@go-to-k/cdkd 0.279.0 → 0.280.1

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-CFVg2o__.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-CWPDckBl.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-C-EXD6HS.js";
+import { t as ASGProvider } from "./asg-provider-BdLzhYo9.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4863,7 +4863,7 @@ function s3BucketDestinationPath(dest, destinationPath) {
 * exported from there because `resolveS3BucketDestination` is S3-specific
 * branch selection, not a shared shape guard — the two only share the wording.
 */
-function describeValue(value) {
+function describeValue$1(value) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return `a string ${JSON.stringify(value)}`;
@@ -5433,11 +5433,11 @@ var S3BucketProvider = class S3BucketProvider {
 			throw new Error(message);
 		};
 		if (dest === void 0 || dest === null) return;
-		if (!isPlainObject$1(dest)) return drop(`${destinationPath} must be an object (got ${describeValue(dest)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		if (!isPlainObject$1(dest)) return drop(`${destinationPath} must be an object (got ${describeValue$1(dest)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
 		const bag = isFlattenedDestination(dest) ? dest : dest["S3BucketDestination"];
-		if (bag === void 0 || bag === null) return drop(`${destinationPath} carries neither a bucket (BucketArn / Bucket) nor a nested S3BucketDestination object (got ${describeValue(dest)}) — the destination would otherwise be dropped from the request with no error`);
-		if (!isPlainObject$1(bag)) return drop(`${nestedPath} must be an object (got ${describeValue(bag)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
-		if (!bag["BucketArn"] && !bag["Bucket"]) return drop(`${bag === dest ? destinationPath : nestedPath} has no destination bucket (BucketArn / Bucket) (got ${describeValue(bag)}) — the request would be rejected by S3, or silently carry no destination`);
+		if (bag === void 0 || bag === null) return drop(`${destinationPath} carries neither a bucket (BucketArn / Bucket) nor a nested S3BucketDestination object (got ${describeValue$1(dest)}) — the destination would otherwise be dropped from the request with no error`);
+		if (!isPlainObject$1(bag)) return drop(`${nestedPath} must be an object (got ${describeValue$1(bag)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		if (!bag["BucketArn"] && !bag["Bucket"]) return drop(`${bag === dest ? destinationPath : nestedPath} has no destination bucket (BucketArn / Bucket) (got ${describeValue$1(bag)}) — the request would be rejected by S3, or silently carry no destination`);
 		return bag;
 	}
 	/**
@@ -20266,7 +20266,13 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			"Tags",
 			"TracingEnabled",
 			"Variables",
-			"MethodSettings"
+			"MethodSettings",
+			"AccessLogSetting",
+			"CacheClusterEnabled",
+			"CacheClusterSize",
+			"CanarySetting",
+			"ClientCertificateId",
+			"DocumentationVersion"
 		])],
 		["AWS::ApiGateway::Method", /* @__PURE__ */ new Set([
 			"RestApiId",
@@ -20749,7 +20755,12 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 		const stageName = properties["StageName"];
 		const deploymentId = properties["DeploymentId"];
 		if (!restApiId || !stageName || !deploymentId) throw new ProvisioningError(`RestApiId, StageName, and DeploymentId are required for API Gateway Stage ${logicalId}`, resourceType, logicalId);
+		for (const key of ["AccessLogSetting", "CanarySetting"]) {
+			const block = properties[key];
+			if (block != null && !isPlainObjectBlock(block)) throw new ProvisioningError(`AWS::ApiGateway::Stage ${key} for ${logicalId} must be an object block; got ${Array.isArray(block) ? "an array" : typeof block}. Fix the template value instead of letting cdkd drop the config.`, resourceType, logicalId);
+		}
 		try {
+			const rawCacheClusterSize = properties["CacheClusterSize"];
 			await this.apiGatewayClient.send(new CreateStageCommand({
 				restApiId,
 				stageName,
@@ -20757,15 +20768,38 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				description: properties["Description"],
 				tracingEnabled: properties["TracingEnabled"],
 				variables: properties["Variables"],
-				tags: this.cfnTagsToRecord(properties["Tags"])
+				tags: this.cfnTagsToRecord(properties["Tags"]),
+				cacheClusterEnabled: properties["CacheClusterEnabled"],
