@go-to-k/cdkd 0.281.15 → 0.281.17

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as replayWarn, $t as findLargeInlineResources, A as green, At as buildDockerImage, B as slowCcOperationTimeoutMs, Bt as getLegacyStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceTimeoutError, Ct as AssetModeResolver, D as bold, Dt as parseBootstrapMarker, E as formatResourceLine, En as StackTerminationProtectionError, Et as getBootstrapMarkerKey, F as clearOnUpdateRemoval, Ft as AssetManifestLoader, G as getAccountInfo, Gt as resolveStateBucketWithDefault, H as isTerminationProtectionPropagationError, Ht as resolveAutoAssetStorage, I as ProviderRegistry, It as getDockerImageBySourceHash, J as normalizeAwsTagsToCfn, Jt as stateBucketExistenceConfirmed, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefaultAndSource, L as findActionableSilentDrops, Lt as Synthesizer, M as yellow, Mn as withErrorHandling, Mt as getDockerCmd, N as IAMRoleProvider, Nt as runDockerForeground, O as cyan, Ot as validateAssetBucketName, P as collectInlinePolicyNamesManagedBySiblings, Pt as runDockerStreaming, Q as readConfigString, Qt as MIGRATE_TMP_PREFIX, R as findSilentDropProperties, Rt as synthesisStatusMessage, S as extractDeploymentEventError, Sn as ProvisioningError, St as rewriteTemplateAssetReferences, T as renderStatefulReason, Tn as StackHasActiveImportsError, Tt as ensureAssetStorage, U as IntrinsicFunctionResolver, Ut as resolveCaptureObservedState, V as disableInstanceApiTermination, Vt as resolveApp, W as cfnRefValueFromPhysicalId, Wt as resolveSkipPrefix, X as assertRegionMatch, Xt as CFN_TEMPLATE_BODY_LIMIT, Y as resolveExplicitPhysicalId, Yt as warnDeprecatedNoPrefixCliFlag, Z as configStringRefusal, Zt as CFN_TEMPLATE_URL_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalStartServiceError, _t as stringifyValue, a as DeploymentEventsStore, an as resolveBucketRegion, at as DiffCalculator, b as unsupportedFinalSnapshotError, bn as NestedStackChildDirectDestroyError, bt as createAssetRedirectResolver, c as replayFailedOperations, cn as resetAwsClients, ct as isRetryableTransientError, d as IMPLICIT_DELETE_DEPENDENCIES, dn as CdkdError, dt as TemplateParser, en as uploadCfnTemplate, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as LockManager, g as ccRoutedFinalSnapshotError, gn as LocalMigrateError, gt as AssetPublisher, h as buildFinalSnapshotIdentifier, hn as LocalInvokeBuildError$1, ht as shouldRetainResource, i as DeploymentEventsReader, it as applyRoleArnIfSet, j as red, jn as normalizeAwsError, jt as formatDockerLoginError, k as gray, kt as validateContainerRepoName, l as replayRollback, ln as setAwsClients, lt as isThrottlingError, m as PRE_DELETE_SNAPSHOT_TYPES, mn as DeployCancelledError, mt as rebuildClientForBucketRegion, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AssemblyReader, nt as requireConfigString, o as planFailedOps, on as AwsClients, ot as describeTypeWithThrottleRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as S3StateBackend, q as WAFv2WebACLProvider, qt as resolveUseCdkBootstrapAssets, r as DeployEngine, rn as processStackMessages, rt as derivePartitionAndUrlSuffix, s as planRollback, sn as getAwsClients, st as withRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as expectedOwnerParam, tt as requireConfigObject, u as withResourceDeadline, ut as DagBuilder, v as isFinalSnapshotError, vt as WorkGraph, w as isStatefulRecreateTargetSync, wn as ResourceUpdateNotSupportedError, wt as BOOTSTRAP_MARKER_PREFIX, x as makeCanonicalizePropertiesFn, xn as PartialFailureError, xt as loadPublishableAssetManifest, y as refusesFinalSnapshot, yn as MissingCdkCliError, yt as buildAssetRedirectMap, z as CloudControlProvider, zt as getDefaultStateBucketName } from "./deploy-engine-B2MDP-jK.js";
