@go-to-k/cdkd 0.283.5 → 0.283.7

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as resolveSkipPrefix, A as green, At as rewriteTemplateAssetReferences, B as slowCcOperationTimeoutMs, Bt as formatDockerLoginError, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as CdkdError, Ct as shouldRetainResource, D as bold, Dn as LocalInvokeBuildError$1, Dt as buildAssetRedirectMap, E as formatResourceLine, En as DeployCancelledError, Et as WorkGraph, F as clearOnUpdateRemoval, Fn as ResourceTimeoutError, Ft as parseBootstrapMarker, G as getAccountInfo, Gt as getDockerImageBySourceHash, H as isTerminationProtectionPropagationError, Ht as runDockerForeground, I as ProviderRegistry, In as ResourceUpdateNotSupportedError, It as validateAssetBucketName, J as normalizeAwsTagsToCfn, Jt as getDefaultStateBucketName, K as refStateLookupFromResource, Kt as Synthesizer, L as findActionableSilentDrops, Ln as StackHasActiveImportsError, Lt as validateContainerRepoName, M as yellow, Mn as NestedStackChildDirectDestroyError, Mt as BOOTSTRAP_MARKER_PREFIX, N as IAMRoleProvider, Nn as PartialFailureError, Nt as ensureAssetStorage, O as cyan, On as LocalMigrateError, Ot as createAssetRedirectResolver, P as collectInlinePolicyNamesManagedBySiblings, Pn as ProvisioningError, Pt as getBootstrapMarkerKey, Q as configBooleanRefusal, Qt as resolveCaptureObservedState, R as findSilentDropProperties, Rn as StackTerminationProtectionError, Rt as buildDenyExternalAccessPolicy, S as extractDeploymentEventError, St as rebuildClientForBucketRegion, T as renderStatefulReason, Tt as stringifyValue, U as IntrinsicFunctionResolver, Un as normalizeAwsError, Ut as runDockerStreaming, V as disableInstanceApiTermination, Vt as getDockerCmd, W as cfnRefValueFromPhysicalId, Wn as withErrorHandling, Wt as AssetManifestLoader, X as assertRegionMatch, Xt as resolveApp, Y as resolveExplicitPhysicalId, Yt as getLegacyStateBucketName, Z as coerceCfnBoolean, Zt as resolveAutoAssetStorage, _ as createPreDeleteFinalSnapshot, _n as resolveBucketRegion, _t as markNonRetryable, a as DeploymentEventsStore, an as CFN_TEMPLATE_BODY_LIMIT, at as s3BucketArn, b as unsupportedFinalSnapshotError, bn as resetAwsClients, bt as LockManager, c as replayFailedOperations, cn as findLargeInlineResources, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PARTITION_TABLE, dt as DiffCalculator, en as resolveStateBucketWithDefault, et as readConfigString, f as computeImplicitDeleteEdges, fn as canonicalizeRegion, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gt as isThrottlingError, h as buildFinalSnapshotIdentifier, hn as processStackMessages, ht as isRetryableTransientError, i as DeploymentEventsReader, in as warnDeprecatedNoPrefixCliFlag, it as requireConfigString, j as red, jn as MissingCdkCliError, jt as AssetModeResolver, k as gray, kn as LocalStartServiceError, kt as loadPublishableAssetManifest, l as replayRollback, ln as uploadCfnTemplate, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mn as AssemblyReader, mt as isMarkedNonRetryable, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveUseCdkBootstrapAssets, nt as requireConfigArray, o as planFailedOps, on as CFN_TEMPLATE_URL_LIMIT, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as derivePartitionAndUrlSuffix, pt as withRetry, q as WAFv2WebACLProvider, qt as synthesisStatusMessage, r as DeployEngine, rn as stateBucketExistenceConfirmed, rt as requireConfigObject, s as planRollback, sn as MIGRATE_TMP_PREFIX, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveStateBucketWithDefaultAndSource, tt as replayWarn, u as withResourceDeadline, un as expectedOwnerParam, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as AwsClients, vt as DagBuilder, w as isStatefulRecreateTargetSync, wt as AssetPublisher, x as makeCanonicalizePropertiesFn, xn as setAwsClients, xt as S3StateBackend, y as refusesFinalSnapshot, yn as getAwsClients, yt as TemplateParser, z as CloudControlProvider, zt as buildDockerImage } from "./deploy-engine-BcwNPlSk.js";
