@go-to-k/cdkd 0.226.0 → 0.227.1

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceNameWithFallback, C as StackHasActiveImportsError, F as getLiveRenderer, H as withStackName, I as PATTERN_B_NAME_PROPERTIES, L as PATTERN_B_RESOURCE_TYPES, M as getLogger, P as runStackBuffered, S as ResourceUpdateNotSupportedError, V as withSkipPrefix, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError, z as generateResourceName } from "./import-helpers-wLipXr5g.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as AssemblyReader, A as shouldRetainResource, B as getDefaultStateBucketName, C as applyRoleArnIfSet, D as LockManager, E as TemplateParser, F as formatDockerLoginError, G as resolveStateBucketWithDefault, H as resolveApp, I as getDockerCmd, J as CFN_TEMPLATE_BODY_LIMIT, K as resolveStateBucketWithDefaultAndSource, L as runDockerForeground, M as stringifyValue, N as WorkGraph, O as S3StateBackend, P as buildDockerImage, Q as uploadCfnTemplate, R as runDockerStreaming, S as IntrinsicFunctionResolver, T as DagBuilder, U as resolveCaptureObservedState, V as getLegacyStateBucketName, W as resolveSkipPrefix, X as MIGRATE_TMP_PREFIX, Y as CFN_TEMPLATE_URL_LIMIT, Z as findLargeInlineResources, _ as IAMRoleProvider, a as withRetry, b as findActionableSilentDrops, c as computeImplicitDeleteEdges, d as bold, f as cyan, g as yellow, h as red, i as withResourceDeadline, j as AssetPublisher, k as rebuildClientForBucketRegion, l as extractDeploymentEventError, m as green, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as gray, q as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as resolveBucketRegion, u as formatResourceLine, v as collectInlinePolicyNamesManagedBySiblings, w as DiffCalculator, x as CloudControlProvider, y as ProviderRegistry, z as Synthesizer } from "./deploy-engine-DM557Qjg.js";
+import { $ as findLargeInlineResources, A as shouldRetainResource, B as getDockerImageBySourceHash, C as applyRoleArnIfSet, D as LockManager, E as TemplateParser, F as formatDockerLoginError, G as resolveCaptureObservedState, H as getDefaultStateBucketName, I as getDockerCmd, J as resolveStateBucketWithDefaultAndSource, K as resolveSkipPrefix, L as runDockerForeground, M as stringifyValue, N as WorkGraph, O as S3StateBackend, P as buildDockerImage, Q as MIGRATE_TMP_PREFIX, R as runDockerStreaming, S as IntrinsicFunctionResolver, T as DagBuilder, U as getLegacyStateBucketName, V as Synthesizer, W as resolveApp, X as CFN_TEMPLATE_BODY_LIMIT, Y as warnDeprecatedNoPrefixCliFlag, Z as CFN_TEMPLATE_URL_LIMIT, _ as IAMRoleProvider, a as withRetry, b as findActionableSilentDrops, c as computeImplicitDeleteEdges, d as bold, et as uploadCfnTemplate, f as cyan, g as yellow, h as red, i as withResourceDeadline, j as AssetPublisher, k as rebuildClientForBucketRegion, l as extractDeploymentEventError, m as green, n as DEFAULT_RESOURCE_WARN_AFTER_MS, o as isRetryableTransientError, p as gray, q as resolveStateBucketWithDefault, r as DeployEngine, rt as resolveBucketRegion, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as AssemblyReader, u as formatResourceLine, v as collectInlinePolicyNamesManagedBySiblings, w as DiffCalculator, x as CloudControlProvider, y as ProviderRegistry, z as AssetManifestLoader } from "./deploy-engine-Bl_Ka0hj.js";
 import { t as ASGProvider } from "./asg-provider-B_hrCxRx.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -32,13 +32,13 @@ import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListHostedZonesCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
+import { join as join$1 } from "path";
 import { CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$7, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$10 } from "@aws-sdk/client-ecr";
 import graphlib from "graphlib";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBProxyCommand, CreateDBProxyEndpointCommand, CreateDBSubnetGroupCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeleteDBSubnetGroupCommand, DeregisterDBProxyTargetsCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, ModifyDBSubnetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-rds";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$9, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-elasticache";
 import { Command, Option } from "commander";
 import { writeFileSync as writeFileSync$1 } from "fs";
-import { join as join$1 } from "path";
 import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
 import * as zlib from "node:zlib";
@@ -67,7 +67,6 @@ import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PR
 import { createServer } from "node:net";
 import { promisify } from "node:util";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-import { readFile } from "fs/promises";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { WebSocketServer } from "ws";
 
@@ -1553,7 +1552,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.226.0";
+	return "0.227.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -9758,6 +9757,7 @@ var DynamoDBTableProvider = class {
 					this.logger.debug(`Updated WarmThroughput on DynamoDB table ${physicalId}`);
 				}
 			}
+			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"]);
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"]);
 			if (JSON.stringify(properties["TimeToLiveSpecification"]) !== JSON.stringify(previousProperties["TimeToLiveSpecification"])) await this.applyTimeToLive(physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
 			if (JSON.stringify(properties["ResourcePolicy"]) !== JSON.stringify(previousProperties["ResourcePolicy"])) {
@@ -10083,6 +10083,79 @@ var DynamoDBTableProvider = class {
 		throw new Error(`Table ${tableName} did not reach ACTIVE status within ${maxAttempts} seconds after UpdateTable`);
 	}
 	/**
+	* Poll DescribeTable until the table is ACTIVE AND every Global Secondary
+	* Index is ACTIVE (not CREATING / UPDATING / DELETING / BACKFILLING). Used
+	* between GSI mutations because a freshly-created index keeps backfilling
+	* after the table itself returns to ACTIVE, and AWS rejects the next GSI op
+	* until the prior index settles.
