@go-to-k/cdkd 0.280.17 → 0.280.19

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-tCcs8UGn.js";
+import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-r4N9-tZD.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-DQLjoTQ3.js";
+import { t as ASGProvider } from "./asg-provider-B62D31jG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -27873,6 +27873,78 @@ const TARGET_GROUP_ATTRIBUTE_DEFAULTS = {
 	"proxy_protocol_v2.enabled": "false"
 };
 /**
+* Documented AWS defaults for the BOOLEAN / ENUM-valued LoadBalancer and
+* Listener attributes, used to reset a removed `LoadBalancerAttributes` /
+* `ListenerAttributes` entry.
+*
+* Unlike ModifyTargetGroupAttributes — which rejects an empty `Value` for
+* EVERY key — these two APIs accept `Value: ''` for the numeric and
+* free-form string attributes and REJECT it only where the value is
+* validated against a fixed set. Live A/B 2026-08-11 (issue #1609 item 1),
+* via the `alb` integ's removal phase:
+*
+*   idle_timeout.timeout_seconds  -> `Value: ''` ACCEPTED (numeric)
+*   deletion_protection.enabled   -> "The value of 'deletion_protection.enabled'
+*                                     must be 'true' or 'false', but was ''"
+*   routing.http.response.server.enabled (Listener)
+*                                 -> same rejection, same shape
+*
+* A rejection fails the whole Modify* call, so ONE removed boolean took the
+* entire deploy down (and then the rollback with it). Hence: send the
+* documented default for the validated keys, and keep the empty string for
+* everything else — which is both these APIs' own "clear the override"
+* signal and the behaviour every non-boolean key already relied on.
+*
+* That fallback is the deliberate DIVERGENCE from
+* TARGET_GROUP_ATTRIBUTE_DEFAULTS, whose unknown-key arm warns and retains:
+* there the empty string is never valid, here it is valid for the majority
+* of keys, so falling back to it preserves working behaviour instead of
+* silently retaining a value the template asked to drop.
+*
+* A key is listed ONLY when ONE unconditional default is established for it —
+* documented in the SDK model, or (for
+* `routing.http.response.server.enabled`, which the model leaves unstated)
+* proven by the `alb` integ's live removal readback. Two exclusion classes
+* matter, and both are the difference between failing loudly and writing a
+* wrong value silently:
+*
+* - **Default depends on the LOAD BALANCER** — `load_balancing.cross_zone.enabled`
+*   is always-on and unconfigurable for an ALB but defaults to false on an
+*   NLB / GWLB, and `ipv6.deny_all_igw_traffic` is "false for internet-facing
+*   load balancers and true for internal load balancers". cdkd knows neither
+*   the type nor the scheme at diff time, so a hardcoded entry would send the
+*   WRONG value for half of all load balancers — and since it is a valid
+*   boolean, AWS accepts it. For `ipv6.deny_all_igw_traffic` that means
+*   silently un-blocking internet-gateway access on an INTERNAL load balancer.
+* - **No documented default at all** — `dns_record.client_routing_policy`
+*   enumerates its possible values but states no default.
+*
+* Both classes keep the empty-string behaviour they have always had, so a
+* removal there fails loudly (for a validated key) instead of guessing.
+*
+* Source: the `@aws-sdk/client-elastic-load-balancing-v2` model docs for
+* `ModifyLoadBalancerAttributes` / `ModifyListenerAttributes`, checked per key;
+* `routing.http.response.server.enabled`'s default is additionally LIVE-proven
+* by the `alb` integ's removal readback rather than taken from the docs.
+*/
+const LOAD_BALANCER_ATTRIBUTE_DEFAULTS = {
+	"deletion_protection.enabled": "false",
+	"access_logs.s3.enabled": "false",
+	"connection_logs.s3.enabled": "false",
+	"health_check_logs.s3.enabled": "false",
+	"routing.http.desync_mitigation_mode": "defensive",
+	"routing.http.drop_invalid_header_fields.enabled": "false",
+	"routing.http.preserve_host_header.enabled": "false",
+	"routing.http.x_amzn_tls_version_and_cipher_suite.enabled": "false",
+	"routing.http.xff_client_port.enabled": "false",
+	"routing.http.xff_header_processing.mode": "append",
+	"routing.http2.enabled": "true",
+	"waf.fail_open.enabled": "false",
+	"zonal_shift.config.enabled": "false"
+};
+/** @see LOAD_BALANCER_ATTRIBUTE_DEFAULTS — same rule, Listener key table. */
+const LISTENER_ATTRIBUTE_DEFAULTS = { "routing.http.response.server.enabled": "true" };
+/**
 * AWS ELBv2 Provider
 *
 * Implements resource provisioning for ELBv2 resources:
@@ -28085,7 +28157,7 @@ var ELBv2Provider = class {
 			return out;
 		};
 		if (JSON.stringify(stripHandled(properties)) !== JSON.stringify(stripHandled(previousProperties))) throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place; for Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.");
-		const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["LoadBalancerAttributes"]), this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]));
+		const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["LoadBalancerAttributes"]), this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]), this.attributeRemovalResolver(LOAD_BALANCER_ATTRIBUTE_DEFAULTS));
 		if (submittedAttrs.length > 0) {
 			await this.getClient().send(new ModifyLoadBalancerAttributesCommand({
 				LoadBalancerArn: physicalId,
@@ -28309,10 +28381,13 @@ var ELBv2Provider = class {
 				UnhealthyThresholdCount: properties["UnhealthyThresholdCount"] !== void 0 ? Number(properties["UnhealthyThresholdCount"]) : void 0,
 				...matcher && { Matcher: matcher }
 			}));
-			const tgAttrDiff = this.diffAttributes(this.normalizeAttributes(properties["TargetGroupAttributes"]), this.normalizeAttributes(previousProperties["TargetGroupAttributes"]), (key) => {
-				const fallback = TARGET_GROUP_ATTRIBUTE_DEFAULTS[key];
