@go-to-k/cdkd 0.281.8 → 0.281.10

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-OafbuSbc.js";
+import { $ as replayWarn, $t as uploadCfnTemplate, A as green, An as normalizeAwsError, At as formatDockerLoginError, B as slowCcOperationTimeoutMs, Bt as resolveApp, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as ResourceUpdateNotSupportedError, Ct as BOOTSTRAP_MARKER_PREFIX, D as bold, Dt as validateAssetBucketName, E as formatResourceLine, Et as parseBootstrapMarker, F as clearOnUpdateRemoval, Ft as getDockerImageBySourceHash, G as getAccountInfo, Gt as resolveStateBucketWithDefaultAndSource, H as isTerminationProtectionPropagationError, Ht as resolveCaptureObservedState, I as ProviderRegistry, It as Synthesizer, J as normalizeAwsTagsToCfn, Jt as warnDeprecatedNoPrefixCliFlag, K as refStateLookupFromResource, Kt as resolveUseCdkBootstrapAssets, L as findActionableSilentDrops, Lt as synthesisStatusMessage, M as yellow, Mt as runDockerForeground, N as IAMRoleProvider, Nt as runDockerStreaming, O as cyan, Ot as validateContainerRepoName, P as collectInlinePolicyNamesManagedBySiblings, Pt as AssetManifestLoader, Q as readConfigString, Qt as findLargeInlineResources, R as findSilentDropProperties, Rt as getDefaultStateBucketName, S as extractDeploymentEventError, Sn as ResourceTimeoutError, St as AssetModeResolver, T as renderStatefulReason, Tn as StackTerminationProtectionError, Tt as getBootstrapMarkerKey, U as IntrinsicFunctionResolver, Ut as resolveSkipPrefix, V as disableInstanceApiTermination, Vt as resolveAutoAssetStorage, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefault, X as assertRegionMatch, Xt as CFN_TEMPLATE_URL_LIMIT, Y as resolveExplicitPhysicalId, Yt as CFN_TEMPLATE_BODY_LIMIT, Z as configStringRefusal, Zt as MIGRATE_TMP_PREFIX, _ as createPreDeleteFinalSnapshot, _t as WorkGraph, a as DeploymentEventsStore, an as AwsClients, at as describeTypeWithThrottleRetry, b as unsupportedFinalSnapshotError, bn as PartialFailureError, bt as loadPublishableAssetManifest, c as replayFailedOperations, cn as setAwsClients, ct as isThrottlingError, d as IMPLICIT_DELETE_DEPENDENCIES, dt as LockManager, en as expectedOwnerParam, et as requireConfigArray, f as computeImplicitDeleteEdges, ft as S3StateBackend, g as ccRoutedFinalSnapshotError, gn as LocalStartServiceError, gt as stringifyValue, h as buildFinalSnapshotIdentifier, hn as LocalMigrateError, ht as AssetPublisher, i as DeploymentEventsReader, in as resolveBucketRegion, it as DiffCalculator, j as red, jn as withErrorHandling, jt as getDockerCmd, k as gray, kt as buildDockerImage, l as replayRollback, lt as DagBuilder, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalInvokeBuildError$1, mt as shouldRetainResource, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as processStackMessages, nt as requireConfigString, o as planFailedOps, on as getAwsClients, ot as withRetry, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as DeployCancelledError, pt as rebuildClientForBucketRegion, q as WAFv2WebACLProvider, qt as stateBucketExistenceConfirmed, r as DeployEngine, rt as applyRoleArnIfSet, s as planRollback, sn as resetAwsClients, st as isRetryableTransientError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssemblyReader, tt as requireConfigObject, u as withResourceDeadline, un as CdkdError, ut as TemplateParser, v as isFinalSnapshotError, vn as MissingCdkCliError, vt as buildAssetRedirectMap, w as isStatefulRecreateTargetSync, wn as StackHasActiveImportsError, wt as ensureAssetStorage, x as makeCanonicalizePropertiesFn, xn as ProvisioningError, xt as rewriteTemplateAssetReferences, y as refusesFinalSnapshot, yn as NestedStackChildDirectDestroyError, yt as createAssetRedirectResolver, z as CloudControlProvider, zt as getLegacyStateBucketName } from "./deploy-engine-DMY-UXvg.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-BhomRJhR.js";
+import { t as ASGProvider } from "./asg-provider-mWcJAGAu.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -13829,8 +13829,14 @@ var DynamoDBGlobalTableProvider = class {
 		if (!keySchema) throw new ProvisioningError(`KeySchema is required for DynamoDB GlobalTable ${logicalId}`, resourceType, logicalId);
 		if (!attributeDefinitions) throw new ProvisioningError(`AttributeDefinitions is required for DynamoDB GlobalTable ${logicalId}`, resourceType, logicalId);
 		let billingMode;
-		try {
