@go-to-k/cdkd 0.280.9 → 0.280.11

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-DyvrbmXh.js";
+import { $ as applyRoleArnIfSet, A as red, At as AssetManifestLoader, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefault, C as isStatefulRecreateTargetSync, Ct as validateAssetBucketName, D as cyan, Dn as withErrorHandling, Dt as getDockerCmd, E as bold, En as normalizeAwsError, Et as formatDockerLoginError, F as ProviderRegistry, Ft as getLegacyStateBucketName, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_BODY_LIMIT, H as cfnRefValueFromPhysicalId, Ht as resolveUseCdkBootstrapAssets, I as findActionableSilentDrops, It as resolveApp, J as readConfigString, Jt as findLargeInlineResources, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_URL_LIMIT, L as CloudControlProvider, Lt as resolveAutoAssetStorage, M as IAMRoleProvider, Mt as Synthesizer, N as collectInlinePolicyNamesManagedBySiblings, Nt as synthesisStatusMessage, O as gray, Ot as runDockerForeground, P as clearOnUpdateRemoval, Pt as getDefaultStateBucketName, Q as requireConfigString, Qt as processStackMessages, R as slowCcOperationTimeoutMs, Rt as resolveCaptureObservedState, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as parseBootstrapMarker, T as formatResourceLine, Tt as buildDockerImage, U as refStateLookupFromResource, Ut as stateBucketExistenceConfirmed, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefaultAndSource, W as WAFv2WebACLProvider, Wt as warnDeprecatedNoPrefixCliFlag, X as requireConfigArray, Xt as expectedOwnerParam, Y as replayWarn, Yt as uploadCfnTemplate, Z as requireConfigObject, Zt as AssemblyReader, _ as createPreDeleteFinalSnapshot, _n as ProvisioningError, _t as rewriteTemplateAssetReferences, a as DeploymentEventsStore, at as DagBuilder, b as unsupportedFinalSnapshotError, bn as StackHasActiveImportsError, bt as ensureAssetStorage, c as replayFailedOperations, ct as S3StateBackend, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalMigrateError, dt as AssetPublisher, en as resolveBucketRegion, et as DiffCalculator, f as computeImplicitDeleteEdges, fn as LocalStartServiceError, ft as stringifyValue, g as ccRoutedFinalSnapshotError, gn as PartialFailureError, gt as loadPublishableAssetManifest, h as buildFinalSnapshotIdentifier, hn as NestedStackChildDirectDestroyError, ht as createAssetRedirectResolver, i as DeploymentEventsReader, in as setAwsClients, it as isThrottlingError, j as yellow, jt as getDockerImageBySourceHash, k as green, kt as runDockerStreaming, l as replayRollback, ln as DeployCancelledError, lt as rebuildClientForBucketRegion, m as PRE_DELETE_SNAPSHOT_TYPES, mn as MissingCdkCliError, mt as buildAssetRedirectMap, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as getAwsClients, nt as withRetry, o as planFailedOps, on as CdkdError, ot as TemplateParser, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pt as WorkGraph, q as assertRegionMatch, qt as MIGRATE_TMP_PREFIX, r as DeployEngine, rn as resetAwsClients, rt as isRetryableTransientError, s as planRollback, st as LockManager, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AwsClients, tt as describeTypeWithThrottleRetry, u as withResourceDeadline, un as LocalInvokeBuildError$1, ut as shouldRetainResource, v as isFinalSnapshotError, vn as ResourceTimeoutError, vt as AssetModeResolver, w as renderStatefulReason, wt as validateContainerRepoName, x as extractDeploymentEventError, xn as StackTerminationProtectionError, xt as getBootstrapMarkerKey, y as refusesFinalSnapshot, yn as ResourceUpdateNotSupportedError, yt as BOOTSTRAP_MARKER_PREFIX, z as disableInstanceApiTermination, zt as resolveSkipPrefix } from "./deploy-engine-DHGLmPWH.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-Bme2nsK8.js";
