@go-to-k/cdkd 0.225.0 → 0.227.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceNameWithFallback, C as StackHasActiveImportsError, F as getLiveRenderer, H as withStackName, I as PATTERN_B_NAME_PROPERTIES, L as PATTERN_B_RESOURCE_TYPES, M as getLogger, P as runStackBuffered, S as ResourceUpdateNotSupportedError, V as withSkipPrefix, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError, z as generateResourceName } from "./import-helpers-wLipXr5g.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as AssemblyReader, A as shouldRetainResource, B as getDefaultStateBucketName, C as applyRoleArnIfSet, D as LockManager, E as TemplateParser, F as formatDockerLoginError, G as resolveStateBucketWithDefault, H as resolveApp, I as getDockerCmd, J as CFN_TEMPLATE_BODY_LIMIT, K as resolveStateBucketWithDefaultAndSource, L as runDockerForeground, M as stringifyValue, N as WorkGraph, O as S3StateBackend, P as buildDockerImage, Q as uploadCfnTemplate, R as runDockerStreaming, S as IntrinsicFunctionResolver, T as DagBuilder, U as resolveCaptureObservedState, V as getLegacyStateBucketName, W as resolveSkipPrefix, X as MIGRATE_TMP_PREFIX, Y as CFN_TEMPLATE_URL_LIMIT, Z as findLargeInlineResources, _ as IAMRoleProvider, a as withRetry, b as findActionableSilentDrops, c as computeImplicitDeleteEdges, d as bold, f as cyan, g as yellow, h as red, i as withResourceDeadline, j as AssetPublisher, k as rebuildClientForBucketRegion, l as extractDeploymentEventError, m as green, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as gray, q as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as resolveBucketRegion, u as formatResourceLine, v as collectInlinePolicyNamesManagedBySiblings, w as DiffCalculator, x as CloudControlProvider, y as ProviderRegistry, z as Synthesizer } from "./deploy-engine-D0CE-sUC.js";
+import { $ as findLargeInlineResources, A as shouldRetainResource, B as getDockerImageBySourceHash, C as applyRoleArnIfSet, D as LockManager, E as TemplateParser, F as formatDockerLoginError, G as resolveCaptureObservedState, H as getDefaultStateBucketName, I as getDockerCmd, J as resolveStateBucketWithDefaultAndSource, K as resolveSkipPrefix, L as runDockerForeground, M as stringifyValue, N as WorkGraph, O as S3StateBackend, P as buildDockerImage, Q as MIGRATE_TMP_PREFIX, R as runDockerStreaming, S as IntrinsicFunctionResolver, T as DagBuilder, U as getLegacyStateBucketName, V as Synthesizer, W as resolveApp, X as CFN_TEMPLATE_BODY_LIMIT, Y as warnDeprecatedNoPrefixCliFlag, Z as CFN_TEMPLATE_URL_LIMIT, _ as IAMRoleProvider, a as withRetry, b as findActionableSilentDrops, c as computeImplicitDeleteEdges, d as bold, et as uploadCfnTemplate, f as cyan, g as yellow, h as red, i as withResourceDeadline, j as AssetPublisher, k as rebuildClientForBucketRegion, l as extractDeploymentEventError, m as green, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as gray, q as resolveStateBucketWithDefault, r as DeployEngine, rt as resolveBucketRegion, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as AssemblyReader, u as formatResourceLine, v as collectInlinePolicyNamesManagedBySiblings, w as DiffCalculator, x as CloudControlProvider, y as ProviderRegistry, z as AssetManifestLoader } from "./deploy-engine-CBzCsd24.js";
 import { t as ASGProvider } from "./asg-provider-B_hrCxRx.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -32,13 +32,13 @@ import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListHostedZonesCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
+import { join as join$1 } from "path";
 import { CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$7, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$10 } from "@aws-sdk/client-ecr";
 import graphlib from "graphlib";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBProxyCommand, CreateDBProxyEndpointCommand, CreateDBSubnetGroupCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeleteDBSubnetGroupCommand, DeregisterDBProxyTargetsCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, ModifyDBSubnetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-rds";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$9, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-elasticache";
 import { Command, Option } from "commander";
 import { writeFileSync as writeFileSync$1 } from "fs";
-import { join as join$1 } from "path";
 import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
 import * as zlib from "node:zlib";
@@ -50,7 +50,7 @@ import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBCluster
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
