@go-to-k/cdkd 0.278.55 → 0.280.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-CJkdO-cZ.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-DRLo8PHT.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BSJ8OWXR.js";
+import { t as ASGProvider } from "./asg-provider-XOMGgJrK.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -17445,11 +17445,17 @@ var EC2Provider = class {
 			"RouteTableId",
 			"DestinationCidrBlock",
 			"DestinationIpv6CidrBlock",
+			"DestinationPrefixListId",
+			"CarrierGatewayId",
+			"CoreNetworkArn",
 			"GatewayId",
+			"LocalGatewayId",
 			"NatGatewayId",
 			"EgressOnlyInternetGatewayId",
 			"InstanceId",
 			"NetworkInterfaceId",
+			"TransitGatewayId",
+			"VpcEndpointId",
 			"VpcPeeringConnectionId"
 		])],
 		["AWS::EC2::SubnetRouteTableAssociation", /* @__PURE__ */ new Set(["SubnetId", "RouteTableId"])],
@@ -18227,21 +18233,26 @@ var EC2Provider = class {
 		const routeTableId = properties["RouteTableId"];
 		const destinationCidrBlock = properties["DestinationCidrBlock"];
 		const destinationIpv6CidrBlock = properties["DestinationIpv6CidrBlock"];
-		const cidr = destinationCidrBlock || destinationIpv6CidrBlock;
-		if (!routeTableId || !cidr) throw new ProvisioningError(`RouteTableId and DestinationCidrBlock/DestinationIpv6CidrBlock are required for Route ${logicalId}`, resourceType, logicalId);
-		const isIpv6 = !destinationCidrBlock && !!destinationIpv6CidrBlock;
+		const destinationPrefixListId = properties["DestinationPrefixListId"];
+		const destination = destinationCidrBlock || destinationIpv6CidrBlock || destinationPrefixListId;
+		if (!routeTableId || !destination) throw new ProvisioningError(`RouteTableId and one of DestinationCidrBlock/DestinationIpv6CidrBlock/DestinationPrefixListId are required for Route ${logicalId}`, resourceType, logicalId);
 		try {
 			await this.ec2Client.send(new CreateRouteCommand({
 				RouteTableId: routeTableId,
-				...isIpv6 ? { DestinationIpv6CidrBlock: destinationIpv6CidrBlock } : { DestinationCidrBlock: destinationCidrBlock },
+				...destinationCidrBlock ? { DestinationCidrBlock: destinationCidrBlock } : destinationIpv6CidrBlock ? { DestinationIpv6CidrBlock: destinationIpv6CidrBlock } : { DestinationPrefixListId: destinationPrefixListId },
+				CarrierGatewayId: properties["CarrierGatewayId"] ?? void 0,
+				CoreNetworkArn: properties["CoreNetworkArn"] ?? void 0,
 				GatewayId: properties["GatewayId"] ?? void 0,
+				LocalGatewayId: properties["LocalGatewayId"] ?? void 0,
 				NatGatewayId: properties["NatGatewayId"] ?? void 0,
 				EgressOnlyInternetGatewayId: properties["EgressOnlyInternetGatewayId"] ?? void 0,
 				InstanceId: properties["InstanceId"] ?? void 0,
 				NetworkInterfaceId: properties["NetworkInterfaceId"] ?? void 0,
+				TransitGatewayId: properties["TransitGatewayId"] ?? void 0,
+				VpcEndpointId: properties["VpcEndpointId"] ?? void 0,
 				VpcPeeringConnectionId: properties["VpcPeeringConnectionId"] ?? void 0
 			}));
-			const physicalId = `${routeTableId}|${cidr}`;
+			const physicalId = `${routeTableId}|${destination}`;
 			this.logger.debug(`Successfully created Route ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
@@ -18275,13 +18286,13 @@ var EC2Provider = class {
 	async deleteRoute(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting Route ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
-		if (parts.length !== 2) throw new ProvisioningError(`Invalid physicalId format for Route ${logicalId}: expected "RouteTableId|DestinationCidrBlock", got "${physicalId}"`, resourceType, logicalId, physicalId);
-		const [routeTableId, destinationCidrBlock] = parts;
+		if (parts.length !== 2) throw new ProvisioningError(`Invalid physicalId format for Route ${logicalId}: expected "RouteTableId|Destination", got "${physicalId}"`, resourceType, logicalId, physicalId);
+		const [routeTableId, destination] = parts;
 		try {
-			const isIpv6 = destinationCidrBlock?.includes(":");
+			const destinationParam = destination?.includes(":") ? { DestinationIpv6CidrBlock: destination } : destination?.startsWith("pl-") ? { DestinationPrefixListId: destination } : { DestinationCidrBlock: destination };
 			await this.ec2Client.send(new DeleteRouteCommand({
 				RouteTableId: routeTableId,
-				...isIpv6 ? { DestinationIpv6CidrBlock: destinationCidrBlock } : { DestinationCidrBlock: destinationCidrBlock }
+				...destinationParam
 			}));
 			this.logger.debug(`Successfully deleted Route ${logicalId}`);
 		} catch (error) {
@@ -19856,28 +19867,31 @@ var EC2Provider = class {
 	/**
 	* AWS::EC2::Route readCurrentState.