+import { t as ASGProvider } from "./asg-provider-CN0zTvF5.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -5077,7 +5077,9 @@ var S3BucketProvider = class S3BucketProvider {
 	*/
 	async applyLifecycleConfiguration(bucketName, lifecycleConfig, onUnusable) {
 		for (const rule of lifecycleConfig.Rules) {
-			const rawTagFilters = rule["Filter"]?.["TagFilters"] ?? rule["TagFilters"];
+			const rawFilter = rule["Filter"];
+			if (rawFilter != null && requireConfigObject(rawFilter, "AWS::S3::Bucket LifecycleConfiguration.Rules[].Filter", { ...onUnusable ? { onUnusable } : {} }) === void 0) return;
+			const rawTagFilters = rawFilter?.["TagFilters"] ?? rule["TagFilters"];
 			if (rawTagFilters != null) {
 				if (requireConfigArray(rawTagFilters, "AWS::S3::Bucket LifecycleConfiguration.Rules[].TagFilters", { ...onUnusable ? { onUnusable } : {} }) === void 0) return;
 			}
@@ -5092,7 +5094,7 @@ var S3BucketProvider = class S3BucketProvider {
 			};
 		};
 		const isPlainPrefixOnly = (rule) => {
-			if (rule["Filter"] !== void 0) return false;
+			if (rule["Filter"] != null) return false;
 			const s = gatherScope(rule);
 			return s.prefix !== void 0 && (s.tagFilters == null || s.tagFilters.length === 0) && s.sizeGt === void 0 && s.sizeLt === void 0;
 		};
@@ -5456,7 +5458,9 @@ var S3BucketProvider = class S3BucketProvider {
 	async applyAnalyticsConfigurations(bucketName, configs, onUnusable) {
 		for (const config of configs) {
 			const id = config["Id"];
-			const storageClassAnalysis = config["StorageClassAnalysis"];
+			const rawStorageClassAnalysis = config["StorageClassAnalysis"];
+			if (rawStorageClassAnalysis != null && requireConfigObject(rawStorageClassAnalysis, "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis", { ...onUnusable ? { onUnusable } : {} }) === void 0) continue;
+			const storageClassAnalysis = rawStorageClassAnalysis;
 			const analyticsConfig = {
 				Id: id,
 				StorageClassAnalysis: {}
@@ -5472,14 +5476,16 @@ var S3BucketProvider = class S3BucketProvider {
 			else if (prefix) analyticsConfig.Filter = { Prefix: prefix };
 			else if (tagFilters && tagFilters.length === 1) analyticsConfig.Filter = { Tag: tagFilters[0] };
 			if (storageClassAnalysis?.["DataExport"] != null) {
-				const dataExport = storageClassAnalysis["DataExport"];
+				const rawDataExport = storageClassAnalysis["DataExport"];
+				if (requireConfigObject(rawDataExport, "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport", { ...onUnusable ? { onUnusable } : {} }) === void 0) continue;
+				const dataExport = rawDataExport;
 				const analyticsDestPath = "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport.Destination";
 				const rawDest = dataExport["Destination"];
 				const s3Dest = this.resolveS3BucketDestination(rawDest, analyticsDestPath, onUnusable);
 				if (s3Dest === void 0 && rawDest != null) continue;
 				const destPath = s3BucketDestinationPath(rawDest, analyticsDestPath);
 				analyticsConfig.StorageClassAnalysis = { DataExport: {
-					OutputSchemaVersion: readConfigString(dataExport, "OutputSchemaVersion", "V_1", "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport"),
