@go-to-k/cdkd 0.278.52 → 0.278.54

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-64dVN8O1.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-CEoy1_C7.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-CjVpdcoW.js";
+import { t as ASGProvider } from "./asg-provider-Ro9B_1Sy.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -50,7 +50,7 @@ import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBCluster
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
 import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$9, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
-import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
+import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
@@ -7775,8 +7775,20 @@ var SNSTopicProvider = class {
 	}
 	/**
 	* Create an SNS topic
+	*
+	* `context.replayingState` (issue #1551) downgrades this method's one
+	* template-shape refusal — `buildDeliveryStatusAttributeMap`'s `'throw'`
+	* mode — to a warning. The rollback executor's
+	* reverse-replacement arm revives the OLD topic with
+	* `create(..., previousState.properties, REPLAYING_STATE_CREATE_CONTEXT)`,
+	* so the properties bag can be a historical cdkd STATE record carrying a
+	* shape this provider now refuses — and the user has no template-side
+	* remedy for a state record. The parameter was previously absent, so that
+	* 4th argument was silently ignored and `buildDeliveryStatusAttributeMap`'s
+	* `'throw'` mode stranded the replay; issue #1538 fixed the update side
+	* only.
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating SNS topic ${logicalId}`);
 		const topicName = properties["TopicName"] || generateResourceName(logicalId, { maxLength: 256 });
 		try {
@@ -7814,7 +7826,7 @@ var SNSTopicProvider = class {
 						AttributeValue: dataProtectionPolicy
 					}));
 				}
-				const deliveryStatusAttributes = buildDeliveryStatusAttributeMap(properties["DeliveryStatusLogging"], logicalId, "throw");
+				const deliveryStatusAttributes = buildDeliveryStatusAttributeMap(properties["DeliveryStatusLogging"], logicalId, context?.replayingState === true ? "warn" : "throw");
 				for (const [attributeName, attributeValue] of deliveryStatusAttributes) await this.snsClient.send(new SetTopicAttributesCommand({
 					TopicArn: topicArn,
 					AttributeName: attributeName,
@@ -8311,9 +8323,15 @@ const SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES = [
 * / unknown protocol, and encodes the create-vs-update distinction
 * (issue #1538):
 *
-* - `'throw'` — the CREATE desired side, which is always template-borne:
-*   a template error must fail fast, naming the offending value.
-* - `'warn'` — the UPDATE desired side, which is NOT always template-borne:
+* - `'throw'` — a TEMPLATE-borne desired side: an ordinary `create()`, where a
+*   template error must fail fast, naming the offending value.
+* - `'warn'` — a desired side that is NOT template-borne. That is every
+*   `update()`, and — since issue #1551 — a `create()` whose
+*   `CreateContext.replayingState` is set (the rollback executor's
+*   reverse-replacement arm, which revives the old topic from a state record).
+*   The wording below is therefore operation-neutral: on a create there is no
+*   previously-set attribute to reset, only one that is never applied. Same
+*   reason as before:
 *   the rollback executor's revert arm and `cdkd drift --revert` both call
 *   `update()` with a state-derived bag as the DESIRED properties, so a
 *   state record carrying an unsupported protocol / malformed shape (a
@@ -8346,8 +8364,9 @@ const SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES = [
 * protocol, non-array container, non-object entry) used to throw on that
 * side too, which made such a state record permanently unreplayable —
 * fixed by issue #1538, which moved `update()`'s desired side to `'warn'`
-* while `create()` keeps `'throw'` (a template create must still fail
-* fast; #1529 / #1536 deliberately left that contract unchanged).
+* while `create()` kept `'throw'`; issue #1551 then extended the downgrade to
+* a create that DECLARES a state replay, leaving the template-path create
+* strict (#1529 / #1536 deliberately left that contract unchanged).
 */
 function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed) {
 	const map = /* @__PURE__ */ new Map();
@@ -8358,7 +8377,7 @@ function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed) {
 	const seenProtocols = /* @__PURE__ */ new Set();
 	if (!Array.isArray(logging)) {
 		if (onMalformed === "throw") throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)}`);
-		if (onMalformed === "warn") warn(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)} — treating it as empty for this update, so previously set delivery-status attributes are reset. The desired properties can come from a cdkd state record (rollback replay / drift --revert), so this does not fail the update; fix the template (or the state record on a replay) to clear this warning.`);
+		if (onMalformed === "warn") warn(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)} — treating it as empty, so no delivery-status attribute is applied (on an update, any previously set one is reset). The desired properties can come from a cdkd state record (rollback replay / drift --revert), so this does not fail the operation; fix the template (or the state record on a replay) to clear this warning.`);
 		return map;