-			billingMode = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", replayWarn(this.logger, context));
+		let billingModeSubstituted = false;
+		try {
+			const billingReplayWarn = replayWarn(this.logger, context).onUnusable;
+			billingMode = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", billingReplayWarn ? { onUnusable: (message) => {
+				billingModeSubstituted = true;
+				billingReplayWarn(message);
+			} } : {});
+			if (billingReplayWarn && properties["BillingMode"] === void 0) this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: the state record declares no BillingMode, so this replay creates the table PAY_PER_REQUEST. If it was PROVISIONED, set the mode in the template and redeploy.`);
 		} catch (error) {
 			throw new ProvisioningError(error instanceof Error ? error.message : String(error), resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
 		}
@@ -13845,6 +13851,10 @@ var DynamoDBGlobalTableProvider = class {
 		const diagnostics = [];
 		if (billingMode === "PROVISIONED") createParams.ProvisionedThroughput = derivePerCallProvisionedThroughput(properties, currentRegion, "min", diagnostics);
 		let effectiveProperties;
+		if (billingModeSubstituted) effectiveProperties = {
+			...properties,
+			BillingMode: billingMode
+		};
 		const streamSpecInput = properties["StreamSpecification"];
 		const needsStream = replicas.some((r) => r["Region"] !== currentRegion) || replicas.length > 1;
 		if (streamSpecInput != null) {
@@ -13864,7 +13874,7 @@ var DynamoDBGlobalTableProvider = class {
 				StreamViewType: streamViewType
 			};
 			if (streamSpecSubstituted) effectiveProperties = {
-				...properties,
+				...effectiveProperties ?? properties,
 				StreamSpecification: { StreamViewType: streamViewType }
 			};
 		} else if (needsStream) {
@@ -14095,7 +14105,7 @@ var DynamoDBGlobalTableProvider = class {
 			let billingUnusable = false;
 			const requestedBilling = requireConfigString(properties["BillingMode"], "PAY_PER_REQUEST", "AWS::DynamoDB::GlobalTable BillingMode", { onUnusable: (message) => {
 				billingUnusable = true;
-				this.logger.warn(`${message} The table's current billing mode (${oldBilling}) is kept for this update rather than flipped to the default.`);
+				this.logger.warn(`AWS::DynamoDB::GlobalTable ${logicalId}: ${message} The mode this update compared against (${oldBilling}) is kept for this update rather than flipped to the default.`);
 			} });
 			const newBilling = billingUnusable ? oldBilling : requestedBilling;
 			const onDemandCeilingLive = oldBilling === "PAY_PER_REQUEST" && newBilling === "PAY_PER_REQUEST";
@@ -14160,11 +14170,26 @@ var DynamoDBGlobalTableProvider = class {
 				} else {
 					const previousStreamSpec = previousProperties["StreamSpecification"];
 					const previousStreamSpecUsable = previousStreamSpec !== void 0 && previousStreamSpec !== null && configStringRefusal(previousStreamSpec, "StreamViewType", "NEW_AND_OLD_IMAGES", "AWS::DynamoDB::GlobalTable StreamSpecification") === void 0;
-					effectiveProperties = { ...properties };
+					effectiveProperties = { ...effectiveProperties ?? properties };
 					if (previousStreamSpecUsable) effectiveProperties["StreamSpecification"] = { ...previousStreamSpec };
 					else delete effectiveProperties["StreamSpecification"];
 				}
 			}
+			if (desiredGsiUnusable) {
+				let previousGsiProbeUnusable = false;
+				toSdkGlobalSecondaryIndexes(previousProperties, currentRegion, oldBilling, "min", void 0, () => {
+					previousGsiProbeUnusable = true;
+				});
+				const previousIndexes = previousProperties["GlobalSecondaryIndexes"];
+				effectiveProperties = { ...effectiveProperties ?? properties };
+				if (!previousGsiProbeUnusable && previousIndexes !== void 0) effectiveProperties["GlobalSecondaryIndexes"] = [...previousIndexes];
+				else delete effectiveProperties["GlobalSecondaryIndexes"];
+			}
+			if (billingUnusable) {
+				effectiveProperties = { ...effectiveProperties ?? properties };
+				if (recordedOldBilling === void 0) delete effectiveProperties["BillingMode"];
+				else effectiveProperties["BillingMode"] = oldBilling;
+			}
 			const awsOnDemand = describeResp.Table?.OnDemandThroughput;
 			const onDemandPayload = {};
 			const resolveCeiling = (desired, live) => {
@@ -36765,6 +36790,51 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	}
 };
 
+//#endregion
+//#region src/utils/aws-partition.ts
+/**
+* AWS partition / URL-suffix derivation, shared across layers.