 	*
-	* physicalId format: `<routeTableId>|<cidr>` where cidr is either v4 or v6.
+	* physicalId format: `<routeTableId>|<destination>` where destination is a
+	* v4 CIDR, a v6 CIDR, or a managed prefix list id (`pl-...`).
 	* AWS API: `DescribeRouteTables(routeTableId)` → walk `Routes[]` for the
-	* entry whose `DestinationCidrBlock` or `DestinationIpv6CidrBlock` matches
-	* the cidr. Returns `undefined` when the route table is gone or the route
-	* has been removed.
+	* entry whose `DestinationCidrBlock`, `DestinationIpv6CidrBlock`, or
+	* `DestinationPrefixListId` matches the destination. Returns `undefined`
+	* when the route table is gone or the route has been removed.
 	*
 	* Surfaces the target field (`GatewayId` / `NatGatewayId` / `InstanceId` /
 	* `NetworkInterfaceId` / `VpcPeeringConnectionId` / `EgressOnlyInternetGatewayId` /
-	* `TransitGatewayId` / `VpcEndpointId`) AWS reports for that route. Drift
-	* signal: route target changed.
+	* `TransitGatewayId` / `LocalGatewayId` / `CarrierGatewayId` / `CoreNetworkArn` /
+	* `VpcEndpointId`) AWS reports for that route. Drift signal: route target changed.
 	*/
 	async readRouteCurrentState(physicalId) {
-		const [rtbId, cidr] = physicalId.split("|");
-		if (!rtbId || !cidr) return void 0;
+		const [rtbId, destination] = physicalId.split("|");
+		if (!rtbId || !destination) return void 0;
 		const rtb = (await this.ec2Client.send(new DescribeRouteTablesCommand({ RouteTableIds: [rtbId] }))).RouteTables?.[0];
 		if (!rtb) return void 0;
-		const route = rtb.Routes?.find((r) => r.DestinationCidrBlock === cidr || r.DestinationIpv6CidrBlock === cidr);
+		const route = rtb.Routes?.find((r) => r.DestinationCidrBlock === destination || r.DestinationIpv6CidrBlock === destination || r.DestinationPrefixListId === destination);
 		if (!route) return void 0;
 		const result = { RouteTableId: rtbId };
 		if (route.DestinationCidrBlock !== void 0) result["DestinationCidrBlock"] = route.DestinationCidrBlock;
 		else if (route.DestinationIpv6CidrBlock !== void 0) result["DestinationIpv6CidrBlock"] = route.DestinationIpv6CidrBlock;
-		if (route.GatewayId !== void 0) result["GatewayId"] = route.GatewayId;
+		else if (route.DestinationPrefixListId !== void 0) result["DestinationPrefixListId"] = route.DestinationPrefixListId;
+		if (route.GatewayId !== void 0) if (route.GatewayId.startsWith("vpce-")) result["VpcEndpointId"] = route.GatewayId;
+		else result["GatewayId"] = route.GatewayId;
 		if (route.NatGatewayId !== void 0) result["NatGatewayId"] = route.NatGatewayId;
 		if (route.InstanceId !== void 0) result["InstanceId"] = route.InstanceId;
 		if (route.NetworkInterfaceId !== void 0) result["NetworkInterfaceId"] = route.NetworkInterfaceId;
@@ -20252,7 +20266,13 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			"Tags",
 			"TracingEnabled",
 			"Variables",
-			"MethodSettings"
+			"MethodSettings",
+			"AccessLogSetting",
+			"CacheClusterEnabled",
+			"CacheClusterSize",
+			"CanarySetting",
+			"ClientCertificateId",
+			"DocumentationVersion"
 		])],
 		["AWS::ApiGateway::Method", /* @__PURE__ */ new Set([
 			"RestApiId",
@@ -20735,7 +20755,12 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 		const stageName = properties["StageName"];
 		const deploymentId = properties["DeploymentId"];
 		if (!restApiId || !stageName || !deploymentId) throw new ProvisioningError(`RestApiId, StageName, and DeploymentId are required for API Gateway Stage ${logicalId}`, resourceType, logicalId);
+		for (const key of ["AccessLogSetting", "CanarySetting"]) {
+			const block = properties[key];
