwnerParam, tt as requireConfigObject, u as withResourceDeadline, ut as DagBuilder, v as isFinalSnapshotError, vt as WorkGraph, w as isStatefulRecreateTargetSync, wn as ResourceUpdateNotSupportedError, wt as BOOTSTRAP_MARKER_PREFIX, x as makeCanonicalizePropertiesFn, xn as PartialFailureError, xt as loadPublishableAssetManifest, y as refusesFinalSnapshot, yn as MissingCdkCliError, yt as buildAssetRedirectMap, z as CloudControlProvider, zt as getDefaultStateBucketName } from "./deploy-engine-B2MDP-jK.js";
+import { $ as replayWarn, $t as findLargeInlineResources, A as green, At as buildDockerImage, B as slowCcOperationTimeoutMs, Bt as getLegacyStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceTimeoutError, Ct as AssetModeResolver, D as bold, Dt as parseBootstrapMarker, E as formatResourceLine, En as StackTerminationProtectionError, Et as getBootstrapMarkerKey, F as clearOnUpdateRemoval, Ft as AssetManifestLoader, G as getAccountInfo, Gt as resolveStateBucketWithDefault, H as isTerminationProtectionPropagationError, Ht as resolveAutoAssetStorage, I as ProviderRegistry, It as getDockerImageBySourceHash, J as normalizeAwsTagsToCfn, Jt as stateBucketExistenceConfirmed, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefaultAndSource, L as findActionableSilentDrops, Lt as Synthesizer, M as yellow, Mn as withErrorHandling, Mt as getDockerCmd, N as IAMRoleProvider, Nt as runDockerForeground, O as cyan, Ot as validateAssetBucketName, P as collectInlinePolicyNamesManagedBySiblings, Pt as runDockerStreaming, Q as readConfigString, Qt as MIGRATE_TMP_PREFIX, R as findSilentDropProperties, Rt as synthesisStatusMessage, S as extractDeploymentEventError, Sn as ProvisioningError, St as rewriteTemplateAssetReferences, T as renderStatefulReason, Tn as StackHasActiveImportsError, Tt as ensureAssetStorage, U as IntrinsicFunctionResolver, Ut as resolveCaptureObservedState, V as disableInstanceApiTermination, Vt as resolveApp, W as cfnRefValueFromPhysicalId, Wt as resolveSkipPrefix, X as assertRegionMatch, Xt as CFN_TEMPLATE_BODY_LIMIT, Y as resolveExplicitPhysicalId, Yt as warnDeprecatedNoPrefixCliFlag, Z as configStringRefusal, Zt as CFN_TEMPLATE_URL_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalStartServiceError, _t as stringifyValue, a as DeploymentEventsStore, an as resolveBucketRegion, at as DiffCalculator, b as unsupportedFinalSnapshotError, bn as NestedStackChildDirectDestroyError, bt as createAssetRedirectResolver, c as replayFailedOperations, cn as resetAwsClients, ct as isRetryableTransientError, d as IMPLICIT_DELETE_DEPENDENCIES, dn as CdkdError, dt as TemplateParser, en as uploadCfnTemplate, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as LockManager, g as ccRoutedFinalSnapshotError, gn as LocalMigrateError, gt as AssetPublisher, h as buildFinalSnapshotIdentifier, hn as LocalInvokeBuildError$1, ht as shouldRetainResource, i as DeploymentEventsReader, it as applyRoleArnIfSet, j as red, jn as normalizeAwsError, jt as formatDockerLoginError, k as gray, kt as validateContainerRepoName, l as replayRollback, ln as setAwsClients, lt as isThrottlingError, m as PRE_DELETE_SNAPSHOT_TYPES, mn as DeployCancelledError, mt as rebuildClientForBucketRegion, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AssemblyReader, nt as requireConfigString, o as planFailedOps, on as AwsClients, ot as describeTypeWithThrottleRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as S3StateBackend, q as WAFv2WebACLProvider, qt as resolveUseCdkBootstrapAssets, r as DeployEngine, rn as processStackMessages, rt as derivePartitionAndUrlSuffix, s as planRollback, sn as getAwsClients, st as withRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as expectedOwnerParam, tt as requireConfigObject, u as withResourceDeadline, ut as DagBuilder, v as isFinalSnapshotError, vt as WorkGraph, w as isStatefulRecreateTargetSync, wn as ResourceUpdateNotSupportedError, wt as BOOTSTRAP_MARKER_PREFIX, x as makeCanonicalizePropertiesFn, xn as PartialFailureError, xt as loadPublishableAssetManifest, y as refusesFinalSnapshot, yn as MissingCdkCliError, yt as buildAssetRedirectMap, z as CloudControlProvider, zt as getDefaultStateBucketName } from "./deploy-engine-CfnMSwyx.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CgQFJdPo.js";
+import { t as ASGProvider } from "./asg-provider-B1pHGT_X.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12194,6 +12194,43 @@ function packCompositeId(resourceType, logicalId, segments, options) {
 	else throw new ProvisioningError(refusal, resourceType, logicalId);
 	return segments.map((segment) => String(segment.value)).join("|");
 }
+/** Render the expected id shape, e.g. `<databaseName>|<tableName>`. */
+function formatShape(segments) {
+	return segments.map((segment) => `<${segment}>`).join("|");
+}
+/**
+* The message EVERY malformed-composite-id decode site emits (issue
+* [#1657](https://github.com/go-to-k/cdkd/issues/1657)).
