@go-to-k/cdkd 0.278.51 → 0.278.53

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-C1otn94r.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-CeEJqaaT.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-B2jsUFUl.js";
+import { t as ASGProvider } from "./asg-provider-Camwh-s6.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -50,7 +50,7 @@ import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBCluster
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
 import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$9, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
-import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
+import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
@@ -33254,6 +33254,18 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 
 //#endregion
 //#region src/provisioning/providers/appsync-provider.ts
+const MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES = [
+	"UserPoolConfig",
+	"OpenIDConnectConfig",
+	"LambdaAuthorizerConfig",
+	"AdditionalAuthenticationProviders",
+	"EnhancedMetricsConfig",
+	"IntrospectionConfig",
+	"QueryDepthLimit",
+	"ResolverCountLimit",
+	"OwnerContact",
+	"MergedApiExecutionRoleArn"
+];
 /**
 * SDK Provider for AWS AppSync resources
 *
@@ -33291,7 +33303,20 @@ var AppSyncProvider = class {
 			"AuthenticationType",
 			"XrayEnabled",
 			"LogConfig",
-			"Tags"
+			"Tags",
+			"AdditionalAuthenticationProviders",
+			"ApiType",
+			"EnhancedMetricsConfig",
+			"EnvironmentVariables",
+			"IntrospectionConfig",
+			"LambdaAuthorizerConfig",
+			"MergedApiExecutionRoleArn",
+			"OpenIDConnectConfig",
+			"OwnerContact",
+			"QueryDepthLimit",
+			"ResolverCountLimit",
+			"UserPoolConfig",
+			"Visibility"
 		])],
 		["AWS::AppSync::GraphQLSchema", /* @__PURE__ */ new Set([
 			"ApiId",
@@ -33331,9 +33356,9 @@ var AppSyncProvider = class {
 		if (!this.client) this.client = new AppSyncClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::AppSync::GraphQLApi": return this.createGraphQLApi(logicalId, resourceType, properties);
+			case "AWS::AppSync::GraphQLApi": return this.createGraphQLApi(logicalId, resourceType, properties, context);
 			case "AWS::AppSync::GraphQLSchema": return this.createGraphQLSchema(logicalId, resourceType, properties);
 			case "AWS::AppSync::DataSource": return this.createDataSource(logicalId, resourceType, properties);
 			case "AWS::AppSync::Resolver": return this.createResolver(logicalId, resourceType, properties);
@@ -33389,6 +33414,7 @@ var AppSyncProvider = class {
 	}
 	async updateGraphQLApi(logicalId, physicalId, resourceType, properties, previousProperties) {
 		if (properties["Name"] !== void 0 && previousProperties["Name"] !== void 0 && properties["Name"] !== previousProperties["Name"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS AppSync GraphqlApi.Name is immutable — destroy + redeploy to rename");
+		for (const immutable of ["ApiType", "Visibility"]) if (properties[immutable] !== void 0 && previousProperties[immutable] !== void 0 && properties[immutable] !== previousProperties[immutable]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS AppSync GraphqlApi.${immutable} is immutable — destroy + redeploy to change it`);
 		const newAuthType = properties["AuthenticationType"];
 		const oldAuthType = previousProperties["AuthenticationType"];
 		const newXray = properties["XrayEnabled"];
@@ -33398,7 +33424,8 @@ var AppSyncProvider = class {
 		const hasXrayDiff = ("XrayEnabled" in properties || "XrayEnabled" in previousProperties) && newXray !== oldXray;
 		const hasAuthDiff = ("AuthenticationType" in properties || "AuthenticationType" in previousProperties) && newAuthType !== oldAuthType;
 		const hasLogDiff = ("LogConfig" in properties || "LogConfig" in previousProperties) && !this.deepEqual(newLog, oldLog);
-		if (hasAuthDiff || hasXrayDiff || hasLogDiff) {
+		const hasConfigDiff = MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES.some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]));
+		if (hasAuthDiff || hasXrayDiff || hasLogDiff || hasConfigDiff) {
 			const input = {
 				apiId: physicalId,
 				name: properties["Name"] ?? previousProperties["Name"],
@@ -33418,17 +33445,26 @@ var AppSyncProvider = class {
 				};
 				else this.logger.warn(`AppSync GraphqlApi ${logicalId}: cannot clear LogConfig — previous state has no CloudWatchLogsRoleArn to reuse for the disable call`);
