@go-to-k/cdkd 0.280.16 → 0.280.18

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-1eZqhWKB.js";
+import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-mvkiu-7h.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-4pPwAL_v.js";
+import { t as ASGProvider } from "./asg-provider-C6cQkX3h.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -22462,6 +22462,7 @@ var ApiGatewayV2Provider = class {
 		const apiId = properties["ApiId"];
 		const integrationType = properties["IntegrationType"];
 		if (!apiId || !integrationType) throw new ProvisioningError(`ApiId and IntegrationType are required for API Gateway V2 Integration ${logicalId}`, resourceType, logicalId);
+		this.warnTlsConfigIgnoredIfPublic(logicalId, properties);
 		try {
 			const integrationId = (await this.getClient().send(new CreateIntegrationCommand({
 				ApiId: apiId,
@@ -22630,6 +22631,30 @@ var ApiGatewayV2Provider = class {
 	*     each uses `properties.ApiId` (passed through PR G's signature
 	*     extension) to issue the appropriate `Get*` call.
 	*/
+	/**
+	* `TlsConfig` is meaningful ONLY for a private (VPC-Link) integration.
+	* On a public one (`ConnectionType` absent or `INTERNET`) AWS SILENTLY
+	* IGNORES the field — it is absent from both the `CreateIntegration`
+	* echo and the `GetIntegration` read-back (direct A/B, 2026-08-11
+	* us-east-1) — so the provider can never read it back and a template
+	* that declares it would report permanent phantom drift on the
+	* `properties`-fallback baseline, with `--revert` re-sending a value AWS
+	* discards on every run (issue #1602). The path is scoped by the
+	* resource's own `ConnectionType` via the optional `properties` bag: a
+	* VPC_LINK integration keeps full `TlsConfig` drift coverage (AWS
+	* returns the field there). Without a USABLE properties bag the answer
+	* stays empty — comparing is the safe default, since hiding a private
+	* integration's real `TlsConfig` drift is worse than a false positive on
+	* a caller that could not supply the bag. An EMPTY bag counts as unusable
+	* for the same reason: the caller passes `resource.properties ?? {}`, so
+	* `{}` means "nothing recorded", not "ConnectionType is absent, therefore
+	* public" (an empty bag also has no `TlsConfig` key for the comparator to
+	* walk, so refusing to declare costs nothing).
+	*/
+	getDriftUnknownPaths(resourceType, properties) {
+		if (resourceType === "AWS::ApiGatewayV2::Integration" && properties !== void 0 && Object.keys(properties).length > 0 && properties["ConnectionType"] !== "VPC_LINK") return ["TlsConfig"];
+		return [];
+	}
 	async readCurrentState(physicalId, _logicalId, resourceType, properties) {
 		switch (resourceType) {
 			case "AWS::ApiGatewayV2::Api": return this.readApi(physicalId);
@@ -22707,7 +22732,7 @@ var ApiGatewayV2Provider = class {
 			if (resp.IntegrationSubtype !== void 0) result["IntegrationSubtype"] = resp.IntegrationSubtype;
 			if (resp.PassthroughBehavior !== void 0) result["PassthroughBehavior"] = resp.PassthroughBehavior;
 			if (resp.RequestTemplates !== void 0) result["RequestTemplates"] = resp.RequestTemplates;
-			if (resp.ResponseParameters !== void 0) result["ResponseParameters"] = this.toCfnResponseParameters(resp.ResponseParameters);
+			if (resp.ResponseParameters !== void 0) result["ResponseParameters"] = this.toCfnResponseParameters(resp.ResponseParameters, properties?.["ResponseParameters"]);
 			if (resp.TemplateSelectionExpression !== void 0) result["TemplateSelectionExpression"] = resp.TemplateSelectionExpression;
 			if (resp.TlsConfig !== void 0) result["TlsConfig"] = resp.TlsConfig;
 			return result;
@@ -23082,6 +23107,7 @@ var ApiGatewayV2Provider = class {
 			changed = true;
 		}
 		if (properties["TlsConfig"] != null && !this.deepEqual(properties["TlsConfig"], previousProperties["TlsConfig"])) {
+			this.warnTlsConfigIgnoredIfPublic(logicalId, properties);
 			input.TlsConfig = properties["TlsConfig"];
 			changed = true;
 		}
@@ -23435,6 +23461,22 @@ var ApiGatewayV2Provider = class {
 		return merged;
 	}
 	/**
+	* Announce a `TlsConfig` that AWS will silently discard (issue #1602):
+	* the field is only honored on a private (VPC-Link) integration, and on a
+	* public one (`ConnectionType` absent or `INTERNET`) AWS accepts the value
+	* and drops it — it never appears on the `GetIntegration` read-back
+	* (direct A/B, 2026-08-11 us-east-1). cdkd still sends the field (parity:
+	* CloudFormation forwards it too and AWS accepts it), but the never-silent
+	* policy requires saying so. The matching drift false positive is closed
+	* by {@link getDriftUnknownPaths}. A WARN on both create and update, never
+	* a throw — the update path can be a state-record replay
+	* (`rollback-executor.ts` / `drift --revert`) where a refusal would leave
+	* the resource un-revertable.
+	*/
+	warnTlsConfigIgnoredIfPublic(logicalId, properties) {
+		if (properties["TlsConfig"] != null && properties["ConnectionType"] !== "VPC_LINK") this.logger.warn(`AWS::ApiGatewayV2::Integration ${logicalId}: TlsConfig is only honored on a VPC_LINK (private) integration — AWS silently ignores it on a public one, and the value will never be readable back from AWS (issue #1602).`);
+	}
+	/**
 	* `ResponseParameters` is the one `AWS::ApiGatewayV2::Integration` property
 	* whose CFn shape does NOT match the SDK's, so forwarding it verbatim is not
 	* an option (issue #609). CloudFormation models it as
@@ -23493,26 +23535,87 @@ var ApiGatewayV2Provider = class {
 	* baseline carries the CFn list-of-pairs, and every `cdkd drift` run would
 	* report permanent phantom drift on a resource nobody touched.