+import { $ as replayWarn, $t as findLargeInlineResources, A as green, At as buildDockerImage, B as slowCcOperationTimeoutMs, Bt as getLegacyStateBucketName, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceTimeoutError, Ct as AssetModeResolver, D as bold, Dt as parseBootstrapMarker, E as formatResourceLine, En as StackTerminationProtectionError, Et as getBootstrapMarkerKey, F as clearOnUpdateRemoval, Ft as AssetManifestLoader, G as getAccountInfo, Gt as resolveStateBucketWithDefault, H as isTerminationProtectionPropagationError, Ht as resolveAutoAssetStorage, I as ProviderRegistry, It as getDockerImageBySourceHash, J as normalizeAwsTagsToCfn, Jt as stateBucketExistenceConfirmed, K as refStateLookupFromResource, Kt as resolveStateBucketWithDefaultAndSource, L as findActionableSilentDrops, Lt as Synthesizer, M as yellow, Mn as withErrorHandling, Mt as getDockerCmd, N as IAMRoleProvider, Nt as runDockerForeground, O as cyan, Ot as validateAssetBucketName, P as collectInlinePolicyNamesManagedBySiblings, Pt as runDockerStreaming, Q as readConfigString, Qt as MIGRATE_TMP_PREFIX, R as findSilentDropProperties, Rt as synthesisStatusMessage, S as extractDeploymentEventError, Sn as ProvisioningError, St as rewriteTemplateAssetReferences, T as renderStatefulReason, Tn as StackHasActiveImportsError, Tt as ensureAssetStorage, U as IntrinsicFunctionResolver, Ut as resolveCaptureObservedState, V as disableInstanceApiTermination, Vt as resolveApp, W as cfnRefValueFromPhysicalId, Wt as resolveSkipPrefix, X as assertRegionMatch, Xt as CFN_TEMPLATE_BODY_LIMIT, Y as resolveExplicitPhysicalId, Yt as warnDeprecatedNoPrefixCliFlag, Z as configStringRefusal, Zt as CFN_TEMPLATE_URL_LIMIT, _ as createPreDeleteFinalSnapshot, _n as LocalStartServiceError, _t as stringifyValue, a as DeploymentEventsStore, an as resolveBucketRegion, at as DiffCalculator, b as unsupportedFinalSnapshotError, bn as NestedStackChildDirectDestroyError, bt as createAssetRedirectResolver, c as replayFailedOperations, cn as resetAwsClients, ct as isRetryableTransientError, d as IMPLICIT_DELETE_DEPENDENCIES, dn as CdkdError, dt as TemplateParser, en as uploadCfnTemplate, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as LockManager, g as ccRoutedFinalSnapshotError, gn as LocalMigrateError, gt as AssetPublisher, h as buildFinalSnapshotIdentifier, hn as LocalInvokeBuildError$1, ht as shouldRetainResource, i as DeploymentEventsReader, it as applyRoleArnIfSet, j as red, jn as normalizeAwsError, jt as formatDockerLoginError, k as gray, kt as validateContainerRepoName, l as replayRollback, ln as setAwsClients, lt as isThrottlingError, m as PRE_DELETE_SNAPSHOT_TYPES, mn as DeployCancelledError, mt as rebuildClientForBucketRegion, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AssemblyReader, nt as requireConfigString, o as planFailedOps, on as AwsClients, ot as describeTypeWithThrottleRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as S3StateBackend, q as WAFv2WebACLProvider, qt as resolveUseCdkBootstrapAssets, r as DeployEngine, rn as processStackMessages, rt as derivePartitionAndUrlSuffix, s as planRollback, sn as getAwsClients, st as withRetry, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as expectedOwnerParam, tt as requireConfigObject, u as withResourceDeadline, ut as DagBuilder, v as isFinalSnapshotError, vt as WorkGraph, w as isStatefulRecreateTargetSync, wn as ResourceUpdateNotSupportedError, wt as BOOTSTRAP_MARKER_PREFIX, x as makeCanonicalizePropertiesFn, xn as PartialFailureError, xt as loadPublishableAssetManifest, y as refusesFinalSnapshot, yn as MissingCdkCliError, yt as buildAssetRedirectMap, z as CloudControlProvider, zt as getDefaultStateBucketName } from "./deploy-engine-B6DcyQpS.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CgQFJdPo.js";
+import { t as ASGProvider } from "./asg-provider-MpqWnvQI.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12194,6 +12194,43 @@ function packCompositeId(resourceType, logicalId, segments, options) {
 	else throw new ProvisioningError(refusal, resourceType, logicalId);
 	return segments.map((segment) => String(segment.value)).join("|");
 }
+/** Render the expected id shape, e.g. `<databaseName>|<tableName>`. */
+function formatShape(segments) {
+	return segments.map((segment) => `<${segment}>`).join("|");
+}
+/**
+* The message EVERY malformed-composite-id decode site emits (issue
+* [#1657](https://github.com/go-to-k/cdkd/issues/1657)).