+				cacheClusterSize: rawCacheClusterSize != null ? String(rawCacheClusterSize) : void 0,
+				documentationVersion: properties["DocumentationVersion"],
+				canarySettings: toSdkCanarySettings(properties["CanarySetting"])
 			}));
 			const methodSettings = properties["MethodSettings"];
-			const methodSettingsOps = buildMethodSettingsPatchOps(void 0, methodSettings);
-			if (methodSettingsOps.length > 0) try {
+			const postCreateOps = buildMethodSettingsPatchOps(void 0, methodSettings);
+			const accessLogSetting = properties["AccessLogSetting"];
+			if (accessLogSetting != null) {
+				if (accessLogSetting.DestinationArn !== void 0) postCreateOps.push({
+					op: "replace",
+					path: "/accessLogSettings/destinationArn",
+					value: normalizeAccessLogDestinationArn(String(accessLogSetting.DestinationArn))
+				});
+				if (accessLogSetting.Format !== void 0) postCreateOps.push({
+					op: "replace",
+					path: "/accessLogSettings/format",
+					value: String(accessLogSetting.Format)
+				});
+			}
+			const clientCertificateId = properties["ClientCertificateId"];
+			if (clientCertificateId !== void 0) postCreateOps.push({
+				op: "replace",
+				path: "/clientCertificateId",
+				value: clientCertificateId
+			});
+			if (postCreateOps.length > 0) try {
 				await this.apiGatewayClient.send(new UpdateStageCommand({
 					restApiId,
 					stageName,
-					patchOperations: methodSettingsOps
+					patchOperations: postCreateOps
 				}));
 			} catch (patchError) {
 				try {
@@ -20774,7 +20808,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 						stageName
 					}));
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up stage ${stageName} after a MethodSettings patch failure: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+					this.logger.warn(`Failed to clean up stage ${stageName} after a post-create patch failure: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
 				}
 				throw patchError;
 			}
@@ -20817,6 +20851,91 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			path: "/tracingEnabled",
 			value: String(tracingEnabled ?? false)
 		});
+		const cacheClusterEnabled = properties["CacheClusterEnabled"];
+		if (cacheClusterEnabled !== previousProperties["CacheClusterEnabled"]) patchOperations.push({
+			op: "replace",
+			path: "/cacheClusterEnabled",
+			value: String(cacheClusterEnabled ?? false)
+		});
+		const rawCacheClusterSize = properties["CacheClusterSize"];
+		const prevRawCacheClusterSize = previousProperties["CacheClusterSize"];
+		if (rawCacheClusterSize != null && (prevRawCacheClusterSize == null || String(rawCacheClusterSize) !== String(prevRawCacheClusterSize))) patchOperations.push({
+			op: "replace",
+			path: "/cacheClusterSize",
+			value: String(rawCacheClusterSize)
+		});
+		const clientCertificateId = properties["ClientCertificateId"];
+		if (clientCertificateId !== previousProperties["ClientCertificateId"]) patchOperations.push({
+			op: "replace",
+			path: "/clientCertificateId",
+			value: clientCertificateId ?? ""
+		});
+		const documentationVersion = properties["DocumentationVersion"];
+		if (documentationVersion !== previousProperties["DocumentationVersion"]) patchOperations.push({
+			op: "replace",
+			path: "/documentationVersion",
+			value: documentationVersion ?? ""
+		});
+		const rawAccessLog = properties["AccessLogSetting"];
+		const accessLogMalformed = rawAccessLog != null && !isPlainObjectBlock(rawAccessLog);
+		if (accessLogMalformed) this.logger.warn(`AWS::ApiGateway::Stage AccessLogSetting for ${logicalId} is not an object block (got ${Array.isArray(rawAccessLog) ? "an array" : typeof rawAccessLog}); leaving the live access-log config untouched.`);
+		const accessLog = accessLogMalformed ? void 0 : rawAccessLog;
+		const prevAccessLog = previousProperties["AccessLogSetting"];
+		if (accessLogMalformed) {} else if (accessLog == null) {
+			if (prevAccessLog != null) patchOperations.push({
+				op: "remove",
+				path: "/accessLogSettings"
+			});
+		} else {
+			if (accessLog.DestinationArn !== prevAccessLog?.DestinationArn) patchOperations.push({
+				op: "replace",
+				path: "/accessLogSettings/destinationArn",
+				value: accessLog.DestinationArn !== void 0 ? normalizeAccessLogDestinationArn(String(accessLog.DestinationArn)) : ""
+			});
+			if (accessLog.Format !== prevAccessLog?.Format) patchOperations.push({
+				op: "replace",