 	}
 	for (const entry of logging) {
@@ -10083,9 +10102,16 @@ var LambdaUrlProvider = class {
 			wasReplaced: false,
 			attributes: {}
 		};
+		let authTypeUnusable = false;
+		const requestedAuthType = requireConfigString(properties["AuthType"], "NONE", "AWS::Lambda::Url AuthType", { onUnusable: (message) => {
+			authTypeUnusable = true;
+			this.logger.warn(`${message} The function URL's existing auth type is kept for this update rather than reset to the default (NONE), which would make the URL public.`);
+		} });
+		const previousAuthType = previousProperties["AuthType"];
+		const authType = authTypeUnusable ? typeof previousAuthType === "string" && previousAuthType.trim() !== "" ? previousAuthType : void 0 : requestedAuthType;
 		const updateParams = {
 			FunctionName: physicalId,
-			AuthType: requireConfigString(properties["AuthType"], "NONE", "AWS::Lambda::Url AuthType")
+			...authType !== void 0 && { AuthType: authType }
 		};
 		const invokeMode = clearOnUpdateRemoval(properties["InvokeMode"], previousProperties["InvokeMode"], "BUFFERED");
 		if (invokeMode !== void 0) updateParams.InvokeMode = invokeMode;
@@ -11729,7 +11755,10 @@ var DynamoDBTableProvider = class {
 			if (table?.TableArn) await this.applyTagDiff(table.TableArn, previousProperties["Tags"], properties["Tags"]);
 			const normalizeTableClass = (v) => typeof v === "string" && v.length > 0 ? v : "STANDARD";
 			const tableClassChanged = normalizeTableClass(properties["TableClass"]) !== normalizeTableClass(previousProperties["TableClass"]);
-			const prevBillingMode = previousProperties["BillingMode"];
+			const recordedPrevBillingMode = previousProperties["BillingMode"];
+			const recordedPrevBillingModeUsable = recordedPrevBillingMode === void 0 || typeof recordedPrevBillingMode === "string" && recordedPrevBillingMode.trim() !== "";
+			const prevBillingMode = recordedPrevBillingModeUsable ? recordedPrevBillingMode : table?.BillingModeSummary?.BillingMode ?? "PROVISIONED";
+			if (!recordedPrevBillingModeUsable) this.logger.warn(`AWS::DynamoDB::Table ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(recordedPrevBillingMode)}) — using the table's actual billing mode (${prevBillingMode}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
 			let billingModeUnusable = false;
 			const requestedBillingMode = properties["BillingMode"] === void 0 ? void 0 : requireConfigString(properties["BillingMode"], "PROVISIONED", "AWS::DynamoDB::Table BillingMode", { onUnusable: (message) => {
 				billingModeUnusable = true;
@@ -12707,7 +12736,8 @@ var DynamoDBGlobalTableProvider = class {
 		}
 		let sdkIndexes;
 		try {
-			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics, replayWarn(this.logger, context).onUnusable);
+			const onUnusableCreateIndexes = replayWarn(this.logger, context).onUnusable;
+			sdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, billingMode, "min", diagnostics, onUnusableCreateIndexes && ((message) => onUnusableCreateIndexes(`${message} Omitting the malformed block, so this create carries NO indexes; the same value is REFUSED on a template-path create`)));
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
@@ -12915,7 +12945,10 @@ var DynamoDBGlobalTableProvider = class {
 				return (props["Replicas"] ?? []).find((r) => r["Region"] === currentRegion)?.["Tags"];
 			};
 			if (tableArn) await this.applyTagDiff(tableArn, extractLocalTags(previousProperties), extractLocalTags(properties));
-			const oldBilling = previousProperties["BillingMode"] ?? "PAY_PER_REQUEST";
+			const recordedOldBilling = previousProperties["BillingMode"];
+			const recordedOldBillingUsable = recordedOldBilling === void 0 || typeof recordedOldBilling === "string" && recordedOldBilling.trim() !== "";
+			const oldBilling = recordedOldBillingUsable ? recordedOldBilling ?? "PAY_PER_REQUEST" : describeResp.Table?.BillingModeSummary?.BillingMode ?? "PROVISIONED";
+			if (!recordedOldBillingUsable) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the recorded previous BillingMode is unusable (${JSON.stringify(recordedOldBilling)}) — using the table's actual billing mode (${oldBilling}) as the comparison baseline for this update so a corrected template does not issue a same-mode UpdateTable.`);
 			let billingUnusable = false;
 			const requestedBilling = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", { onUnusable: (message) => {
 				billingUnusable = true;
@@ -12927,8 +12960,19 @@ var DynamoDBGlobalTableProvider = class {
 			const desiredCeilings = collectTableOnDemandCeilings(properties, currentRegion, diagnostics);
 			const flippingToProvisioned = oldBilling !== newBilling && newBilling === "PROVISIONED";
 			if (flippingToProvisioned) derivePerCallProvisionedThroughput(properties, currentRegion, "seed", diagnostics);
-			const desiredSdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "min", flippingToProvisioned ? void 0 : diagnostics);
-			if (flippingToProvisioned) toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed", diagnostics);
+			let desiredGsiUnusable = false;
+			const onUnusableGsiBlock = (message) => {
+				desiredGsiUnusable = true;
+				this.logger.warn(`${message} No GlobalSecondaryIndexes change is applied by this update; the table's existing indexes are left untouched.`);
+			};
+			let previousGsiUnusable = false;
+			const onUnusablePreviousGsiBlock = (message) => {
+				previousGsiUnusable = true;