 			}
+			this.applyGraphQLApiConfig(input, properties, {
+				forUpdate: true,
+				previousProperties,
+				logicalId,
+				shapeGuard: {
+					logicalId,
+					onUnusable: (message) => this.logger.warn(`${message} (leaving the live value untouched)`)
+				}
+			});
 			try {
 				await this.getClient().send(new UpdateGraphqlApiCommand(input));
 			} catch (error) {
 				throw this.wrapUpdateError(error, resourceType, logicalId, physicalId, "GraphqlApi");
 			}
 		}
+		await this.applyEnvironmentVariables(physicalId, resourceType, logicalId, properties, previousProperties);
 		await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 		return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 	}
 	async updateGraphQLSchema(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -33436,8 +33472,7 @@ var AppSyncProvider = class {
 		const oldDef = previousProperties["Definition"];
 		if (newDef === void 0 || newDef === oldDef) return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 		const apiId = properties["ApiId"] ?? physicalId;
 		try {
@@ -33450,8 +33485,7 @@ var AppSyncProvider = class {
 		}
 		return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 	}
 	async updateDataSource(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -33479,8 +33513,7 @@ var AppSyncProvider = class {
 		const oldHttp = previousProperties["HttpConfig"];
 		if (!(newDesc !== oldDesc || newRole !== oldRole || !this.deepEqual(newDDB, oldDDB) || !this.deepEqual(newLambda, oldLambda) || !this.deepEqual(newHttp, oldHttp))) return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 		const input = {
 			apiId,
@@ -33503,8 +33536,7 @@ var AppSyncProvider = class {
 		}
 		return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 	}
 	async updateResolver(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -33530,8 +33562,7 @@ var AppSyncProvider = class {
 			"Code"
 		].some((key) => !this.deepEqual(properties[key], previousProperties[key]))) return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 		const input = {
 			apiId,
@@ -33559,8 +33590,7 @@ var AppSyncProvider = class {
 		}
 		return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 	}
 	async updateApiKey(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -33573,8 +33603,7 @@ var AppSyncProvider = class {
 		const oldExp = previousProperties["Expires"];
 		if (newDesc === oldDesc && newExp === oldExp) return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 		const input = {
 			apiId,
@@ -33589,8 +33618,7 @@ var AppSyncProvider = class {
 		}
 		return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 	}
 	/**
@@ -33677,11 +33705,212 @@ var AppSyncProvider = class {
 		if (resourceType === "AWS::AppSync::GraphQLSchema") return ["DefinitionS3Location"];
 		return [];
 	}
-	async createGraphQLApi(logicalId, resourceType, properties) {
+	/**
+	* Read a nested config container.
+	*
+	* A present-but-NOT-an-object value (an unresolved intrinsic, a mis-nested
+	* L1, a string where the template meant a block) must never fall through as
+	* "absent" — that reintroduces the very silent-drop class this batch closes
+	* (see `src/provisioning/config-shape.ts`'s "Never infer a default from a
+	* possibly-malformed value"). An ABSENT container keeps returning
+	* `undefined`, which is a legitimate "not configured".
+	*/
+	asObject(value, path, options) {
+		if (value == null) return void 0;
+		if (typeof value === "object" && !Array.isArray(value)) return value;
+		const message = `AWS::AppSync::GraphQLApi ${path} must be an object, got ${Array.isArray(value) ? "array" : typeof value} — cdkd refuses to drop it silently`;
+		if (options?.onUnusable) {
+			options.onUnusable(message);
+			return;
+		}
+		throw new ProvisioningError(message, "AWS::AppSync::GraphQLApi", options?.logicalId ?? "");
+	}
+	/**
+	* NOTE: `awsRegion` / `defaultAction` are passed through VERBATIM, including
+	* when the template omits them. cdkd deliberately does NOT substitute a
+	* default: `DefaultAction` decides whether an unauthenticated request is
+	* ALLOWed or DENYed, so inventing one would be a security decision made on
+	* the user's behalf, and what CloudFormation itself defaults here has not
+	* been A/B-verified. An omitted required member reaches AWS as a LOUD
+	* validation error naming the field — not a silent drop.