-				if (fallback === void 0) this.logger.warn(`TargetGroup attribute ${key} was removed from the template but has no documented default cdkd can reset it to — the live value is retained. Set the attribute explicitly to change it.`);
-				return fallback;
+			const tgAttrDiff = this.diffAttributes(this.normalizeAttributes(properties["TargetGroupAttributes"]), this.normalizeAttributes(previousProperties["TargetGroupAttributes"]), (key, currentValue) => {
+				const fallback = Object.hasOwn(TARGET_GROUP_ATTRIBUTE_DEFAULTS, key) ? TARGET_GROUP_ATTRIBUTE_DEFAULTS[key] : void 0;
+				if (fallback === void 0) {
+					this.logger.warn(`TargetGroup attribute ${key} was removed from the template but has no documented default cdkd can reset it to — the live value is retained. Set the attribute explicitly to change it.`);
+					return;
+				}
+				return currentValue === fallback ? void 0 : fallback;
 			});
 			if (tgAttrDiff.length > 0) {
 				await this.getClient().send(new ModifyTargetGroupAttributesCommand({
@@ -28444,7 +28519,7 @@ var ELBv2Provider = class {
 				...alpnPolicy && alpnPolicy.length > 0 && { AlpnPolicy: alpnPolicy },
 				...mutualAuth !== void 0 && { MutualAuthentication: mutualAuth }
 			}));
-			const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["ListenerAttributes"]), this.normalizeAttributes(previousProperties["ListenerAttributes"]));
+			const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["ListenerAttributes"]), this.normalizeAttributes(previousProperties["ListenerAttributes"]), this.attributeRemovalResolver(LISTENER_ATTRIBUTE_DEFAULTS));
 			if (submittedAttrs.length > 0) {
 				await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
 					ListenerArn: physicalId,
@@ -28522,14 +28597,28 @@ var ELBv2Provider = class {
 	/**
 	* Key-diff two normalized `{Key, Value}` attribute lists into the payload
 	* for a Modify*Attributes call: changed values from `newAttrs` win, and
-	* keys present only in `oldAttrs` are pushed back through `removalValue` —
-	* by default the empty string, which ModifyLoadBalancerAttributes /
-	* ModifyListenerAttributes accept as "clear the override". A resolver
-	* returning `undefined` SKIPS the entry (the resolver owns any warn).
-	* An empty return means nothing changed and the call should be skipped.
-	* Shared by the LoadBalancer / TargetGroup / Listener update paths.
-	*/
-	diffAttributes(newAttrs, oldAttrs, removalValue = () => "") {
+	* keys present only in `oldAttrs` are pushed back through `removalValue`.
+	* A resolver returning `undefined` SKIPS the entry (the resolver owns any
+	* warn). An empty return means nothing changed and the call should be
+	* skipped. Shared by the LoadBalancer / TargetGroup / Listener update
+	* paths — and all three pass their OWN resolver, because the three APIs
+	* disagree about what resets an attribute:
+	*
+	* - LoadBalancer / Listener: the empty string clears a numeric or
+	*   free-form-string override, but a BOOLEAN / ENUM key rejects it and
+	*   fails the whole call, so those take a documented default
+	*   (`LOAD_BALANCER_ATTRIBUTE_DEFAULTS` / `LISTENER_ATTRIBUTE_DEFAULTS`).
+	* - TargetGroup: the empty string is rejected for EVERY key, so the
+	*   documented default is the only reset and an unknown key warns and
+	*   retains (`TARGET_GROUP_ATTRIBUTE_DEFAULTS`).
+	*
+	* All three behaviours were live-verified 2026-08-11. `removalValue` is
+	* REQUIRED rather than defaulted: there is no reset value that is correct
+	* for all three APIs, so a caller that forgets to pass one should fail to
+	* compile instead of silently inheriting the empty string that two of the
+	* three reject.
+	*/
+	diffAttributes(newAttrs, oldAttrs, removalValue) {
 		const newAttrMap = new Map(newAttrs.map((a) => [a.Key, a.Value]));
 		const oldAttrMap = new Map(oldAttrs.map((a) => [a.Key, a.Value]));
 		const submitted = [];
@@ -28537,8 +28626,8 @@ var ELBv2Provider = class {
 			Key: k,
 			Value: v
 		});
-		for (const [k] of oldAttrMap) if (!newAttrMap.has(k)) {
-			const value = removalValue(k);
+		for (const [k, currentValue] of oldAttrMap) if (!newAttrMap.has(k)) {
+			const value = removalValue(k, currentValue);
 			if (value !== void 0) submitted.push({
 				Key: k,
 				Value: value
@@ -28547,6 +28636,40 @@ var ELBv2Provider = class {
 		return submitted;
 	}
 	/**
+	* Build the `removalValue` resolver for the LoadBalancer / Listener attribute
+	* arms: reset a removed key to its documented default, or to `''` (which
+	* those two APIs accept as "clear the override") when no default is known.
+	*
+	* **A key already AT its default is SKIPPED, and that is a safety property,
+	* not an optimization.** The previous side is not always a template: `cdkd
+	* drift --revert` calls `update(..., newProperties, outcome.awsProperties)`
+	* (`src/cli/commands/drift.ts`), so `oldAttrs` can be the FULL
+	* `readCurrentState` snapshot — every attribute AWS reports, including the
+	* ~18 the user never templated. Against a state record with no
+	* `observedProperties` the desired side is the template's one or two keys,
+	* so every untemplated key looks REMOVED and would be "reset".
+	*
+	* Writing a documented default there would silently disable deletion
+	* protection, access / connection logs, HTTP/2, WAF fail-open and zonal
+	* shift on a live load balancer. Before the defaults table existed this was
+	* accidentally safe — `''` fails validation, so the whole revert aborted and
+	* changed nothing — so introducing the table without this guard would have
+	* converted a loud refusal into a silent destructive write.
+	*
+	* The skip is exact rather than heuristic: a key the user never templated is
+	* BY DEFINITION sitting at its default, so it is skipped; a key the template
+	* really did set is set to a NON-default value (otherwise templating it
+	* would be a no-op), so its reset still fires. A template that set a key to
+	* exactly its default and then dropped it is skipped too — correctly, since
+	* there is nothing to change.