+				this.logger.warn(`${message} (recorded in cdkd state, not in the template) — using the table's LIVE indexes as the comparison baseline for this update, so a corrected template still applies.`);
+			};
+			const liveIndexNames = new Set((describeResp.Table?.GlobalSecondaryIndexes ?? []).map((live) => live.IndexName).filter((name) => typeof name === "string"));
+			const desiredSdkIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "min", flippingToProvisioned ? void 0 : diagnostics, onUnusableGsiBlock);
+			if (flippingToProvisioned) toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed", diagnostics, onUnusableGsiBlock);
 			for (const replica of properties["Replicas"] ?? []) {
 				const replicaRegion = asRecord$1(replica)?.["Region"];
 				if (typeof replicaRegion !== "string" || replicaRegion === currentRegion) continue;
@@ -12959,11 +13003,18 @@ var DynamoDBGlobalTableProvider = class {
 				flatChanged = true;
 			}
 			if (properties["StreamSpecification"] !== void 0 && !deepEqual$1(properties["StreamSpecification"], previousProperties["StreamSpecification"])) {
-				flatUpdate.StreamSpecification = {
-					StreamEnabled: true,
-					StreamViewType: readConfigString(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification")
-				};
-				flatChanged = true;
+				let streamSpecUnusable = false;
+				const streamViewType = readConfigString(properties["StreamSpecification"], "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification", { onUnusable: (message) => {
+					streamSpecUnusable = true;
+					this.logger.warn(`${message} The table's existing stream configuration is left untouched for this update rather than re-pointed at the default.`);
+				} });
+				if (!streamSpecUnusable) {
+					flatUpdate.StreamSpecification = {
+						StreamEnabled: true,
+						StreamViewType: streamViewType
+					};
+					flatChanged = true;
+				}
 			}
 			const awsOnDemand = describeResp.Table?.OnDemandThroughput;
 			const onDemandPayload = {};
@@ -12995,11 +13046,13 @@ var DynamoDBGlobalTableProvider = class {
 				};
 				if (newBilling === "PROVISIONED") {
 					billingUpdate.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion, "seed");
-					const provisionedIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed");
+					const provisionedIndexes = toSdkGlobalSecondaryIndexes(properties, currentRegion, newBilling, "seed", void 0, onUnusableGsiBlock);
+					const previousFlipIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, newBilling, "seed", void 0, onUnusablePreviousGsiBlock);
+					if (desiredGsiUnusable || previousGsiUnusable) throw new ProvisioningError(`Cannot flip AWS::DynamoDB::GlobalTable ${logicalId} to PROVISIONED while its GlobalSecondaryIndexes block is unusable: AWS requires per-index provisioned capacity in the same UpdateTable, and it cannot be derived from a malformed block (nor read from a table that is still on-demand). Fix the GlobalSecondaryIndexes value — in the template, or in the cdkd state record on a rollback / drift --revert replay — and re-deploy. The table is unchanged.`, resourceType, logicalId, physicalId);
+					const previousByIndexName = /* @__PURE__ */ new Map();
+					for (const gsi of previousFlipIndexes) if (gsi.IndexName) previousByIndexName.set(gsi.IndexName, gsi);
 					const previousCfnIndexes = previousProperties["GlobalSecondaryIndexes"];
 					const existingIndexNames = new Set((Array.isArray(previousCfnIndexes) ? previousCfnIndexes : []).map((entry) => entry?.["IndexName"]).filter((name) => typeof name === "string"));
-					const previousByIndexName = /* @__PURE__ */ new Map();
-					for (const gsi of toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, newBilling, "seed")) if (gsi.IndexName) previousByIndexName.set(gsi.IndexName, gsi);
 					const byIndexName = new Map(previousByIndexName);
 					const survivingIndexNames = /* @__PURE__ */ new Set();
 					for (const gsi of provisionedIndexes) {
@@ -13121,8 +13174,18 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForReplicaActive(physicalId, region, logicalId);
 			}
-			const previousSdkIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling);
-			const gsiDiff = diffGlobalSecondaryIndexes(previousSdkIndexes, desiredSdkIndexes);
+			const previousTranslatedIndexes = toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, onUnusablePreviousGsiBlock);
+			const previousSdkIndexes = previousGsiUnusable ? desiredSdkIndexes.filter((gsi) => typeof gsi.IndexName === "string" && liveIndexNames.has(gsi.IndexName)) : previousTranslatedIndexes;
+			if (previousGsiUnusable) {
+				const desiredNames = new Set(desiredSdkIndexes.map((gsi) => gsi.IndexName).filter((name) => typeof name === "string"));
+				const liveOnly = [...liveIndexNames].filter((name) => !desiredNames.has(name));
+				if (liveOnly.length > 0) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${liveOnly.join(", ")} exist(s) on the table but not in the template. No Delete is issued while the recorded GlobalSecondaryIndexes are unusable — a junk state record cannot prove cdkd created them. Re-deploy once state carries a valid block to remove them.`);
+			}
+			const gsiDiff = desiredGsiUnusable ? {
+				added: [],
+				removed: [],
+				modified: []
+			} : diffGlobalSecondaryIndexes(previousSdkIndexes, desiredSdkIndexes);
 			const rawOnDemandDeclarations = collectRawOnDemandDeclarations(properties, currentRegion);