+	*/
+	toSdkUserPoolConfig(value, path = "UserPoolConfig", options) {
+		const cfn = this.asObject(value, path, options);
+		if (!cfn) return void 0;
+		return {
+			userPoolId: cfn["UserPoolId"],
+			awsRegion: cfn["AwsRegion"],
+			defaultAction: cfn["DefaultAction"],
+			...cfn["AppIdClientRegex"] !== void 0 ? { appIdClientRegex: cfn["AppIdClientRegex"] } : {}
+		};
+	}
+	/**
+	* The `UserPoolConfig` nested under an ADDITIONAL auth provider is a
+	* DIFFERENT shape from the top-level one — AWS models it as
+	* `CognitoUserPoolConfig`, which has no `defaultAction` member.
+	*/
+	toSdkCognitoUserPoolConfig(value, path = "UserPoolConfig", options) {
+		const cfn = this.asObject(value, path, options);
+		if (!cfn) return void 0;
+		return {
+			userPoolId: cfn["UserPoolId"],
+			awsRegion: cfn["AwsRegion"],
+			...cfn["AppIdClientRegex"] !== void 0 ? { appIdClientRegex: cfn["AppIdClientRegex"] } : {}
+		};
+	}
+	toSdkOpenIDConnectConfig(value, path = "OpenIDConnectConfig", options) {
+		const cfn = this.asObject(value, path, options);
+		if (!cfn) return void 0;
+		return {
+			issuer: cfn["Issuer"],
+			...cfn["ClientId"] !== void 0 ? { clientId: cfn["ClientId"] } : {},
+			...cfn["IatTTL"] !== void 0 ? { iatTTL: cfn["IatTTL"] } : {},
+			...cfn["AuthTTL"] !== void 0 ? { authTTL: cfn["AuthTTL"] } : {}
+		};
+	}
+	toSdkLambdaAuthorizerConfig(value, path = "LambdaAuthorizerConfig", options) {
+		const cfn = this.asObject(value, path, options);
+		if (!cfn) return void 0;
+		return {
+			authorizerUri: cfn["AuthorizerUri"],
+			...cfn["AuthorizerResultTtlInSeconds"] !== void 0 ? { authorizerResultTtlInSeconds: cfn["AuthorizerResultTtlInSeconds"] } : {},
+			...cfn["IdentityValidationExpression"] !== void 0 ? { identityValidationExpression: cfn["IdentityValidationExpression"] } : {}
+		};
+	}
+	toSdkAdditionalAuthProviders(value, options) {
+		if (value == null) return void 0;
+		let entries;
+		try {
+			entries = requireConfigArray(value, "AWS::AppSync::GraphQLApi AdditionalAuthenticationProviders");
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			if (options?.onUnusable) {
+				options.onUnusable(message);
+				return;
+			}
+			throw new ProvisioningError(message, "AWS::AppSync::GraphQLApi", options?.logicalId ?? "", void 0, error instanceof Error ? error : void 0);
+		}
+		return entries.map((entry, index) => {
+			const at = `AdditionalAuthenticationProviders[${index}]`;
+			const cfn = this.asObject(entry, at, options) ?? {};
+			const provider = {};
+			if (cfn["AuthenticationType"] !== void 0) provider.authenticationType = cfn["AuthenticationType"];
+			const oidc = this.toSdkOpenIDConnectConfig(cfn["OpenIDConnectConfig"], `${at}.OpenIDConnectConfig`, options);
+			if (oidc) provider.openIDConnectConfig = oidc;
+			const pool = this.toSdkCognitoUserPoolConfig(cfn["UserPoolConfig"], `${at}.UserPoolConfig`);
+			if (pool) provider.userPoolConfig = pool;
+			const lambda = this.toSdkLambdaAuthorizerConfig(cfn["LambdaAuthorizerConfig"], `${at}.LambdaAuthorizerConfig`, options);
+			if (lambda) provider.lambdaAuthorizerConfig = lambda;
+			return provider;
+		});
+	}
+	toSdkEnhancedMetricsConfig(value, options) {
+		const cfn = this.asObject(value, "EnhancedMetricsConfig", options);
+		if (!cfn) return void 0;
+		return {
+			resolverLevelMetricsBehavior: cfn["ResolverLevelMetricsBehavior"],
+			dataSourceLevelMetricsBehavior: cfn["DataSourceLevelMetricsBehavior"],
+			operationLevelMetricsConfig: cfn["OperationLevelMetricsConfig"]
+		};
+	}
+	/**
+	* Fill the config members shared by `CreateGraphqlApi` and
+	* `UpdateGraphqlApi` from the CFn property bag.