+import { $ as configStringRefusal, $t as resolveSkipPrefix, A as green, At as rewriteTemplateAssetReferences, B as slowCcOperationTimeoutMs, Bt as formatDockerLoginError, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as CdkdError, Ct as shouldRetainResource, D as bold, Dn as LocalInvokeBuildError$1, Dt as buildAssetRedirectMap, E as formatResourceLine, En as DeployCancelledError, Et as WorkGraph, F as clearOnUpdateRemoval, Fn as ResourceTimeoutError, Ft as parseBootstrapMarker, G as getAccountInfo, Gt as getDockerImageBySourceHash, H as isTerminationProtectionPropagationError, Ht as runDockerForeground, I as ProviderRegistry, In as ResourceUpdateNotSupportedError, It as validateAssetBucketName, J as normalizeAwsTagsToCfn, Jt as getDefaultStateBucketName, K as refStateLookupFromResource, Kt as Synthesizer, L as findActionableSilentDrops, Ln as StackHasActiveImportsError, Lt as validateContainerRepoName, M as yellow, Mn as NestedStackChildDirectDestroyError, Mt as BOOTSTRAP_MARKER_PREFIX, N as IAMRoleProvider, Nn as PartialFailureError, Nt as ensureAssetStorage, O as cyan, On as LocalMigrateError, Ot as createAssetRedirectResolver, P as collectInlinePolicyNamesManagedBySiblings, Pn as ProvisioningError, Pt as getBootstrapMarkerKey, Q as configBooleanRefusal, Qt as resolveCaptureObservedState, R as findSilentDropProperties, Rn as StackTerminationProtectionError, Rt as buildDenyExternalAccessPolicy, S as extractDeploymentEventError, St as rebuildClientForBucketRegion, T as renderStatefulReason, Tt as stringifyValue, U as IntrinsicFunctionResolver, Un as normalizeAwsError, Ut as runDockerStreaming, V as disableInstanceApiTermination, Vt as getDockerCmd, W as cfnRefValueFromPhysicalId, Wn as withErrorHandling, Wt as AssetManifestLoader, X as assertRegionMatch, Xt as resolveApp, Y as resolveExplicitPhysicalId, Yt as getLegacyStateBucketName, Z as coerceCfnBoolean, Zt as resolveAutoAssetStorage, _ as createPreDeleteFinalSnapshot, _n as resolveBucketRegion, _t as markNonRetryable, a as DeploymentEventsStore, an as CFN_TEMPLATE_BODY_LIMIT, at as s3BucketArn, b as unsupportedFinalSnapshotError, bn as resetAwsClients, bt as LockManager, c as replayFailedOperations, cn as findLargeInlineResources, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PARTITION_TABLE, dt as DiffCalculator, en as resolveStateBucketWithDefault, et as readConfigString, f as computeImplicitDeleteEdges, fn as canonicalizeRegion, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gt as isThrottlingError, h as buildFinalSnapshotIdentifier, hn as processStackMessages, ht as isRetryableTransientError, i as DeploymentEventsReader, in as warnDeprecatedNoPrefixCliFlag, it as requireConfigString, j as red, jn as MissingCdkCliError, jt as AssetModeResolver, k as gray, kn as LocalStartServiceError, kt as loadPublishableAssetManifest, l as replayRollback, ln as uploadCfnTemplate, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mn as AssemblyReader, mt as isMarkedNonRetryable, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveUseCdkBootstrapAssets, nt as requireConfigArray, o as planFailedOps, on as CFN_TEMPLATE_URL_LIMIT, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as derivePartitionAndUrlSuffix, pt as withRetry, q as WAFv2WebACLProvider, qt as synthesisStatusMessage, r as DeployEngine, rn as stateBucketExistenceConfirmed, rt as requireConfigObject, s as planRollback, sn as MIGRATE_TMP_PREFIX, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveStateBucketWithDefaultAndSource, tt as replayWarn, u as withResourceDeadline, un as expectedOwnerParam, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as AwsClients, vt as DagBuilder, w as isStatefulRecreateTargetSync, wt as AssetPublisher, x as makeCanonicalizePropertiesFn, xn as setAwsClients, xt as S3StateBackend, y as refusesFinalSnapshot, yn as getAwsClients, yt as TemplateParser, z as CloudControlProvider, zt as buildDockerImage } from "./deploy-engine-CKpBSlde.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-B9eSuRPc.js";
+import { t as ASGProvider } from "./asg-provider-o7QsopaI.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -40935,7 +40935,7 @@ var GlueProvider = class {
 	}