 import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListWebACLsCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$12, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
 import { CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreatePrivateDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, UpdatePrivateDnsNamespaceCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { CreatePrivateDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, UpdatePrivateDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$13, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetDatabasesCommand, GetJobCommand, GetSecurityConfigurationCommand, GetSecurityConfigurationsCommand, GetTableCommand, GetTablesCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, ListWorkflowsCommand, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
@@ -67,7 +67,6 @@ import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PR
 import { createServer } from "node:net";
 import { promisify } from "node:util";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-import { readFile } from "fs/promises";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { WebSocketServer } from "ws";
 
@@ -1553,7 +1552,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.225.0";
+	return "0.227.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -12093,6 +12092,21 @@ var CloudWatchAlarmProvider = class {
 		"EvaluateLowSampleCountPercentile",
 		"ThresholdMetricId"
 	])]]);
+	/**
+	* Properties this provider deliberately does NOT wire through to the SDK,
+	* with a one-line rationale per entry (consumed by the property-coverage
+	* check, issue #391).
+	*
+	* `EvaluationCriteria` / `EvaluationInterval` appear in the CloudFormation
+	* `AWS::CloudWatch::Alarm` registry schema but are absent from BOTH the AWS
+	* SDK `PutMetricAlarm` input (`@aws-sdk/client-cloudwatch`) AND the
+	* aws-cdk-lib `CfnAlarm` L1 — a newer CFn-schema surface ahead of SDK / CDK
+	* support, so there is no wire path to forward them and no CDK app can emit
+	* them. Per the #609 backfillability rule (a property absent from EITHER the
+	* SDK create input OR the CDK L1 is not backfillable), they are classified
+	* unhandled-by-design rather than left as a "not yet implemented" TODO.
+	*/
+	unhandledByDesign = new Map([["AWS::CloudWatch::Alarm", new Map([["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."], ["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.cloudWatchClient = awsClients.cloudWatch;
@@ -19294,6 +19308,7 @@ var AgentCoreRuntimeProvider = class {
 */
 var StepFunctionsProvider = class {
 	sfnClient;
+	s3Client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("StepFunctionsProvider");
 	handledProperties = new Map([["AWS::StepFunctions::StateMachine", new Set([
@@ -19305,6 +19320,7 @@ var StepFunctionsProvider = class {
 		"Tags",
 		"DefinitionString",
 		"Definition",
+		"DefinitionS3Location",
 		"DefinitionSubstitutions",
 		"EncryptionConfiguration"
 	])]]);
@@ -19312,6 +19328,10 @@ var StepFunctionsProvider = class {
 		if (!this.sfnClient) this.sfnClient = new SFNClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.sfnClient;
 	}
+	getS3Client() {
+		if (!this.s3Client) this.s3Client = new S3Client(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.s3Client;
+	}
 	/**
 	* Create a Step Functions state machine
 	*/
@@ -19321,7 +19341,7 @@ var StepFunctionsProvider = class {
 		const roleArn = properties["RoleArn"];
 		if (!roleArn) throw new ProvisioningError(`RoleArn is required for Step Functions state machine ${logicalId}`, resourceType, logicalId);
 		try {
-			const definitionString = this.buildDefinitionString(properties);
+			const definitionString = await this.buildDefinitionString(properties);
 			let tags;
 			if (properties["Tags"]) tags = properties["Tags"].map((tag) => ({
 				key: tag.Key,
@@ -19364,7 +19384,7 @@ var StepFunctionsProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Step Functions state machine ${logicalId}: ${physicalId}`);
 		try {
-			const definitionString = this.buildDefinitionString(properties);
+			const definitionString = await this.buildDefinitionString(properties);
 			const encryptionConfiguration = mapEncryptionConfiguration(properties["EncryptionConfiguration"]);
 			const loggingConfiguration = mapLoggingConfiguration(properties["LoggingConfiguration"]);
 			const tracingConfiguration = mapTracingConfiguration(properties["TracingConfiguration"]);
@@ -19564,10 +19584,22 @@ var StepFunctionsProvider = class {
 		return false;
 	}
 	/**
-	* Build definition string from CDK properties.