 			const previousSdkByName = /* @__PURE__ */ new Map();
 			for (const prev of previousSdkIndexes) if (prev.IndexName) previousSdkByName.set(prev.IndexName, prev);
@@ -13182,7 +13245,10 @@ var DynamoDBGlobalTableProvider = class {
 				}));
 				await this.waitForTableActiveAfterUpdate(physicalId, logicalId);
 			}
-			if (newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") {
+			const skipAutoScalingForUnusableGsi = desiredGsiUnusable && newBilling !== "PAY_PER_REQUEST";
+			const autoScalingMeaningfulForIndexes = (newBilling === "PROVISIONED" || oldBilling === "PROVISIONED") && !skipAutoScalingForUnusableGsi;
+			if (skipAutoScalingForUnusableGsi && oldBilling === "PROVISIONED") this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: skipping the auto-scaling target reconcile because the GlobalSecondaryIndexes block is unusable — the per-index targets are derived from it, so reconciling would deregister the live indexes' scalable targets. Existing targets are left untouched.`);
+			if (autoScalingMeaningfulForIndexes) {
 				if (gsiDiff.added.length > 0) await this.waitForIndexesActive(physicalId, logicalId);
 				await this.reconcileAutoScalingTargets(physicalId, collectAutoScalingTargets(previousProperties, currentRegion), newBilling === "PAY_PER_REQUEST" ? [] : collectAutoScalingTargets(properties, currentRegion), currentRegion, autoScalingApplied);
 			}
@@ -14692,7 +14758,7 @@ function toSdkGlobalSecondaryIndexes(properties, region, billingMode, source = "
 	if (rawIndexes !== void 0 && !Array.isArray(rawIndexes)) {
 		const shapeDetail = `AWS::DynamoDB::GlobalTable GlobalSecondaryIndexes must be an array, got ${typeof rawIndexes} (${JSON.stringify(rawIndexes)?.slice(0, 200)}).`;
 		if (onUnusableIndexes) {
-			onUnusableIndexes(`${shapeDetail} Omitting the malformed block, so this create carries NO indexes; the same value is REFUSED on a template-path create`);
+			onUnusableIndexes(shapeDetail);
 			return [];
 		}
 		throw new Error(`${shapeDetail} An unresolved intrinsic here would otherwise deploy a table with no indexes.`);
@@ -33254,6 +33320,18 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 
 //#endregion
 //#region src/provisioning/providers/appsync-provider.ts
+const MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES = [
+	"UserPoolConfig",
+	"OpenIDConnectConfig",
+	"LambdaAuthorizerConfig",
+	"AdditionalAuthenticationProviders",
+	"EnhancedMetricsConfig",
+	"IntrospectionConfig",
+	"QueryDepthLimit",
+	"ResolverCountLimit",
+	"OwnerContact",
+	"MergedApiExecutionRoleArn"
+];
 /**
 * SDK Provider for AWS AppSync resources
 *
@@ -33291,7 +33369,20 @@ var AppSyncProvider = class {
 			"AuthenticationType",
 			"XrayEnabled",
 			"LogConfig",
-			"Tags"
+			"Tags",
+			"AdditionalAuthenticationProviders",
+			"ApiType",
+			"EnhancedMetricsConfig",
+			"EnvironmentVariables",
+			"IntrospectionConfig",
+			"LambdaAuthorizerConfig",
+			"MergedApiExecutionRoleArn",
+			"OpenIDConnectConfig",
+			"OwnerContact",
+			"QueryDepthLimit",
+			"ResolverCountLimit",
+			"UserPoolConfig",
+			"Visibility"
 		])],
 		["AWS::AppSync::GraphQLSchema", /* @__PURE__ */ new Set([
 			"ApiId",
@@ -33331,9 +33422,9 @@ var AppSyncProvider = class {
 		if (!this.client) this.client = new AppSyncClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
 	}
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::AppSync::GraphQLApi": return this.createGraphQLApi(logicalId, resourceType, properties);
+			case "AWS::AppSync::GraphQLApi": return this.createGraphQLApi(logicalId, resourceType, properties, context);
 			case "AWS::AppSync::GraphQLSchema": return this.createGraphQLSchema(logicalId, resourceType, properties);
 			case "AWS::AppSync::DataSource": return this.createDataSource(logicalId, resourceType, properties);
 			case "AWS::AppSync::Resolver": return this.createResolver(logicalId, resourceType, properties);
@@ -33389,6 +33480,7 @@ var AppSyncProvider = class {
 	}
 	async updateGraphQLApi(logicalId, physicalId, resourceType, properties, previousProperties) {
 		if (properties["Name"] !== void 0 && previousProperties["Name"] !== void 0 && properties["Name"] !== previousProperties["Name"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS AppSync GraphqlApi.Name is immutable — destroy + redeploy to rename");
+		for (const immutable of ["ApiType", "Visibility"]) if (properties[immutable] !== void 0 && previousProperties[immutable] !== void 0 && properties[immutable] !== previousProperties[immutable]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS AppSync GraphqlApi.${immutable} is immutable — destroy + redeploy to change it`);
 		const newAuthType = properties["AuthenticationType"];
 		const oldAuthType = previousProperties["AuthenticationType"];
 		const newXray = properties["XrayEnabled"];
@@ -33398,7 +33490,8 @@ var AppSyncProvider = class {
 		const hasXrayDiff = ("XrayEnabled" in properties || "XrayEnabled" in previousProperties) && newXray !== oldXray;
 		const hasAuthDiff = ("AuthenticationType" in properties || "AuthenticationType" in previousProperties) && newAuthType !== oldAuthType;
 		const hasLogDiff = ("LogConfig" in properties || "LogConfig" in previousProperties) && !this.deepEqual(newLog, oldLog);
-		if (hasAuthDiff || hasXrayDiff || hasLogDiff) {
+		const hasConfigDiff = MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES.some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]));