+*
+* ## Why one builder
+*
+* Roughly half the decode sites stated the expected shape and half only echoed
+* the value back, and the format is documented nowhere else — so on the silent
+* half the message was the user's only possible route to the answer and it did
+* not carry it. Routing the sites that already got it right through the same
+* builder is what stops them drifting back.
+*
+* ## This is a WORDING fix, not an acceptance change
+*
+* Each caller keeps its own split-and-guard exactly as it was. The arities
+* genuinely differ (some sites accept AT LEAST N segments, some destructure the
+* first N and tolerate extras — the #1672 ambiguity, tracked separately), and
+* folding them into one predicate here would silently change which ids deploy.
+*
+* ## The `skipping` variant
+*
+* On the DELETE path the established policy is warn-and-continue, so a
+* malformed record leaves the AWS resource ALIVE while `cdkd destroy` reports
+* success. That policy is not changed here — but the warning now says what the
+* skip costs, because an orphan the user is never told about is one they cannot
+* go and delete.
+*/
+function compositeIdFormatMessage(format, logicalId, physicalId, options) {
+	const accepted = format.alsoAccepts ? `"${formatShape(format.segments)}" or ${format.alsoAccepts}` : `"${formatShape(format.segments)}"`;
+	const head = `Invalid physicalId format for ${format.label} ${logicalId}: expected ${accepted}, got "${physicalId}"`;
+	if (!options?.skipping) return head;
+	return `${head}. Skipping the delete — the AWS resource is LEFT IN PLACE and cdkd will report this delete as successful, so delete it by hand (or repair the id in state.json and re-run) if it still exists. NOTE this arm is reached from cdkd destroy AND from the deploy engine's replacement / rollback deletes.`;
+}
 
 //#endregion
 //#region src/provisioning/providers/lambda-event-invoke-config-provider.ts
@@ -14219,13 +14256,17 @@ var DynamoDBGlobalTableProvider = class {
 		if (!attributeDefinitions) throw new ProvisioningError(`AttributeDefinitions is required for DynamoDB GlobalTable ${logicalId}`, resourceType, logicalId);
 		let billingMode;
 		let billingModeSubstituted = false;
+		let billingModeAbsentOnReplay = false;
 		try {
 			const billingReplayWarn = replayWarn(this.logger, context).onUnusable;
 			billingMode = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", billingReplayWarn ? { onUnusable: (message) => {
 				billingModeSubstituted = true;
 				billingReplayWarn(message);
 			} } : {});
-			if (billingReplayWarn && properties["BillingMode"] === void 0) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the state record declares no BillingMode, so this replay creates the table PAY_PER_REQUEST. If it was PROVISIONED, set the mode in the template and redeploy.`);
+			if (billingReplayWarn && properties["BillingMode"] === void 0) {
+				billingModeAbsentOnReplay = true;
+				this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the state record declares no BillingMode, so this replay creates the table PAY_PER_REQUEST. If it was PROVISIONED, set the mode in the template and redeploy.`);
+			}
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
@@ -14240,10 +14281,11 @@ var DynamoDBGlobalTableProvider = class {
 		const diagnostics = [];
 		if (billingMode === "PROVISIONED") createParams.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion, "min", diagnostics);
 		let effectiveProperties;
-		if (billingModeSubstituted) effectiveProperties = {
+		if (billingModeSubstituted) effectiveProperties = stripProvisionedCapacityKeys({
 			...properties,
 			BillingMode: billingMode
-		};
+		});