-	* Handles both DefinitionString (string) and DefinitionString (object) forms.
+	* Build the state-machine definition string from CDK properties.
+	*
+	* Precedence (mirrors CloudFormation): an inline `DefinitionString` /
+	* `Definition` wins over `DefinitionS3Location`. The inline forms are
+	* returned verbatim — any `DefinitionSubstitutions` they need are already
+	* folded into the template as `Fn::Sub` and resolved by cdkd's intrinsic
+	* resolver before the provider sees them.
+	*
+	* `DefinitionS3Location` ({@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-stepfunctions-statemachine-s3location.html S3Location})
+	* has no SDK `CreateStateMachine` field — CloudFormation reads the S3 object
+	* and inlines its contents as the `definition`. cdkd does the same: fetch
+	* the object body, then apply `DefinitionSubstitutions` ourselves because
+	* the intrinsic resolver cannot reach into S3 content (unlike the inline
+	* path, where substitutions arrive pre-resolved).
 	*/
-	buildDefinitionString(properties) {
+	async buildDefinitionString(properties) {
 		const definitionString = properties["DefinitionString"];
 		const definition = properties["Definition"];
 		if (definitionString !== void 0) {
@@ -19578,8 +19610,44 @@ var StepFunctionsProvider = class {
 			if (typeof definition === "string") return definition;
 			return JSON.stringify(definition);
 		}
+		const s3Location = properties["DefinitionS3Location"];
+		if (s3Location?.Bucket && s3Location.Key) {
+			const body = await this.fetchDefinitionFromS3(s3Location.Bucket, s3Location.Key, s3Location.Version);
+			return this.applyDefinitionSubstitutions(body, properties["DefinitionSubstitutions"]);
+		}
 		return "{}";
 	}
+	/**
+	* Fetch a state-machine definition (Amazon States Language JSON/YAML) from
+	* S3 and return its body as a UTF-8 string. Honors an optional object
+	* version for versioning-enabled buckets.
+	*/
+	async fetchDefinitionFromS3(bucket, key, version) {
+		this.logger.debug(`Fetching state-machine definition from s3://${bucket}/${key}${version ? `?versionId=${version}` : ""}`);
+		const resp = await this.getS3Client().send(new GetObjectCommand({
+			Bucket: bucket,
+			Key: key,
+			...version && { VersionId: version }
+		}));
+		if (!resp.Body) throw new Error(`DefinitionS3Location object s3://${bucket}/${key} returned no body`);
+		const body = await resp.Body.transformToString();
+		if (body.length === 0) throw new Error(`DefinitionS3Location object s3://${bucket}/${key} returned an empty body`);
+		return body;
+	}
+	/**
+	* Apply CloudFormation `DefinitionSubstitutions` (a `{ name: value }` map) to
+	* a definition body by replacing each `${name}` token with its value.
+	* Returns the body unchanged when no substitutions are supplied.