+		if (hasAuthDiff || hasXrayDiff || hasLogDiff || hasConfigDiff) {
 			const input = {
 				apiId: physicalId,
 				name: properties["Name"] ?? previousProperties["Name"],
@@ -33418,17 +33511,26 @@ var AppSyncProvider = class {
 				};
 				else this.logger.warn(`AppSync GraphqlApi ${logicalId}: cannot clear LogConfig — previous state has no CloudWatchLogsRoleArn to reuse for the disable call`);
 			}
+			this.applyGraphQLApiConfig(input, properties, {
+				forUpdate: true,
+				previousProperties,
+				logicalId,
+				shapeGuard: {
+					logicalId,
+					onUnusable: (message) => this.logger.warn(`${message} (leaving the live value untouched)`)
+				}
+			});
 			try {
 				await this.getClient().send(new UpdateGraphqlApiCommand(input));
 			} catch (error) {
 				throw this.wrapUpdateError(error, resourceType, logicalId, physicalId, "GraphqlApi");
 			}
 		}
+		await this.applyEnvironmentVariables(physicalId, resourceType, logicalId, properties, previousProperties);
 		await this.applyTagDiff(physicalId, resourceType, logicalId, previousProperties["Tags"], properties["Tags"]);
 		return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 	}
 	async updateGraphQLSchema(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -33436,8 +33538,7 @@ var AppSyncProvider = class {
 		const oldDef = previousProperties["Definition"];
 		if (newDef === void 0 || newDef === oldDef) return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 		const apiId = properties["ApiId"] ?? physicalId;
 		try {
@@ -33450,8 +33551,7 @@ var AppSyncProvider = class {
 		}
 		return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 	}
 	async updateDataSource(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -33479,8 +33579,7 @@ var AppSyncProvider = class {
 		const oldHttp = previousProperties["HttpConfig"];
 		if (!(newDesc !== oldDesc || newRole !== oldRole || !this.deepEqual(newDDB, oldDDB) || !this.deepEqual(newLambda, oldLambda) || !this.deepEqual(newHttp, oldHttp))) return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 		const input = {
 			apiId,
@@ -33503,8 +33602,7 @@ var AppSyncProvider = class {
 		}
 		return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 	}
 	async updateResolver(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -33530,8 +33628,7 @@ var AppSyncProvider = class {
 			"Code"
 		].some((key) => !this.deepEqual(properties[key], previousProperties[key]))) return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 		const input = {
 			apiId,
@@ -33559,8 +33656,7 @@ var AppSyncProvider = class {
 		}
 		return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 	}
 	async updateApiKey(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -33573,8 +33669,7 @@ var AppSyncProvider = class {
 		const oldExp = previousProperties["Expires"];
 		if (newDesc === oldDesc && newExp === oldExp) return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 		const input = {
 			apiId,
@@ -33589,8 +33684,7 @@ var AppSyncProvider = class {
 		}
 		return {
 			physicalId,
-			wasReplaced: false,
-			attributes: {}
+			wasReplaced: false
 		};
 	}
 	/**
@@ -33677,11 +33771,212 @@ var AppSyncProvider = class {
 		if (resourceType === "AWS::AppSync::GraphQLSchema") return ["DefinitionS3Location"];
 		return [];
 	}
-	async createGraphQLApi(logicalId, resourceType, properties) {
+	/**
+	* Read a nested config container.
+	*
+	* A present-but-NOT-an-object value (an unresolved intrinsic, a mis-nested
+	* L1, a string where the template meant a block) must never fall through as
+	* "absent" — that reintroduces the very silent-drop class this batch closes
+	* (see `src/provisioning/config-shape.ts`'s "Never infer a default from a
+	* possibly-malformed value"). An ABSENT container keeps returning
+	* `undefined`, which is a legitimate "not configured".
+	*/
+	asObject(value, path, options) {
+		if (value == null) return void 0;
+		if (typeof value === "object" && !Array.isArray(value)) return value;
+		const message = `AWS::AppSync::GraphQLApi ${path} must be an object, got ${Array.isArray(value) ? "array" : typeof value} — cdkd refuses to drop it silently`;
+		if (options?.onUnusable) {
+			options.onUnusable(message);
+			return;
+		}
+		throw new ProvisioningError(message, "AWS::AppSync::GraphQLApi", options?.logicalId ?? "");
+	}
+	/**
+	* NOTE: `awsRegion` / `defaultAction` are passed through VERBATIM, including
+	* when the template omits them. cdkd deliberately does NOT substitute a
+	* default: `DefaultAction` decides whether an unauthenticated request is
+	* ALLOWed or DENYed, so inventing one would be a security decision made on
+	* the user's behalf, and what CloudFormation itself defaults here has not
+	* been A/B-verified. An omitted required member reaches AWS as a LOUD
+	* validation error naming the field — not a silent drop.
+	*/
+	toSdkUserPoolConfig(value, path = "UserPoolConfig", options) {
+		const cfn = this.asObject(value, path, options);
+		if (!cfn) return void 0;
+		return {
+			userPoolId: cfn["UserPoolId"],
+			awsRegion: cfn["AwsRegion"],
+			defaultAction: cfn["DefaultAction"],
+			...cfn["AppIdClientRegex"] !== void 0 ? { appIdClientRegex: cfn["AppIdClientRegex"] } : {}
+		};
+	}
+	/**
+	* The `UserPoolConfig` nested under an ADDITIONAL auth provider is a
+	* DIFFERENT shape from the top-level one — AWS models it as
+	* `CognitoUserPoolConfig`, which has no `defaultAction` member.