+					OutputSchemaVersion: readConfigString(dataExport, "OutputSchemaVersion", "V_1", "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport", { ...onUnusable ? { onUnusable } : {} }),
 					Destination: s3Dest ? { S3BucketDestination: {
 						Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
 						BucketAccountId: s3Dest["BucketAccountId"],
@@ -5624,8 +5630,12 @@ var S3BucketProvider = class S3BucketProvider {
 		}
 		return sdkDest;
 	}
-	async applyReplicationConfiguration(bucketName, replConfig) {
+	async applyReplicationConfiguration(bucketName, replConfig, onUnusable) {
 		const rules = replConfig["Rules"];
+		for (const rule of rules || []) {
+			const rawFilter = rule["Filter"];
+			if (rawFilter != null && requireConfigObject(rawFilter, "AWS::S3::Bucket ReplicationConfiguration.Rules[].Filter", { ...onUnusable ? { onUnusable } : {} }) === void 0) return;
+		}
 		await this.s3Client.send(new PutBucketReplicationCommand({
 			Bucket: bucketName,
 			ReplicationConfiguration: {
@@ -5648,7 +5658,7 @@ var S3BucketProvider = class S3BucketProvider {
 						if (Object.keys(sdkCriteria).length > 0) sdkRule["SourceSelectionCriteria"] = sdkCriteria;
 					}
 					const filter = rule["Filter"];
-					if (filter) {
+					if (filter != null) {
 						const and = filter["And"];
 						const prefix = filter["Prefix"];
 						const tagFilter = filter["TagFilter"];
@@ -5879,7 +5889,7 @@ var S3BucketProvider = class S3BucketProvider {
 		});
 		await this.diffSubConfig(bucketName, previousProperties["LoggingConfiguration"], properties["LoggingConfiguration"], async (cfg) => this.applyLoggingConfiguration(bucketName, cfg), async () => this.applyLoggingConfiguration(bucketName, void 0));
 		await this.diffSubConfig(bucketName, previousProperties["NotificationConfiguration"], properties["NotificationConfiguration"], async (cfg) => this.applyNotificationConfiguration(bucketName, cfg), async () => this.applyNotificationConfiguration(bucketName, void 0));
-		await this.diffSubConfig(bucketName, previousProperties["ReplicationConfiguration"], properties["ReplicationConfiguration"], async (cfg) => this.applyReplicationConfiguration(bucketName, cfg), async () => {
+		await this.diffSubConfig(bucketName, previousProperties["ReplicationConfiguration"], properties["ReplicationConfiguration"], async (cfg) => this.applyReplicationConfiguration(bucketName, cfg, (m) => this.logger.warn(m)), async () => {
 			await this.s3Client.send(new DeleteBucketReplicationCommand({ Bucket: bucketName }));
 			this.logger.debug(`Deleted replication configuration on bucket ${bucketName}`);
 		});
@@ -5955,7 +5965,7 @@ var S3BucketProvider = class S3BucketProvider {
 		const inventoryConfigs = properties["InventoryConfigurations"];
 		if (inventoryConfigs && Array.isArray(inventoryConfigs) && inventoryConfigs.length > 0) await this.applyInventoryConfigurations(bucketName, inventoryConfigs, replayOnUnusable);
 		const replConfig = properties["ReplicationConfiguration"];
-		if (replConfig) await this.applyReplicationConfiguration(bucketName, replConfig);
+		if (replConfig) await this.applyReplicationConfiguration(bucketName, replConfig, replayOnUnusable);
 		const objectLockConfig = properties["ObjectLockConfiguration"];
 		if (objectLockConfig) await this.applyObjectLockConfiguration(bucketName, objectLockConfig);
 	}
@@ -21993,7 +22003,17 @@ var ApiGatewayV2Provider = class {
 			"PayloadFormatVersion",
 			"TimeoutInMillis",
 			"RequestParameters",