 	*
-	* The pairs are sorted by `Destination` because this turns an UNORDERED SDK
-	* map into an ARRAY, and `calculateResourceDrift` compares arrays
-	* POSITIONALLY — AWS does not guarantee map readback order, so an unsorted
-	* rebuild would trade the shape-mismatch phantom drift for an ordering one
-	* (and `--revert` would re-push an identical value forever). Same reasoning
-	* as `src/analyzer/drift-normalize.ts`, applied at the source instead.
-	*/
-	toCfnResponseParameters(value) {
+	* Order matters because this turns an UNORDERED SDK map into an ARRAY, and
+	* `calculateResourceDrift` compares arrays POSITIONALLY — AWS does not
+	* guarantee map readback order, so an arbitrary rebuild would trade the
+	* shape-mismatch phantom drift for an ordering one (and `--revert` would
+	* re-push an identical value forever). Declared destinations therefore keep
+	* their DECLARED position and anything else is sorted; both are stable
+	* across reads. Same reasoning as `src/analyzer/drift-normalize.ts`,
+	* applied at the source instead.
+	*
+	* `declared` (the state-recorded desired `ResponseParameters` block, when
+	* the caller has it) makes the inverse MIRROR the template's spelling per
+	* status code (issue #1602): {@link toSdkResponseParameters} accepts an
+	* ALREADY-FLAT block (`{ "<status>": { "<Destination>": "<Source>" } }` —
+	* the SDK spelling a hand-written template may use) and passes it through,
+	* which made the pair non-injective — this method always rebuilt the CFn
+	* list shape, so a flat-spelled baseline could never compare equal to the
+	* read-back and reported permanent phantom drift. For a status code whose
+	* DECLARED block matches the flat-passthrough branch of
+	* {@link toSdkResponseParameters} (an object without an array
+	* `ResponseParameters` member), the read-back now stays flat too; every
+	* other status code (declared CFn shape, declared absent, no `declared` at
+	* all) keeps the CFn list shape. Object comparison is key-based, so the
+	* flat map round-trips without the sort the list shape needs.
+	*
+	* The CFn arm mirrors the declared block too, in the two ways the
+	* `properties`-fallback baseline is compared on: ENTRY ORDER (the
+	* comparator walks arrays positionally, and the template's order is
+	* whatever the author wrote — sorting only the read side is the mistake
+	* `drift-normalize.ts`'s header records) and SCALAR TYPE (CFn types
+	* `Source` as free-form and cdkd coerces a number to a string on the way
+	* out, so re-emitting AWS's string against a numeric declaration is
+	* permanent phantom drift). Declared destinations keep their declared
+	* position and their declared scalar whenever the value still agrees with
+	* AWS; a destination AWS returns that the template never declared is
+	* appended in sorted order, so the result stays deterministic across reads.
+	*/
+	toCfnResponseParameters(value, declared) {
 		if (value == null) return void 0;
+		const declaredBlocks = declared != null && typeof declared === "object" && !Array.isArray(declared) ? declared : void 0;
 		const out = {};
 		for (const [statusCode, flat] of Object.entries(value)) {
 			if (flat == null || typeof flat !== "object" || Array.isArray(flat)) continue;
-			out[statusCode] = { ResponseParameters: Object.entries(flat).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([destination, source]) => ({
-				Destination: destination,
-				Source: source
-			})) };
+			const declaredBlock = declaredBlocks?.[statusCode];
+			const declaredIsBlock = declaredBlock != null && typeof declaredBlock === "object" && !Array.isArray(declaredBlock);
+			const declaredEntries = declaredIsBlock ? declaredBlock["ResponseParameters"] : void 0;
+			if (declaredIsBlock && !Array.isArray(declaredEntries)) {
+				out[statusCode] = flat;
+				continue;
+			}
+			out[statusCode] = { ResponseParameters: this.mirrorDeclaredResponsePairs(flat, declaredEntries) };
 		}
 		return out;
 	}
 	/**
+	* Rebuild one status code's CFn list-of-pairs from AWS's flat map, keeping
+	* the DECLARED entries' order and scalar types where they still agree with
+	* AWS. See {@link toCfnResponseParameters} for why both matter.
+	*/
+	mirrorDeclaredResponsePairs(flat, declaredEntries) {
+		const remaining = new Map(Object.entries(flat));
+		const pairs = [];
+		if (Array.isArray(declaredEntries)) for (const entry of declaredEntries) {
+			if (entry == null || typeof entry !== "object" || Array.isArray(entry)) continue;
+			const destination = entry["Destination"];
+			if (typeof destination !== "string" || !remaining.has(destination)) continue;
+			const awsSource = remaining.get(destination);
+			remaining.delete(destination);
+			const declaredSource = entry["Source"];
+			const declaredDenotesSame = (typeof declaredSource === "number" || typeof declaredSource === "boolean") && String(declaredSource) === awsSource;
+			pairs.push({
+				Destination: destination,
+				Source: declaredDenotesSame ? declaredSource : awsSource
+			});
+		}
+		for (const [destination, source] of [...remaining.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) pairs.push({
+			Destination: destination,
+			Source: source
+		});
+		return pairs;
+	}
+	/**
 	* Convert CloudFormation Tags (Array<{Key, Value}>) to SDK Tags (Record<string, string>).