+*
+* ## Why one builder
+*
+* Roughly half the decode sites stated the expected shape and half only echoed
+* the value back, and the format is documented nowhere else — so on the silent
+* half the message was the user's only possible route to the answer and it did
+* not carry it. Routing the sites that already got it right through the same
+* builder is what stops them drifting back.
+*
+* ## This is a WORDING fix, not an acceptance change
+*
+* Each caller keeps its own split-and-guard exactly as it was. The arities
+* genuinely differ (some sites accept AT LEAST N segments, some destructure the
+* first N and tolerate extras — the #1672 ambiguity, tracked separately), and
+* folding them into one predicate here would silently change which ids deploy.
+*
+* ## The `skipping` variant
+*
+* On the DELETE path the established policy is warn-and-continue, so a
+* malformed record leaves the AWS resource ALIVE while `cdkd destroy` reports
+* success. That policy is not changed here — but the warning now says what the
+* skip costs, because an orphan the user is never told about is one they cannot
+* go and delete.
+*/
+function compositeIdFormatMessage(format, logicalId, physicalId, options) {
+	const accepted = format.alsoAccepts ? `"${formatShape(format.segments)}" or ${format.alsoAccepts}` : `"${formatShape(format.segments)}"`;
+	const head = `Invalid physicalId format for ${format.label} ${logicalId}: expected ${accepted}, got "${physicalId}"`;
+	if (!options?.skipping) return head;
+	return `${head}. Skipping the delete — the AWS resource is LEFT IN PLACE and cdkd will report this delete as successful, so delete it by hand (or repair the id in state.json and re-run) if it still exists. NOTE this arm is reached from cdkd destroy AND from the deploy engine's replacement / rollback deletes.`;
+}
 
 //#endregion
 //#region src/provisioning/providers/lambda-event-invoke-config-provider.ts
@@ -19200,6 +19237,32 @@ function canonicalizeIpProtocolValue(value) {
 
 //#endregion
 //#region src/provisioning/providers/ec2-provider.ts
+/** Shapes of the four `AWS::EC2::*` composite physicalIds (issue #1657). */
+const EC2_VPC_GATEWAY_ATTACHMENT_ID_FORMAT = {
+	label: "VPCGatewayAttachment",
+	segments: ["internetGatewayId", "vpcId"]
+};
+const EC2_ROUTE_ID_FORMAT = {
+	label: "Route",
+	segments: ["routeTableId", "destination"]
+};
+const EC2_SG_INGRESS_ID_FORMAT = {
+	label: "SecurityGroupIngress",
+	segments: [
+		"groupId",
+		"ipProtocol",
+		"fromPort",
+		"toPort"
+	]
+};
+const EC2_NETWORK_ACL_ENTRY_ID_FORMAT = {
+	label: "NetworkAclEntry",
+	segments: [
+		"networkAclId",
+		"ruleNumber",
+		"egress"
+	]
+};
 /**
 * The `AWS::EC2::Route` destination keys, in CloudFormation's own precedence
 * order — which is also the order `createRoute`'s
@@ -20092,7 +20155,7 @@ var EC2Provider = class {
 	async deleteVpcGatewayAttachment(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting VPCGatewayAttachment ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 2) throw new ProvisioningError(`Invalid physicalId format for VPCGatewayAttachment ${logicalId}: expected "IGW|VpcId", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 2) throw new ProvisioningError(compositeIdFormatMessage(EC2_VPC_GATEWAY_ATTACHMENT_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [internetGatewayId, vpcId] = parts;
 		try {
 			await this.withDependencyViolationRetry(() => this.ec2Client.send(new DetachInternetGatewayCommand({
@@ -20285,7 +20348,7 @@ var EC2Provider = class {
 	async deleteRoute(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting Route ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 2) throw new ProvisioningError(`Invalid physicalId format for Route ${logicalId}: expected "RouteTableId|Destination", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 2) throw new ProvisioningError(compositeIdFormatMessage(EC2_ROUTE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [routeTableId, destination] = parts;