+			if (block != null && !isPlainObjectBlock(block)) throw new ProvisioningError(`AWS::ApiGateway::Stage ${key} for ${logicalId} must be an object block; got ${Array.isArray(block) ? "an array" : typeof block}. Fix the template value instead of letting cdkd drop the config.`, resourceType, logicalId);
+		}
 		try {
+			const rawCacheClusterSize = properties["CacheClusterSize"];
 			await this.apiGatewayClient.send(new CreateStageCommand({
 				restApiId,
 				stageName,
@@ -20743,15 +20768,38 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				description: properties["Description"],
 				tracingEnabled: properties["TracingEnabled"],
 				variables: properties["Variables"],
-				tags: this.cfnTagsToRecord(properties["Tags"])
+				tags: this.cfnTagsToRecord(properties["Tags"]),
+				cacheClusterEnabled: properties["CacheClusterEnabled"],
+				cacheClusterSize: rawCacheClusterSize != null ? String(rawCacheClusterSize) : void 0,
+				documentationVersion: properties["DocumentationVersion"],
+				canarySettings: toSdkCanarySettings(properties["CanarySetting"])
 			}));
 			const methodSettings = properties["MethodSettings"];
-			const methodSettingsOps = buildMethodSettingsPatchOps(void 0, methodSettings);
-			if (methodSettingsOps.length > 0) try {
+			const postCreateOps = buildMethodSettingsPatchOps(void 0, methodSettings);
+			const accessLogSetting = properties["AccessLogSetting"];
+			if (accessLogSetting != null) {
+				if (accessLogSetting.DestinationArn !== void 0) postCreateOps.push({
+					op: "replace",
+					path: "/accessLogSettings/destinationArn",
+					value: normalizeAccessLogDestinationArn(String(accessLogSetting.DestinationArn))
+				});
+				if (accessLogSetting.Format !== void 0) postCreateOps.push({
+					op: "replace",
+					path: "/accessLogSettings/format",
+					value: String(accessLogSetting.Format)
+				});
+			}
+			const clientCertificateId = properties["ClientCertificateId"];
+			if (clientCertificateId !== void 0) postCreateOps.push({
+				op: "replace",
+				path: "/clientCertificateId",
+				value: clientCertificateId
+			});
+			if (postCreateOps.length > 0) try {
 				await this.apiGatewayClient.send(new UpdateStageCommand({
 					restApiId,
 					stageName,
-					patchOperations: methodSettingsOps
+					patchOperations: postCreateOps
 				}));
 			} catch (patchError) {
 				try {
@@ -20760,7 +20808,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 						stageName
 					}));
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up stage ${stageName} after a MethodSettings patch failure: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+					this.logger.warn(`Failed to clean up stage ${stageName} after a post-create patch failure: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
 				}
 				throw patchError;
 			}
@@ -20803,6 +20851,91 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			path: "/tracingEnabled",
 			value: String(tracingEnabled ?? false)
 		});
+		const cacheClusterEnabled = properties["CacheClusterEnabled"];
+		if (cacheClusterEnabled !== previousProperties["CacheClusterEnabled"]) patchOperations.push({
+			op: "replace",
+			path: "/cacheClusterEnabled",
+			value: String(cacheClusterEnabled ?? false)
+		});
+		const rawCacheClusterSize = properties["CacheClusterSize"];
+		const prevRawCacheClusterSize = previousProperties["CacheClusterSize"];
+		if (rawCacheClusterSize != null && (prevRawCacheClusterSize == null || String(rawCacheClusterSize) !== String(prevRawCacheClusterSize))) patchOperations.push({
+			op: "replace",
+			path: "/cacheClusterSize",
+			value: String(rawCacheClusterSize)
+		});
+		const clientCertificateId = properties["ClientCertificateId"];
+		if (clientCertificateId !== previousProperties["ClientCertificateId"]) patchOperations.push({
+			op: "replace",
+			path: "/clientCertificateId",
+			value: clientCertificateId ?? ""