 	*/
 	cfnTagsToRecord(tags) {
@@ -34561,6 +34664,7 @@ const MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES = [
 */
 var AppSyncProvider = class {
 	client;
+	s3Client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("AppSyncProvider");
 	/**
@@ -34611,7 +34715,12 @@ var AppSyncProvider = class {
 			"ServiceRoleArn",
 			"DynamoDBConfig",
 			"LambdaConfig",
-			"HttpConfig"
+			"HttpConfig",
+			"ElasticsearchConfig",
+			"EventBridgeConfig",
+			"MetricsConfig",
+			"OpenSearchServiceConfig",
+			"RelationalDatabaseConfig"
 		])],
 		["AWS::AppSync::Resolver", /* @__PURE__ */ new Set([
 			"ApiId",
@@ -34623,7 +34732,14 @@ var AppSyncProvider = class {
 			"Kind",
 			"PipelineConfig",
 			"Runtime",
-			"Code"
+			"Code",
+			"CachingConfig",
+			"CodeS3Location",
+			"MaxBatchSize",
+			"MetricsConfig",
+			"RequestMappingTemplateS3Location",
+			"ResponseMappingTemplateS3Location",
+			"SyncConfig"
 		])],
 		["AWS::AppSync::ApiKey", /* @__PURE__ */ new Set([
 			"ApiId",
@@ -34631,11 +34747,23 @@ var AppSyncProvider = class {
 			"Expires"
 		])]
 	]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::AppSync::DataSource", /* @__PURE__ */ new Map([["ElasticsearchConfig", "Legacy Elasticsearch alias; use OpenSearchServiceConfig (AppSync deprecated the Elasticsearch DataSource type in favor of OpenSearch)"]])]]);
 	getClient() {
 		if (!this.client) this.client = new AppSyncClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
 	}
+	/**
+	* Lazy S3 client for the `*S3Location` properties (Resolver
+	* `CodeS3Location` / `RequestMappingTemplateS3Location` /
+	* `ResponseMappingTemplateS3Location`, GraphQLSchema
+	* `DefinitionS3Location`) — CloudFormation reads the S3 object and inlines
+	* its body, and cdkd mirrors that. Same construction as
+	* `StepFunctionsProvider.getS3Client` (the sibling `DefinitionS3Location`
+	* implementation).
+	*/
+	getS3Client() {
+		if (!this.s3Client) this.s3Client = new S3Client(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.s3Client;
+	}
 	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::AppSync::GraphQLApi": return this.createGraphQLApi(logicalId, resourceType, properties, context);
@@ -34654,11 +34782,16 @@ var AppSyncProvider = class {
 	*     `XrayEnabled` / `LogConfig`) + `TagResource` / `UntagResource`
 	*     for `Tags` diff. `Name` is immutable on AWS.
 	*   - `DataSource`   → `UpdateDataSourceCommand` (`Description` /
-	*     `ServiceRoleArn` / `DynamoDBConfig` / `LambdaConfig` / `HttpConfig`).
+	*     `ServiceRoleArn` / the per-type configs — `DynamoDBConfig` /
+	*     `LambdaConfig` / `HttpConfig` / `ElasticsearchConfig` /
+	*     `OpenSearchServiceConfig` / `EventBridgeConfig` /
+	*     `RelationalDatabaseConfig` — / `MetricsConfig`).
 	*     `ApiId` / `Name` / `Type` are immutable identity fields.
 	*   - `Resolver`     → `UpdateResolverCommand` (`DataSourceName` /
 	*     `RequestMappingTemplate` / `ResponseMappingTemplate` / `Kind` /
-	*     `PipelineConfig` / `Runtime` / `Code`). `ApiId` / `TypeName` /
+	*     `PipelineConfig` / `Runtime` / `Code` / `CachingConfig` /
+	*     `SyncConfig` / `MaxBatchSize` / `MetricsConfig` + the three
+	*     `*S3Location` fetch-and-inline pairs). `ApiId` / `TypeName` /
 	*     `FieldName` are immutable identity fields.
 	*   - `ApiKey`       → `UpdateApiKeyCommand` (`Description` / `Expires`).
 	*     `ApiId` is immutable; the AWS-generated key id is immutable.
@@ -34750,7 +34883,23 @@ var AppSyncProvider = class {
 	async updateGraphQLSchema(logicalId, physicalId, resourceType, properties, previousProperties) {
 		const newDef = properties["Definition"];
 		const oldDef = previousProperties["Definition"];
-		if (newDef === void 0 || newDef === oldDef) return {
+		const newLoc = properties["DefinitionS3Location"];
+		const oldLoc = previousProperties["DefinitionS3Location"];
+		let definition;
+		if (newDef !== void 0) {
+			if (newLoc !== void 0) this.logger.warn(`${resourceType} ${logicalId}: both Definition and DefinitionS3Location are set — using the inline Definition and ignoring DefinitionS3Location (CFn treats them as alternatives)`);
+			if (newDef === oldDef) return {
+				physicalId,
+				wasReplaced: false
+			};
+			definition = newDef;
+		} else if (newLoc !== void 0) {
+			if (this.deepEqual(newLoc, oldLoc)) return {
+				physicalId,
+				wasReplaced: false
+			};
+			definition = await this.fetchS3LocationBody(newLoc, resourceType, logicalId, "DefinitionS3Location");
+		} else return {
 			physicalId,
 			wasReplaced: false
 		};
@@ -34758,7 +34907,7 @@ var AppSyncProvider = class {
 		try {
 			await this.getClient().send(new StartSchemaCreationCommand({
 				apiId,
-				definition: Buffer.from(newDef, "utf-8")
+				definition: Buffer.from(definition, "utf-8")
 			}));
 		} catch (error) {
 			throw this.wrapUpdateError(error, resourceType, logicalId, physicalId, "GraphqlSchema");
@@ -34781,17 +34930,18 @@ var AppSyncProvider = class {
 		const [apiId, name] = physicalId.split("|");
 		if (!apiId || !name) throw new ProvisioningError(`Invalid DataSource physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
 		const type = properties["Type"] ?? previousProperties["Type"];
-		const newDesc = properties["Description"];
-		const oldDesc = previousProperties["Description"];
-		const newRole = properties["ServiceRoleArn"];
-		const oldRole = previousProperties["ServiceRoleArn"];
-		const newDDB = properties["DynamoDBConfig"];
-		const oldDDB = previousProperties["DynamoDBConfig"];