+*
+* Lives in `src/utils/` because it has consumers in two different layers: the
+* `cdkd local *` command family (which passes a region in once to keep the STS
+* hop minimal) and the provisioning layer's `AppSyncProvider`, which rebuilds a
+* child resource's ARN when AWS did not report one.
+*
+* It was originally defined in `src/local/ecs-task-resolver.ts`, which
+* re-exports it so every existing call site is unchanged; a provisioning
+* provider importing from `src/local/**` would invert the layering.
+*
+* NOTE this is the mapping to prefer over `getAccountInfo().partition`
+* (`src/deployment/intrinsic-function-resolver.ts`), which is hardcoded to
+* `'aws'` and says so in its own comment.
+*/
+/**
+* Derive the AWS partition / URL suffix for an AWS region. Same mapping
+* CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
+*/
+function derivePartitionAndUrlSuffix(region) {
+	if (region.startsWith("cn-")) return {
+		partition: "aws-cn",
+		urlSuffix: "amazonaws.com.cn"
+	};
+	if (region.startsWith("us-gov-")) return {
+		partition: "aws-us-gov",
+		urlSuffix: "amazonaws.com"
+	};
+	if (region.startsWith("us-iso-")) return {
+		partition: "aws-iso",
+		urlSuffix: "c2s.ic.gov"
+	};
+	if (region.startsWith("us-isob-")) return {
+		partition: "aws-iso-b",
+		urlSuffix: "sc2s.sgov.gov"
+	};
+	return {
+		partition: "aws",
+		urlSuffix: "amazonaws.com"
+	};
+}
+
 //#endregion
 //#region src/provisioning/providers/appsync-provider.ts
 const MUTABLE_GRAPHQL_API_CONFIG_PROPERTIES = [
@@ -36882,6 +36952,111 @@ var AppSyncProvider = class {
 		return this.client;
 	}
 	/**
+	* Build a child-resource ARN from the deploy's REAL partition / region /
+	* account (issue #1681).
+	*
+	* The three child types record an ARN attribute because CloudFormation's
+	* `Ref` for each of them returns the resource ARN (docs-verified 2026-08-12)
+	* and `Fn::GetAtt` serves the same value from the same cached map — this
+	* provider's `getAttribute` always resolves `undefined`, so the recorded
+	* attribute is the ONLY source for both intrinsics.
+	*
+	* Until #1681 those attributes were string-built as
+	* `arn:aws:appsync:*:*:...`, i.e. with literal `*` in the region and account
+	* positions, so every consumer received an ARN AWS cannot resolve. Prefer the
+	* ARN the create response reports (`dataSourceArn` / `resolverArn`); this
+	* helper is for `AWS::AppSync::ApiKey`, whose `CreateApiKey` response carries
+	* no ARN field at all, and as the fallback for the other two when a response
+	* comes back without one.
+	*
+	* `getAccountInfo` is the same STS-backed, process-cached resolver
+	* `CloudControlProvider` uses for its own ARN reconstruction, so this costs
+	* at most one `GetCallerIdentity` per deploy.