 	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::Glue::Database": return this.createDatabase(logicalId, resourceType, properties);
+			case "AWS::Glue::Database": return this.createDatabase(logicalId, resourceType, properties, context);
 			case "AWS::Glue::Table": return this.createTable(logicalId, resourceType, properties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
@@ -40954,7 +40954,7 @@ var GlueProvider = class {
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
-	async createDatabase(logicalId, resourceType, properties) {
+	async createDatabase(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Glue Database ${logicalId}`);
 		const databaseInput = properties["DatabaseInput"];
 		if (!databaseInput) throw new ProvisioningError(`DatabaseInput is required for Glue Database ${logicalId}`, resourceType, logicalId);
@@ -40964,7 +40964,7 @@ var GlueProvider = class {
 		try {
 			await this.getClient().send(new CreateDatabaseCommand({
 				CatalogId: catalogId,
-				DatabaseInput: this.buildDatabaseInput(databaseInput, databaseName)
+				DatabaseInput: this.buildDatabaseInput(databaseInput, databaseName, { ...replayWarn(this.logger, context) })
 			}));
 			this.logger.debug(`Successfully created Glue Database ${logicalId}: ${databaseName}`);
 			return {
@@ -40982,9 +40982,13 @@ var GlueProvider = class {
 		if (!databaseInput) throw new ProvisioningError(`DatabaseInput is required for Glue Database update ${logicalId}`, resourceType, logicalId, physicalId);
 		const catalogId = properties["CatalogId"];
 		const liveParameters = await this.readLiveDatabaseParameters(logicalId, resourceType, physicalId, catalogId);
+		const previousDatabaseInput = asRecord(previousProperties?.["DatabaseInput"]);
 		try {
-			const builtDatabaseInput = this.buildDatabaseInput(databaseInput, physicalId);
-			this.preserveAwsManagedParameters(builtDatabaseInput, databaseInput["Parameters"], (previousProperties?.["DatabaseInput"])?.["Parameters"], liveParameters);
+			const builtDatabaseInput = this.buildDatabaseInput(databaseInput, physicalId, {
+				onUnusable: (message) => this.logger.warn(message),
+				previousDatabaseInput
+			});
+			this.preserveAwsManagedParameters(builtDatabaseInput, databaseInput["Parameters"], previousDatabaseInput?.["Parameters"], liveParameters);
 			await this.getClient().send(new UpdateDatabaseCommand({
 				...catalogId !== void 0 && { CatalogId: catalogId },
 				Name: physicalId,
@@ -41358,15 +41362,137 @@ var GlueProvider = class {
 	* so empty-string Description, empty Parameters map, etc. reach AWS
 	* intact — `cdkd drift --revert` relies on this to clear console-side
 	* additions.
-	*/
-	buildDatabaseInput(databaseInput, fallbackName) {
+	*
+	* `options` carries the shape-guard policy for the three nested blocks added
+	* by issue #1807, and the two call sites answer differently because their
+	* desired bag has a different provenance (`.claude/rules/providers.md`):
+	*
+	*   - CREATE passes NO `onUnusable`, so a malformed block is REFUSED before
+	*     the AWS call — the value is template-borne, and the alternative is
+	*     sending an empty `{}` block AWS would reject with a far less
+	*     actionable message. Under `CreateContext.replayingState` the refusal
+	*     downgrades through the shared `replayWarn`, since a reverse-replacement
+	*     re-create reads a STATE record the user cannot edit from the template.
+	*   - UPDATE passes a warn callback UNCONDITIONALLY (the `updateRoute`
+	*     precedent — `update()` has no context, so it cannot tell a template
+	*     push from the state-borne bag `drift --revert` and the rollback revert
+	*     arm hand it), and then RETAINS the PREVIOUS side's block, which is why
+	*     `previousDatabaseInput` is threaded in. Omitting instead would ERASE a
+	*     live resource link, because `UpdateDatabase` replaces `DatabaseInput`
+	*     wholesale — the #1612 "UPDATE retains the previous value" row, reached
+	*     here through a whole-blob API rather than a per-item one. When the
+	*     previous side is unusable too the key is DROPPED: there is no value
+	*     cdkd can vouch for either way (#1653 review).