-		const newLambda = properties["LambdaConfig"];
-		const oldLambda = previousProperties["LambdaConfig"];
-		const newHttp = properties["HttpConfig"];
-		const oldHttp = previousProperties["HttpConfig"];
-		if (!(newDesc !== oldDesc || newRole !== oldRole || !this.deepEqual(newDDB, oldDDB) || !this.deepEqual(newLambda, oldLambda) || !this.deepEqual(newHttp, oldHttp))) return {
+		if (![
+			"Description",
+			"ServiceRoleArn",
+			"DynamoDBConfig",
+			"LambdaConfig",
+			"HttpConfig",
+			"ElasticsearchConfig",
+			"OpenSearchServiceConfig",
+			"EventBridgeConfig",
+			"RelationalDatabaseConfig",
+			"MetricsConfig"
+		].some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]))) return {
 			physicalId,
 			wasReplaced: false
 		};
@@ -34800,15 +34950,7 @@ var AppSyncProvider = class {
 			name,
 			type
 		};
-		if (newDesc !== void 0) input.description = newDesc;
-		if (newRole !== void 0) input.serviceRoleArn = newRole;
-		if (newDDB !== void 0) input.dynamodbConfig = {
-			tableName: newDDB["TableName"],
-			awsRegion: newDDB["AwsRegion"],
-			useCallerCredentials: newDDB["UseCallerCredentials"]
-		};
-		if (newLambda !== void 0) input.lambdaConfig = { lambdaFunctionArn: newLambda["LambdaFunctionArn"] };
-		if (newHttp !== void 0) input.httpConfig = { endpoint: newHttp["Endpoint"] };
+		this.applyDataSourceConfig(input, resourceType, logicalId, properties);
 		try {
 			await this.getClient().send(new UpdateDataSourceCommand(input));
 		} catch (error) {
@@ -34839,8 +34981,15 @@ var AppSyncProvider = class {
 			"Kind",
 			"PipelineConfig",
 			"Runtime",
-			"Code"
-		].some((key) => !this.deepEqual(properties[key], previousProperties[key]))) return {
+			"Code",
+			"CachingConfig",
+			"SyncConfig",
+			"MaxBatchSize",
+			"MetricsConfig",
+			"CodeS3Location",
+			"RequestMappingTemplateS3Location",
+			"ResponseMappingTemplateS3Location"
+		].some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]))) return {
 			physicalId,
 			wasReplaced: false
 		};
@@ -34849,20 +34998,7 @@ var AppSyncProvider = class {
 			typeName,
 			fieldName
 		};
-		const effectiveKind = properties["Kind"] ?? previousProperties["Kind"] ?? "UNIT";
-		if (effectiveKind === "UNIT" && properties["DataSourceName"] !== void 0) input.dataSourceName = properties["DataSourceName"];
-		if (properties["RequestMappingTemplate"] !== void 0) input.requestMappingTemplate = properties["RequestMappingTemplate"];
-		if (properties["ResponseMappingTemplate"] !== void 0) input.responseMappingTemplate = properties["ResponseMappingTemplate"];
-		if (properties["Kind"] !== void 0) input.kind = properties["Kind"];
-		if (effectiveKind === "PIPELINE" && properties["PipelineConfig"] !== void 0) input.pipelineConfig = { functions: properties["PipelineConfig"]["Functions"] };
-		if (properties["Runtime"] !== void 0) {
-			const runtime = properties["Runtime"];
-			input.runtime = {
-				name: runtime["Name"],
-				runtimeVersion: runtime["RuntimeVersion"]
-			};
-		}
-		if (properties["Code"] !== void 0) input.code = properties["Code"];
+		await this.applyResolverConfig(input, resourceType, logicalId, properties, previousProperties, true);
 		try {
 			await this.getClient().send(new UpdateResolverCommand(input));
 		} catch (error) {
@@ -34983,6 +35119,11 @@ var AppSyncProvider = class {
 	*/
 	getDriftUnknownPaths(resourceType) {
 		if (resourceType === "AWS::AppSync::GraphQLSchema") return ["DefinitionS3Location"];
+		if (resourceType === "AWS::AppSync::Resolver") return [
+			"CodeS3Location",
+			"RequestMappingTemplateS3Location",
+			"ResponseMappingTemplateS3Location"
+		];
 		return [];
 	}
 	/**
@@ -34995,15 +35136,15 @@ var AppSyncProvider = class {
 	* possibly-malformed value"). An ABSENT container keeps returning
 	* `undefined`, which is a legitimate "not configured".
 	*/
-	asObject(value, path, options) {
+	asObject(value, path, options, resourceType = "AWS::AppSync::GraphQLApi") {
 		if (value == null) return void 0;
 		if (typeof value === "object" && !Array.isArray(value)) return value;
-		const message = `AWS::AppSync::GraphQLApi ${path} must be an object, got ${Array.isArray(value) ? "array" : typeof value} — cdkd refuses to drop it silently`;
+		const message = `${resourceType} ${path} must be an object, got ${Array.isArray(value) ? "array" : typeof value} — cdkd refuses to drop it silently`;
 		if (options?.onUnusable) {
 			options.onUnusable(message);
 			return;
 		}
-		throw new ProvisioningError(message, "AWS::AppSync::GraphQLApi", options?.logicalId ?? "");
+		throw new ProvisioningError(message, resourceType, options?.logicalId ?? "");
 	}
 	/**
 	* NOTE: `awsRegion` / `defaultAction` are passed through VERBATIM, including
@@ -35181,6 +35322,211 @@ var AppSyncProvider = class {
 			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, isUpdate ? "GraphqlApi (env vars)" : "GraphqlApi (env vars, post-create)");
 		}
 	}
+	/** CFn `CachingConfig` (`Ttl` / `CachingKeys`) -> SDK `cachingConfig`. */
+	toSdkCachingConfig(value, logicalId) {
+		const cfn = this.asObject(value, "CachingConfig", { logicalId }, "AWS::AppSync::Resolver");
+		if (!cfn) return void 0;
+		const out = { ttl: cfn["Ttl"] };
+		if (cfn["CachingKeys"] !== void 0) out.cachingKeys = requireConfigArray(cfn["CachingKeys"], "AWS::AppSync::Resolver CachingConfig.CachingKeys");
+		return out;
+	}
+	/**
+	* CFn `SyncConfig` (`ConflictDetection` / `ConflictHandler` /
+	* `LambdaConflictHandlerConfig.LambdaConflictHandlerArn`) -> SDK
+	* `syncConfig`.