+	*/
+	async buildAppSyncArn(suffix) {
+		const accountInfo = await getAccountInfo(this.providerRegion ?? await this.getClient().config.region());
+		const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
+		return `arn:${partition}:appsync:${accountInfo.region}:${accountInfo.accountId}:${suffix}`;
+	}
+	/**
+	* {@link buildAppSyncArn} for the POST-CREATE sites, where throwing is not an
+	* option (issue #1681 PR review).
+	*
+	* Moving the ARN build outside the create `try` stops a failure being
+	* re-labelled as a creation failure — but on its own it does NOT stop the
+	* resource being orphaned: `create()` still throws, the engine still journals
+	* no physicalId for a failed CREATE, and the resource still sits in AWS
+	* untracked (the issue #1710 class). Since the ARN is bookkeeping and the
+	* resource already exists, the honest answer is to never fail the create for
+	* it: warn, omit the attribute, and let `Ref` fall back to the compound id
+	* exactly as it does for an imported child. The resource's next update heals
+	* the record via `childRefAttributes`.
+	*/
+	async buildAppSyncArnOrWarn(suffix, logicalId, physicalId) {
+		try {
+			return await this.buildAppSyncArn(suffix);
+		} catch (error) {
+			this.logger.warn(`Created ${logicalId} (${physicalId}) but could not build its ARN attribute: ${error instanceof Error ? error.message : String(error)}. Ref will resolve to the compound physical id until the next update.`);
+			return;
+		}
+	}
+	/**
+	* Rebuild a child type's COMPLETE attribute set from its compound physical id
+	* (issue #1681), for the update path to return.
+	*
+	* This is what heals a record written by a pre-#1681 binary. `update()`
+	* previously returned no attributes, and the deploy engine carries the
+	* existing ones forward when a provider reports none — so without this a
+	* resource created before the fix would keep its `arn:aws:appsync:*:*:...`
+	* placeholder for the rest of its life, since only a REPLACEMENT re-runs
+	* `create()`. `Fn::GetAtt` reads the same cached map, so the placeholder was
+	* breaking that intrinsic too, independently of the `Ref` defect #1681 is
+	* about.
+	*
+	* It must return EVERY key the create path records, not just the ARN: an
+	* `attributes` map returned from `update()` REPLACES the record's map
+	* wholesale rather than merging into it (`deploy-engine.ts`), so a partial
+	* answer would silently drop `Name` / `ApiKey`.
+	*
+	* Returns `undefined` for an id whose arity does not match the type — a
+	* record that malformed cannot be healed by guessing, and carrying the
+	* existing attributes forward is the safe answer.
+	*/
+	async childRefAttributes(resourceType, physicalId) {
+		const parts = physicalId.split("|");
+		if (resourceType === "AWS::AppSync::DataSource" && parts.length === 2) {
+			const [apiId, name] = parts;
+			return {
+				DataSourceArn: await this.buildAppSyncArn(`apis/${apiId}/datasources/${name}`),
+				Name: name
+			};
+		}
+		if (resourceType === "AWS::AppSync::Resolver" && parts.length === 3) {
+			const [apiId, typeName, fieldName] = parts;
+			return { ResolverArn: await this.buildAppSyncArn(`apis/${apiId}/types/${typeName}/resolvers/${fieldName}`) };
+		}
+		if (resourceType === "AWS::AppSync::ApiKey" && parts.length === 2) {
+			const [apiId, apiKeyId] = parts;
+			return {
+				ApiKey: apiKeyId,
+				Arn: await this.buildAppSyncArn(`apis/${apiId}/apikey/${apiKeyId}`)
+			};
+		}
+	}
+	/**
+	* The no-replacement update result for a child type, carrying the healed
+	* attribute set (issue #1681). Reporting none is still the correct answer for
+	* an unhealable id — the engine then carries the existing attributes forward.