+		});
+		const documentationVersion = properties["DocumentationVersion"];
+		if (documentationVersion !== previousProperties["DocumentationVersion"]) patchOperations.push({
+			op: "replace",
+			path: "/documentationVersion",
+			value: documentationVersion ?? ""
+		});
+		const rawAccessLog = properties["AccessLogSetting"];
+		const accessLogMalformed = rawAccessLog != null && !isPlainObjectBlock(rawAccessLog);
+		if (accessLogMalformed) this.logger.warn(`AWS::ApiGateway::Stage AccessLogSetting for ${logicalId} is not an object block (got ${Array.isArray(rawAccessLog) ? "an array" : typeof rawAccessLog}); leaving the live access-log config untouched.`);
+		const accessLog = accessLogMalformed ? void 0 : rawAccessLog;
+		const prevAccessLog = previousProperties["AccessLogSetting"];
+		if (accessLogMalformed) {} else if (accessLog == null) {
+			if (prevAccessLog != null) patchOperations.push({
+				op: "remove",
+				path: "/accessLogSettings"
+			});
+		} else {
+			if (accessLog.DestinationArn !== prevAccessLog?.DestinationArn) patchOperations.push({
+				op: "replace",
+				path: "/accessLogSettings/destinationArn",
+				value: accessLog.DestinationArn !== void 0 ? normalizeAccessLogDestinationArn(String(accessLog.DestinationArn)) : ""
+			});
+			if (accessLog.Format !== prevAccessLog?.Format) patchOperations.push({
+				op: "replace",
+				path: "/accessLogSettings/format",
+				value: accessLog.Format !== void 0 ? String(accessLog.Format) : ""
+			});
+		}
+		const rawCanary = properties["CanarySetting"];
+		const canaryMalformed = rawCanary != null && !isPlainObjectBlock(rawCanary);
+		if (canaryMalformed) this.logger.warn(`AWS::ApiGateway::Stage CanarySetting for ${logicalId} is not an object block (got ${Array.isArray(rawCanary) ? "an array" : typeof rawCanary}); leaving the live canary config untouched.`);
+		const canary = canaryMalformed ? void 0 : rawCanary;
+		const prevCanary = previousProperties["CanarySetting"];
+		if (canaryMalformed) {} else if (canary == null) {
+			if (prevCanary != null) patchOperations.push({
+				op: "remove",
+				path: "/canarySettings"
+			});
+		} else {
+			if (canary.PercentTraffic !== prevCanary?.PercentTraffic) patchOperations.push({
+				op: "replace",
+				path: "/canarySettings/percentTraffic",
+				value: String(canary.PercentTraffic ?? 0)
+			});
+			if (canary.DeploymentId !== prevCanary?.DeploymentId) patchOperations.push({
+				op: "replace",
+				path: "/canarySettings/deploymentId",
+				value: canary.DeploymentId ?? ""
+			});
+			if (canary.UseStageCache !== prevCanary?.UseStageCache) patchOperations.push({
+				op: "replace",
+				path: "/canarySettings/useStageCache",
+				value: String(canary.UseStageCache ?? false)
+			});
+			const overrides = canary.StageVariableOverrides ?? {};
+			const prevOverrides = prevCanary?.StageVariableOverrides ?? {};
+			for (const [key, value] of Object.entries(overrides)) if (prevOverrides[key] !== value) patchOperations.push({
+				op: "replace",
+				path: `/canarySettings/stageVariableOverrides/${key}`,
+				value
+			});
+			for (const key of Object.keys(prevOverrides)) if (!(key in overrides)) patchOperations.push({
+				op: "remove",
+				path: `/canarySettings/stageVariableOverrides/${key}`
+			});
+		}
 		const variables = properties["Variables"] ?? {};
 		const prevVariables = previousProperties["Variables"] ?? {};
 		for (const [key, value] of Object.entries(variables)) if (prevVariables[key] !== value) patchOperations.push({
@@ -21319,6 +21452,24 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			result["Description"] = resp.description ?? "";
 			if (resp.tracingEnabled !== void 0) result["TracingEnabled"] = resp.tracingEnabled;