+	*/
+	applyDefinitionSubstitutions(body, substitutions) {
+		if (substitutions === null || typeof substitutions !== "object" || Array.isArray(substitutions)) return body;
+		let result = body;
+		for (const [name, value] of Object.entries(substitutions)) {
+			if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") continue;
+			result = result.split(`\${${name}}`).join(String(value));
+		}
+		return result;
+	}
 };
 /**
 * Translate a CFn-shape `EncryptionConfiguration` (PascalCase) into the SDK's
@@ -26700,7 +26768,8 @@ var ServiceDiscoveryProvider = class {
 		"Description",
 		"HealthCheckConfig",
 		"Tags",
-		"Type"
+		"Type",
+		"ServiceAttributes"
 	])]]);
 	getClient() {
 		if (!this.client) this.client = new ServiceDiscoveryClient(this.providerRegion ? { region: this.providerRegion } : {});
@@ -26853,11 +26922,30 @@ var ServiceDiscoveryProvider = class {
 				...type && { Type: type }
 			}))).Service;
 			if (!service || !service.Id) throw new Error("CreateService did not return Service ID");
-			this.logger.debug(`Successfully created service discovery service ${logicalId}: ${service.Id}`);
+			const serviceId = service.Id;
+			this.logger.debug(`Successfully created service discovery service ${logicalId}: ${serviceId}`);
+			try {
+				const attrs = this.normalizeServiceAttributes(properties["ServiceAttributes"]);
+				if (Object.keys(attrs).length > 0) {
+					await withRetry(() => client.send(new UpdateServiceAttributesCommand({
+						ServiceId: serviceId,
+						Attributes: attrs
+					})), logicalId, { logger: this.logger });
+					this.logger.debug(`Applied ${Object.keys(attrs).length} ServiceAttribute(s) for ${logicalId}`);
+				}
+			} catch (innerError) {
+				try {
+					await client.send(new DeleteServiceCommand$1({ Id: serviceId }));
+					this.logger.debug(`Cleaned up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure`);
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws servicediscovery delete-service --id ${serviceId}`);
+				}
+				throw innerError;
+			}
 			return {
-				physicalId: service.Id,
+				physicalId: serviceId,
 				attributes: {
-					Id: service.Id,
+					Id: serviceId,
 					Arn: service.Arn || "",
 					Name: service.Name || name || ""
 				}
@@ -26884,7 +26972,7 @@ var ServiceDiscoveryProvider = class {
 	* full AWS-current snapshot as `properties`, so the round-trip is
 	* value-preserving.
 	*/
-	async updateService(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async updateService(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating service discovery service ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const serviceChange = {};
@@ -26892,7 +26980,15 @@ var ServiceDiscoveryProvider = class {
 		const dnsConfig = properties["DnsConfig"];
 		if (dnsConfig?.DnsRecords !== void 0) serviceChange.DnsConfig = { DnsRecords: dnsConfig.DnsRecords };
 		if (properties["HealthCheckConfig"] !== void 0) serviceChange.HealthCheckConfig = properties["HealthCheckConfig"];
-		if (Object.keys(serviceChange).length === 0) {
+		const newAttrs = this.normalizeServiceAttributes(properties["ServiceAttributes"]);
+		const oldAttrs = this.normalizeServiceAttributes(previousProperties["ServiceAttributes"]);
+		const upsertAttrs = {};
+		for (const [k, v] of Object.entries(newAttrs)) if (oldAttrs[k] !== v) upsertAttrs[k] = v;
+		const removedAttrKeys = Object.keys(oldAttrs).filter((k) => !(k in newAttrs));
+		const hasServiceChange = Object.keys(serviceChange).length > 0;
+		const hasAttrUpsert = Object.keys(upsertAttrs).length > 0;
+		const hasAttrRemove = removedAttrKeys.length > 0;
+		if (!hasServiceChange && !hasAttrUpsert && !hasAttrRemove) {
 			this.logger.debug(`No mutable diff for ServiceDiscovery Service ${logicalId}, skipping update`);
 			return {
 				physicalId,
@@ -26900,11 +26996,27 @@ var ServiceDiscoveryProvider = class {
 			};
 		}
 		try {
-			const operationId = (await client.send(new UpdateServiceCommand$1({
-				Id: physicalId,
-				Service: serviceChange
-			}))).OperationId;
-			if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			if (hasServiceChange) {
+				const operationId = (await client.send(new UpdateServiceCommand$1({
+					Id: physicalId,
+					Service: serviceChange
+				}))).OperationId;
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			}
+			if (hasAttrUpsert) {
+				await withRetry(() => client.send(new UpdateServiceAttributesCommand({
+					ServiceId: physicalId,
+					Attributes: upsertAttrs