+	*/
+	async childUpdateResult(resourceType, physicalId) {
+		const attributes = await this.childRefAttributes(resourceType, physicalId);
+		return {
+			physicalId,
+			wasReplaced: false,
+			...attributes && { attributes }
+		};
+	}
+	/**
 	* Lazy S3 client for the `*S3Location` properties (Resolver
 	* `CodeS3Location` / `RequestMappingTemplateS3Location` /
 	* `ResponseMappingTemplateS3Location`, GraphQLSchema
@@ -37071,10 +37246,7 @@ var AppSyncProvider = class {
 			"EventBridgeConfig",
 			"RelationalDatabaseConfig",
 			"MetricsConfig"
-		].some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]))) return {
-			physicalId,
-			wasReplaced: false
-		};
+		].some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]))) return this.childUpdateResult(resourceType, physicalId);
 		const input = {
 			apiId,
 			name,
@@ -37086,10 +37258,7 @@ var AppSyncProvider = class {
 		} catch (error) {
 			throw this.wrapUpdateError(error, resourceType, logicalId, physicalId, "DataSource");
 		}
-		return {
-			physicalId,
-			wasReplaced: false
-		};
+		return this.childUpdateResult(resourceType, physicalId);
 	}
 	async updateResolver(logicalId, physicalId, resourceType, properties, previousProperties) {
 		for (const field of [
@@ -37119,10 +37288,7 @@ var AppSyncProvider = class {
 			"CodeS3Location",
 			"RequestMappingTemplateS3Location",
 			"ResponseMappingTemplateS3Location"
-		].some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]))) return {
-			physicalId,
-			wasReplaced: false
-		};
+		].some((key) => (key in properties || key in previousProperties) && !this.deepEqual(properties[key], previousProperties[key]))) return this.childUpdateResult(resourceType, physicalId);
 		const input = {
 			apiId,
 			typeName,
@@ -37134,10 +37300,7 @@ var AppSyncProvider = class {
 		} catch (error) {
 			throw this.wrapUpdateError(error, resourceType, logicalId, physicalId, "Resolver");
 		}
-		return {
-			physicalId,
-			wasReplaced: false
-		};
+		return this.childUpdateResult(resourceType, physicalId);
 	}
 	async updateApiKey(logicalId, physicalId, resourceType, properties, previousProperties) {
 		if (properties["ApiId"] !== void 0 && previousProperties["ApiId"] !== void 0 && properties["ApiId"] !== previousProperties["ApiId"]) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "AWS AppSync ApiKey.ApiId is immutable — destroy + redeploy to change");
@@ -37147,10 +37310,7 @@ var AppSyncProvider = class {
 		const oldDesc = previousProperties["Description"];
 		const newExp = properties["Expires"];
 		const oldExp = previousProperties["Expires"];
-		if (newDesc === oldDesc && newExp === oldExp) return {
-			physicalId,
-			wasReplaced: false
-		};
+		if (newDesc === oldDesc && newExp === oldExp) return this.childUpdateResult(resourceType, physicalId);
 		const input = {
 			apiId,
 			id: apiKeyId
@@ -37162,10 +37322,7 @@ var AppSyncProvider = class {
 		} catch (error) {
 			throw this.wrapUpdateError(error, resourceType, logicalId, physicalId, "ApiKey");
 		}
-		return {
-			physicalId,
-			wasReplaced: false
-		};
+		return this.childUpdateResult(resourceType, physicalId);
 	}
 	/**
 	* Apply a Tags diff to a GraphqlApi via TagResource / UntagResource.