+		else if (billingModeAbsentOnReplay) effectiveProperties = stripProvisionedCapacityKeys(properties);
 		const streamSpecInput = properties["StreamSpecification"];
 		const needsStream = replicas.some((r) => r["Region"] !== currentRegion) || replicas.length > 1;
 		if (streamSpecInput != null) {
@@ -14274,12 +14316,28 @@ var DynamoDBGlobalTableProvider = class {
 			};
 		}
 		let sdkIndexes;
+		let indexesOmitted = false;
 		try {
 			const onUnusableCreateIndexes = replayWarn(this.logger, context).onUnusable;
-			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics, onUnusableCreateIndexes && ((message) => onUnusableCreateIndexes(`${message} Omitting the malformed block, so this create carries NO indexes; the same value is REFUSED on a template-path create`)));
+			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics, onUnusableCreateIndexes && ((message) => {
+				indexesOmitted = true;
+				onUnusableCreateIndexes(`${message} Omitting the malformed block, so this create carries NO indexes; the same value is REFUSED on a template-path create`);
+			}));
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
+		if (indexesOmitted) {
+			effectiveProperties = { ...effectiveProperties ?? properties };
+			delete effectiveProperties["GlobalSecondaryIndexes"];
+			const replicasForOmit = effectiveProperties["Replicas"];
+			if (Array.isArray(replicasForOmit)) effectiveProperties["Replicas"] = replicasForOmit.map((entry) => {
+				const replica = asRecord$1(entry);
+				if (!replica || replica["Region"] !== currentRegion) return entry;
+				const copy = { ...replica };
+				delete copy["GlobalSecondaryIndexes"];
+				return copy;
+			});
+		}
 		if (sdkIndexes.length > 0) createParams.GlobalSecondaryIndexes = sdkIndexes;
 		if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
 		if (properties["SSESpecification"]) {
@@ -16425,6 +16483,82 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 	return result;
 }
 /**
+* Remove every PROVISIONED-only capacity member from a desired-property bag
+* (issue #1726).
+*
+* Used by `create()`'s `BillingMode` warn-and-SUBSTITUTE arm and by its ABSENT
+* sibling: whenever the create resolves to `PAY_PER_REQUEST` on a bag that was
+* not written for it, the same create skips `createParams.ProvisionedThroughput`
+* and every per-index / per-replica provisioned member is dropped before the
+* call (each of the reads below is gated on `billingMode === 'PROVISIONED'`).
+* Recording those keys describes capacity AWS never received.
+*
+* The set is the intersection of two questions, and BOTH are needed — taking
+* either alone is what the review of the first cut corrected:
+*
+* - **what could not have been SENT** — every member `toSdkGlobalSecondaryIndexes`
+*   / `toSdkReplicaThroughputOverrides` read behind a PROVISIONED gate, which
+*   includes the two legacy SDK-shaped spellings a pre-#1387 cdkd wrote into
+*   state (`GlobalSecondaryIndexes[].ProvisionedThroughput`,
+*   `Replicas[].ProvisionedThroughputOverride`). A state replay is exactly that
+*   population, so leaving them out made the strip narrower than its own rule.
+* - **what `readCurrentState` can REPORT under the new mode** — the top-level
+*   `WriteProvisionedThroughputSettings` emits `{}` for an on-demand table and
+*   every other member here is omitted entirely, so a surviving key is a record
+*   the readback can never match.
+*
+* DELIBERATELY NOT removed: every `*OnDemand*` member. `OnDemandThroughput` is
+* attached to `CreateTable` precisely when the mode is not PROVISIONED, so those
+* WERE sent — a blanket "strip anything throughput-shaped" would record a loss
+* that did not happen, and a unit row plus an integ phase fence exactly that.