+				})), logicalId, { logger: this.logger });
+				this.logger.debug(`Applied ${Object.keys(upsertAttrs).length} ServiceAttribute change(s) for ${logicalId}`);
+			}
+			if (hasAttrRemove) {
+				await withRetry(() => client.send(new DeleteServiceAttributesCommand({
+					ServiceId: physicalId,
+					Attributes: removedAttrKeys
+				})), logicalId, { logger: this.logger });
+				this.logger.debug(`Removed ${removedAttrKeys.length} ServiceAttribute(s) for ${logicalId}`);
+			}
 			this.logger.debug(`Successfully updated service discovery service ${logicalId}`);
 			return {
 				physicalId,
@@ -27044,9 +27156,31 @@ var ServiceDiscoveryProvider = class {
 		if (svc.DnsConfig) result["DnsConfig"] = svc.DnsConfig;
 		if (svc.HealthCheckConfig) result["HealthCheckConfig"] = svc.HealthCheckConfig;
 		if (svc.HealthCheckCustomConfig) result["HealthCheckCustomConfig"] = svc.HealthCheckCustomConfig;
+		try {
+			result["ServiceAttributes"] = (await this.getClient().send(new GetServiceAttributesCommand({ ServiceId: physicalId }))).ServiceAttributes?.Attributes ?? {};
+		} catch (err) {
+			this.logger.debug(`ServiceDiscovery GetServiceAttributes(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
 		if (svc.Arn) await this.attachTags(result, svc.Arn);
 		return result;
 	}
+	/**
+	* Normalize a CFn `ServiceAttributes` value (a bare key→value JSON map) into
+	* the SDK's `Attributes` shape (`Record<string,string>`). Only string /
+	* number / boolean values are coerced via `String()`; a non-scalar value is
+	* malformed input and is dropped rather than stringified to `[object
+	* Object]`. A non-object input (absent / null / array) yields `{}` so callers
+	* can branch on `Object.keys(...).length`.
+	*/
+	normalizeServiceAttributes(raw) {
+		if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return {};
+		const out = {};
+		for (const [k, v] of Object.entries(raw)) {
+			if (v === void 0 || v === null) continue;
+			if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") out[k] = String(v);
+		}
+		return out;
+	}
 	/** Best-effort tag fetch via `ListTagsForResource(ResourceARN)`. */
 	async attachTags(result, arn) {
 		try {
@@ -47466,133 +47600,6 @@ const STREAM_PRELUDE_SEPARATOR = Buffer.from([
 	0
 ]);
 
-//#endregion
-//#region src/assets/asset-manifest-loader.ts
-/**
-* Asset manifest loader
-*
-* Loads and parses CDK asset manifests from the CDK output directory
-*/
-var AssetManifestLoader = class {
-	logger = getLogger().child("AssetManifestLoader");
-	/**
-	* Load asset manifest from CDK output directory
-	*
-	* @param cdkOutputDir CDK output directory (e.g., "cdk.out")
-	* @param stackName Stack name
-	* @returns Asset manifest or null if not found
-	*/
-	async loadManifest(cdkOutputDir, stackName) {
-		const manifestPath = join$1(cdkOutputDir, `${stackName}.assets.json`);
-		try {
-			this.logger.debug(`Loading asset manifest from: ${manifestPath}`);
-			const content = await readFile(manifestPath, "utf-8");
-			const manifest = JSON.parse(content);
-			this.logger.debug(`Loaded asset manifest: ${Object.keys(manifest.files).length} file assets, ${Object.keys(manifest.dockerImages).length} docker image assets`);
-			return manifest;
-		} catch (error) {
-			if (error.code === "ENOENT") {
-				this.logger.debug(`Asset manifest not found: ${manifestPath}`);
-				return null;
-			}
-			throw new Error(`Failed to load asset manifest from ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`);
-		}
-	}
-	/**
-	* Get file assets from manifest (excludes CloudFormation templates)
-	*
-	* @param manifest Asset manifest
-	* @returns Map of asset hash to file asset
-	*/
-	getFileAssets(manifest) {
-		const fileAssets = /* @__PURE__ */ new Map();
-		for (const [assetHash, asset] of Object.entries(manifest.files)) {
-			if (asset.source.path.endsWith(".json") || asset.source.path.endsWith(".template.json")) {
-				this.logger.debug(`Skipping CloudFormation template asset: ${asset.displayName}`);
-				continue;
-			}
-			fileAssets.set(assetHash, asset);
-		}
-		this.logger.debug(`Found ${fileAssets.size} file assets (excluding templates)`);
-		return fileAssets;
-	}
-	/**
-	* Get asset source path (absolute path)
-	*
-	* @param cdkOutputDir CDK output directory
-	* @param asset File asset
-	* @returns Absolute path to asset source
-	*/
-	getAssetSourcePath(cdkOutputDir, asset) {
-		return join$1(cdkOutputDir, asset.source.path);
-	}
-	/**
-	* Resolve asset destination values (replace ${AWS::AccountId}, ${AWS::Region}, etc.)