+	*/
+	toSdkCognitoUserPoolConfig(value, path = "UserPoolConfig", options) {
+		const cfn = this.asObject(value, path, options);
+		if (!cfn) return void 0;
+		return {
+			userPoolId: cfn["UserPoolId"],
+			awsRegion: cfn["AwsRegion"],
+			...cfn["AppIdClientRegex"] !== void 0 ? { appIdClientRegex: cfn["AppIdClientRegex"] } : {}
+		};
+	}
+	toSdkOpenIDConnectConfig(value, path = "OpenIDConnectConfig", options) {
+		const cfn = this.asObject(value, path, options);
+		if (!cfn) return void 0;
+		return {
+			issuer: cfn["Issuer"],
+			...cfn["ClientId"] !== void 0 ? { clientId: cfn["ClientId"] } : {},
+			...cfn["IatTTL"] !== void 0 ? { iatTTL: cfn["IatTTL"] } : {},
+			...cfn["AuthTTL"] !== void 0 ? { authTTL: cfn["AuthTTL"] } : {}
+		};
+	}
+	toSdkLambdaAuthorizerConfig(value, path = "LambdaAuthorizerConfig", options) {
+		const cfn = this.asObject(value, path, options);
+		if (!cfn) return void 0;
+		return {
+			authorizerUri: cfn["AuthorizerUri"],
+			...cfn["AuthorizerResultTtlInSeconds"] !== void 0 ? { authorizerResultTtlInSeconds: cfn["AuthorizerResultTtlInSeconds"] } : {},
+			...cfn["IdentityValidationExpression"] !== void 0 ? { identityValidationExpression: cfn["IdentityValidationExpression"] } : {}
+		};
+	}
+	toSdkAdditionalAuthProviders(value, options) {
+		if (value == null) return void 0;
+		let entries;
+		try {
+			entries = requireConfigArray(value, "AWS::AppSync::GraphQLApi AdditionalAuthenticationProviders");
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			if (options?.onUnusable) {
+				options.onUnusable(message);
+				return;
+			}
+			throw new ProvisioningError(message, "AWS::AppSync::GraphQLApi", options?.logicalId ?? "", void 0, error instanceof Error ? error : void 0);
+		}
+		return entries.map((entry, index) => {
+			const at = `AdditionalAuthenticationProviders[${index}]`;
+			const cfn = this.asObject(entry, at, options) ?? {};
+			const provider = {};
+			if (cfn["AuthenticationType"] !== void 0) provider.authenticationType = cfn["AuthenticationType"];
+			const oidc = this.toSdkOpenIDConnectConfig(cfn["OpenIDConnectConfig"], `${at}.OpenIDConnectConfig`, options);
+			if (oidc) provider.openIDConnectConfig = oidc;
+			const pool = this.toSdkCognitoUserPoolConfig(cfn["UserPoolConfig"], `${at}.UserPoolConfig`);
+			if (pool) provider.userPoolConfig = pool;
+			const lambda = this.toSdkLambdaAuthorizerConfig(cfn["LambdaAuthorizerConfig"], `${at}.LambdaAuthorizerConfig`, options);
+			if (lambda) provider.lambdaAuthorizerConfig = lambda;
+			return provider;
+		});
+	}
+	toSdkEnhancedMetricsConfig(value, options) {
+		const cfn = this.asObject(value, "EnhancedMetricsConfig", options);
+		if (!cfn) return void 0;
+		return {
+			resolverLevelMetricsBehavior: cfn["ResolverLevelMetricsBehavior"],
+			dataSourceLevelMetricsBehavior: cfn["DataSourceLevelMetricsBehavior"],
+			operationLevelMetricsConfig: cfn["OperationLevelMetricsConfig"]
+		};
+	}
+	/**
+	* Fill the config members shared by `CreateGraphqlApi` and
+	* `UpdateGraphqlApi` from the CFn property bag.
+	*
+	* `ApiType` / `Visibility` are deliberately NOT here: the SDK's update
+	* input has no member for either (they are create-only on AWS), so
+	* `updateGraphQLApi` refuses the change and the replacement rule in
+	* `src/analyzer/replacement-rules.ts` routes it through CREATE+DELETE.
+	*
+	* `forUpdate` turns on the removal sentinels: on UPDATE a property the
+	* user DELETED from the template must be actively reset, because
+	* AppSync treats an omitted member as "no change" (the same semantic
+	* `LogConfig`'s clearing branch documents below). Only the members AWS
+	* gives a sentinel for can be reset that way — `MergedApiExecutionRoleArn`
+	* and the three auth-config blocks have none, so their removal is
+	* reported to the user instead of silently no-op'ing.