 		try {
 			const destinationParam = destination?.includes(":") ? { DestinationIpv6CidrBlock: destination } : destination?.startsWith("pl-") ? { DestinationPrefixListId: destination } : { DestinationCidrBlock: destination };
@@ -20629,7 +20692,7 @@ var EC2Provider = class {
 	async deleteSecurityGroupIngress(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting SecurityGroupIngress ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 4) throw new ProvisioningError(`Invalid physicalId format for SecurityGroupIngress ${logicalId}: expected "GroupId|Protocol|FromPort|ToPort", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 4) throw new ProvisioningError(compositeIdFormatMessage(EC2_SG_INGRESS_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [groupId, ipProtocol, fromPortStr, toPortStr] = parts;
 		const ipPermission = properties ? this.buildIpPermission(properties) : {
 			IpProtocol: ipProtocol,
@@ -21319,7 +21382,7 @@ var EC2Provider = class {
 		this.logger.debug(`Deleting NetworkAclEntry ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
 		if (parts.length < 3) {
-			this.logger.warn(`Invalid NetworkAclEntry physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(EC2_NETWORK_ACL_ENTRY_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		const networkAclId = parts[0];
@@ -21629,7 +21692,7 @@ var EC2Provider = class {
 	* Skipped (return `undefined`, falls through to the comparator's
 	* "unsupported" outcome):
 	*  - **AWS::EC2::VPCGatewayAttachment**: physical id is
-	*    `IGW|VpcId`. The two ids are immutable inputs to the SDK call;
+	*    `<internetGatewayId>|<vpcId>`. The two ids are immutable inputs to the SDK call;
 	*    drift detection on this resource has no useful signal beyond
 	*    existence verification (which the user can do via the parent IGW
 	*    / VPC drift report).
@@ -22321,6 +22384,15 @@ function isDefaultEgressRule(rule) {
 
 //#endregion
 //#region src/provisioning/providers/apigateway-provider.ts
+/** Shape of an `AWS::ApiGateway::Method` physicalId (issue #1657). */
+const APIGW_METHOD_ID_FORMAT = {
+	label: "API Gateway Method",
+	segments: [
+		"restApiId",
+		"resourceId",
+		"httpMethod"
+	]
+};
 /**
 * AWS API Gateway Provider
 *
@@ -23306,7 +23378,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	async updateMethod(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating API Gateway Method ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 3) throw new ProvisioningError(`Invalid physicalId format for API Gateway Method ${logicalId}: expected "restApiId|resourceId|httpMethod", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 3) throw new ProvisioningError(compositeIdFormatMessage(APIGW_METHOD_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [restApiId, resourceId, httpMethod] = parts;
 		const patchOperations = [];
 		for (const { key, path } of [
@@ -23380,7 +23452,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	async deleteMethod(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting API Gateway Method ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 3) throw new ProvisioningError(`Invalid physicalId format for API Gateway Method ${logicalId}: expected "restApiId|resourceId|httpMethod", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 3) throw new ProvisioningError(compositeIdFormatMessage(APIGW_METHOD_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [restApiId, resourceId, httpMethod] = parts;
 		try {
 			await this.apiGatewayClient.send(new DeleteMethodCommand({
@@ -37181,6 +37253,23 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 
 //#endregion
 //#region src/provisioning/providers/appsync-provider.ts
+/** Shapes of the three `AWS::AppSync::*` child composite physicalIds (issue #1657). */
+const APPSYNC_DATASOURCE_ID_FORMAT = {
+	label: "AppSync DataSource",
+	segments: ["apiId", "name"]