+	*/
+	attributeRemovalResolver(defaults) {
+		return (key, currentValue) => {
+			const fallback = Object.hasOwn(defaults, key) ? defaults[key] : "";
+			return currentValue === fallback ? void 0 : fallback;
+		};
+	}
+	/**
 	* Normalize a CFn `Targets` value (an array of `{ Id, Port?,
 	* AvailabilityZone? }` objects) into the SDK's `TargetDescription[]` shape.
 	* Entries missing an `Id` are dropped (Id is the only required member);
@@ -34664,6 +34787,7 @@ const MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES = [
 */
 var AppSyncProvider = class {
 	client;
+	s3Client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("AppSyncProvider");
 	/**
@@ -34714,7 +34838,12 @@ var AppSyncProvider = class {
 			"ServiceRoleArn",
 			"DynamoDBConfig",
 			"LambdaConfig",
-			"HttpConfig"
+			"HttpConfig",
+			"ElasticsearchConfig",
+			"EventBridgeConfig",
+			"MetricsConfig",
+			"OpenSearchServiceConfig",
+			"RelationalDatabaseConfig"
 		])],
 		["AWS::AppSync::Resolver", /* @__PURE__ */ new Set([
 			"ApiId",
@@ -34726,7 +34855,14 @@ var AppSyncProvider = class {
 			"Kind",
 			"PipelineConfig",
 			"Runtime",
-			"Code"
+			"Code",
+			"CachingConfig",
+			"CodeS3Location",
+			"MaxBatchSize",
+			"MetricsConfig",
+			"RequestMappingTemplateS3Location",
+			"ResponseMappingTemplateS3Location",
+			"SyncConfig"
 		])],
 		["AWS::AppSync::ApiKey", /* @__PURE__ */ new Set([
 			"ApiId",
@@ -34734,11 +34870,23 @@ var AppSyncProvider = class {
 			"Expires"
 		])]
 	]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::AppSync::DataSource", /* @__PURE__ */ new Map([["ElasticsearchConfig", "Legacy Elasticsearch alias; use OpenSearchServiceConfig (AppSync deprecated the Elasticsearch DataSource type in favor of OpenSearch)"]])]]);
 	getClient() {
 		if (!this.client) this.client = new AppSyncClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
 	}
+	/**
+	* Lazy S3 client for the `*S3Location` properties (Resolver
+	* `CodeS3Location` / `RequestMappingTemplateS3Location` /
+	* `ResponseMappingTemplateS3Location`, GraphQLSchema
+	* `DefinitionS3Location`) — CloudFormation reads the S3 object and inlines
+	* its body, and cdkd mirrors that. Same construction as
+	* `StepFunctionsProvider.getS3Client` (the sibling `DefinitionS3Location`
+	* implementation).
+	*/
+	getS3Client() {
+		if (!this.s3Client) this.s3Client = new S3Client(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.s3Client;
+	}
 	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
 			case "AWS::AppSync::GraphQLApi": return this.createGraphQLApi(logicalId, resourceType, properties, context);
@@ -34757,11 +34905,16 @@ var AppSyncProvider = class {
 	*     `XrayEnabled` / `LogConfig`) + `TagResource` / `UntagResource`
 	*     for `Tags` diff. `Name` is immutable on AWS.
 	*   - `DataSource`   → `UpdateDataSourceCommand` (`Description` /
-	*     `ServiceRoleArn` / `DynamoDBConfig` / `LambdaConfig` / `HttpConfig`).
+	*     `ServiceRoleArn` / the per-type configs — `DynamoDBConfig` /
+	*     `LambdaConfig` / `HttpConfig` / `ElasticsearchConfig` /
+	*     `OpenSearchServiceConfig` / `EventBridgeConfig` /
+	*     `RelationalDatabaseConfig` — / `MetricsConfig`).
 	*     `ApiId` / `Name` / `Type` are immutable identity fields.
 	*   - `Resolver`     → `UpdateResolverCommand` (`DataSourceName` /
 	*     `RequestMappingTemplate` / `ResponseMappingTemplate` / `Kind` /
-	*     `PipelineConfig` / `Runtime` / `Code`). `ApiId` / `TypeName` /
+	*     `PipelineConfig` / `Runtime` / `Code` / `CachingConfig` /
+	*     `SyncConfig` / `MaxBatchSize` / `MetricsConfig` + the three
+	*     `*S3Location` fetch-and-inline pairs). `ApiId` / `TypeName` /
 	*     `FieldName` are immutable identity fields.
 	*   - `ApiKey`       → `UpdateApiKeyCommand` (`Description` / `Expires`).
 	*     `ApiId` is immutable; the AWS-generated key id is immutable.