+*
+* Pure and non-mutating at every level — the caller's bag is
+* `previousState.properties` on the replay path and the rollback executor
+* spreads the answer shallowly, so an in-place edit would corrupt a record the
+* caller still holds.
+*/
+function stripProvisionedCapacityKeys(properties) {
+	const result = { ...properties };
+	delete result["WriteProvisionedThroughputSettings"];
+	const indexes = result["GlobalSecondaryIndexes"];
+	if (Array.isArray(indexes)) result["GlobalSecondaryIndexes"] = indexes.map((entry) => {
+		const gsi = asRecord$1(entry);
+		if (!gsi) return entry;
+		const copy = { ...gsi };
+		delete copy["WriteProvisionedThroughputSettings"];
+		delete copy["ReadProvisionedThroughputSettings"];
+		delete copy["ProvisionedThroughput"];
+		return copy;
+	});
+	const replicas = result["Replicas"];
+	if (Array.isArray(replicas)) result["Replicas"] = replicas.map((entry) => {
+		const replica = asRecord$1(entry);
+		if (!replica) return entry;
+		const copy = { ...replica };
+		delete copy["ReadProvisionedThroughputSettings"];
+		delete copy["ProvisionedThroughputOverride"];
+		const replicaIndexes = copy["GlobalSecondaryIndexes"];
+		if (Array.isArray(replicaIndexes)) {
+			const kept = replicaIndexes.map((indexEntry) => {
+				const gsi = asRecord$1(indexEntry);
+				if (!gsi) return indexEntry;
+				const indexCopy = { ...gsi };
+				delete indexCopy["ReadProvisionedThroughputSettings"];
+				delete indexCopy["ProvisionedThroughputOverride"];
+				return indexCopy;
+			}).filter((entry) => {
+				const gsi = asRecord$1(entry);
+				if (!gsi) return true;
+				return Object.keys(gsi).some((k) => k !== "IndexName");
+			});
+			if (kept.length > 0) copy["GlobalSecondaryIndexes"] = kept;
+			else delete copy["GlobalSecondaryIndexes"];
+		}
+		return copy;
+	});
+	return result;
+}
+/**
 * True when a CFn sub-object is nothing but an unresolved intrinsic
 * (`{"Fn::If": […]}` / `{"Ref": …}`), i.e. the template DID declare the block
 * but its value could not be resolved to a shape with members.
@@ -19200,6 +19334,32 @@ function canonicalizeIpProtocolValue(value) {
 
 //#endregion
 //#region src/provisioning/providers/ec2-provider.ts
+/** Shapes of the four `AWS::EC2::*` composite physicalIds (issue #1657). */
+const EC2_VPC_GATEWAY_ATTACHMENT_ID_FORMAT = {
+	label: "VPCGatewayAttachment",
+	segments: ["internetGatewayId", "vpcId"]
+};
+const EC2_ROUTE_ID_FORMAT = {
+	label: "Route",
+	segments: ["routeTableId", "destination"]
+};
+const EC2_SG_INGRESS_ID_FORMAT = {
+	label: "SecurityGroupIngress",
+	segments: [
+		"groupId",
+		"ipProtocol",
+		"fromPort",
+		"toPort"
+	]
+};
+const EC2_NETWORK_ACL_ENTRY_ID_FORMAT = {
+	label: "NetworkAclEntry",
+	segments: [
+		"networkAclId",
+		"ruleNumber",
+		"egress"
+	]
+};
 /**
 * The `AWS::EC2::Route` destination keys, in CloudFormation's own precedence
 * order — which is also the order `createRoute`'s
@@ -20092,7 +20252,7 @@ var EC2Provider = class {
 	async deleteVpcGatewayAttachment(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting VPCGatewayAttachment ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 2) throw new ProvisioningError(`Invalid physicalId format for VPCGatewayAttachment ${logicalId}: expected "IGW|VpcId", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 2) throw new ProvisioningError(compositeIdFormatMessage(EC2_VPC_GATEWAY_ATTACHMENT_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [internetGatewayId, vpcId] = parts;
 		try {
 			await this.withDependencyViolationRetry(() => this.ec2Client.send(new DetachInternetGatewayCommand({
@@ -20285,7 +20445,7 @@ var EC2Provider = class {
 	async deleteRoute(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting Route ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 2) throw new ProvisioningError(`Invalid physicalId format for Route ${logicalId}: expected "RouteTableId|Destination", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 2) throw new ProvisioningError(compositeIdFormatMessage(EC2_ROUTE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [routeTableId, destination] = parts;