@@ -37827,6 +37984,7 @@ var AppSyncProvider = class {
 			name: "name",
 			value: name
 		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		let reportedArn;
 		try {
 			const input = {
 				apiId,
@@ -37834,19 +37992,20 @@ var AppSyncProvider = class {
 				type
 			};
 			this.applyDataSourceConfig(input, resourceType, logicalId, properties);
-			await this.getClient().send(new CreateDataSourceCommand(input));
+			reportedArn = (await this.getClient().send(new CreateDataSourceCommand(input))).dataSource?.dataSourceArn;
 			this.logger.debug(`Successfully created DataSource ${logicalId}: ${physicalId}`);
-			return {
-				physicalId,
-				attributes: {
-					DataSourceArn: `arn:aws:appsync:*:*:apis/${apiId}/datasources/${name}`,
-					Name: name
-				}
-			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create DataSource ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
+		const dataSourceArn = reportedArn ?? await this.buildAppSyncArnOrWarn(`apis/${apiId}/datasources/${name}`, logicalId, physicalId);
+		return {
+			physicalId,
+			attributes: {
+				...dataSourceArn !== void 0 && { DataSourceArn: dataSourceArn },
+				Name: name
+			}
+		};
 	}
 	async deleteDataSource(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting DataSource ${logicalId}: ${physicalId}`);
@@ -37891,6 +38050,7 @@ var AppSyncProvider = class {
 				value: fieldName
 			}
 		], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		let reportedArn;
 		try {
 			const input = {
 				apiId,
@@ -37898,16 +38058,17 @@ var AppSyncProvider = class {
 				fieldName
 			};
 			await this.applyResolverConfig(input, resourceType, logicalId, properties);
-			await this.getClient().send(new CreateResolverCommand(input));
+			reportedArn = (await this.getClient().send(new CreateResolverCommand(input))).resolver?.resolverArn;
 			this.logger.debug(`Successfully created Resolver ${logicalId}: ${physicalId}`);
-			return {
-				physicalId,
-				attributes: { ResolverArn: `arn:aws:appsync:*:*:apis/${apiId}/types/${typeName}/resolvers/${fieldName}` }
-			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create Resolver ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
+		const resolverArn = reportedArn ?? await this.buildAppSyncArnOrWarn(`apis/${apiId}/types/${typeName}/resolvers/${fieldName}`, logicalId, physicalId);
+		return {
+			physicalId,
+			attributes: { ...resolverArn !== void 0 && { ResolverArn: resolverArn } }
+		};
 	}
 	async deleteResolver(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting Resolver ${logicalId}: ${physicalId}`);
@@ -37949,17 +38110,19 @@ var AppSyncProvider = class {
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create ApiKey ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
+		const physicalId = packCompositeId(resourceType, logicalId, [{
+			name: "apiId",
+			value: apiId
+		}, {
+			name: "apiKeyId",
+			value: apiKeyId
+		}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0);
+		const apiKeyArn = await this.buildAppSyncArnOrWarn(`apis/${apiId}/apikey/${apiKeyId}`, logicalId, physicalId);
 		return {
-			physicalId: packCompositeId(resourceType, logicalId, [{
-				name: "apiId",
-				value: apiId
-			}, {
-				name: "apiKeyId",
-				value: apiKeyId
-			}], context?.replayingState === true ? { onRefusal: (message) => this.logger.warn(message) } : void 0),
+			physicalId,
 			attributes: {
 				ApiKey: apiKeyId,
-				Arn: `arn:aws:appsync:*:*:apis/${apiId}/apikeys/${apiKeyId}`
+				...apiKeyArn !== void 0 && { Arn: apiKeyArn }
 			}
 		};
 	}
@@ -64628,34 +64791,6 @@ function notFoundError$1(target, stack, resources) {
 
 //#endregion
 //#region src/local/ecs-task-resolver.ts
-/**
-* Derive the AWS partition / URL suffix for an AWS region. Same mapping
-* CloudFormation applies to `${AWS::Partition}` / `${AWS::URLSuffix}`.
-* Exported so the CLI can keep the STS hop minimal — caller passes the
-* region in once, this returns the matching partition + suffix.
-*/
-function derivePartitionAndUrlSuffix(region) {
-	if (region.startsWith("cn-")) return {
-		partition: "aws-cn",
-		urlSuffix: "amazonaws.com.cn"
-	};
-	if (region.startsWith("us-gov-")) return {
-		partition: "aws-us-gov",
-		urlSuffix: "amazonaws.com"
-	};
-	if (region.startsWith("us-iso-")) return {
-		partition: "aws-iso",
-		urlSuffix: "c2s.ic.gov"
-	};
-	if (region.startsWith("us-isob-")) return {
-		partition: "aws-iso-b",
-		urlSuffix: "sc2s.sgov.gov"
-	};
-	return {
-		partition: "aws",
-		urlSuffix: "amazonaws.com"
-	};
-}
 function detectEcsImageResolutionNeeds(stack) {
 	const resources = stack.template.Resources ?? {};
 	let needsPseudoParameters = false;
@@ -73301,7 +73436,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.8");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.281.10");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;