+	*/
+	applyGraphQLApiConfig(input, properties, options) {
+		const forUpdate = options?.forUpdate === true;
+		const previous = options?.previousProperties ?? {};
+		const guard = options?.shapeGuard ?? (options?.logicalId !== void 0 ? { logicalId: options.logicalId } : {});
+		const removed = (key) => forUpdate && properties[key] === void 0 && previous[key] !== void 0;
+		const userPool = this.toSdkUserPoolConfig(properties["UserPoolConfig"], "UserPoolConfig", guard);
+		if (userPool) input.userPoolConfig = userPool;
+		const oidc = this.toSdkOpenIDConnectConfig(properties["OpenIDConnectConfig"], "OpenIDConnectConfig", guard);
+		if (oidc) input.openIDConnectConfig = oidc;
+		const lambdaAuth = this.toSdkLambdaAuthorizerConfig(properties["LambdaAuthorizerConfig"], "LambdaAuthorizerConfig", guard);
+		if (lambdaAuth) input.lambdaAuthorizerConfig = lambdaAuth;
+		const additional = this.toSdkAdditionalAuthProviders(properties["AdditionalAuthenticationProviders"], guard);
+		if (additional) input.additionalAuthenticationProviders = additional;
+		else if (removed("AdditionalAuthenticationProviders")) input.additionalAuthenticationProviders = [];
+		const metrics = this.toSdkEnhancedMetricsConfig(properties["EnhancedMetricsConfig"], guard);
+		if (metrics) input.enhancedMetricsConfig = metrics;
+		if (properties["IntrospectionConfig"] !== void 0) input.introspectionConfig = properties["IntrospectionConfig"];
+		else if (removed("IntrospectionConfig")) input.introspectionConfig = "ENABLED";
+		if (properties["QueryDepthLimit"] !== void 0) input.queryDepthLimit = properties["QueryDepthLimit"];
+		else if (removed("QueryDepthLimit")) input.queryDepthLimit = 0;
+		if (properties["ResolverCountLimit"] !== void 0) input.resolverCountLimit = properties["ResolverCountLimit"];
+		else if (removed("ResolverCountLimit")) input.resolverCountLimit = 0;
+		if (properties["OwnerContact"] !== void 0) input.ownerContact = properties["OwnerContact"];
+		else if (removed("OwnerContact")) input.ownerContact = "";
+		if (properties["MergedApiExecutionRoleArn"] !== void 0) input.mergedApiExecutionRoleArn = properties["MergedApiExecutionRoleArn"];
+		if (forUpdate) {
+			for (const key of [
+				"MergedApiExecutionRoleArn",
+				"UserPoolConfig",
+				"OpenIDConnectConfig",
+				"LambdaAuthorizerConfig",
+				"EnhancedMetricsConfig"
+			]) if (removed(key)) this.logger.warn(`AppSync GraphqlApi ${options?.logicalId ?? ""}: cannot clear ${key} on update — AppSync has no reset sentinel for it and treats an omitted member as "no change". Destroy + redeploy the API to drop it.`);
+		}
+	}
+	/**
+	* `EnvironmentVariables` lives on its OWN API pair
+	* (`PutGraphqlApiEnvironmentVariables` / `Get...`), not on
+	* Create/UpdateGraphqlApi. The PUT is whole-map replace, so a removed
+	* key is cleared by re-putting the remaining map (and `{}` clears all).
+	*/
+	async applyEnvironmentVariables(apiId, resourceType, logicalId, properties, previousProperties, replayingState = false) {
+		const isUpdate = previousProperties !== void 0;
+		let desired;
+		try {
+			desired = this.asObject(properties["EnvironmentVariables"], "EnvironmentVariables", { logicalId });
+		} catch (error) {
+			if (!isUpdate && !replayingState) throw error;
+			this.logger.warn(`AppSync GraphqlApi ${logicalId}: ${error instanceof Error ? error.message : String(error)} — leaving the live environment variables untouched`);
+			return;
+		}
+		let previous;
+		if (previousProperties) {
+			const raw = previousProperties["EnvironmentVariables"];
+			previous = raw != null && typeof raw === "object" && !Array.isArray(raw) ? raw : void 0;
+		}
+		if (desired === void 0 && previous === void 0) return;
+		if (isUpdate && this.deepEqual(desired, previous)) return;
+		const environmentVariables = {};
+		for (const [key, value] of Object.entries(desired ?? {})) if (typeof value === "string") environmentVariables[key] = value;
+		else if (typeof value === "number" && Number.isFinite(value) || typeof value === "boolean") environmentVariables[key] = String(value);
+		else throw new ProvisioningError(`AWS::AppSync::GraphQLApi EnvironmentVariables.${key} must be a string, got ${Array.isArray(value) ? "array" : value === null ? "null" : typeof value}`, resourceType, logicalId, apiId);
+		try {
+			await this.getClient().send(new PutGraphqlApiEnvironmentVariablesCommand({
+				apiId,
+				environmentVariables
+			}));
+		} catch (error) {
+			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, isUpdate ? "GraphqlApi (env vars)" : "GraphqlApi (env vars, post-create)");
+		}
+	}
+	async createGraphQLApi(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating GraphQL API ${logicalId}`);
 		const name = properties["Name"];
 		if (!name) throw new ProvisioningError(`Name is required for GraphQLApi ${logicalId}`, resourceType, logicalId);
 		const authenticationType = properties["AuthenticationType"];
+		let createdApiId;
+		const shapeGuard = {
+			logicalId,
+			...context?.replayingState === true ? { onUnusable: (message) => this.logger.warn(`${message} (state replay — proceeding without it)`) } : {}
+		};
 		try {
 			const input = {
 				name,
@@ -33702,10 +33997,18 @@ var AppSyncProvider = class {
 				for (const tag of tags) tagMap[tag.Key] = tag.Value;
 				input.tags = tagMap;
 			}
+			this.applyGraphQLApiConfig(input, properties, {
+				logicalId,
+				shapeGuard
+			});
+			if (properties["ApiType"] !== void 0) input.apiType = properties["ApiType"];
+			if (properties["Visibility"] !== void 0) input.visibility = properties["Visibility"];