+	*
+	* `ApiType` / `Visibility` are deliberately NOT here: the SDK's update
+	* input has no member for either (they are create-only on AWS), so
+	* `updateGraphQLApi` refuses the change and the replacement rule in
+	* `src/analyzer/replacement-rules.ts` routes it through CREATE+DELETE.
+	*
+	* `forUpdate` turns on the removal sentinels: on UPDATE a property the
+	* user DELETED from the template must be actively reset, because
+	* AppSync treats an omitted member as "no change" (the same semantic
+	* `LogConfig`'s clearing branch documents below). Only the members AWS
+	* gives a sentinel for can be reset that way — `MergedApiExecutionRoleArn`
+	* and the three auth-config blocks have none, so their removal is
+	* reported to the user instead of silently no-op'ing.
+	*/
+	applyGraphQLApiConfig(input, properties, options) {
+		const forUpdate = options?.forUpdate === true;
+		const previous = options?.previousProperties ?? {};
+		const guard = options?.shapeGuard ?? (options?.logicalId !== void 0 ? { logicalId: options.logicalId } : {});
+		const removed = (key) => forUpdate && properties[key] === void 0 && previous[key] !== void 0;
+		const userPool = this.toSdkUserPoolConfig(properties["UserPoolConfig"], "UserPoolConfig", guard);
+		if (userPool) input.userPoolConfig = userPool;
+		const oidc = this.toSdkOpenIDConnectConfig(properties["OpenIDConnectConfig"], "OpenIDConnectConfig", guard);
+		if (oidc) input.openIDConnectConfig = oidc;
+		const lambdaAuth = this.toSdkLambdaAuthorizerConfig(properties["LambdaAuthorizerConfig"], "LambdaAuthorizerConfig", guard);
+		if (lambdaAuth) input.lambdaAuthorizerConfig = lambdaAuth;
+		const additional = this.toSdkAdditionalAuthProviders(properties["AdditionalAuthenticationProviders"], guard);
+		if (additional) input.additionalAuthenticationProviders = additional;
+		else if (removed("AdditionalAuthenticationProviders")) input.additionalAuthenticationProviders = [];
+		const metrics = this.toSdkEnhancedMetricsConfig(properties["EnhancedMetricsConfig"], guard);
+		if (metrics) input.enhancedMetricsConfig = metrics;
+		if (properties["IntrospectionConfig"] !== void 0) input.introspectionConfig = properties["IntrospectionConfig"];
+		else if (removed("IntrospectionConfig")) input.introspectionConfig = "ENABLED";
+		if (properties["QueryDepthLimit"] !== void 0) input.queryDepthLimit = properties["QueryDepthLimit"];
+		else if (removed("QueryDepthLimit")) input.queryDepthLimit = 0;
+		if (properties["ResolverCountLimit"] !== void 0) input.resolverCountLimit = properties["ResolverCountLimit"];
+		else if (removed("ResolverCountLimit")) input.resolverCountLimit = 0;
+		if (properties["OwnerContact"] !== void 0) input.ownerContact = properties["OwnerContact"];
+		else if (removed("OwnerContact")) input.ownerContact = "";
+		if (properties["MergedApiExecutionRoleArn"] !== void 0) input.mergedApiExecutionRoleArn = properties["MergedApiExecutionRoleArn"];
+		if (forUpdate) {
+			for (const key of [
+				"MergedApiExecutionRoleArn",
+				"UserPoolConfig",
+				"OpenIDConnectConfig",
+				"LambdaAuthorizerConfig",
+				"EnhancedMetricsConfig"
+			]) if (removed(key)) this.logger.warn(`AppSync GraphqlApi ${options?.logicalId ?? ""}: cannot clear ${key} on update — AppSync has no reset sentinel for it and treats an omitted member as "no change". Destroy + redeploy the API to drop it.`);
+		}
+	}
+	/**
+	* `EnvironmentVariables` lives on its OWN API pair
+	* (`PutGraphqlApiEnvironmentVariables` / `Get...`), not on
+	* Create/UpdateGraphqlApi. The PUT is whole-map replace, so a removed
+	* key is cleared by re-putting the remaining map (and `{}` clears all).