+	*/
+	toSdkSyncConfig(value, logicalId) {
+		const cfn = this.asObject(value, "SyncConfig", { logicalId }, "AWS::AppSync::Resolver");
+		if (!cfn) return void 0;
+		const out = {};
+		if (cfn["ConflictDetection"] !== void 0) out.conflictDetection = cfn["ConflictDetection"];
+		if (cfn["ConflictHandler"] !== void 0) out.conflictHandler = cfn["ConflictHandler"];
+		const lambdaHandler = this.asObject(cfn["LambdaConflictHandlerConfig"], "SyncConfig.LambdaConflictHandlerConfig", { logicalId }, "AWS::AppSync::Resolver");
+		if (lambdaHandler) out.lambdaConflictHandlerConfig = { lambdaConflictHandlerArn: lambdaHandler["LambdaConflictHandlerArn"] };
+		return out;
+	}
+	/**
+	* Parse the `s3://bucket/key` URL the AppSync `*S3Location` string
+	* properties carry.
+	*
+	* CDK's asset bindings (`appsync.Code.fromAsset`, `aws-s3-assets` Asset
+	* `s3ObjectUrl`) emit exactly this form, and the CloudFormation examples
+	* for these properties use it too. Anything else (an `https://` object
+	* URL, a bare bucket, a non-string) is refused with a clear error naming
+	* the property — never silently dropped.
+	*/
+	parseS3LocationUrl(location, resourceType, logicalId, propertyPath) {
+		if (typeof location !== "string") throw new ProvisioningError(`${resourceType} ${propertyPath} must be a string s3://bucket/key URL, got ${Array.isArray(location) ? "array" : typeof location} — check for an unresolved intrinsic`, resourceType, logicalId);
+		const match = /^s3:\/\/([^/]+)\/(.+)$/.exec(location);
+		if (!match || !match[1] || !match[2]) throw new ProvisioningError(`${resourceType} ${propertyPath} must be an s3://bucket/key URL (got '${location}')`, resourceType, logicalId);
+		return {
+			bucket: match[1],
+			key: match[2]
+		};
+	}
+	/**
+	* Fetch an `*S3Location` object body as a UTF-8 string.
+	*
+	* CloudFormation's behavior for these properties is to download the S3
+	* object and pass its CONTENT as the corresponding inline member
+	* (`code` / `requestMappingTemplate` / `responseMappingTemplate` /
+	* `definition`); the URL itself never reaches AppSync. Mirrors
+	* `StepFunctionsProvider.fetchDefinitionFromS3`, including the
+	* empty-body refusal (AWS would reject '' with a generic validation
+	* error naming nothing).
+	*/
+	async fetchS3LocationBody(location, resourceType, logicalId, propertyPath) {
+		const { bucket, key } = this.parseS3LocationUrl(location, resourceType, logicalId, propertyPath);
+		this.logger.debug(`Fetching ${propertyPath} for ${logicalId} from s3://${bucket}/${key}`);
+		let body;
+		try {
+			const resp = await this.getS3Client().send(new GetObjectCommand({
+				Bucket: bucket,
+				Key: key
+			}));
+			if (!resp.Body) throw new Error(`object returned no body`);
+			body = await resp.Body.transformToString();
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			throw new ProvisioningError(`Failed to fetch ${propertyPath} s3://${bucket}/${key} for ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+		}
+		if (body.length === 0) throw new ProvisioningError(`${propertyPath} object s3://${bucket}/${key} returned an empty body`, resourceType, logicalId);
+		return body;
+	}
+	/**
+	* Resolve an inline-or-S3 property pair to the inline SDK value.
+	*
+	* Precedence: the INLINE property wins when both are present, matching
+	* the repo's established S3Location precedent (StepFunctions
+	* `DefinitionString` over `DefinitionS3Location`, AppSync GraphQLSchema
+	* `Definition` over `DefinitionS3Location`) — CFn treats the pair as
+	* alternatives and CDK's bindings only ever emit one, so both-present is
+	* a hand-authored template; it is honored inline-first with a loud
+	* warning rather than refused.
+	*/
+	async resolveInlineOrS3Template(inline, s3Location, inlineKey, s3Key, resourceType, logicalId) {
+		if (inline !== void 0) {
+			if (s3Location !== void 0) this.logger.warn(`${resourceType} ${logicalId}: both ${inlineKey} and ${s3Key} are set — using the inline ${inlineKey} and ignoring ${s3Key} (CFn treats them as alternatives)`);
+			return inline;
+		}
+		if (s3Location !== void 0) return this.fetchS3LocationBody(s3Location, resourceType, logicalId, s3Key);
+	}
+	/**
+	* Fill the mutable members shared by `CreateResolver` and `UpdateResolver`
+	* from the CFn property bag — the single mapper both paths use so they
+	* cannot diverge (the `applyGraphQLApiConfig` pattern).
+	*
+	* REMOVAL semantics: unlike `UpdateGraphqlApi` (where an omitted member is
+	* "no change" and removal needs reset sentinels), `UpdateResolver` is a
+	* FULL-REPLACE write — the desired bag is mapped in its entirety and an
+	* omitted member is cleared server-side, so "absent in template => omitted
+	* from the update input => cleared by AppSync" and no sentinel is needed.
+	* That semantic is pinned live by the integ fixture's REMOVAL phase
+	* (tests/integration/appsync/verify.sh drops the resolver's MetricsConfig
+	* and asserts AWS reset it while a sibling DataSource keeps its own).
+	* MetricsConfig is the one member A/B'd against real AWS; the other
+	* members rest on the same UpdateResolver full-replace API contract, not
+	* on a per-member live probe (the #1160 doctrine's per-member A/B was
+	* deliberately not paid here — recorded in the PR body).
+	*
+	* Resolver shape is `Kind`-discriminated:
+	*   - Kind=UNIT     -> DataSourceName applies, PipelineConfig is N/A.