-			"Description"
+			"Description",
+			"ConnectionId",
+			"ConnectionType",
+			"ContentHandlingStrategy",
+			"CredentialsArn",
+			"IntegrationSubtype",
+			"PassthroughBehavior",
+			"RequestTemplates",
+			"ResponseParameters",
+			"TemplateSelectionExpression",
+			"TlsConfig"
 		])],
 		["AWS::ApiGatewayV2::Route", /* @__PURE__ */ new Set([
 			"ApiId",
@@ -22219,7 +22239,17 @@ var ApiGatewayV2Provider = class {
 				PayloadFormatVersion: properties["PayloadFormatVersion"],
 				TimeoutInMillis: properties["TimeoutInMillis"],
 				RequestParameters: properties["RequestParameters"],
-				Description: properties["Description"]
+				Description: properties["Description"],
+				ConnectionId: properties["ConnectionId"],
+				ConnectionType: properties["ConnectionType"],
+				ContentHandlingStrategy: properties["ContentHandlingStrategy"],
+				CredentialsArn: properties["CredentialsArn"],
+				IntegrationSubtype: properties["IntegrationSubtype"],
+				PassthroughBehavior: properties["PassthroughBehavior"],
+				RequestTemplates: properties["RequestTemplates"],
+				ResponseParameters: this.toSdkResponseParameters(properties["ResponseParameters"]),
+				TemplateSelectionExpression: properties["TemplateSelectionExpression"],
+				TlsConfig: properties["TlsConfig"]
 			}))).IntegrationId;
 			this.logger.debug(`Successfully created API Gateway V2 Integration ${logicalId}: ${integrationId}`);
 			return {
@@ -22438,6 +22468,16 @@ var ApiGatewayV2Provider = class {
 			if (resp.TimeoutInMillis !== void 0) result["TimeoutInMillis"] = resp.TimeoutInMillis;
 			if (resp.RequestParameters !== void 0) result["RequestParameters"] = resp.RequestParameters;
 			if (resp.Description !== void 0) result["Description"] = resp.Description;
+			if (resp.ConnectionId !== void 0) result["ConnectionId"] = resp.ConnectionId;
+			if (resp.ConnectionType !== void 0) result["ConnectionType"] = resp.ConnectionType;
+			if (resp.ContentHandlingStrategy !== void 0) result["ContentHandlingStrategy"] = resp.ContentHandlingStrategy;
+			if (resp.CredentialsArn !== void 0) result["CredentialsArn"] = resp.CredentialsArn;
+			if (resp.IntegrationSubtype !== void 0) result["IntegrationSubtype"] = resp.IntegrationSubtype;
+			if (resp.PassthroughBehavior !== void 0) result["PassthroughBehavior"] = resp.PassthroughBehavior;
+			if (resp.RequestTemplates !== void 0) result["RequestTemplates"] = resp.RequestTemplates;
+			if (resp.ResponseParameters !== void 0) result["ResponseParameters"] = this.toCfnResponseParameters(resp.ResponseParameters);
+			if (resp.TemplateSelectionExpression !== void 0) result["TemplateSelectionExpression"] = resp.TemplateSelectionExpression;
+			if (resp.TlsConfig !== void 0) result["TlsConfig"] = resp.TlsConfig;
 			return result;
 		} catch (err) {
 			if (err instanceof NotFoundException$3) return void 0;
@@ -22720,7 +22760,11 @@ var ApiGatewayV2Provider = class {
 	* `UpdateIntegration` keys on `(ApiId, IntegrationId)`. Mutable
 	* fields cdkd manages: `IntegrationType` / `IntegrationUri` /
 	* `IntegrationMethod` / `PayloadFormatVersion` / `TimeoutInMillis` /
-	* `RequestParameters` / `Description`.
+	* `RequestParameters` / `Description`, plus the issue #609 backfill
+	* (`ConnectionId` / `ConnectionType` / `ContentHandlingStrategy` /
+	* `CredentialsArn` / `IntegrationSubtype` / `PassthroughBehavior` /
+	* `RequestTemplates` / `ResponseParameters` / `TemplateSelectionExpression`
+	* / `TlsConfig`).