+};
+const APPSYNC_RESOLVER_ID_FORMAT = {
+	label: "AppSync Resolver",
+	segments: [
+		"apiId",
+		"typeName",
+		"fieldName"
+	]
+};
+const APPSYNC_APIKEY_ID_FORMAT = {
+	label: "AppSync ApiKey",
+	segments: ["apiId", "apiKeyId"]
+};
 const MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES = [
 	"UserPoolConfig",
 	"OpenIDConnectConfig",
@@ -37651,7 +37740,7 @@ var AppSyncProvider = class {
 			if (next !== void 0 && prev !== void 0 && next !== prev) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS AppSync DataSource.${field} is immutable — destroy + redeploy to change`);
 		}
 		const [apiId, name] = physicalId.split("|");
-		if (!apiId || !name) throw new ProvisioningError(`Invalid DataSource physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (!apiId || !name) throw new ProvisioningError(compositeIdFormatMessage(APPSYNC_DATASOURCE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const type = properties["Type"] ?? previousProperties["Type"];
 		if (![
 			"Description",
@@ -37689,7 +37778,7 @@ var AppSyncProvider = class {
 			if (next !== void 0 && prev !== void 0 && next !== prev) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS AppSync Resolver.${field} is immutable — destroy + redeploy to change`);
 		}
 		const parts = physicalId.split("|");
-		if (parts.length < 3) throw new ProvisioningError(`Invalid Resolver physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (parts.length < 3) throw new ProvisioningError(compositeIdFormatMessage(APPSYNC_RESOLVER_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [apiId, typeName, fieldName] = parts;
 		if (![
 			"DataSourceName",
@@ -37723,7 +37812,7 @@ var AppSyncProvider = class {
 	async updateApiKey(logicalId, physicalId, resourceType, properties, previousProperties) {
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS AppSync ApiKey.ApiId is immutable — destroy + redeploy to change");
 		const [apiId, apiKeyId] = physicalId.split("|");
-		if (!apiId || !apiKeyId) throw new ProvisioningError(`Invalid ApiKey physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (!apiId || !apiKeyId) throw new ProvisioningError(compositeIdFormatMessage(APPSYNC_APIKEY_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const newDesc = properties["Description"];
 		const oldDesc = previousProperties["Description"];
 		const newExp = properties["Expires"];
@@ -38429,7 +38518,7 @@ var AppSyncProvider = class {
 		this.logger.debug(`Deleting DataSource ${logicalId}: ${physicalId}`);
 		const [apiId, name] = physicalId.split("|");
 		if (!apiId || !name) {
-			this.logger.warn(`Invalid DataSource physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(APPSYNC_DATASOURCE_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		try {
@@ -38492,7 +38581,7 @@ var AppSyncProvider = class {
 		this.logger.debug(`Deleting Resolver ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
 		if (parts.length < 3) {
-			this.logger.warn(`Invalid Resolver physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(APPSYNC_RESOLVER_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		const [apiId, typeName, fieldName] = parts;
@@ -38548,7 +38637,7 @@ var AppSyncProvider = class {
 		this.logger.debug(`Deleting ApiKey ${logicalId}: ${physicalId}`);
 		const [apiId, apiKeyId] = physicalId.split("|");
 		if (!apiId || !apiKeyId) {
-			this.logger.warn(`Invalid ApiKey physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(APPSYNC_APIKEY_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		try {
@@ -38935,6 +39024,11 @@ var AppSyncProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/glue-provider.ts
+/** Shape of an `AWS::Glue::Table` physicalId, for every decode site (issue #1657). */
+const GLUE_TABLE_ID_FORMAT = {
+	label: "Glue Table",
+	segments: ["databaseName", "tableName"]
+};
 /**
 * Read a template-borne value that is about to be forwarded to a Glue read
 * API as a string.