 			const response = await this.getClient().send(new CreateGraphqlApiCommand(input));
+			createdApiId = response.graphqlApi?.apiId;
 			const apiId = response.graphqlApi.apiId;
 			const arn = response.graphqlApi.arn;
 			const graphQLUrl = response.graphqlApi.uris?.["GRAPHQL"] ?? "";
+			await this.applyEnvironmentVariables(apiId, resourceType, logicalId, properties, void 0, context?.replayingState === true);
 			this.logger.debug(`Successfully created GraphQL API ${logicalId}: ${apiId}`);
 			return {
 				physicalId: apiId,
@@ -33716,6 +34019,12 @@ var AppSyncProvider = class {
 				}
 			};
 		} catch (error) {
+			if (createdApiId) try {
+				await this.getClient().send(new DeleteGraphqlApiCommand({ apiId: createdApiId }));
+				this.logger.debug(`Rolled back partially-created GraphQL API ${createdApiId}`);
+			} catch (rollbackError) {
+				this.logger.warn(`Failed to roll back partially-created GraphQL API ${createdApiId}: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
+			}
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create GraphQL API ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
@@ -34039,8 +34348,62 @@ var AppSyncProvider = class {
 			result["LogConfig"] = log;
 		}
 		result["Tags"] = normalizeAwsTagsToCfn(api.tags);
+		if (api.userPoolConfig) result["UserPoolConfig"] = this.userPoolConfigToCfn(api.userPoolConfig);
+		if (api.openIDConnectConfig) result["OpenIDConnectConfig"] = this.openIDConnectConfigToCfn(api.openIDConnectConfig);
+		if (api.lambdaAuthorizerConfig) result["LambdaAuthorizerConfig"] = this.lambdaAuthorizerConfigToCfn(api.lambdaAuthorizerConfig);
+		if (api.additionalAuthenticationProviders) result["AdditionalAuthenticationProviders"] = api.additionalAuthenticationProviders.map((provider) => {
+			const entry = {};
+			if (provider.authenticationType !== void 0) entry["AuthenticationType"] = provider.authenticationType;
+			if (provider.openIDConnectConfig) entry["OpenIDConnectConfig"] = this.openIDConnectConfigToCfn(provider.openIDConnectConfig);
+			if (provider.userPoolConfig) entry["UserPoolConfig"] = this.userPoolConfigToCfn(provider.userPoolConfig);
+			if (provider.lambdaAuthorizerConfig) entry["LambdaAuthorizerConfig"] = this.lambdaAuthorizerConfigToCfn(provider.lambdaAuthorizerConfig);
+			return entry;
+		});
+		if (api.enhancedMetricsConfig) {
+			const metrics = {};
+			if (api.enhancedMetricsConfig.resolverLevelMetricsBehavior !== void 0) metrics["ResolverLevelMetricsBehavior"] = api.enhancedMetricsConfig.resolverLevelMetricsBehavior;
+			if (api.enhancedMetricsConfig.dataSourceLevelMetricsBehavior !== void 0) metrics["DataSourceLevelMetricsBehavior"] = api.enhancedMetricsConfig.dataSourceLevelMetricsBehavior;
+			if (api.enhancedMetricsConfig.operationLevelMetricsConfig !== void 0) metrics["OperationLevelMetricsConfig"] = api.enhancedMetricsConfig.operationLevelMetricsConfig;
+			result["EnhancedMetricsConfig"] = metrics;
+		}
+		if (api.apiType !== void 0) result["ApiType"] = api.apiType;
+		if (api.visibility !== void 0) result["Visibility"] = api.visibility;
+		if (api.introspectionConfig !== void 0) result["IntrospectionConfig"] = api.introspectionConfig;
+		if (api.queryDepthLimit !== void 0) result["QueryDepthLimit"] = api.queryDepthLimit;
+		if (api.resolverCountLimit !== void 0) result["ResolverCountLimit"] = api.resolverCountLimit;
+		if (api.ownerContact !== void 0) result["OwnerContact"] = api.ownerContact;
+		if (api.mergedApiExecutionRoleArn !== void 0) result["MergedApiExecutionRoleArn"] = api.mergedApiExecutionRoleArn;
+		try {
+			const envResp = await this.getClient().send(new GetGraphqlApiEnvironmentVariablesCommand({ apiId: physicalId }));
+			if (envResp.environmentVariables !== void 0) result["EnvironmentVariables"] = envResp.environmentVariables;
+		} catch (err) {
+			this.logger.warn(`Could not read AppSync GraphqlApi ${physicalId} environment variables (drift on that property will not be reported): ${err instanceof Error ? err.message : String(err)}`);
+		}
 		return result;
 	}
+	userPoolConfigToCfn(config) {
+		const out = {};
+		if (config.userPoolId !== void 0) out["UserPoolId"] = config.userPoolId;
+		if (config.awsRegion !== void 0) out["AwsRegion"] = config.awsRegion;
+		if ("defaultAction" in config && config.defaultAction !== void 0) out["DefaultAction"] = config.defaultAction;
+		if (config.appIdClientRegex !== void 0) out["AppIdClientRegex"] = config.appIdClientRegex;
+		return out;
+	}
+	openIDConnectConfigToCfn(config) {
+		const out = {};
+		if (config.issuer !== void 0) out["Issuer"] = config.issuer;
+		if (config.clientId !== void 0) out["ClientId"] = config.clientId;
+		if (config.iatTTL !== void 0) out["IatTTL"] = config.iatTTL;
+		if (config.authTTL !== void 0) out["AuthTTL"] = config.authTTL;
+		return out;
+	}
+	lambdaAuthorizerConfigToCfn(config) {
+		const out = {};
+		if (config.authorizerUri !== void 0) out["AuthorizerUri"] = config.authorizerUri;
+		if (config.authorizerResultTtlInSeconds !== void 0) out["AuthorizerResultTtlInSeconds"] = config.authorizerResultTtlInSeconds;
+		if (config.identityValidationExpression !== void 0) out["IdentityValidationExpression"] = config.identityValidationExpression;
+		return out;
+	}
 	async readDataSource(physicalId) {
 		const [apiId, name] = physicalId.split("|");
 		if (!apiId || !name) return void 0;
@@ -67739,7 +68102,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.52");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.54");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;