@@ -34853,7 +35006,23 @@ var AppSyncProvider = class {
 	async updateGraphQLSchema(logicalId, physicalId, resourceType, properties, previousProperties) {
 		const newDef = properties["Definition"];
 		const oldDef = previousProperties["Definition"];
-		if (newDef === void 0 || newDef === oldDef) return {
+		const newLoc = properties["DefinitionS3Location"];
+		const oldLoc = previousProperties["DefinitionS3Location"];
+		let definition;
+		if (newDef !== void 0) {
+			if (newLoc !== void 0) this.logger.warn(`${resourceType} ${logicalId}: both Definition and DefinitionS3Location are set — using the inline Definition and ignoring DefinitionS3Location (CFn treats them as alternatives)`);
+			if (newDef === oldDef) return {
+				physicalId,
+				wasReplaced: false
+			};
+			definition = newDef;
+		} else if (newLoc !== void 0) {
+			if (this.deepEqual(newLoc, oldLoc)) return {
+				physicalId,
+				wasReplaced: false
+			};
+			definition = await this.fetchS3LocationBody(newLoc, resourceType, logicalId, "DefinitionS3Location");
+		} else return {
 			physicalId,
 			wasReplaced: false
 		};
@@ -34861,7 +35030,7 @@ var AppSyncProvider = class {
 		try {
 			await this.getClient().send(new StartSchemaCreationCommand({
 				apiId,
-				definition: Buffer.from(newDef, "utf-8")
+				definition: Buffer.from(definition, "utf-8")
 			}));
 		} catch (error) {
 			throw this.wrapUpdateError(error, resourceType, logicalId, physicalId, "GraphqlSchema");
@@ -34884,17 +35053,18 @@ var AppSyncProvider = class {
 		const [apiId, name] = physicalId.split("|");
 		if (!apiId || !name) throw new ProvisioningError(`Invalid DataSource physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
 		const type = properties["Type"] ?? previousProperties["Type"];
-		const newDesc = properties["Description"];
-		const oldDesc = previousProperties["Description"];
-		const newRole = properties["ServiceRoleArn"];
-		const oldRole = previousProperties["ServiceRoleArn"];
-		const newDDB = properties["DynamoDBConfig"];
-		const oldDDB = previousProperties["DynamoDBConfig"];
-		const newLambda = properties["LambdaConfig"];
-		const oldLambda = previousProperties["LambdaConfig"];
-		const newHttp = properties["HttpConfig"];
-		const oldHttp = previousProperties["HttpConfig"];
-		if (!(newDesc !== oldDesc || newRole !== oldRole || !this.deepEqual(newDDB, oldDDB) || !this.deepEqual(newLambda, oldLambda) || !this.deepEqual(newHttp, oldHttp))) return {
+		if (![
+			"Description",
+			"ServiceRoleArn",
+			"DynamoDBConfig",
+			"LambdaConfig",
+			"HttpConfig",
+			"ElasticsearchConfig",
+			"OpenSearchServiceConfig",
+			"EventBridgeConfig",
+			"RelationalDatabaseConfig",
+			"MetricsConfig"
+		].some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]))) return {
 			physicalId,
 			wasReplaced: false
 		};
@@ -34903,15 +35073,7 @@ var AppSyncProvider = class {
 			name,
 			type
 		};
-		if (newDesc !== void 0) input.description = newDesc;
-		if (newRole !== void 0) input.serviceRoleArn = newRole;
-		if (newDDB !== void 0) input.dynamodbConfig = {
-			tableName: newDDB["TableName"],
-			awsRegion: newDDB["AwsRegion"],
-			useCallerCredentials: newDDB["UseCallerCredentials"]
-		};
-		if (newLambda !== void 0) input.lambdaConfig = { lambdaFunctionArn: newLambda["LambdaFunctionArn"] };
-		if (newHttp !== void 0) input.httpConfig = { endpoint: newHttp["Endpoint"] };
+		this.applyDataSourceConfig(input, resourceType, logicalId, properties);
 		try {
 			await this.getClient().send(new UpdateDataSourceCommand(input));
 		} catch (error) {
@@ -34942,8 +35104,15 @@ var AppSyncProvider = class {
 			"Kind",
 			"PipelineConfig",
 			"Runtime",
-			"Code"
-		].some((key) => !this.deepEqual(properties[key], previousProperties[key]))) return {
+			"Code",
+			"CachingConfig",
+			"SyncConfig",
+			"MaxBatchSize",
+			"MetricsConfig",
+			"CodeS3Location",
+			"RequestMappingTemplateS3Location",
+			"ResponseMappingTemplateS3Location"
+		].some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]))) return {
 			physicalId,
 			wasReplaced: false
 		};
@@ -34952,20 +35121,7 @@ var AppSyncProvider = class {
 			typeName,
 			fieldName
 		};
-		const effectiveKind = properties["Kind"] ?? previousProperties["Kind"] ?? "UNIT";
-		if (effectiveKind === "UNIT" && properties["DataSourceName"] !== void 0) input.dataSourceName = properties["DataSourceName"];
-		if (properties["RequestMappingTemplate"] !== void 0) input.requestMappingTemplate = properties["RequestMappingTemplate"];
-		if (properties["ResponseMappingTemplate"] !== void 0) input.responseMappingTemplate = properties["ResponseMappingTemplate"];
-		if (properties["Kind"] !== void 0) input.kind = properties["Kind"];
-		if (effectiveKind === "PIPELINE" && properties["PipelineConfig"] !== void 0) input.pipelineConfig = { functions: properties["PipelineConfig"]["Functions"] };
-		if (properties["Runtime"] !== void 0) {
-			const runtime = properties["Runtime"];
-			input.runtime = {
-				name: runtime["Name"],
-				runtimeVersion: runtime["RuntimeVersion"]
-			};
-		}
-		if (properties["Code"] !== void 0) input.code = properties["Code"];
+		await this.applyResolverConfig(input, resourceType, logicalId, properties, previousProperties, true);
 		try {
 			await this.getClient().send(new UpdateResolverCommand(input));
 		} catch (error) {
@@ -35086,6 +35242,11 @@ var AppSyncProvider = class {
 	*/
 	getDriftUnknownPaths(resourceType) {
 		if (resourceType === "AWS::AppSync::GraphQLSchema") return ["DefinitionS3Location"];
+		if (resourceType === "AWS::AppSync::Resolver") return [
+			"CodeS3Location",
+			"RequestMappingTemplateS3Location",
+			"ResponseMappingTemplateS3Location"
+		];
 		return [];
 	}
 	/**
@@ -35098,15 +35259,15 @@ var AppSyncProvider = class {
 	* possibly-malformed value"). An ABSENT container keeps returning
 	* `undefined`, which is a legitimate "not configured".