 			if (resp.variables !== void 0) result["Variables"] = resp.variables;
+			if (resp.cacheClusterEnabled !== void 0) result["CacheClusterEnabled"] = resp.cacheClusterEnabled;
+			if (resp.cacheClusterSize !== void 0) result["CacheClusterSize"] = resp.cacheClusterSize;
+			if (resp.clientCertificateId !== void 0) result["ClientCertificateId"] = resp.clientCertificateId;
+			if (resp.documentationVersion !== void 0) result["DocumentationVersion"] = resp.documentationVersion;
+			if (resp.accessLogSettings !== void 0) {
+				const accessLog = {};
+				if (resp.accessLogSettings.destinationArn !== void 0) accessLog["DestinationArn"] = resp.accessLogSettings.destinationArn;
+				if (resp.accessLogSettings.format !== void 0) accessLog["Format"] = resp.accessLogSettings.format;
+				result["AccessLogSetting"] = accessLog;
+			}
+			if (resp.canarySettings !== void 0) {
+				const canary = {};
+				if (resp.canarySettings.percentTraffic !== void 0) canary["PercentTraffic"] = resp.canarySettings.percentTraffic;
+				if (resp.canarySettings.deploymentId !== void 0) canary["DeploymentId"] = resp.canarySettings.deploymentId;
+				if (resp.canarySettings.stageVariableOverrides !== void 0) canary["StageVariableOverrides"] = resp.canarySettings.stageVariableOverrides;
+				if (resp.canarySettings.useStageCache !== void 0) canary["UseStageCache"] = resp.canarySettings.useStageCache;
+				result["CanarySetting"] = canary;
+			}
 			const stateMethodSettings = properties?.["MethodSettings"];
 			if (stateMethodSettings && stateMethodSettings.length > 0) result["MethodSettings"] = stateMethodSettings.map((stateEntry) => {
 				const awsEntry = (resp.methodSettings ?? {})[methodSettingKey(stateEntry)];
@@ -21398,6 +21549,43 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	}
 };
 /**
+* A nested CFn config block must be a plain object; a string, array, or
+* unresolved intrinsic that leaks through resolution indexes every sub-field
+* to `undefined` (#1471/#1493 class). Create refuses such a block; update
+* warns and skips the property.
+*/
+function isPlainObjectBlock(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Strip the `:*` suffix off a CloudWatch Logs log-group ARN.
+*
+* CDK's canonical `LogGroupLogDestination` emits `Fn::GetAtt [LogGroup, Arn]`
+* for `AccessLogSetting.DestinationArn`, and a log group's Arn attribute ends
+* with `:*` — a shape API Gateway's UpdateStage REJECTS ("Access log
+* destination must only contain characters a-z, ..."). CloudFormation's Stage
+* handler normalizes the suffix and accepts the template (proven by the
+* apigw-stage-throttling fixture's CC-routed history), so the SDK provider
+* must match for parity or every CDK `deployOptions.accessLogDestination`
+* app fails on deploy (caught live by that integ, 2026-08-11).
+*/
+function normalizeAccessLogDestinationArn(arn) {
+	return arn.endsWith(":*") ? arn.slice(0, -2) : arn;
+}
+/**
+* Map the CFn `CanarySetting` block to the SDK `CreateStageCommand`
+* `canarySettings` shape (PascalCase -> camelCase member rename).
+*/
+function toSdkCanarySettings(setting) {
+	if (setting == null) return void 0;
+	return {
+		percentTraffic: setting.PercentTraffic,
+		deploymentId: setting.DeploymentId,
+		stageVariableOverrides: setting.StageVariableOverrides,
+		useStageCache: setting.UseStageCache
+	};
+}
+/**
 * CFn MethodSetting field → UpdateStage patch-path suffix under
 * `/{method_setting_key}/`. The get-stage response field for each is the
 * camelCase of the CFn name (used by the drift readback).
@@ -68100,7 +68288,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.55");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.0");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;