+	*   - Kind=PIPELINE -> PipelineConfig applies, DataSourceName is N/A
+	*                      (AWS rejects the call if it's set).
+	* The gate applies ONLY on update (`forUpdate`), where the effective Kind
+	* falls back to the state-recorded previous value and finally AWS's
+	* default 'UNIT' — an update must not re-send the other kind's member on a
+	* live resolver. On CREATE both members forward UNCONDITIONALLY when
+	* present: gating there would silently drop a crossed shape (the very
+	* silent-drop class this batch closes) where CFn parity is AWS's own loud
+	* rejection — the same forward-don't-gate doctrine as
+	* `applyDataSourceConfig`'s per-type sub-configs.
+	*/
+	async applyResolverConfig(input, resourceType, logicalId, properties, previousProperties, forUpdate = false) {
+		const effectiveKind = properties["Kind"] ?? previousProperties?.["Kind"] ?? "UNIT";
+		if ((!forUpdate || effectiveKind === "UNIT") && properties["DataSourceName"] !== void 0) input.dataSourceName = properties["DataSourceName"];
+		if (properties["Kind"] !== void 0) input.kind = properties["Kind"];
+		if ((!forUpdate || effectiveKind === "PIPELINE") && properties["PipelineConfig"] !== void 0) input.pipelineConfig = { functions: properties["PipelineConfig"]["Functions"] };
+		if (properties["Runtime"] !== void 0) {
+			const runtime = properties["Runtime"];
+			input.runtime = {
+				name: runtime["Name"],
+				runtimeVersion: runtime["RuntimeVersion"]
+			};
+		}
+		const requestTemplate = await this.resolveInlineOrS3Template(properties["RequestMappingTemplate"], properties["RequestMappingTemplateS3Location"], "RequestMappingTemplate", "RequestMappingTemplateS3Location", resourceType, logicalId);
+		if (requestTemplate !== void 0) input.requestMappingTemplate = requestTemplate;
+		const responseTemplate = await this.resolveInlineOrS3Template(properties["ResponseMappingTemplate"], properties["ResponseMappingTemplateS3Location"], "ResponseMappingTemplate", "ResponseMappingTemplateS3Location", resourceType, logicalId);
+		if (responseTemplate !== void 0) input.responseMappingTemplate = responseTemplate;
+		const code = await this.resolveInlineOrS3Template(properties["Code"], properties["CodeS3Location"], "Code", "CodeS3Location", resourceType, logicalId);
+		if (code !== void 0) input.code = code;
+		const caching = this.toSdkCachingConfig(properties["CachingConfig"], logicalId);
+		if (caching) input.cachingConfig = caching;
+		const sync = this.toSdkSyncConfig(properties["SyncConfig"], logicalId);
+		if (sync) input.syncConfig = sync;
+		if (properties["MaxBatchSize"] !== void 0) input.maxBatchSize = properties["MaxBatchSize"];
+		if (properties["MetricsConfig"] !== void 0) input.metricsConfig = properties["MetricsConfig"];
+	}
+	/**
+	* Fill the mutable members shared by `CreateDataSource` and
+	* `UpdateDataSource` from the CFn property bag — single mapper for both
+	* paths (the `applyGraphQLApiConfig` pattern).
+	*
+	* REMOVAL semantics: `UpdateDataSource` is a FULL-REPLACE write like
+	* `UpdateResolver` — an omitted member is cleared server-side, so removal
+	* needs no reset sentinel (see `applyResolverConfig`'s note; pinned live
+	* by the integ fixture's REMOVAL phase).
+	*
+	* The per-type sub-configs (`DynamoDBConfig` / `LambdaConfig` /
+	* `HttpConfig` / `ElasticsearchConfig` / `OpenSearchServiceConfig` /
+	* `EventBridgeConfig` / `RelationalDatabaseConfig`) are mutually exclusive
+	* on the `Type` discriminator. The write side deliberately FORWARDS
+	* whichever block the template carries rather than gating on `Type`:
+	* gating would silently drop a mismatched block (the very silent-drop
+	* class this batch closes), while AWS rejects a crossed shape with a loud
+	* validation error. The read side (`readDataSource`) gates on the
+	* response's own discriminator instead.