 	*/
-	asObject(value, path, options) {
+	asObject(value, path, options, resourceType = "AWS::AppSync::GraphQLApi") {
 		if (value == null) return void 0;
 		if (typeof value === "object" && !Array.isArray(value)) return value;
-		const message = `AWS::AppSync::GraphQLApi ${path} must be an object, got ${Array.isArray(value) ? "array" : typeof value} — cdkd refuses to drop it silently`;
+		const message = `${resourceType} ${path} must be an object, got ${Array.isArray(value) ? "array" : typeof value} — cdkd refuses to drop it silently`;
 		if (options?.onUnusable) {
 			options.onUnusable(message);
 			return;
 		}
-		throw new ProvisioningError(message, "AWS::AppSync::GraphQLApi", options?.logicalId ?? "");
+		throw new ProvisioningError(message, resourceType, options?.logicalId ?? "");
 	}
 	/**
 	* NOTE: `awsRegion` / `defaultAction` are passed through VERBATIM, including
@@ -35284,6 +35445,211 @@ var AppSyncProvider = class {
 			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, isUpdate ? "GraphqlApi (env vars)" : "GraphqlApi (env vars, post-create)");
 		}
 	}
+	/** CFn `CachingConfig` (`Ttl` / `CachingKeys`) -> SDK `cachingConfig`. */
+	toSdkCachingConfig(value, logicalId) {
+		const cfn = this.asObject(value, "CachingConfig", { logicalId }, "AWS::AppSync::Resolver");
+		if (!cfn) return void 0;
+		const out = { ttl: cfn["Ttl"] };
+		if (cfn["CachingKeys"] !== void 0) out.cachingKeys = requireConfigArray(cfn["CachingKeys"], "AWS::AppSync::Resolver CachingConfig.CachingKeys");
+		return out;
+	}
+	/**
+	* CFn `SyncConfig` (`ConflictDetection` / `ConflictHandler` /
+	* `LambdaConflictHandlerConfig.LambdaConflictHandlerArn`) -> SDK
+	* `syncConfig`.
+	*/
+	toSdkSyncConfig(value, logicalId) {
+		const cfn = this.asObject(value, "SyncConfig", { logicalId }, "AWS::AppSync::Resolver");
+		if (!cfn) return void 0;
+		const out = {};
+		if (cfn["ConflictDetection"] !== void 0) out.conflictDetection = cfn["ConflictDetection"];
+		if (cfn["ConflictHandler"] !== void 0) out.conflictHandler = cfn["ConflictHandler"];
+		const lambdaHandler = this.asObject(cfn["LambdaConflictHandlerConfig"], "SyncConfig.LambdaConflictHandlerConfig", { logicalId }, "AWS::AppSync::Resolver");
+		if (lambdaHandler) out.lambdaConflictHandlerConfig = { lambdaConflictHandlerArn: lambdaHandler["LambdaConflictHandlerArn"] };
+		return out;
+	}
+	/**
+	* Parse the `s3://bucket/key` URL the AppSync `*S3Location` string
+	* properties carry.
+	*
+	* CDK's asset bindings (`appsync.Code.fromAsset`, `aws-s3-assets` Asset
+	* `s3ObjectUrl`) emit exactly this form, and the CloudFormation examples
+	* for these properties use it too. Anything else (an `https://` object
+	* URL, a bare bucket, a non-string) is refused with a clear error naming
+	* the property — never silently dropped.
+	*/
+	parseS3LocationUrl(location, resourceType, logicalId, propertyPath) {
+		if (typeof location !== "string") throw new ProvisioningError(`${resourceType} ${propertyPath} must be a string s3://bucket/key URL, got ${Array.isArray(location) ? "array" : typeof location} — check for an unresolved intrinsic`, resourceType, logicalId);
+		const match = /^s3:\/\/([^/]+)\/(.+)$/.exec(location);
+		if (!match || !match[1] || !match[2]) throw new ProvisioningError(`${resourceType} ${propertyPath} must be an s3://bucket/key URL (got '${location}')`, resourceType, logicalId);
+		return {
+			bucket: match[1],
+			key: match[2]
+		};
+	}
+	/**
+	* Fetch an `*S3Location` object body as a UTF-8 string.
+	*
+	* CloudFormation's behavior for these properties is to download the S3
+	* object and pass its CONTENT as the corresponding inline member
+	* (`code` / `requestMappingTemplate` / `responseMappingTemplate` /
+	* `definition`); the URL itself never reaches AppSync. Mirrors
+	* `StepFunctionsProvider.fetchDefinitionFromS3`, including the
+	* empty-body refusal (AWS would reject '' with a generic validation
+	* error naming nothing).
+	*/
+	async fetchS3LocationBody(location, resourceType, logicalId, propertyPath) {
+		const { bucket, key } = this.parseS3LocationUrl(location, resourceType, logicalId, propertyPath);
+		this.logger.debug(`Fetching ${propertyPath} for ${logicalId} from s3://${bucket}/${key}`);
+		let body;
+		try {
+			const resp = await this.getS3Client().send(new GetObjectCommand({
+				Bucket: bucket,
+				Key: key
+			}));
+			if (!resp.Body) throw new Error(`object returned no body`);
+			body = await resp.Body.transformToString();
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			throw new ProvisioningError(`Failed to fetch ${propertyPath} s3://${bucket}/${key} for ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+		}
+		if (body.length === 0) throw new ProvisioningError(`${propertyPath} object s3://${bucket}/${key} returned an empty body`, resourceType, logicalId);
+		return body;
+	}
+	/**
+	* Resolve an inline-or-S3 property pair to the inline SDK value.
+	*
+	* Precedence: the INLINE property wins when both are present, matching
+	* the repo's established S3Location precedent (StepFunctions
+	* `DefinitionString` over `DefinitionS3Location`, AppSync GraphQLSchema
+	* `Definition` over `DefinitionS3Location`) — CFn treats the pair as
+	* alternatives and CDK's bindings only ever emit one, so both-present is
+	* a hand-authored template; it is honored inline-first with a loud
+	* warning rather than refused.
+	*/
+	async resolveInlineOrS3Template(inline, s3Location, inlineKey, s3Key, resourceType, logicalId) {
+		if (inline !== void 0) {
+			if (s3Location !== void 0) this.logger.warn(`${resourceType} ${logicalId}: both ${inlineKey} and ${s3Key} are set — using the inline ${inlineKey} and ignoring ${s3Key} (CFn treats them as alternatives)`);
+			return inline;
+		}
+		if (s3Location !== void 0) return this.fetchS3LocationBody(s3Location, resourceType, logicalId, s3Key);
+	}
+	/**
+	* Fill the mutable members shared by `CreateResolver` and `UpdateResolver`
+	* from the CFn property bag — the single mapper both paths use so they
+	* cannot diverge (the `applyGraphQLApiConfig` pattern).