+	*/
+	buildDatabaseInput(databaseInput, fallbackName, options) {
+		const guardOptions = options?.onUnusable ? { onUnusable: options.onUnusable } : void 0;
+		const previous = options?.previousDatabaseInput;
+		/**
+		* The record a nested block is BUILT FROM: the desired side when it names
+		* at least one sendable member, else the previous side when IT does, else
+		* nothing.
+		*
+		* The emptiness test is what makes the ladder complete, and getting it
+		* wrong is how the first cut of this guard still erased a live resource
+		* link: a bare `{}` and an unresolved `{Ref: ...}` are plain OBJECTS, so
+		* the shape guard accepts them and a `?? previous` fallback never fires —
+		* the block then built empty and `UpdateDatabase`, which replaces
+		* `DatabaseInput` wholesale, dropped a link the template still declared.
+		*
+		* A member counts as sendable only when it is a STRING or a NUMBER: the
+		* leaf casts below are unchecked, so an intrinsic-valued `DatabaseName`
+		* would otherwise put an OBJECT on the wire — the same defect one level in.
+		*/
+		const pickBlockSource = (desiredRaw, previousRaw, path, block, members) => {
+			const namesSendable = (bag) => {
+				if (bag === void 0) return false;
+				const present = members.filter((m) => bag[m] !== void 0);
+				return present.length > 0 && present.every((m) => isSendableLeaf(bag[m]));
+			};
+			const desired = guardOptions ? requireConfigObject(desiredRaw, path, guardOptions) : requireConfigObject(desiredRaw, path);
+			if (namesSendable(desired)) return desired;
+			if (desired !== void 0) {
+				const message = emptyBlockMessage(block);
+				if (options?.onUnusable) options.onUnusable(message);
+				else throw new Error(message);
+			}
+			const retained = asRecord(previousRaw);
+			return namesSendable(retained) ? retained : void 0;
+		};
 		const result = { Name: databaseInput["Name"] ?? fallbackName };
 		if (databaseInput["Description"] !== void 0) result.Description = databaseInput["Description"];
 		if (databaseInput["LocationUri"] !== void 0) result.LocationUri = databaseInput["LocationUri"];
 		if (databaseInput["Parameters"] !== void 0) result.Parameters = stringifyParameterValues(databaseInput["Parameters"]);
+		if (databaseInput["TargetDatabase"] !== void 0) {
+			const target = pickBlockSource(databaseInput["TargetDatabase"], previous?.["TargetDatabase"], "AWS::Glue::Database DatabaseInput.TargetDatabase", "TargetDatabase", TARGET_DATABASE_MEMBERS);
+			if (target !== void 0) {
+				const targetDatabase = {};
+				if (isSendableLeaf(target["CatalogId"])) targetDatabase.CatalogId = String(target["CatalogId"]);
+				if (isSendableLeaf(target["DatabaseName"])) targetDatabase.DatabaseName = String(target["DatabaseName"]);
+				if (isSendableLeaf(target["Region"])) targetDatabase.Region = String(target["Region"]);
+				result.TargetDatabase = targetDatabase;
+			}
+		}
+		if (databaseInput["FederatedDatabase"] !== void 0) {
+			const federated = pickBlockSource(databaseInput["FederatedDatabase"], previous?.["FederatedDatabase"], "AWS::Glue::Database DatabaseInput.FederatedDatabase", "FederatedDatabase", FEDERATED_DATABASE_MEMBERS);
+			if (federated !== void 0) {
+				const federatedDatabase = {};
+				if (isSendableLeaf(federated["ConnectionName"])) federatedDatabase.ConnectionName = String(federated["ConnectionName"]);
+				if (isSendableLeaf(federated["Identifier"])) federatedDatabase.Identifier = String(federated["Identifier"]);
+				result.FederatedDatabase = federatedDatabase;
+			}
+		}
+		if (databaseInput["CreateTableDefaultPermissions"] !== void 0) {
+			const permissions = this.usableDefaultPermissions(databaseInput["CreateTableDefaultPermissions"], guardOptions) ?? this.usableDefaultPermissions(previous?.["CreateTableDefaultPermissions"], { onUnusable: () => void 0 });
+			if (permissions !== void 0) result.CreateTableDefaultPermissions = permissions.map((entry) => {
+				const permission = {};
+				if (entry["Permissions"] !== void 0) permission.Permissions = entry["Permissions"];
+				const declaredPrincipal = asRecord(entry["Principal"]);
+				if (declaredPrincipal !== void 0) {
+					const principal = {};
+					if (isSendableLeaf(declaredPrincipal["DataLakePrincipalIdentifier"])) principal.DataLakePrincipalIdentifier = String(declaredPrincipal["DataLakePrincipalIdentifier"]);
+					permission.Principal = principal;
+				}
+				return permission;
+			});
+		}
 		return result;
 	}
 	/**
+	* `DatabaseInput.CreateTableDefaultPermissions` as a USABLE list, or
+	* `undefined` when the declared value is a shape cdkd refuses to narrow.