+	*/
+	applyDataSourceConfig(input, resourceType, logicalId, properties) {
+		if (properties["Description"] !== void 0) input.description = properties["Description"];
+		if (properties["ServiceRoleArn"] !== void 0) input.serviceRoleArn = properties["ServiceRoleArn"];
+		const dynamo = this.asObject(properties["DynamoDBConfig"], "DynamoDBConfig", { logicalId }, resourceType);
+		if (dynamo) input.dynamodbConfig = {
+			tableName: dynamo["TableName"],
+			awsRegion: dynamo["AwsRegion"],
+			...dynamo["UseCallerCredentials"] !== void 0 ? { useCallerCredentials: dynamo["UseCallerCredentials"] } : {}
+		};
+		const lambda = this.asObject(properties["LambdaConfig"], "LambdaConfig", { logicalId }, resourceType);
+		if (lambda) input.lambdaConfig = { lambdaFunctionArn: lambda["LambdaFunctionArn"] };
+		const http = this.asObject(properties["HttpConfig"], "HttpConfig", { logicalId }, resourceType);
+		if (http) input.httpConfig = { endpoint: http["Endpoint"] };
+		const es = this.asObject(properties["ElasticsearchConfig"], "ElasticsearchConfig", { logicalId }, resourceType);
+		if (es) input.elasticsearchConfig = {
+			endpoint: es["Endpoint"],
+			awsRegion: es["AwsRegion"]
+		};
+		const openSearch = this.asObject(properties["OpenSearchServiceConfig"], "OpenSearchServiceConfig", { logicalId }, resourceType);
+		if (openSearch) input.openSearchServiceConfig = {
+			endpoint: openSearch["Endpoint"],
+			awsRegion: openSearch["AwsRegion"]
+		};
+		const eventBridge = this.asObject(properties["EventBridgeConfig"], "EventBridgeConfig", { logicalId }, resourceType);
+		if (eventBridge) input.eventBridgeConfig = { eventBusArn: eventBridge["EventBusArn"] };
+		const relational = this.asObject(properties["RelationalDatabaseConfig"], "RelationalDatabaseConfig", { logicalId }, resourceType);
+		if (relational) {
+			const rdsConfig = { relationalDatabaseSourceType: relational["RelationalDatabaseSourceType"] };
+			const rdsEndpoint = this.asObject(relational["RdsHttpEndpointConfig"], "RelationalDatabaseConfig.RdsHttpEndpointConfig", { logicalId }, resourceType);
+			if (rdsEndpoint) rdsConfig.rdsHttpEndpointConfig = {
+				awsRegion: rdsEndpoint["AwsRegion"],
+				dbClusterIdentifier: rdsEndpoint["DbClusterIdentifier"],
+				...rdsEndpoint["DatabaseName"] !== void 0 ? { databaseName: rdsEndpoint["DatabaseName"] } : {},
+				...rdsEndpoint["Schema"] !== void 0 ? { schema: rdsEndpoint["Schema"] } : {},
+				...rdsEndpoint["AwsSecretStoreArn"] !== void 0 ? { awsSecretStoreArn: rdsEndpoint["AwsSecretStoreArn"] } : {}
+			};
+			input.relationalDatabaseConfig = rdsConfig;
+		}
+		if (properties["MetricsConfig"] !== void 0) input.metricsConfig = properties["MetricsConfig"];
+	}
 	async createGraphQLApi(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating GraphQL API ${logicalId}`);
 		const name = properties["Name"];
@@ -35265,11 +35611,19 @@ var AppSyncProvider = class {
 		const definition = properties["Definition"];
 		const definitionS3Location = properties["DefinitionS3Location"];
 		try {
-			if (definition) await this.getClient().send(new StartSchemaCreationCommand({
-				apiId,
-				definition: new TextEncoder().encode(definition)
-			}));
-			else if (definitionS3Location) this.logger.warn(`S3-based schema definition for ${logicalId} - using inline only`);
+			if (definition) {
+				if (definitionS3Location !== void 0) this.logger.warn(`${resourceType} ${logicalId}: both Definition and DefinitionS3Location are set — using the inline Definition and ignoring DefinitionS3Location (CFn treats them as alternatives)`);
+				await this.getClient().send(new StartSchemaCreationCommand({
+					apiId,
+					definition: new TextEncoder().encode(definition)
+				}));
+			} else if (definitionS3Location !== void 0) {
+				const body = await this.fetchS3LocationBody(definitionS3Location, resourceType, logicalId, "DefinitionS3Location");
+				await this.getClient().send(new StartSchemaCreationCommand({
+					apiId,
+					definition: new TextEncoder().encode(body)
+				}));
+			}
 			this.logger.debug(`Successfully started schema creation for ${logicalId}`);
 			return {
 				physicalId: apiId,
@@ -35292,18 +35646,7 @@ var AppSyncProvider = class {
 				name,
 				type
 			};
-			if (properties["Description"]) input.description = properties["Description"];
-			if (properties["ServiceRoleArn"]) input.serviceRoleArn = properties["ServiceRoleArn"];
-			if (properties["DynamoDBConfig"]) {
-				const config = properties["DynamoDBConfig"];
-				input.dynamodbConfig = {
-					tableName: config["TableName"],
-					awsRegion: config["AwsRegion"],
-					useCallerCredentials: config["UseCallerCredentials"]
-				};
-			}
-			if (properties["LambdaConfig"]) input.lambdaConfig = { lambdaFunctionArn: properties["LambdaConfig"]["LambdaFunctionArn"] };
-			if (properties["HttpConfig"]) input.httpConfig = { endpoint: properties["HttpConfig"]["Endpoint"] };
+			this.applyDataSourceConfig(input, resourceType, logicalId, properties);
 			await this.getClient().send(new CreateDataSourceCommand(input));
 			const physicalId = `${apiId}|${name}`;
 			this.logger.debug(`Successfully created DataSource ${logicalId}: ${physicalId}`);
@@ -35354,19 +35697,7 @@ var AppSyncProvider = class {
 				typeName,
 				fieldName
 			};
-			if (properties["DataSourceName"]) input.dataSourceName = properties["DataSourceName"];
-			if (properties["RequestMappingTemplate"]) input.requestMappingTemplate = properties["RequestMappingTemplate"];
-			if (properties["ResponseMappingTemplate"]) input.responseMappingTemplate = properties["ResponseMappingTemplate"];
-			if (properties["Kind"]) input.kind = properties["Kind"];
-			if (properties["PipelineConfig"]) input.pipelineConfig = { functions: properties["PipelineConfig"]["Functions"] };
-			if (properties["Runtime"]) {
-				const runtime = properties["Runtime"];
-				input.runtime = {
-					name: runtime["Name"],
-					runtimeVersion: runtime["RuntimeVersion"]
-				};
-			}
-			if (properties["Code"]) input.code = properties["Code"];
+			await this.applyResolverConfig(input, resourceType, logicalId, properties);
 			await this.getClient().send(new CreateResolverCommand(input));
 			const physicalId = `${apiId}|${typeName}|${fieldName}`;
 			this.logger.debug(`Successfully created Resolver ${logicalId}: ${physicalId}`);
@@ -35465,10 +35796,13 @@ var AppSyncProvider = class {
 	*    CDK's `aws:*` auto-tags are filtered out and the result key is
 	*    omitted when no user tags remain.
 	*  - `DataSource` → `GetDataSource` (Name, Type, Description,
-	*    ServiceRoleArn, DynamoDBConfig, LambdaConfig, HttpConfig). The
+	*    ServiceRoleArn, the per-type configs — DynamoDBConfig, LambdaConfig,
+	*    HttpConfig, ElasticsearchConfig, OpenSearchServiceConfig,
+	*    EventBridgeConfig, RelationalDatabaseConfig — and MetricsConfig). The
 	*    `ApiId` cdkd holds is recovered from the `apiId|name` physicalId.