+	*
+	* REMOVAL semantics: unlike `UpdateGraphqlApi` (where an omitted member is
+	* "no change" and removal needs reset sentinels), `UpdateResolver` is a
+	* FULL-REPLACE write — the desired bag is mapped in its entirety and an
+	* omitted member is cleared server-side, so "absent in template => omitted
+	* from the update input => cleared by AppSync" and no sentinel is needed.
+	* That semantic is pinned live by the integ fixture's REMOVAL phase
+	* (tests/integration/appsync/verify.sh drops the resolver's MetricsConfig
+	* and asserts AWS reset it while a sibling DataSource keeps its own).
+	* MetricsConfig is the one member A/B'd against real AWS; the other
+	* members rest on the same UpdateResolver full-replace API contract, not
+	* on a per-member live probe (the #1160 doctrine's per-member A/B was
+	* deliberately not paid here — recorded in the PR body).
+	*
+	* Resolver shape is `Kind`-discriminated:
+	*   - Kind=UNIT     -> DataSourceName applies, PipelineConfig is N/A.
+	*   - Kind=PIPELINE -> PipelineConfig applies, DataSourceName is N/A
+	*                      (AWS rejects the call if it's set).
+	* The gate applies ONLY on update (`forUpdate`), where the effective Kind
+	* falls back to the state-recorded previous value and finally AWS's
+	* default 'UNIT' — an update must not re-send the other kind's member on a
+	* live resolver. On CREATE both members forward UNCONDITIONALLY when
+	* present: gating there would silently drop a crossed shape (the very
+	* silent-drop class this batch closes) where CFn parity is AWS's own loud
+	* rejection — the same forward-don't-gate doctrine as
+	* `applyDataSourceConfig`'s per-type sub-configs.
+	*/
+	async applyResolverConfig(input, resourceType, logicalId, properties, previousProperties, forUpdate = false) {
+		const effectiveKind = properties["Kind"] ?? previousProperties?.["Kind"] ?? "UNIT";
+		if ((!forUpdate || effectiveKind === "UNIT") && properties["DataSourceName"] !== void 0) input.dataSourceName = properties["DataSourceName"];
+		if (properties["Kind"] !== void 0) input.kind = properties["Kind"];
+		if ((!forUpdate || effectiveKind === "PIPELINE") && properties["PipelineConfig"] !== void 0) input.pipelineConfig = { functions: properties["PipelineConfig"]["Functions"] };
+		if (properties["Runtime"] !== void 0) {
+			const runtime = properties["Runtime"];
+			input.runtime = {
+				name: runtime["Name"],
+				runtimeVersion: runtime["RuntimeVersion"]
+			};
+		}
+		const requestTemplate = await this.resolveInlineOrS3Template(properties["RequestMappingTemplate"], properties["RequestMappingTemplateS3Location"], "RequestMappingTemplate", "RequestMappingTemplateS3Location", resourceType, logicalId);
+		if (requestTemplate !== void 0) input.requestMappingTemplate = requestTemplate;
+		const responseTemplate = await this.resolveInlineOrS3Template(properties["ResponseMappingTemplate"], properties["ResponseMappingTemplateS3Location"], "ResponseMappingTemplate", "ResponseMappingTemplateS3Location", resourceType, logicalId);
+		if (responseTemplate !== void 0) input.responseMappingTemplate = responseTemplate;
+		const code = await this.resolveInlineOrS3Template(properties["Code"], properties["CodeS3Location"], "Code", "CodeS3Location", resourceType, logicalId);
+		if (code !== void 0) input.code = code;
+		const caching = this.toSdkCachingConfig(properties["CachingConfig"], logicalId);
+		if (caching) input.cachingConfig = caching;
+		const sync = this.toSdkSyncConfig(properties["SyncConfig"], logicalId);
+		if (sync) input.syncConfig = sync;
+		if (properties["MaxBatchSize"] !== void 0) input.maxBatchSize = properties["MaxBatchSize"];
+		if (properties["MetricsConfig"] !== void 0) input.metricsConfig = properties["MetricsConfig"];
+	}
+	/**
+	* Fill the mutable members shared by `CreateDataSource` and
+	* `UpdateDataSource` from the CFn property bag — single mapper for both
+	* paths (the `applyGraphQLApiConfig` pattern).
+	*
+	* REMOVAL semantics: `UpdateDataSource` is a FULL-REPLACE write like
+	* `UpdateResolver` — an omitted member is cleared server-side, so removal
+	* needs no reset sentinel (see `applyResolverConfig`'s note; pinned live
+	* by the integ fixture's REMOVAL phase).
+	*
+	* The per-type sub-configs (`DynamoDBConfig` / `LambdaConfig` /
+	* `HttpConfig` / `ElasticsearchConfig` / `OpenSearchServiceConfig` /
+	* `EventBridgeConfig` / `RelationalDatabaseConfig`) are mutually exclusive
+	* on the `Type` discriminator. The write side deliberately FORWARDS
+	* whichever block the template carries rather than gating on `Type`:
+	* gating would silently drop a mismatched block (the very silent-drop
+	* class this batch closes), while AWS rejects a crossed shape with a loud
+	* validation error. The read side (`readDataSource`) gates on the
+	* response's own discriminator instead.