+				path: "/accessLogSettings/format",
+				value: accessLog.Format !== void 0 ? String(accessLog.Format) : ""
+			});
+		}
+		const rawCanary = properties["CanarySetting"];
+		const canaryMalformed = rawCanary != null && !isPlainObjectBlock(rawCanary);
+		if (canaryMalformed) this.logger.warn(`AWS::ApiGateway::Stage CanarySetting for ${logicalId} is not an object block (got ${Array.isArray(rawCanary) ? "an array" : typeof rawCanary}); leaving the live canary config untouched.`);
+		const canary = canaryMalformed ? void 0 : rawCanary;
+		const prevCanary = previousProperties["CanarySetting"];
+		if (canaryMalformed) {} else if (canary == null) {
+			if (prevCanary != null) patchOperations.push({
+				op: "remove",
+				path: "/canarySettings"
+			});
+		} else {
+			if (canary.PercentTraffic !== prevCanary?.PercentTraffic) patchOperations.push({
+				op: "replace",
+				path: "/canarySettings/percentTraffic",
+				value: String(canary.PercentTraffic ?? 0)
+			});
+			if (canary.DeploymentId !== prevCanary?.DeploymentId) patchOperations.push({
+				op: "replace",
+				path: "/canarySettings/deploymentId",
+				value: canary.DeploymentId ?? ""
+			});
+			if (canary.UseStageCache !== prevCanary?.UseStageCache) patchOperations.push({
+				op: "replace",
+				path: "/canarySettings/useStageCache",
+				value: String(canary.UseStageCache ?? false)
+			});
+			const overrides = canary.StageVariableOverrides ?? {};
+			const prevOverrides = prevCanary?.StageVariableOverrides ?? {};
+			for (const [key, value] of Object.entries(overrides)) if (prevOverrides[key] !== value) patchOperations.push({
+				op: "replace",
+				path: `/canarySettings/stageVariableOverrides/${key}`,
+				value
+			});
+			for (const key of Object.keys(prevOverrides)) if (!(key in overrides)) patchOperations.push({
+				op: "remove",
+				path: `/canarySettings/stageVariableOverrides/${key}`
+			});
+		}
 		const variables = properties["Variables"] ?? {};
 		const prevVariables = previousProperties["Variables"] ?? {};
 		for (const [key, value] of Object.entries(variables)) if (prevVariables[key] !== value) patchOperations.push({
@@ -21333,6 +21452,24 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			result["Description"] = resp.description ?? "";
 			if (resp.tracingEnabled !== void 0) result["TracingEnabled"] = resp.tracingEnabled;
 			if (resp.variables !== void 0) result["Variables"] = resp.variables;
+			if (resp.cacheClusterEnabled !== void 0) result["CacheClusterEnabled"] = resp.cacheClusterEnabled;
+			if (resp.cacheClusterSize !== void 0) result["CacheClusterSize"] = resp.cacheClusterSize;
+			if (resp.clientCertificateId !== void 0) result["ClientCertificateId"] = resp.clientCertificateId;
+			if (resp.documentationVersion !== void 0) result["DocumentationVersion"] = resp.documentationVersion;
+			if (resp.accessLogSettings !== void 0) {
+				const accessLog = {};
+				if (resp.accessLogSettings.destinationArn !== void 0) accessLog["DestinationArn"] = resp.accessLogSettings.destinationArn;
+				if (resp.accessLogSettings.format !== void 0) accessLog["Format"] = resp.accessLogSettings.format;
+				result["AccessLogSetting"] = accessLog;
+			}
+			if (resp.canarySettings !== void 0) {
+				const canary = {};
+				if (resp.canarySettings.percentTraffic !== void 0) canary["PercentTraffic"] = resp.canarySettings.percentTraffic;
+				if (resp.canarySettings.deploymentId !== void 0) canary["DeploymentId"] = resp.canarySettings.deploymentId;
+				if (resp.canarySettings.stageVariableOverrides !== void 0) canary["StageVariableOverrides"] = resp.canarySettings.stageVariableOverrides;
+				if (resp.canarySettings.useStageCache !== void 0) canary["UseStageCache"] = resp.canarySettings.useStageCache;
+				result["CanarySetting"] = canary;
+			}
 			const stateMethodSettings = properties?.["MethodSettings"];
 			if (stateMethodSettings && stateMethodSettings.length > 0) result["MethodSettings"] = stateMethodSettings.map((stateEntry) => {
 				const awsEntry = (resp.methodSettings ?? {})[methodSettingKey(stateEntry)];
@@ -21412,6 +21549,43 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	}
 };
 /**
+* A nested CFn config block must be a plain object; a string, array, or
+* unresolved intrinsic that leaks through resolution indexes every sub-field
+* to `undefined` (#1471/#1493 class). Create refuses such a block; update
+* warns and skips the property.