 	*/
 	async updateIntegration(logicalId, physicalId, resourceType, properties, previousProperties) {
 		const apiId = properties["ApiId"] ?? previousProperties["ApiId"];
@@ -22765,6 +22809,50 @@ var ApiGatewayV2Provider = class {
 				changed = true;
 			}
 		}
+		if (properties["ConnectionId"] != null && properties["ConnectionId"] !== previousProperties["ConnectionId"]) {
+			input.ConnectionId = properties["ConnectionId"];
+			changed = true;
+		}
+		if (properties["ConnectionType"] != null && properties["ConnectionType"] !== previousProperties["ConnectionType"]) {
+			input.ConnectionType = properties["ConnectionType"];
+			changed = true;
+		}
+		if (properties["ContentHandlingStrategy"] != null && properties["ContentHandlingStrategy"] !== previousProperties["ContentHandlingStrategy"]) {
+			input.ContentHandlingStrategy = properties["ContentHandlingStrategy"];
+			changed = true;
+		}
+		if (properties["CredentialsArn"] != null && properties["CredentialsArn"] !== previousProperties["CredentialsArn"]) {
+			input.CredentialsArn = properties["CredentialsArn"];
+			changed = true;
+		}
+		if (properties["IntegrationSubtype"] != null && properties["IntegrationSubtype"] !== previousProperties["IntegrationSubtype"]) {
+			input.IntegrationSubtype = properties["IntegrationSubtype"];
+			changed = true;
+		}
+		if (input.IntegrationSubtype === void 0) {
+			const liveSubtype = properties["IntegrationSubtype"] ?? previousProperties["IntegrationSubtype"];
+			if (liveSubtype !== void 0) input.IntegrationSubtype = liveSubtype;
+		}
+		if (properties["PassthroughBehavior"] != null && properties["PassthroughBehavior"] !== previousProperties["PassthroughBehavior"]) {
+			input.PassthroughBehavior = properties["PassthroughBehavior"];
+			changed = true;
+		}
+		if (properties["RequestTemplates"] != null && !this.deepEqual(properties["RequestTemplates"], previousProperties["RequestTemplates"])) {
+			input.RequestTemplates = properties["RequestTemplates"];
+			changed = true;
+		}
+		if (properties["ResponseParameters"] != null && !this.deepEqual(properties["ResponseParameters"], previousProperties["ResponseParameters"])) {
+			input.ResponseParameters = this.toSdkResponseParameters(properties["ResponseParameters"]);
+			changed = true;
+		}
+		if (properties["TemplateSelectionExpression"] != null && properties["TemplateSelectionExpression"] !== previousProperties["TemplateSelectionExpression"]) {
+			input.TemplateSelectionExpression = properties["TemplateSelectionExpression"];
+			changed = true;
+		}
+		if (properties["TlsConfig"] != null && !this.deepEqual(properties["TlsConfig"], previousProperties["TlsConfig"])) {
+			input.TlsConfig = properties["TlsConfig"];
+			changed = true;
+		}
 		if (!changed) {
 			this.logger.debug(`No mutable Integration fields changed for ${logicalId}; skipping UpdateIntegration`);
 			return {
@@ -23115,6 +23203,84 @@ var ApiGatewayV2Provider = class {
 		return merged;
 	}
 	/**
+	* `ResponseParameters` is the one `AWS::ApiGatewayV2::Integration` property
+	* whose CFn shape does NOT match the SDK's, so forwarding it verbatim is not
+	* an option (issue #609). CloudFormation models it as
+	* `{ "<statusCode>": { ResponseParameters: [{ Destination, Source }, ...] } }`
+	* while `CreateIntegration` / `UpdateIntegration` take the flattened
+	* `{ "<statusCode>": { "<Destination>": "<Source>" } }`. The AWS SDK v3
+	* serializer drops members it cannot model, so the un-converted CFn shape
+	* would deliver an EMPTY map per status code — the silent-drop class one
+	* level down.