+	*/
+	applyDataSourceConfig(input, resourceType, logicalId, properties) {
+		if (properties["Description"] !== void 0) input.description = properties["Description"];
+		if (properties["ServiceRoleArn"] !== void 0) input.serviceRoleArn = properties["ServiceRoleArn"];
+		const dynamo = this.asObject(properties["DynamoDBConfig"], "DynamoDBConfig", { logicalId }, resourceType);
+		if (dynamo) input.dynamodbConfig = {
+			tableName: dynamo["TableName"],
+			awsRegion: dynamo["AwsRegion"],
+			...dynamo["UseCallerCredentials"] !== void 0 ? { useCallerCredentials: dynamo["UseCallerCredentials"] } : {}
+		};
+		const lambda = this.asObject(properties["LambdaConfig"], "LambdaConfig", { logicalId }, resourceType);
+		if (lambda) input.lambdaConfig = { lambdaFunctionArn: lambda["LambdaFunctionArn"] };
+		const http = this.asObject(properties["HttpConfig"], "HttpConfig", { logicalId }, resourceType);
+		if (http) input.httpConfig = { endpoint: http["Endpoint"] };
+		const es = this.asObject(properties["ElasticsearchConfig"], "ElasticsearchConfig", { logicalId }, resourceType);
+		if (es) input.elasticsearchConfig = {
+			endpoint: es["Endpoint"],
+			awsRegion: es["AwsRegion"]
+		};
+		const openSearch = this.asObject(properties["OpenSearchServiceConfig"], "OpenSearchServiceConfig", { logicalId }, resourceType);
+		if (openSearch) input.openSearchServiceConfig = {
+			endpoint: openSearch["Endpoint"],
+			awsRegion: openSearch["AwsRegion"]
+		};
+		const eventBridge = this.asObject(properties["EventBridgeConfig"], "EventBridgeConfig", { logicalId }, resourceType);
+		if (eventBridge) input.eventBridgeConfig = { eventBusArn: eventBridge["EventBusArn"] };
+		const relational = this.asObject(properties["RelationalDatabaseConfig"], "RelationalDatabaseConfig", { logicalId }, resourceType);
+		if (relational) {
+			const rdsConfig = { relationalDatabaseSourceType: relational["RelationalDatabaseSourceType"] };
+			const rdsEndpoint = this.asObject(relational["RdsHttpEndpointConfig"], "RelationalDatabaseConfig.RdsHttpEndpointConfig", { logicalId }, resourceType);
+			if (rdsEndpoint) rdsConfig.rdsHttpEndpointConfig = {
+				awsRegion: rdsEndpoint["AwsRegion"],
+				dbClusterIdentifier: rdsEndpoint["DbClusterIdentifier"],
+				...rdsEndpoint["DatabaseName"] !== void 0 ? { databaseName: rdsEndpoint["DatabaseName"] } : {},
+				...rdsEndpoint["Schema"] !== void 0 ? { schema: rdsEndpoint["Schema"] } : {},
+				...rdsEndpoint["AwsSecretStoreArn"] !== void 0 ? { awsSecretStoreArn: rdsEndpoint["AwsSecretStoreArn"] } : {}
+			};
+			input.relationalDatabaseConfig = rdsConfig;
+		}
+		if (properties["MetricsConfig"] !== void 0) input.metricsConfig = properties["MetricsConfig"];
+	}
 	async createGraphQLApi(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating GraphQL API ${logicalId}`);
 		const name = properties["Name"];
@@ -35368,11 +35734,19 @@ var AppSyncProvider = class {
 		const definition = properties["Definition"];
 		const definitionS3Location = properties["DefinitionS3Location"];
 		try {
-			if (definition) await this.getClient().send(new StartSchemaCreationCommand({
-				apiId,
-				definition: new TextEncoder().encode(definition)
-			}));
-			else if (definitionS3Location) this.logger.warn(`S3-based schema definition for ${logicalId} - using inline only`);
+			if (definition) {
+				if (definitionS3Location !== void 0) this.logger.warn(`${resourceType} ${logicalId}: both Definition and DefinitionS3Location are set — using the inline Definition and ignoring DefinitionS3Location (CFn treats them as alternatives)`);
+				await this.getClient().send(new StartSchemaCreationCommand({
+					apiId,
+					definition: new TextEncoder().encode(definition)
+				}));
+			} else if (definitionS3Location !== void 0) {
+				const body = await this.fetchS3LocationBody(definitionS3Location, resourceType, logicalId, "DefinitionS3Location");
+				await this.getClient().send(new StartSchemaCreationCommand({
+					apiId,
+					definition: new TextEncoder().encode(body)
+				}));
+			}
 			this.logger.debug(`Successfully started schema creation for ${logicalId}`);
 			return {
 				physicalId: apiId,
@@ -35395,18 +35769,7 @@ var AppSyncProvider = class {
 				name,
 				type
 			};
-			if (properties["Description"]) input.description = properties["Description"];
-			if (properties["ServiceRoleArn"]) input.serviceRoleArn = properties["ServiceRoleArn"];
-			if (properties["DynamoDBConfig"]) {
-				const config = properties["DynamoDBConfig"];
-				input.dynamodbConfig = {
-					tableName: config["TableName"],
-					awsRegion: config["AwsRegion"],
-					useCallerCredentials: config["UseCallerCredentials"]
-				};
-			}
-			if (properties["LambdaConfig"]) input.lambdaConfig = { lambdaFunctionArn: properties["LambdaConfig"]["LambdaFunctionArn"] };
-			if (properties["HttpConfig"]) input.httpConfig = { endpoint: properties["HttpConfig"]["Endpoint"] };
+			this.applyDataSourceConfig(input, resourceType, logicalId, properties);
 			await this.getClient().send(new CreateDataSourceCommand(input));
 			const physicalId = `${apiId}|${name}`;
 			this.logger.debug(`Successfully created DataSource ${logicalId}: ${physicalId}`);
@@ -35457,19 +35820,7 @@ var AppSyncProvider = class {
 				typeName,
 				fieldName
 			};
-			if (properties["DataSourceName"]) input.dataSourceName = properties["DataSourceName"];
-			if (properties["RequestMappingTemplate"]) input.requestMappingTemplate = properties["RequestMappingTemplate"];
-			if (properties["ResponseMappingTemplate"]) input.responseMappingTemplate = properties["ResponseMappingTemplate"];
-			if (properties["Kind"]) input.kind = properties["Kind"];
-			if (properties["PipelineConfig"]) input.pipelineConfig = { functions: properties["PipelineConfig"]["Functions"] };
-			if (properties["Runtime"]) {
-				const runtime = properties["Runtime"];
-				input.runtime = {
-					name: runtime["Name"],
-					runtimeVersion: runtime["RuntimeVersion"]
-				};
-			}
-			if (properties["Code"]) input.code = properties["Code"];
+			await this.applyResolverConfig(input, resourceType, logicalId, properties);
 			await this.getClient().send(new CreateResolverCommand(input));
 			const physicalId = `${apiId}|${typeName}|${fieldName}`;
 			this.logger.debug(`Successfully created Resolver ${logicalId}: ${physicalId}`);
@@ -35568,10 +35919,13 @@ var AppSyncProvider = class {
 	*    CDK's `aws:*` auto-tags are filtered out and the result key is
 	*    omitted when no user tags remain.