+	*/
+	async applyEnvironmentVariables(apiId, resourceType, logicalId, properties, previousProperties, replayingState = false) {
+		const isUpdate = previousProperties !== void 0;
+		let desired;
+		try {
+			desired = this.asObject(properties["EnvironmentVariables"], "EnvironmentVariables", { logicalId });
+		} catch (error) {
+			if (!isUpdate && !replayingState) throw error;
+			this.logger.warn(`AppSync GraphqlApi ${logicalId}: ${error instanceof Error ? error.message : String(error)} — leaving the live environment variables untouched`);
+			return;
+		}
+		let previous;
+		if (previousProperties) {
+			const raw = previousProperties["EnvironmentVariables"];
+			previous = raw != null && typeof raw === "object" && !Array.isArray(raw) ? raw : void 0;
+		}
+		if (desired === void 0 && previous === void 0) return;
+		if (isUpdate && this.deepEqual(desired, previous)) return;
+		const environmentVariables = {};
+		for (const [key, value] of Object.entries(desired ?? {})) if (typeof value === "string") environmentVariables[key] = value;
+		else if (typeof value === "number" && Number.isFinite(value) || typeof value === "boolean") environmentVariables[key] = String(value);
+		else throw new ProvisioningError(`AWS::AppSync::GraphQLApi EnvironmentVariables.${key} must be a string, got ${Array.isArray(value) ? "array" : value === null ? "null" : typeof value}`, resourceType, logicalId, apiId);
+		try {
+			await this.getClient().send(new PutGraphqlApiEnvironmentVariablesCommand({
+				apiId,
+				environmentVariables
+			}));
+		} catch (error) {
+			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, isUpdate ? "GraphqlApi (env vars)" : "GraphqlApi (env vars, post-create)");
+		}
+	}
+	async createGraphQLApi(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating GraphQL API ${logicalId}`);
 		const name = properties["Name"];
 		if (!name) throw new ProvisioningError(`Name is required for GraphQLApi ${logicalId}`, resourceType, logicalId);
 		const authenticationType = properties["AuthenticationType"];
+		let createdApiId;
+		const shapeGuard = {
+			logicalId,
+			...context?.replayingState === true ? { onUnusable: (message) => this.logger.warn(`${message} (state replay — proceeding without it)`) } : {}
+		};
 		try {
 			const input = {
 				name,
@@ -33702,10 +33931,18 @@ var AppSyncProvider = class {
 				for (const tag of tags) tagMap[tag.Key] = tag.Value;
 				input.tags = tagMap;
 			}
+			this.applyGraphQLApiConfig(input, properties, {
+				logicalId,
+				shapeGuard
+			});
+			if (properties["ApiType"] !== void 0) input.apiType = properties["ApiType"];
+			if (properties["Visibility"] !== void 0) input.visibility = properties["Visibility"];
 			const response = await this.getClient().send(new CreateGraphqlApiCommand(input));
+			createdApiId = response.graphqlApi?.apiId;
 			const apiId = response.graphqlApi.apiId;
 			const arn = response.graphqlApi.arn;
 			const graphQLUrl = response.graphqlApi.uris?.["GRAPHQL"] ?? "";
+			await this.applyEnvironmentVariables(apiId, resourceType, logicalId, properties, void 0, context?.replayingState === true);
 			this.logger.debug(`Successfully created GraphQL API ${logicalId}: ${apiId}`);
 			return {
 				physicalId: apiId,
@@ -33716,6 +33953,12 @@ var AppSyncProvider = class {
 				}
 			};
 		} catch (error) {
+			if (createdApiId) try {
+				await this.getClient().send(new DeleteGraphqlApiCommand({ apiId: createdApiId }));
+				this.logger.debug(`Rolled back partially-created GraphQL API ${createdApiId}`);
+			} catch (rollbackError) {
+				this.logger.warn(`Failed to roll back partially-created GraphQL API ${createdApiId}: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+			}
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create GraphQL API ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
@@ -34039,8 +34282,62 @@ var AppSyncProvider = class {
 			result["LogConfig"] = log;
 		}
 		result["Tags"] = normalizeAwsTagsToCfn(api.tags);
+		if (api.userPoolConfig) result["UserPoolConfig"] = this.userPoolConfigToCfn(api.userPoolConfig);
+		if (api.openIDConnectConfig) result["OpenIDConnectConfig"] = this.openIDConnectConfigToCfn(api.openIDConnectConfig);