+	*/
+	async waitForTableAndIndexesActive(tableName, maxAttempts = 1800) {
+		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table;
+			const tableActive = table?.TableStatus === "ACTIVE";
+			const indexesActive = (table?.GlobalSecondaryIndexes ?? []).every((gsi) => gsi.IndexStatus === "ACTIVE");
+			if (tableActive && indexesActive) return;
+			await new Promise((resolve) => setTimeout(resolve, 1e3));
+		}
+		throw new Error(`Table ${tableName} and its global secondary indexes did not reach ACTIVE within ${maxAttempts} seconds after UpdateTable`);
+	}
+	/**
+	* Apply Global Secondary Index add / remove / per-index throughput changes
+	* via UpdateTable's `GlobalSecondaryIndexUpdates`.
+	*
+	* AWS constraints mirrored here:
+	*  - At most ONE GSI Create or Delete per UpdateTable call; a second
+	*    mutation while the table / an index is still building is rejected. Each
+	*    op therefore runs in its own UpdateTable and waits for ACTIVE before the
+	*    next (creating GSIs also go through a BACKFILLING phase that ACTIVE
+	*    covers).
+	*  - A GSI `Create` must carry the AttributeDefinitions for the new index's
+	*    key attributes — the full desired AttributeDefinitions array is passed
+	*    so every newly-referenced attribute is defined.
+	*  - On an existing same-name index, only a PROVISIONED `ProvisionedThroughput`
+	*    (RCU/WCU) change is mutable in place and is issued as an `Update`. A
+	*    `KeySchema` / `Projection` change is immutable in place (AWS models it as
+	*    a delete + re-create); since the diff keys GSIs by name it would not emit
+	*    a remove-then-add pair, so this method throws on such a change rather than
+	*    silently dropping it.
+	*/
+	async applyGsiUpdates(physicalId, resourceType, logicalId, previousGsis, desiredGsis, desiredAttributeDefinitions) {
+		const prev = previousGsis ?? [];
+		const desired = desiredGsis ?? [];
+		const prevByName = new Map(prev.filter((g) => g.IndexName).map((g) => [g.IndexName, g]));
+		const desiredByName = new Map(desired.filter((g) => g.IndexName).map((g) => [g.IndexName, g]));
+		const ops = [];
+		for (const name of prevByName.keys()) if (!desiredByName.has(name)) ops.push({ Delete: { IndexName: name } });
+		for (const [name, gsi] of desiredByName) if (!prevByName.has(name)) {
+			if (!gsi.KeySchema) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} is missing KeySchema`, resourceType, logicalId, physicalId);
+			ops.push({ Create: {
+				IndexName: name,
+				KeySchema: gsi.KeySchema,
+				Projection: gsi.Projection,
+				...gsi.ProvisionedThroughput ? { ProvisionedThroughput: gsi.ProvisionedThroughput } : {},
+				...gsi.OnDemandThroughput ? { OnDemandThroughput: gsi.OnDemandThroughput } : {}
+			} });
+		} else {
+			const before = prevByName.get(name);
+			if (JSON.stringify(before.KeySchema) !== JSON.stringify(gsi.KeySchema) || JSON.stringify(before.Projection) !== JSON.stringify(gsi.Projection)) throw new ProvisioningError(`GlobalSecondaryIndex ${name} on DynamoDB table ${logicalId} changed its KeySchema or Projection, which DynamoDB cannot modify in place. Rename the index (so it is dropped and re-created) or replace the table.`, resourceType, logicalId, physicalId);
+			if (gsi.ProvisionedThroughput && JSON.stringify(before.ProvisionedThroughput) !== JSON.stringify(gsi.ProvisionedThroughput)) ops.push({ Update: {
+				IndexName: name,
+				ProvisionedThroughput: gsi.ProvisionedThroughput
+			} });
+		}
+		for (const op of ops) {
+			const input = {
+				TableName: physicalId,
+				GlobalSecondaryIndexUpdates: [op]
+			};
+			if (op.Create && desiredAttributeDefinitions) input.AttributeDefinitions = desiredAttributeDefinitions;
+			await this.dynamoDBClient.send(new UpdateTableCommand(input));
+			await this.waitForTableAndIndexesActive(physicalId);
+			const verb = op.Create ? "created" : op.Delete ? "deleted" : "updated";
+			this.logger.debug(`${verb} GSI ${op.Create?.IndexName ?? op.Delete?.IndexName ?? op.Update?.IndexName} on DynamoDB table ${physicalId}`);
+		}
+	}
+	/**
 	* Resolve a single `Fn::GetAtt` attribute for an existing DynamoDB table.