 		try {
 			const destinationParam = destination?.includes(":") ? { DestinationIpv6CidrBlock: destination } : destination?.startsWith("pl-") ? { DestinationPrefixListId: destination } : { DestinationCidrBlock: destination };
@@ -20629,7 +20789,7 @@ var EC2Provider = class {
 	async deleteSecurityGroupIngress(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting SecurityGroupIngress ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 4) throw new ProvisioningError(`Invalid physicalId format for SecurityGroupIngress ${logicalId}: expected "GroupId|Protocol|FromPort|ToPort", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 4) throw new ProvisioningError(compositeIdFormatMessage(EC2_SG_INGRESS_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [groupId, ipProtocol, fromPortStr, toPortStr] = parts;
 		const ipPermission = properties ? this.buildIpPermission(properties) : {
 			IpProtocol: ipProtocol,
@@ -21319,7 +21479,7 @@ var EC2Provider = class {
 		this.logger.debug(`Deleting NetworkAclEntry ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
 		if (parts.length < 3) {
-			this.logger.warn(`Invalid NetworkAclEntry physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(EC2_NETWORK_ACL_ENTRY_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		const networkAclId = parts[0];
@@ -21629,7 +21789,7 @@ var EC2Provider = class {
 	* Skipped (return `undefined`, falls through to the comparator's
 	* "unsupported" outcome):
 	*  - **AWS::EC2::VPCGatewayAttachment**: physical id is
-	*    `IGW|VpcId`. The two ids are immutable inputs to the SDK call;
+	*    `<internetGatewayId>|<vpcId>`. The two ids are immutable inputs to the SDK call;
 	*    drift detection on this resource has no useful signal beyond
 	*    existence verification (which the user can do via the parent IGW
 	*    / VPC drift report).
@@ -22321,6 +22481,15 @@ function isDefaultEgressRule(rule) {
 
 //#endregion
 //#region src/provisioning/providers/apigateway-provider.ts
+/** Shape of an `AWS::ApiGateway::Method` physicalId (issue #1657). */
+const APIGW_METHOD_ID_FORMAT = {
+	label: "API Gateway Method",
+	segments: [
+		"restApiId",
+		"resourceId",
+		"httpMethod"
+	]
+};
 /**
 * AWS API Gateway Provider
 *
@@ -23306,7 +23475,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	async updateMethod(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating API Gateway Method ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 3) throw new ProvisioningError(`Invalid physicalId format for API Gateway Method ${logicalId}: expected "restApiId|resourceId|httpMethod", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 3) throw new ProvisioningError(compositeIdFormatMessage(APIGW_METHOD_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [restApiId, resourceId, httpMethod] = parts;
 		const patchOperations = [];
 		for (const { key, path } of [
@@ -23380,7 +23549,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	async deleteMethod(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting API Gateway Method ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 3) throw new ProvisioningError(`Invalid physicalId format for API Gateway Method ${logicalId}: expected "restApiId|resourceId|httpMethod", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		if (parts.length !== 3) throw new ProvisioningError(compositeIdFormatMessage(APIGW_METHOD_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [restApiId, resourceId, httpMethod] = parts;
 		try {
 			await this.apiGatewayClient.send(new DeleteMethodCommand({
@@ -37181,6 +37350,23 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 
 //#endregion
 //#region src/provisioning/providers/appsync-provider.ts
+/** Shapes of the three `AWS::AppSync::*` child composite physicalIds (issue #1657). */
+const APPSYNC_DATASOURCE_ID_FORMAT = {