+*/
+function isPlainObjectBlock(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Strip the `:*` suffix off a CloudWatch Logs log-group ARN.
+*
+* CDK's canonical `LogGroupLogDestination` emits `Fn::GetAtt [LogGroup, Arn]`
+* for `AccessLogSetting.DestinationArn`, and a log group's Arn attribute ends
+* with `:*` — a shape API Gateway's UpdateStage REJECTS ("Access log
+* destination must only contain characters a-z, ..."). CloudFormation's Stage
+* handler normalizes the suffix and accepts the template (proven by the
+* apigw-stage-throttling fixture's CC-routed history), so the SDK provider
+* must match for parity or every CDK `deployOptions.accessLogDestination`
+* app fails on deploy (caught live by that integ, 2026-08-11).
+*/
+function normalizeAccessLogDestinationArn(arn) {
+	return arn.endsWith(":*") ? arn.slice(0, -2) : arn;
+}
+/**
+* Map the CFn `CanarySetting` block to the SDK `CreateStageCommand`
+* `canarySettings` shape (PascalCase -> camelCase member rename).
+*/
+function toSdkCanarySettings(setting) {
+	if (setting == null) return void 0;
+	return {
+		percentTraffic: setting.PercentTraffic,
+		deploymentId: setting.DeploymentId,
+		stageVariableOverrides: setting.StageVariableOverrides,
+		useStageCache: setting.UseStageCache
+	};
+}
+/**
 * CFn MethodSetting field → UpdateStage patch-path suffix under
 * `/{method_setting_key}/`. The get-stage response field for each is the
 * camelCase of the CFn name (used by the drift readback).
@@ -43152,6 +43326,87 @@ const DEFAULT_EVENT_SELECTORS = Object.freeze([Object.freeze({
 	IncludeManagementEvents: true
 })]);
 /**
+* `undefined` for an absent / null / EMPTY optional string field.
+*
+* Module-scoped since issue #1565 so `create()` can use it too: an always-emit
+* placeholder can reach `create()` — `drift --accept` falls back to mutating
+* `properties` when `observedProperties` is absent, and the rollback executor
+* replays `previousState.properties` through `create()` on a reverse
+* replacement — and `CreateTrail` with `CloudWatchLogsLogGroupArn: ''` is an
+* UNPROBED shape that may 400 on ARN format. `''` there means "not
+* configured", which is exactly what omitting the field says.
+*
+* The update path is where the distinction between absent and `''` matters
+* (see {@link resolveCloudWatchLogsPair}); on create there is no previous
+* value to clear, so both collapse to "omit".
+*/
+function emptyToUndefined(v) {
+	if (v === void 0 || v === null || v === "") return void 0;
+	return v;
+}
+/**
+* Resolve the `CloudWatchLogsLogGroupArn` / `CloudWatchLogsRoleArn` pair for an
+* `UpdateTrail`, distinguishing an ABSENT desired side from an explicit `''`.
+*
+* The pair is all-or-nothing on AWS, so the two fields are decided TOGETHER —
+* the caller cannot build the half-configured request AWS rejects.