+	*
+	* Anything that is not the expected object / array shape (an unresolved
+	* intrinsic, a malformed block) passes through untouched so AWS surfaces the
+	* real validation error instead of cdkd inventing one.
+	*
+	* `Source` is COERCED from a number / boolean rather than skipped. CFn types
+	* `ResponseParameters` as free-form `object` and coerces scalars, cdkd does
+	* not (the `coerceNumber` class in `.claude/rules/providers.md`), so an
+	* unquoted `Source: 403` under the canonical `overwrite:statuscode`
+	* destination is a perfectly legal template whose value arrives as a NUMBER.
+	* Skipping it would re-introduce the silent drop this method exists to close.
+	* A `Destination` is never coerced — it becomes an SDK map KEY, and a
+	* non-string there is a malformed template, not a scalar shorthand.
+	*/
+	toSdkResponseParameters(value) {
+		if (value == null) return void 0;
+		if (typeof value !== "object" || Array.isArray(value)) return value;
+		const out = {};
+		for (const [statusCode, block] of Object.entries(value)) {
+			if (block == null || typeof block !== "object" || Array.isArray(block)) {
+				out[statusCode] = block;
+				continue;
+			}
+			const entries = block["ResponseParameters"];
+			if (!Array.isArray(entries)) {
+				out[statusCode] = block;
+				continue;
+			}
+			const mapped = {};
+			for (const entry of entries) {
+				const destination = entry != null && typeof entry === "object" && !Array.isArray(entry) ? entry["Destination"] : void 0;
+				const source = entry != null && typeof entry === "object" && !Array.isArray(entry) ? entry["Source"] : void 0;
+				const coerced = typeof source === "string" ? source : typeof source === "number" || typeof source === "boolean" ? String(source) : void 0;
+				if (typeof destination !== "string" || coerced === void 0) {
+					this.logger.warn(`AWS::ApiGatewayV2::Integration ResponseParameters['${statusCode}'] has an entry cdkd cannot deliver (Destination must be a string and Source a string / number / boolean; got ${JSON.stringify(destination)} / ${JSON.stringify(source)}); skipping that entry.`);
+					continue;
+				}
+				mapped[destination] = coerced;
+			}
+			out[statusCode] = mapped;
+		}
+		return out;
+	}
+	/**
+	* Inverse of {@link toSdkResponseParameters}, for `readCurrentState`. Without
+	* it the AWS-current side would carry the flat SDK map while the cdkd
+	* baseline carries the CFn list-of-pairs, and every `cdkd drift` run would
+	* report permanent phantom drift on a resource nobody touched.
+	*
+	* The pairs are sorted by `Destination` because this turns an UNORDERED SDK
+	* map into an ARRAY, and `calculateResourceDrift` compares arrays
+	* POSITIONALLY — AWS does not guarantee map readback order, so an unsorted
+	* rebuild would trade the shape-mismatch phantom drift for an ordering one
+	* (and `--revert` would re-push an identical value forever). Same reasoning
+	* as `src/analyzer/drift-normalize.ts`, applied at the source instead.
+	*/
+	toCfnResponseParameters(value) {
+		if (value == null) return void 0;
+		const out = {};
+		for (const [statusCode, flat] of Object.entries(value)) {
+			if (flat == null || typeof flat !== "object" || Array.isArray(flat)) continue;
+			out[statusCode] = { ResponseParameters: Object.entries(flat).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([destination, source]) => ({
+				Destination: destination,
+				Source: source
+			})) };
+		}
+		return out;
+	}
+	/**
 	* Convert CloudFormation Tags (Array<{Key, Value}>) to SDK Tags (Record<string, string>).
 	*/
 	cfnTagsToRecord(tags) {
@@ -68747,7 +68913,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.9");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.11");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;