+		if (api.lambdaAuthorizerConfig) result["LambdaAuthorizerConfig"] = this.lambdaAuthorizerConfigToCfn(api.lambdaAuthorizerConfig);
+		if (api.additionalAuthenticationProviders) result["AdditionalAuthenticationProviders"] = api.additionalAuthenticationProviders.map((provider) => {
+			const entry = {};
+			if (provider.authenticationType !== void 0) entry["AuthenticationType"] = provider.authenticationType;
+			if (provider.openIDConnectConfig) entry["OpenIDConnectConfig"] = this.openIDConnectConfigToCfn(provider.openIDConnectConfig);
+			if (provider.userPoolConfig) entry["UserPoolConfig"] = this.userPoolConfigToCfn(provider.userPoolConfig);
+			if (provider.lambdaAuthorizerConfig) entry["LambdaAuthorizerConfig"] = this.lambdaAuthorizerConfigToCfn(provider.lambdaAuthorizerConfig);
+			return entry;
+		});
+		if (api.enhancedMetricsConfig) {
+			const metrics = {};
+			if (api.enhancedMetricsConfig.resolverLevelMetricsBehavior !== void 0) metrics["ResolverLevelMetricsBehavior"] = api.enhancedMetricsConfig.resolverLevelMetricsBehavior;
+			if (api.enhancedMetricsConfig.dataSourceLevelMetricsBehavior !== void 0) metrics["DataSourceLevelMetricsBehavior"] = api.enhancedMetricsConfig.dataSourceLevelMetricsBehavior;
+			if (api.enhancedMetricsConfig.operationLevelMetricsConfig !== void 0) metrics["OperationLevelMetricsConfig"] = api.enhancedMetricsConfig.operationLevelMetricsConfig;
+			result["EnhancedMetricsConfig"] = metrics;
+		}
+		if (api.apiType !== void 0) result["ApiType"] = api.apiType;
+		if (api.visibility !== void 0) result["Visibility"] = api.visibility;
+		if (api.introspectionConfig !== void 0) result["IntrospectionConfig"] = api.introspectionConfig;
+		if (api.queryDepthLimit !== void 0) result["QueryDepthLimit"] = api.queryDepthLimit;
+		if (api.resolverCountLimit !== void 0) result["ResolverCountLimit"] = api.resolverCountLimit;
+		if (api.ownerContact !== void 0) result["OwnerContact"] = api.ownerContact;
+		if (api.mergedApiExecutionRoleArn !== void 0) result["MergedApiExecutionRoleArn"] = api.mergedApiExecutionRoleArn;
+		try {
+			const envResp = await this.getClient().send(new GetGraphqlApiEnvironmentVariablesCommand({ apiId: physicalId }));
+			if (envResp.environmentVariables !== void 0) result["EnvironmentVariables"] = envResp.environmentVariables;
+		} catch (err) {
+			this.logger.warn(`Could not read AppSync GraphqlApi ${physicalId} environment variables (drift on that property will not be reported): ${err instanceof Error ? err.message : String(err)}`);
+		}
 		return result;
 	}
+	userPoolConfigToCfn(config) {
+		const out = {};
+		if (config.userPoolId !== void 0) out["UserPoolId"] = config.userPoolId;
+		if (config.awsRegion !== void 0) out["AwsRegion"] = config.awsRegion;
+		if ("defaultAction" in config && config.defaultAction !== void 0) out["DefaultAction"] = config.defaultAction;
+		if (config.appIdClientRegex !== void 0) out["AppIdClientRegex"] = config.appIdClientRegex;
+		return out;
+	}
+	openIDConnectConfigToCfn(config) {
+		const out = {};
+		if (config.issuer !== void 0) out["Issuer"] = config.issuer;
+		if (config.clientId !== void 0) out["ClientId"] = config.clientId;
+		if (config.iatTTL !== void 0) out["IatTTL"] = config.iatTTL;
+		if (config.authTTL !== void 0) out["AuthTTL"] = config.authTTL;
+		return out;
+	}
+	lambdaAuthorizerConfigToCfn(config) {
+		const out = {};
+		if (config.authorizerUri !== void 0) out["AuthorizerUri"] = config.authorizerUri;
+		if (config.authorizerResultTtlInSeconds !== void 0) out["AuthorizerResultTtlInSeconds"] = config.authorizerResultTtlInSeconds;
+		if (config.identityValidationExpression !== void 0) out["IdentityValidationExpression"] = config.identityValidationExpression;
+		return out;
+	}
 	async readDataSource(physicalId) {
 		const [apiId, name] = physicalId.split("|");
 		if (!apiId || !name) return void 0;
@@ -42758,6 +43055,25 @@ function mapHttpEndpointDescriptionToCfn(desc) {
 //#endregion
 //#region src/provisioning/providers/cloudtrail-provider.ts
 /**
+* The selector set a trail carries when its template declares NO
+* `EventSelectors`, and therefore the RESET payload for a removal.