 	*
 	* CloudFormation's `AWS::DynamoDB::Table` exposes `Arn`, `StreamArn`
@@ -12093,6 +12166,21 @@ var CloudWatchAlarmProvider = class {
 		"EvaluateLowSampleCountPercentile",
 		"ThresholdMetricId"
 	])]]);
+	/**
+	* Properties this provider deliberately does NOT wire through to the SDK,
+	* with a one-line rationale per entry (consumed by the property-coverage
+	* check, issue #391).
+	*
+	* `EvaluationCriteria` / `EvaluationInterval` appear in the CloudFormation
+	* `AWS::CloudWatch::Alarm` registry schema but are absent from BOTH the AWS
+	* SDK `PutMetricAlarm` input (`@aws-sdk/client-cloudwatch`) AND the
+	* aws-cdk-lib `CfnAlarm` L1 — a newer CFn-schema surface ahead of SDK / CDK
+	* support, so there is no wire path to forward them and no CDK app can emit
+	* them. Per the #609 backfillability rule (a property absent from EITHER the
+	* SDK create input OR the CDK L1 is not backfillable), they are classified
+	* unhandled-by-design rather than left as a "not yet implemented" TODO.
+	*/
+	unhandledByDesign = new Map([["AWS::CloudWatch::Alarm", new Map([["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."], ["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.cloudWatchClient = awsClients.cloudWatch;
@@ -19294,6 +19382,7 @@ var AgentCoreRuntimeProvider = class {
 */
 var StepFunctionsProvider = class {
 	sfnClient;
+	s3Client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("StepFunctionsProvider");
 	handledProperties = new Map([["AWS::StepFunctions::StateMachine", new Set([
@@ -19305,6 +19394,7 @@ var StepFunctionsProvider = class {
 		"Tags",
 		"DefinitionString",
 		"Definition",
+		"DefinitionS3Location",
 		"DefinitionSubstitutions",
 		"EncryptionConfiguration"
 	])]]);
@@ -19312,6 +19402,10 @@ var StepFunctionsProvider = class {
 		if (!this.sfnClient) this.sfnClient = new SFNClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.sfnClient;
 	}
+	getS3Client() {
+		if (!this.s3Client) this.s3Client = new S3Client(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.s3Client;
+	}
 	/**
 	* Create a Step Functions state machine
 	*/
@@ -19321,7 +19415,7 @@ var StepFunctionsProvider = class {
 		const roleArn = properties["RoleArn"];
 		if (!roleArn) throw new ProvisioningError(`RoleArn is required for Step Functions state machine ${logicalId}`, resourceType, logicalId);
 		try {
-			const definitionString = this.buildDefinitionString(properties);
+			const definitionString = await this.buildDefinitionString(properties);
 			let tags;
 			if (properties["Tags"]) tags = properties["Tags"].map((tag) => ({
 				key: tag.Key,
@@ -19364,7 +19458,7 @@ var StepFunctionsProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Step Functions state machine ${logicalId}: ${physicalId}`);
 		try {
-			const definitionString = this.buildDefinitionString(properties);
+			const definitionString = await this.buildDefinitionString(properties);
 			const encryptionConfiguration = mapEncryptionConfiguration(properties["EncryptionConfiguration"]);
 			const loggingConfiguration = mapLoggingConfiguration(properties["LoggingConfiguration"]);
 			const tracingConfiguration = mapTracingConfiguration(properties["TracingConfiguration"]);
@@ -19564,10 +19658,22 @@ var StepFunctionsProvider = class {
 		return false;
 	}
 	/**
-	* Build definition string from CDK properties.