 	*  - `DataSource` → `GetDataSource` (Name, Type, Description,
-	*    ServiceRoleArn, DynamoDBConfig, LambdaConfig, HttpConfig). The
+	*    ServiceRoleArn, the per-type configs — DynamoDBConfig, LambdaConfig,
+	*    HttpConfig, ElasticsearchConfig, OpenSearchServiceConfig,
+	*    EventBridgeConfig, RelationalDatabaseConfig — and MetricsConfig). The
 	*    `ApiId` cdkd holds is recovered from the `apiId|name` physicalId.
 	*  - `Resolver` → `GetResolver` (TypeName, FieldName, DataSourceName,
-	*    request/response templates, Kind, PipelineConfig, Runtime, Code).
+	*    request/response templates, Kind, PipelineConfig, Runtime, Code,
+	*    CachingConfig, SyncConfig, MaxBatchSize, MetricsConfig).
 	*  - `ApiKey` → `ListApiKeys` filtered by id (no `GetApiKey` SDK call;
 	*    AppSync only exposes list-based access). Surfaces Description and
 	*    Expires.
@@ -35749,6 +36103,35 @@ var AppSyncProvider = class {
 		}
 		if (ds.lambdaConfig?.lambdaFunctionArn !== void 0) result["LambdaConfig"] = { LambdaFunctionArn: ds.lambdaConfig.lambdaFunctionArn };
 		if (ds.httpConfig?.endpoint !== void 0) result["HttpConfig"] = { Endpoint: ds.httpConfig.endpoint };
+		if (ds.elasticsearchConfig) {
+			const es = {};
+			if (ds.elasticsearchConfig.endpoint !== void 0) es["Endpoint"] = ds.elasticsearchConfig.endpoint;
+			if (ds.elasticsearchConfig.awsRegion !== void 0) es["AwsRegion"] = ds.elasticsearchConfig.awsRegion;
+			if (Object.keys(es).length > 0) result["ElasticsearchConfig"] = es;
+		}
+		if (ds.openSearchServiceConfig) {
+			const os = {};
+			if (ds.openSearchServiceConfig.endpoint !== void 0) os["Endpoint"] = ds.openSearchServiceConfig.endpoint;
+			if (ds.openSearchServiceConfig.awsRegion !== void 0) os["AwsRegion"] = ds.openSearchServiceConfig.awsRegion;
+			if (Object.keys(os).length > 0) result["OpenSearchServiceConfig"] = os;
+		}
+		if (ds.eventBridgeConfig?.eventBusArn !== void 0) result["EventBridgeConfig"] = { EventBusArn: ds.eventBridgeConfig.eventBusArn };
+		if (ds.relationalDatabaseConfig) {
+			const rds = {};
+			if (ds.relationalDatabaseConfig.relationalDatabaseSourceType !== void 0) rds["RelationalDatabaseSourceType"] = ds.relationalDatabaseConfig.relationalDatabaseSourceType;
+			const endpoint = ds.relationalDatabaseConfig.rdsHttpEndpointConfig;
+			if (endpoint) {
+				const ep = {};
+				if (endpoint.awsRegion !== void 0) ep["AwsRegion"] = endpoint.awsRegion;
+				if (endpoint.dbClusterIdentifier !== void 0) ep["DbClusterIdentifier"] = endpoint.dbClusterIdentifier;
+				if (endpoint.databaseName !== void 0) ep["DatabaseName"] = endpoint.databaseName;
+				if (endpoint.schema !== void 0) ep["Schema"] = endpoint.schema;
+				if (endpoint.awsSecretStoreArn !== void 0) ep["AwsSecretStoreArn"] = endpoint.awsSecretStoreArn;
+				if (Object.keys(ep).length > 0) rds["RdsHttpEndpointConfig"] = ep;
+			}
+			if (Object.keys(rds).length > 0) result["RelationalDatabaseConfig"] = rds;
+		}
+		if (ds.metricsConfig !== void 0) result["MetricsConfig"] = ds.metricsConfig;
 		return result;
 	}
 	async readResolver(physicalId) {
@@ -35783,6 +36166,21 @@ var AppSyncProvider = class {
 			result["RequestMappingTemplate"] = resolver.requestMappingTemplate ?? "";
 			result["ResponseMappingTemplate"] = resolver.responseMappingTemplate ?? "";
 		}
+		if (resolver.cachingConfig) {
+			const caching = {};
+			if (resolver.cachingConfig.ttl !== void 0) caching["Ttl"] = resolver.cachingConfig.ttl;
+			if (resolver.cachingConfig.cachingKeys !== void 0) caching["CachingKeys"] = [...resolver.cachingConfig.cachingKeys];
+			if (Object.keys(caching).length > 0) result["CachingConfig"] = caching;
+		}
+		if (resolver.syncConfig) {
+			const sync = {};
+			if (resolver.syncConfig.conflictDetection !== void 0) sync["ConflictDetection"] = resolver.syncConfig.conflictDetection;
+			if (resolver.syncConfig.conflictHandler !== void 0) sync["ConflictHandler"] = resolver.syncConfig.conflictHandler;
+			if (resolver.syncConfig.lambdaConflictHandlerConfig?.lambdaConflictHandlerArn !== void 0) sync["LambdaConflictHandlerConfig"] = { LambdaConflictHandlerArn: resolver.syncConfig.lambdaConflictHandlerConfig.lambdaConflictHandlerArn };
+			if (Object.keys(sync).length > 0) result["SyncConfig"] = sync;
+		}
+		if (resolver.maxBatchSize !== void 0) result["MaxBatchSize"] = resolver.maxBatchSize;
+		if (resolver.metricsConfig !== void 0) result["MetricsConfig"] = resolver.metricsConfig;
 		return result;
 	}
 	async readApiKey(physicalId) {
@@ -69522,7 +69920,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.17");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.19");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;