+*
+* - ABSENT (`undefined` / `null`) on BOTH sides -> send neither. The template
+*   never declared them, and the live CFn A/B (2026-08-10) measured a template
+*   removal as RETAINED, so sending nothing IS the parity behavior. `null`
+*   counts as absent because a JSON state round-trip can produce one where the
+*   template had nothing.
+* - BOTH `''` -> send both. `''` is the clear, which is what makes a
+*   `drift --revert` of a console-side enable actually revert (issue #1565).
+*   On an already-unwired trail that re-asserts a null field, which AWS accepts
+*   as the no-op it is, and it rides an `UpdateTrail` this method issues
+*   anyway. Deliberately NOT gated on "differs from the previous side": that
+*   gate would also stop forwarding an UNCHANGED populated pair, which
+*   `cloudtrail-provider-roundtrip.test.ts` pins as a wire-layer guarantee.
+* - BOTH populated -> send both verbatim.
+* - Anything else — a non-string value, or exactly ONE half populated -> send
+*   NEITHER, and report it. Both shapes are unusable rather than meaningful:
+*   coercing them would send `''` next to a real ARN (the request AWS rejects)
+*   or, worse, read a malformed `null` as a CLEAR and silently disable a live
+*   trail's CloudWatch Logs delivery — the
+*   `malformed-value-must-not-read-as-removal` class this same file already
+*   guards for `EventSelectors`. Leaving the pair alone is the non-destructive
+*   reading, and the caller warns so the divergence is loud.
+*
+* Only the DESIRED side decides, which keeps the guard-the-desired-side-only
+* rule intact.
+*/
+function resolveCloudWatchLogsPair(properties) {
+	const desiredGroup = properties["CloudWatchLogsLogGroupArn"];
+	const desiredRole = properties["CloudWatchLogsRoleArn"];
+	if (desiredGroup == null && desiredRole == null) return {
+		logGroupArn: void 0,
+		roleArn: void 0
+	};
+	if (typeof desiredGroup !== "string" || typeof desiredRole !== "string") return {
+		logGroupArn: void 0,
+		roleArn: void 0,
+		unusable: `CloudWatchLogsLogGroupArn / CloudWatchLogsRoleArn must both be strings (got ${describeValue(desiredGroup)} / ${describeValue(desiredRole)}) — check for an unresolved intrinsic or a half-written state record`
+	};
+	if (desiredGroup === "" !== (desiredRole === "")) return {
+		logGroupArn: void 0,
+		roleArn: void 0,
+		unusable: "CloudWatchLogsLogGroupArn / CloudWatchLogsRoleArn are all-or-nothing on AWS, but only one of them carries a value — sending the pair would be rejected"
+	};
+	return {
+		logGroupArn: desiredGroup,
+		roleArn: desiredRole
+	};
+}
+/** Human-readable type for a warning, without echoing user data. */
+function describeValue(value) {
+	if (value === null) return "null";
+	if (value === void 0) return "nothing";
+	if (Array.isArray(value)) return "an array";
+	if (typeof value === "string") return value === "" ? "''" : "a string";
+	return `a ${typeof value}`;
+}
+/**
 * SDK Provider for AWS CloudTrail resources
 *
 * Supports:
@@ -43190,16 +43445,16 @@ var CloudTrailProvider = class {
 		const s3BucketName = properties["S3BucketName"];
 		if (!s3BucketName) throw new ProvisioningError(`S3BucketName is required for CloudTrail Trail ${logicalId}`, resourceType, logicalId);
 		const trailName = properties["TrailName"];
-		const s3KeyPrefix = properties["S3KeyPrefix"];
+		const s3KeyPrefix = emptyToUndefined(properties["S3KeyPrefix"]);
 		const isMultiRegionTrail = properties["IsMultiRegionTrail"];
 		const includeGlobalServiceEvents = properties["IncludeGlobalServiceEvents"];
 		const enableLogFileValidation = properties["EnableLogFileValidation"];
 		const isLogging = properties["IsLogging"];