+	label: "AppSync DataSource",
+	segments: ["apiId", "name"]
+};
+const APPSYNC_RESOLVER_ID_FORMAT = {
+	label: "AppSync Resolver",
+	segments: [
+		"apiId",
+		"typeName",
+		"fieldName"
+	]
+};
+const APPSYNC_APIKEY_ID_FORMAT = {
+	label: "AppSync ApiKey",
+	segments: ["apiId", "apiKeyId"]
+};
 const MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES = [
 	"UserPoolConfig",
 	"OpenIDConnectConfig",
@@ -37651,7 +37837,7 @@ var AppSyncProvider = class {
 			if (next !== void 0 && prev !== void 0 && next !== prev) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS AppSync DataSource.${field} is immutable — destroy + redeploy to change`);
 		}
 		const [apiId, name] = physicalId.split("|");
-		if (!apiId || !name) throw new ProvisioningError(`Invalid DataSource physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (!apiId || !name) throw new ProvisioningError(compositeIdFormatMessage(APPSYNC_DATASOURCE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const type = properties["Type"] ?? previousProperties["Type"];
 		if (![
 			"Description",
@@ -37689,7 +37875,7 @@ var AppSyncProvider = class {
 			if (next !== void 0 && prev !== void 0 && next !== prev) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS AppSync Resolver.${field} is immutable — destroy + redeploy to change`);
 		}
 		const parts = physicalId.split("|");
-		if (parts.length < 3) throw new ProvisioningError(`Invalid Resolver physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (parts.length < 3) throw new ProvisioningError(compositeIdFormatMessage(APPSYNC_RESOLVER_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const [apiId, typeName, fieldName] = parts;
 		if (![
 			"DataSourceName",
@@ -37723,7 +37909,7 @@ var AppSyncProvider = class {
 	async updateApiKey(logicalId, physicalId, resourceType, properties, previousProperties) {
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS AppSync ApiKey.ApiId is immutable — destroy + redeploy to change");
 		const [apiId, apiKeyId] = physicalId.split("|");
-		if (!apiId || !apiKeyId) throw new ProvisioningError(`Invalid ApiKey physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (!apiId || !apiKeyId) throw new ProvisioningError(compositeIdFormatMessage(APPSYNC_APIKEY_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const newDesc = properties["Description"];
 		const oldDesc = previousProperties["Description"];
 		const newExp = properties["Expires"];
@@ -38429,7 +38615,7 @@ var AppSyncProvider = class {
 		this.logger.debug(`Deleting DataSource ${logicalId}: ${physicalId}`);
 		const [apiId, name] = physicalId.split("|");
 		if (!apiId || !name) {
-			this.logger.warn(`Invalid DataSource physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(APPSYNC_DATASOURCE_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		try {
@@ -38492,7 +38678,7 @@ var AppSyncProvider = class {
 		this.logger.debug(`Deleting Resolver ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
 		if (parts.length < 3) {
-			this.logger.warn(`Invalid Resolver physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(APPSYNC_RESOLVER_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		const [apiId, typeName, fieldName] = parts;
@@ -38548,7 +38734,7 @@ var AppSyncProvider = class {
 		this.logger.debug(`Deleting ApiKey ${logicalId}: ${physicalId}`);
 		const [apiId, apiKeyId] = physicalId.split("|");
 		if (!apiId || !apiKeyId) {
-			this.logger.warn(`Invalid ApiKey physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(APPSYNC_APIKEY_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		try {
@@ -38935,6 +39121,11 @@ var AppSyncProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/glue-provider.ts
+/** Shape of an `AWS::Glue::Table` physicalId, for every decode site (issue #1657). */
+const GLUE_TABLE_ID_FORMAT = {
+	label: "Glue Table",
+	segments: ["databaseName", "tableName"]
+};
 /**
 * Read a template-borne value that is about to be forwarded to a Glue read
 * API as a string.