@@ -39232,7 +39326,7 @@ var GlueProvider = class {
 	async updateTable(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Glue Table ${logicalId}: ${physicalId}`);
 		const [databaseName, tableName] = physicalId.split("|");
-		if (!databaseName || !tableName) throw new ProvisioningError(`Invalid Glue Table physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (!databaseName || !tableName) throw new ProvisioningError(compositeIdFormatMessage(GLUE_TABLE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const tableInput = properties["TableInput"];
 		if (!tableInput) throw new ProvisioningError(`TableInput is required for Glue Table update ${logicalId}`, resourceType, logicalId, physicalId);
 		const catalogId = properties["CatalogId"];
@@ -39269,7 +39363,7 @@ var GlueProvider = class {
 		this.logger.debug(`Deleting Glue Table ${logicalId}: ${physicalId}`);
 		const [databaseName, tableName] = physicalId.split("|");
 		if (!databaseName || !tableName) {
-			this.logger.warn(`Invalid Glue Table physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(GLUE_TABLE_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		const target = deleteCatalogId(properties);
@@ -50232,6 +50326,20 @@ var S3DirectoryBucketProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/s3-tables-provider.ts
+/** Shapes of the two `AWS::S3Tables::*` composite physicalIds (issue #1657). */
+const S3_TABLES_NAMESPACE_ID_FORMAT = {
+	label: "S3 Tables Namespace",
+	segments: ["tableBucketARN", "namespace"]
+};
+const S3_TABLES_TABLE_ID_FORMAT = {
+	label: "S3 Tables Table",
+	segments: [
+		"tableBucketARN",
+		"namespace",
+		"name"
+	],
+	alsoAccepts: "a table ARN"
+};
 /**
 * Parse cdkd's composite namespace physicalId `<tableBucketARN>|<namespace>`.
 *
@@ -50478,7 +50586,7 @@ var S3TablesProvider = class {
 	async deleteNamespace(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting S3 Tables Namespace ${logicalId}: ${physicalId}`);
 		const [tableBucketARN, namespaceName] = physicalId.split("|");
-		if (!tableBucketARN || !namespaceName) throw new ProvisioningError(`Invalid physical ID format for S3 Tables Namespace ${logicalId}: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (!tableBucketARN || !namespaceName) throw new ProvisioningError(compositeIdFormatMessage(S3_TABLES_NAMESPACE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		try {
 			await this.getClient().send(new DeleteNamespaceCommand$1({
 				tableBucketARN,
@@ -50892,7 +51000,7 @@ var S3TablesProvider = class {
 			this.logger.debug(`S3 Tables Table ${physicalId} does not exist, skipping deletion`);
 			return;
 		}
-		if (resolved === "unparseable") throw new ProvisioningError(`Invalid physical ID format for S3 Tables Table ${logicalId}: ${physicalId} (expected '<tableBucketARN>|<namespace>|<name>' or a table ARN)`, resourceType, logicalId, physicalId);
+		if (resolved === "unparseable") throw new ProvisioningError(compositeIdFormatMessage(S3_TABLES_TABLE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const { tableBucketARN, namespace, name } = resolved;
 		try {
 			await this.getClient().send(new DeleteTableCommand$2({
@@ -51013,7 +51121,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resolvedParts = await this.resolveTableParts(physicalId);
 		if (resolvedParts === "not-found") throw new ProvisioningError(`applyTableTagsDiff: table '${physicalId}' no longer exists (state is out of sync) — refusing to silently drop the tag update`, resourceType, logicalId, physicalId);
-		if (resolvedParts === "unparseable") throw new ProvisioningError(`applyTableTagsDiff: cannot derive table ARN from physicalId '${physicalId}' (expected '<bucketArn>|<namespace>|<name>' or a table ARN) — refusing to silently drop the tag update`, resourceType, logicalId, physicalId);
+		if (resolvedParts === "unparseable") throw new ProvisioningError(`applyTableTagsDiff: ${compositeIdFormatMessage(S3_TABLES_TABLE_ID_FORMAT, logicalId, physicalId)}. Cannot derive the table ARN for the tag update, and refusing to silently drop it.`, resourceType, logicalId, physicalId);
 		const { tableBucketARN, namespace, name } = resolvedParts;
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
@@ -73857,7 +73965,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.15");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.16");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;