 		const tags = properties["Tags"];
-		const cloudWatchLogsLogGroupArn = properties["CloudWatchLogsLogGroupArn"];
-		const cloudWatchLogsRoleArn = properties["CloudWatchLogsRoleArn"];
-		const kmsKeyId = properties["KMSKeyId"];
-		const snsTopicName = properties["SnsTopicName"];
+		const cloudWatchLogsLogGroupArn = emptyToUndefined(properties["CloudWatchLogsLogGroupArn"]);
+		const cloudWatchLogsRoleArn = emptyToUndefined(properties["CloudWatchLogsRoleArn"]);
+		const kmsKeyId = emptyToUndefined(properties["KMSKeyId"]);
+		const snsTopicName = emptyToUndefined(properties["SnsTopicName"]);
 		const isOrganizationTrail = properties["IsOrganizationTrail"];
 		const eventSelectors = properties["EventSelectors"];
 		const insightSelectors = properties["InsightSelectors"];
@@ -43251,18 +43506,16 @@ var CloudTrailProvider = class {
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating CloudTrail Trail ${logicalId}: ${physicalId}`);
-		const emptyToUndefined = (v) => {
-			if (v === void 0 || v === null || v === "") return void 0;
-			return v;
-		};
 		const s3BucketName = properties["S3BucketName"];
 		const s3KeyPrefix = clearOnUpdateRemoval(emptyToUndefined(properties["S3KeyPrefix"]), emptyToUndefined(previousProperties["S3KeyPrefix"]), "");
 		const isMultiRegionTrail = clearOnUpdateRemoval(properties["IsMultiRegionTrail"], previousProperties["IsMultiRegionTrail"], false);
 		const includeGlobalServiceEvents = isMultiRegionTrail === false ? clearOnUpdateRemoval(properties["IncludeGlobalServiceEvents"], previousProperties["IncludeGlobalServiceEvents"], false) : properties["IncludeGlobalServiceEvents"];
 		const enableLogFileValidation = clearOnUpdateRemoval(properties["EnableLogFileValidation"], previousProperties["EnableLogFileValidation"], false);
 		const isLogging = properties["IsLogging"];
-		const cloudWatchLogsLogGroupArn = emptyToUndefined(properties["CloudWatchLogsLogGroupArn"]);
-		const cloudWatchLogsRoleArn = emptyToUndefined(properties["CloudWatchLogsRoleArn"]);
+		const cwPair = resolveCloudWatchLogsPair(properties);
+		if (cwPair.unusable !== void 0) this.logger.warn(`CloudTrail Trail ${logicalId}: ${cwPair.unusable}. The trail's existing CloudWatch Logs wiring is left untouched for this update.`);
+		const cloudWatchLogsLogGroupArn = cwPair.logGroupArn;
+		const cloudWatchLogsRoleArn = cwPair.roleArn;
 		const kmsKeyId = emptyToUndefined(properties["KMSKeyId"]);
 		const snsTopicName = clearOnUpdateRemoval(emptyToUndefined(properties["SnsTopicName"]), emptyToUndefined(previousProperties["SnsTopicName"]), "");
 		const isOrganizationTrail = properties["IsOrganizationTrail"];
@@ -43444,10 +43697,8 @@ var CloudTrailProvider = class {
 		result["IsMultiRegionTrail"] = trail.IsMultiRegionTrail ?? false;
 		result["IncludeGlobalServiceEvents"] = trail.IncludeGlobalServiceEvents ?? true;
 		result["EnableLogFileValidation"] = trail.LogFileValidationEnabled ?? false;
-		if (trail.CloudWatchLogsLogGroupArn && trail.CloudWatchLogsRoleArn) {
-			result["CloudWatchLogsLogGroupArn"] = trail.CloudWatchLogsLogGroupArn;
-			result["CloudWatchLogsRoleArn"] = trail.CloudWatchLogsRoleArn;
-		}
+		result["CloudWatchLogsLogGroupArn"] = trail.CloudWatchLogsLogGroupArn ?? "";
+		result["CloudWatchLogsRoleArn"] = trail.CloudWatchLogsRoleArn ?? "";
 		result["KMSKeyId"] = trail.KmsKeyId ?? "";
 		result["SnsTopicName"] = trail.SnsTopicName ?? "";
 		result["IsOrganizationTrail"] = trail.IsOrganizationTrail ?? false;
@@ -68114,7 +68365,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.279.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.1");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;