@@ -39232,7 +39423,7 @@ var GlueProvider = class {
 	async updateTable(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Glue Table ${logicalId}: ${physicalId}`);
 		const [databaseName, tableName] = physicalId.split("|");
-		if (!databaseName || !tableName) throw new ProvisioningError(`Invalid Glue Table physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (!databaseName || !tableName) throw new ProvisioningError(compositeIdFormatMessage(GLUE_TABLE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const tableInput = properties["TableInput"];
 		if (!tableInput) throw new ProvisioningError(`TableInput is required for Glue Table update ${logicalId}`, resourceType, logicalId, physicalId);
 		const catalogId = properties["CatalogId"];
@@ -39269,7 +39460,7 @@ var GlueProvider = class {
 		this.logger.debug(`Deleting Glue Table ${logicalId}: ${physicalId}`);
 		const [databaseName, tableName] = physicalId.split("|");
 		if (!databaseName || !tableName) {
-			this.logger.warn(`Invalid Glue Table physical ID format: ${physicalId}, skipping`);
+			this.logger.warn(compositeIdFormatMessage(GLUE_TABLE_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return;
 		}
 		const target = deleteCatalogId(properties);
@@ -50232,6 +50423,20 @@ var S3DirectoryBucketProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/s3-tables-provider.ts
+/** Shapes of the two `AWS::S3Tables::*` composite physicalIds (issue #1657). */
+const S3_TABLES_NAMESPACE_ID_FORMAT = {
+	label: "S3 Tables Namespace",
+	segments: ["tableBucketARN", "namespace"]
+};
+const S3_TABLES_TABLE_ID_FORMAT = {
+	label: "S3 Tables Table",
+	segments: [
+		"tableBucketARN",
+		"namespace",
+		"name"
+	],
+	alsoAccepts: "a table ARN"
+};
 /**
 * Parse cdkd's composite namespace physicalId `<tableBucketARN>|<namespace>`.
 *
@@ -50478,7 +50683,7 @@ var S3TablesProvider = class {
 	async deleteNamespace(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting S3 Tables Namespace ${logicalId}: ${physicalId}`);
 		const [tableBucketARN, namespaceName] = physicalId.split("|");
-		if (!tableBucketARN || !namespaceName) throw new ProvisioningError(`Invalid physical ID format for S3 Tables Namespace ${logicalId}: ${physicalId}`, resourceType, logicalId, physicalId);
+		if (!tableBucketARN || !namespaceName) throw new ProvisioningError(compositeIdFormatMessage(S3_TABLES_NAMESPACE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		try {
 			await this.getClient().send(new DeleteNamespaceCommand$1({
 				tableBucketARN,
@@ -50892,7 +51097,7 @@ var S3TablesProvider = class {
 			this.logger.debug(`S3 Tables Table ${physicalId} does not exist, skipping deletion`);
 			return;
 		}
-		if (resolved === "unparseable") throw new ProvisioningError(`Invalid physical ID format for S3 Tables Table ${logicalId}: ${physicalId} (expected '<tableBucketARN>|<namespace>|<name>' or a table ARN)`, resourceType, logicalId, physicalId);
+		if (resolved === "unparseable") throw new ProvisioningError(compositeIdFormatMessage(S3_TABLES_TABLE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
 		const { tableBucketARN, namespace, name } = resolved;
 		try {
 			await this.getClient().send(new DeleteTableCommand$2({
@@ -51013,7 +51218,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resolvedParts = await this.resolveTableParts(physicalId);
 		if (resolvedParts === "not-found") throw new ProvisioningError(`applyTableTagsDiff: table '${physicalId}' no longer exists (state is out of sync) — refusing to silently drop the tag update`, resourceType, logicalId, physicalId);
-		if (resolvedParts === "unparseable") throw new ProvisioningError(`applyTableTagsDiff: cannot derive table ARN from physicalId '${physicalId}' (expected '<bucketArn>|<namespace>|<name>' or a table ARN) — refusing to silently drop the tag update`, resourceType, logicalId, physicalId);
+		if (resolvedParts === "unparseable") throw new ProvisioningError(`applyTableTagsDiff: ${compositeIdFormatMessage(S3_TABLES_TABLE_ID_FORMAT, logicalId, physicalId)}. Cannot derive the table ARN for the tag update, and refusing to silently drop it.`, resourceType, logicalId, physicalId);
 		const { tableBucketARN, namespace, name } = resolvedParts;
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
@@ -73857,7 +74062,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.15");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.17");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;