 	*  - `Resolver` → `GetResolver` (TypeName, FieldName, DataSourceName,
-	*    request/response templates, Kind, PipelineConfig, Runtime, Code).
+	*    request/response templates, Kind, PipelineConfig, Runtime, Code,
+	*    CachingConfig, SyncConfig, MaxBatchSize, MetricsConfig).
 	*  - `ApiKey` → `ListApiKeys` filtered by id (no `GetApiKey` SDK call;
 	*    AppSync only exposes list-based access). Surfaces Description and
 	*    Expires.
@@ -35646,6 +35980,35 @@ var AppSyncProvider = class {
 		}
 		if (ds.lambdaConfig?.lambdaFunctionArn !== void 0) result["LambdaConfig"] = { LambdaFunctionArn: ds.lambdaConfig.lambdaFunctionArn };
 		if (ds.httpConfig?.endpoint !== void 0) result["HttpConfig"] = { Endpoint: ds.httpConfig.endpoint };
+		if (ds.elasticsearchConfig) {
+			const es = {};
+			if (ds.elasticsearchConfig.endpoint !== void 0) es["Endpoint"] = ds.elasticsearchConfig.endpoint;
+			if (ds.elasticsearchConfig.awsRegion !== void 0) es["AwsRegion"] = ds.elasticsearchConfig.awsRegion;
+			if (Object.keys(es).length > 0) result["ElasticsearchConfig"] = es;
+		}
+		if (ds.openSearchServiceConfig) {
+			const os = {};
+			if (ds.openSearchServiceConfig.endpoint !== void 0) os["Endpoint"] = ds.openSearchServiceConfig.endpoint;
+			if (ds.openSearchServiceConfig.awsRegion !== void 0) os["AwsRegion"] = ds.openSearchServiceConfig.awsRegion;
+			if (Object.keys(os).length > 0) result["OpenSearchServiceConfig"] = os;
+		}
+		if (ds.eventBridgeConfig?.eventBusArn !== void 0) result["EventBridgeConfig"] = { EventBusArn: ds.eventBridgeConfig.eventBusArn };
+		if (ds.relationalDatabaseConfig) {
+			const rds = {};
+			if (ds.relationalDatabaseConfig.relationalDatabaseSourceType !== void 0) rds["RelationalDatabaseSourceType"] = ds.relationalDatabaseConfig.relationalDatabaseSourceType;
+			const endpoint = ds.relationalDatabaseConfig.rdsHttpEndpointConfig;
+			if (endpoint) {
+				const ep = {};
+				if (endpoint.awsRegion !== void 0) ep["AwsRegion"] = endpoint.awsRegion;
+				if (endpoint.dbClusterIdentifier !== void 0) ep["DbClusterIdentifier"] = endpoint.dbClusterIdentifier;
+				if (endpoint.databaseName !== void 0) ep["DatabaseName"] = endpoint.databaseName;
+				if (endpoint.schema !== void 0) ep["Schema"] = endpoint.schema;
+				if (endpoint.awsSecretStoreArn !== void 0) ep["AwsSecretStoreArn"] = endpoint.awsSecretStoreArn;
+				if (Object.keys(ep).length > 0) rds["RdsHttpEndpointConfig"] = ep;
+			}
+			if (Object.keys(rds).length > 0) result["RelationalDatabaseConfig"] = rds;
+		}
+		if (ds.metricsConfig !== void 0) result["MetricsConfig"] = ds.metricsConfig;
 		return result;
 	}
 	async readResolver(physicalId) {
@@ -35680,6 +36043,21 @@ var AppSyncProvider = class {
 			result["RequestMappingTemplate"] = resolver.requestMappingTemplate ?? "";
 			result["ResponseMappingTemplate"] = resolver.responseMappingTemplate ?? "";
 		}
+		if (resolver.cachingConfig) {
+			const caching = {};
+			if (resolver.cachingConfig.ttl !== void 0) caching["Ttl"] = resolver.cachingConfig.ttl;
+			if (resolver.cachingConfig.cachingKeys !== void 0) caching["CachingKeys"] = [...resolver.cachingConfig.cachingKeys];
+			if (Object.keys(caching).length > 0) result["CachingConfig"] = caching;
+		}
+		if (resolver.syncConfig) {
+			const sync = {};
+			if (resolver.syncConfig.conflictDetection !== void 0) sync["ConflictDetection"] = resolver.syncConfig.conflictDetection;
+			if (resolver.syncConfig.conflictHandler !== void 0) sync["ConflictHandler"] = resolver.syncConfig.conflictHandler;
+			if (resolver.syncConfig.lambdaConflictHandlerConfig?.lambdaConflictHandlerArn !== void 0) sync["LambdaConflictHandlerConfig"] = { LambdaConflictHandlerArn: resolver.syncConfig.lambdaConflictHandlerConfig.lambdaConflictHandlerArn };
+			if (Object.keys(sync).length > 0) result["SyncConfig"] = sync;
+		}
+		if (resolver.maxBatchSize !== void 0) result["MaxBatchSize"] = resolver.maxBatchSize;
+		if (resolver.metricsConfig !== void 0) result["MetricsConfig"] = resolver.metricsConfig;
 		return result;
 	}
 	async readApiKey(physicalId) {
@@ -51937,7 +52315,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				});
 				continue;
 			}
-			const ignorePaths = provider.getDriftUnknownPaths ? provider.getDriftUnknownPaths(resource.resourceType) : [];
+			const ignorePaths = provider.getDriftUnknownPaths ? provider.getDriftUnknownPaths(resource.resourceType, resource.properties ?? {}) : [];
 			const unorderedPaths = provider.getDriftUnorderedPaths ? provider.getDriftUnorderedPaths(resource.resourceType) : [];
 			const useObserved = resource.observedProperties !== void 0;
 			const baseline = useObserved ? resource.observedProperties : resource.properties ?? {};
@@ -69419,7 +69797,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.16");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.18");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;