+*
+* Live CFn A/B (issue #1549, us-east-1, 2026-08-11): removing `EventSelectors`
+* from a deployed trail's template resets the live selectors to exactly this
+* shape — AWS echoes it back as `{ReadWriteType: 'All', IncludeManagementEvents:
+* true, DataResources: [], ExcludeManagementEventSources: []}`, the two empty
+* lists being response-side defaults that do NOT need sending.
+*
+* It is a VALUE, not an empty array, because `PutEventSelectors` rejects `[]`
+* with `InvalidEventSelectorsException: Specify a valid number of selectors
+* (1 to 5) for your trail` — the divergence from the `InsightSelectors` sibling,
+* where AWS documents `[]` as the removal shape.
+*/
+const DEFAULT_EVENT_SELECTORS = Object.freeze([Object.freeze({
+	ReadWriteType: "All",
+	IncludeManagementEvents: true
+})]);
+/**
 * SDK Provider for AWS CloudTrail resources
 *
 * Supports:
@@ -42886,15 +43202,29 @@ var CloudTrailProvider = class {
 				SnsTopicName: snsTopicName,
 				IsOrganizationTrail: isOrganizationTrail
 			}));
-			const newEventSelectors = properties["EventSelectors"];
+			const rawEventSelectors = properties["EventSelectors"];
+			let eventSelectorsUnusable = false;
+			let newEventSelectors;
+			if (rawEventSelectors != null) try {
+				newEventSelectors = requireConfigArray(rawEventSelectors, "AWS::CloudTrail::Trail EventSelectors");
+			} catch (error) {
+				eventSelectorsUnusable = true;
+				this.logger.warn(`${error instanceof Error ? error.message : String(error)} The trail's existing event selectors are left untouched for this update rather than reset to the AWS default.`);
+			}
 			const oldEventSelectors = previousProperties["EventSelectors"];
-			if (JSON.stringify(newEventSelectors) !== JSON.stringify(oldEventSelectors)) {
-				if (newEventSelectors && newEventSelectors.length > 0) {
-					this.logger.debug(`Updating event selectors for CloudTrail Trail ${logicalId}`);
+			if (!eventSelectorsUnusable && JSON.stringify(newEventSelectors) !== JSON.stringify(oldEventSelectors)) {
+				const isRemoval = newEventSelectors === void 0 || newEventSelectors.length === 0;
+				const eventSelectorsToSend = newEventSelectors === void 0 || newEventSelectors.length === 0 ? DEFAULT_EVENT_SELECTORS : newEventSelectors;
+				this.logger.debug(isRemoval ? `Resetting event selectors to the AWS default for CloudTrail Trail ${logicalId}` : `Updating event selectors for CloudTrail Trail ${logicalId}`);
+				try {
 					await this.getClient().send(new PutEventSelectorsCommand({
 						TrailName: physicalId,
-						EventSelectors: newEventSelectors
+						EventSelectors: [...eventSelectorsToSend]
 					}));
+				} catch (error) {
+					const message = error instanceof Error ? error.message : String(error);
+					if (!isRemoval || !/advanced[\s-]*event[\s-]*selector/i.test(message)) throw error;
+					this.logger.warn(`CloudTrail Trail ${logicalId}: skipping the EventSelectors reset — the trail is using AdvancedEventSelectors, which AWS manages through a separate API, so there are no basic event selectors to clear (${message})`);
 				}
 			}
 			const newInsightSelectors = properties["InsightSelectors"];
@@ -42906,7 +43236,8 @@ var CloudTrailProvider = class {
 					InsightSelectors: newInsightSelectors ?? []
 				}));
 			}
-			if (isLogging !== previousProperties["IsLogging"]) if (isLogging === false) {
+			const oldIsLogging = previousProperties["IsLogging"];
+			if (isLogging !== void 0 && isLogging !== oldIsLogging) if (isLogging === false) {
 				this.logger.debug(`Stopping logging for CloudTrail Trail ${logicalId}`);
 				await this.getClient().send(new StopLoggingCommand({ Name: physicalId }));
 			} else {
@@ -67705,7 +68036,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.51");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.53");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;