+	*
+	* The block is validated ALL-OR-NOTHING rather than per entry, which is the
+	* opposite of the S3 per-`Id` appliers and deliberate: this is a Lake
+	* Formation grant list delivered by ONE wholesale `CreateDatabase` /
+	* `UpdateDatabase` call, so dropping the entries cdkd cannot read would
+	* silently NARROW the permissions the template declared — the failure this
+	* guard exists to prevent, one level in from the block itself. A malformed
+	* ENTRY therefore invalidates the block, and the caller then refuses (create)
+	* or retains the previous list (update).
+	*
+	* `Permissions` is checked for ARRAY-ness for the same reason: the SDK member
+	* is `Permission[]`, so a bare string would be forwarded verbatim and the
+	* serializer would drop it, granting nothing while the deploy reports success.
+	*/
+	usableDefaultPermissions(value, guardOptions) {
+		if (value === void 0) return void 0;
+		const path = "AWS::Glue::Database DatabaseInput.CreateTableDefaultPermissions";
+		const entries = guardOptions ? requireConfigArray(value, path, guardOptions) : requireConfigArray(value, path);
+		if (entries === void 0) return void 0;
+		for (const entry of entries) {
+			const principal = asRecord(entry["Principal"]);
+			if (asRecord(entry) !== void 0 && (entry["Permissions"] !== void 0 || entry["Principal"] !== void 0) && (entry["Permissions"] === void 0 || Array.isArray(entry["Permissions"])) && (entry["Principal"] === void 0 || principal !== void 0 && isSendableLeaf(principal["DataLakePrincipalIdentifier"]))) continue;
+			const detail = `${path} carries an entry cdkd cannot read (each entry must be an object naming Permissions as a list and/or Principal as an object whose DataLakePrincipalIdentifier is a string or a number)`;
+			if (guardOptions?.onUnusable) {
+				guardOptions.onUnusable(`${detail}. Leaving the whole block unapplied rather than sending a NARROWED grant list. On an UPDATE that is a RESET: UpdateDatabase replaces DatabaseInput wholesale, so unless a usable previous list is retained the database falls back to the account default (IAM_ALLOWED_PRINCIPALS / ALL) — fix the template value to restore the declared grants`);
+				return;
+			}
+			throw new Error(detail);
+		}
+		return entries;
+	}
+	/**
 	* Build TableInput for Glue API from CFn template properties
 	*/
 	buildTableInput(tableInput, fallbackName) {
@@ -41476,9 +41602,30 @@ var GlueProvider = class {
 	* readback for it (and fabricating a placeholder would itself fire false
 	* drift). Declaring it here keeps the drift comparator from false-positiving
 	* on a state-recorded `OpenTableFormatInput` that the readback never surfaces.
+	*
+	* `AWS::Glue::Database` declares `DatabaseInput.CreateTableDefaultPermissions`
+	* PER RESOURCE (the issue #1602 seam), and only for a database whose template
+	* does NOT declare the block. AWS materializes a Lake Formation DEFAULT there
+	* — `[{IAM_ALLOWED_PRINCIPALS, [ALL]}]` on a catalog that has not been
+	* onboarded to Lake Formation (measured us-east-1, 2026-08-13) — so once
+	* issue #1807 taught `readDatabase` to surface the block, comparing it would
+	* report drift on EVERY existing database: the baseline is an
+	* `observedProperties` capture written by a binary that did not read the key,
+	* `drift.ts` walks the key UNION on that baseline (`unionWalkObjects`), and
+	* `deploy-engine.ts` does not refresh a record that already has one — so the
+	* phantom would persist until an unrelated UPDATE or a `drift --accept`.