-	*
-	* @param value Value with placeholders
-	* @param accountId AWS account ID
-	* @param region AWS region
-	* @param partition AWS partition (default: "aws")
-	* @returns Resolved value
-	*/
-	resolveAssetDestinationValue(value, accountId, region, partition = "aws") {
-		return value.replace(/\$\{AWS::AccountId\}/g, accountId).replace(/\$\{AWS::Region\}/g, region).replace(/\$\{AWS::Partition\}/g, partition);
-	}
-};
-/**
-* Look up the docker-image asset that backs a Lambda's `Code.ImageUri`.
-*
-* The CDK template synthesizes `Code.ImageUri` as a `Fn::Sub` whose body
-* references the bootstrap ECR repo and ends in `:<hash>` — that hash is
-* the same key used in `manifest.dockerImages[<hash>]`. cdkd extracts the
-* hash by walking known image-URI shapes; on miss, when the manifest has
-* exactly one Docker image, we fall back to it (single-asset heuristic) so
-* locally-built non-bootstrapped images still work. This is documented as
-* a v1 limitation; immutable digest pins (`@sha256:<digest>`) hit the same
-* fallback path.
-*
-* Returns the `(hash, asset)` pair when matched, or `undefined` when both
-* the regex AND the single-asset fallback miss (typically: 0 docker assets,
-* or 2+ docker assets with no hash match — the caller should treat this as
-* "fall through to the ECR-pull path").
-*
-* Exported as a free function (not a method) so the local-invoke modules
-* can reuse it without depending on the `AssetManifestLoader` instance —
-* the manifest itself is a plain JSON shape.
-*/
-function getDockerImageBySourceHash(manifest, imageUri) {
-	const dockerImages = manifest.dockerImages ?? {};
-	const entries = Object.entries(dockerImages);
-	if (entries.length === 0) return void 0;
-	const hash = extractHashFromImageUri(imageUri);
-	if (hash !== void 0) {
-		const asset = dockerImages[hash];
-		if (asset) return {
-			hash,
-			asset
-		};
-	}
-	if (entries.length === 1) {
-		const [singleHash, singleAsset] = entries[0];
-		return {
-			hash: singleHash,
-			asset: singleAsset
-		};
-	}
-}
-/**
-* Extract the source hash from a Lambda `Code.ImageUri` string. CDK's
-* bootstrap layout ends every image URI in `:<hex-hash>`, and that hash
-* is the same key used in the asset manifest's `dockerImages` map.
-*
-* Returns `undefined` for shapes we can't parse (digest pins, missing tag,
-* etc.) — the caller falls back to the single-asset heuristic.
-*/
-function extractHashFromImageUri(imageUri) {
-	if (imageUri.includes("@sha256:")) return void 0;
-	return /:([a-f0-9]{8,})$/.exec(imageUri)?.[1];
-}
-
 //#endregion
 //#region src/utils/single-flight.ts
 /**
@@ -54615,7 +54622,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.225.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.227.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());