+	* This is the ELBv2 `Targets` shape one type over: a value a SIBLING owns is
+	* ignored while the template declares none, and an explicit declaration —
+	* including an empty list — IS a declaration and stays compared.
+	*
+	* `TargetDatabase` / `FederatedDatabase` need no such scoping: AWS reports
+	* them only when they were actually set, so an appearance is real drift.
 	*/
-	getDriftUnknownPaths(resourceType) {
+	getDriftUnknownPaths(resourceType, properties) {
 		if (resourceType === "AWS::Glue::Table") return ["OpenTableFormatInput"];
+		if (resourceType === "AWS::Glue::Database") {
+			if (asRecord(properties?.["DatabaseInput"])?.["CreateTableDefaultPermissions"] === void 0) return ["DatabaseInput.CreateTableDefaultPermissions"];
+		}
 		return [];
 	}
 	async readDatabase(physicalId, catalogId) {
@@ -41498,6 +41645,9 @@ var GlueProvider = class {
 		dbInput["Description"] = db.Description ?? "";
 		if (db.LocationUri !== void 0) dbInput["LocationUri"] = db.LocationUri;
 		dbInput["Parameters"] = db.Parameters ?? {};
+		if (db.TargetDatabase !== void 0) dbInput["TargetDatabase"] = { ...db.TargetDatabase };
+		if (db.FederatedDatabase !== void 0) dbInput["FederatedDatabase"] = { ...db.FederatedDatabase };
+		if (db.CreateTableDefaultPermissions !== void 0) dbInput["CreateTableDefaultPermissions"] = db.CreateTableDefaultPermissions.map((entry) => ({ ...entry }));
 		const result = { DatabaseInput: dbInput };
 		if (db.Name !== void 0) result["DatabaseName"] = db.Name;
 		return result;
@@ -42380,6 +42530,35 @@ function parameterKeySet(value) {
 * its `Fn::*`/`Ref` key — harmless here, since providers only ever see
 * resolved values.)
 */
+/**
+* The CFn members of the two `DatabaseInput` object blocks, as the SENDABLE-ness
+* test sees them. They must stay in step with the per-member writes in
+* `buildDatabaseInput` — a name here that the builder does not write would let
+* an EMPTY block onto the wire, and one the builder writes but this list omits
+* would refuse a valid template that names only it. The unit suite fences both
+* directions by asserting each member ALONE reaches AWS, which fails on a
+* dropped entry (the member stops being sendable) and on an added one (the
+* block builds empty).
+*/
+const TARGET_DATABASE_MEMBERS = [
+	"CatalogId",
+	"DatabaseName",
+	"Region"
+];
+const FEDERATED_DATABASE_MEMBERS = ["ConnectionName", "Identifier"];
+/**
+* Is this leaf value one cdkd can put on the wire? A STRING or a NUMBER — CFn
+* is stringly typed and an unquoted YAML account id arrives as a number (the
+* reason `catalogIdForApi` exists) — and nothing else, so an unresolved
+* intrinsic cannot ride an unchecked cast into the request.
+*/
+const isSendableLeaf = (value) => typeof value === "string" || typeof value === "number" && Number.isFinite(value);
+/**
+* The refusal sentence for a `DatabaseInput` block that IS a plain object and
+* still names nothing cdkd can send — an unresolved intrinsic or a bare `{}`.
+* Shared so the create refusal and the update warning cannot drift apart.
+*/
+const emptyBlockMessage = (block) => `AWS::Glue::Database DatabaseInput.${block} declares no member cdkd can send (an unresolved intrinsic, an empty block), or mixes sendable members with unreadable ones; sending it would put an empty or NARROWED ${block} on the wire. Where this is only WARNED — an update, or a state replay — the previously applied block is retained if cdkd can still read one, and otherwise the key is omitted, which UpdateDatabase applies as a removal because it replaces DatabaseInput wholesale`;
 function asRecord(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return;
 	return value;
@@ -77006,7 +77185,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.5");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.7");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;