-	* Handles both DefinitionString (string) and DefinitionString (object) forms.
+	* Build the state-machine definition string from CDK properties.
+	*
+	* Precedence (mirrors CloudFormation): an inline `DefinitionString` /
+	* `Definition` wins over `DefinitionS3Location`. The inline forms are
+	* returned verbatim — any `DefinitionSubstitutions` they need are already
+	* folded into the template as `Fn::Sub` and resolved by cdkd's intrinsic
+	* resolver before the provider sees them.
+	*
+	* `DefinitionS3Location` ({@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-stepfunctions-statemachine-s3location.html S3Location})
+	* has no SDK `CreateStateMachine` field — CloudFormation reads the S3 object
+	* and inlines its contents as the `definition`. cdkd does the same: fetch
+	* the object body, then apply `DefinitionSubstitutions` ourselves because
+	* the intrinsic resolver cannot reach into S3 content (unlike the inline
+	* path, where substitutions arrive pre-resolved).
 	*/
-	buildDefinitionString(properties) {
+	async buildDefinitionString(properties) {
 		const definitionString = properties["DefinitionString"];
 		const definition = properties["Definition"];
 		if (definitionString !== void 0) {
@@ -19578,8 +19684,44 @@ var StepFunctionsProvider = class {
 			if (typeof definition === "string") return definition;
 			return JSON.stringify(definition);
 		}
+		const s3Location = properties["DefinitionS3Location"];
+		if (s3Location?.Bucket && s3Location.Key) {
+			const body = await this.fetchDefinitionFromS3(s3Location.Bucket, s3Location.Key, s3Location.Version);
+			return this.applyDefinitionSubstitutions(body, properties["DefinitionSubstitutions"]);
+		}
 		return "{}";
 	}
+	/**
+	* Fetch a state-machine definition (Amazon States Language JSON/YAML) from
+	* S3 and return its body as a UTF-8 string. Honors an optional object
+	* version for versioning-enabled buckets.
+	*/
+	async fetchDefinitionFromS3(bucket, key, version) {
+		this.logger.debug(`Fetching state-machine definition from s3://${bucket}/${key}${version ? `?versionId=${version}` : ""}`);
+		const resp = await this.getS3Client().send(new GetObjectCommand({
+			Bucket: bucket,
+			Key: key,
+			...version && { VersionId: version }
+		}));
+		if (!resp.Body) throw new Error(`DefinitionS3Location object s3://${bucket}/${key} returned no body`);
+		const body = await resp.Body.transformToString();
+		if (body.length === 0) throw new Error(`DefinitionS3Location object s3://${bucket}/${key} returned an empty body`);
+		return body;
+	}
+	/**
+	* Apply CloudFormation `DefinitionSubstitutions` (a `{ name: value }` map) to
+	* a definition body by replacing each `${name}` token with its value.
+	* Returns the body unchanged when no substitutions are supplied.
+	*/
+	applyDefinitionSubstitutions(body, substitutions) {
+		if (substitutions === null || typeof substitutions !== "object" || Array.isArray(substitutions)) return body;
+		let result = body;
+		for (const [name, value] of Object.entries(substitutions)) {
+			if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") continue;
+			result = result.split(`\${${name}}`).join(String(value));
+		}
+		return result;
+	}
 };
 /**
 * Translate a CFn-shape `EncryptionConfiguration` (PascalCase) into the SDK's
@@ -47532,133 +47674,6 @@ const STREAM_PRELUDE_SEPARATOR = Buffer.from([
 	0
 ]);
 
-//#endregion
-//#region src/assets/asset-manifest-loader.ts
-/**
-* Asset manifest loader
-*
-* Loads and parses CDK asset manifests from the CDK output directory
-*/
-var AssetManifestLoader = class {
-	logger = getLogger().child("AssetManifestLoader");
-	/**
-	* Load asset manifest from CDK output directory
-	*
-	* @param cdkOutputDir CDK output directory (e.g., "cdk.out")
-	* @param stackName Stack name
-	* @returns Asset manifest or null if not found
-	*/
-	async loadManifest(cdkOutputDir, stackName) {
-		const manifestPath = join$1(cdkOutputDir, `${stackName}.assets.json`);
-		try {
-			this.logger.debug(`Loading asset manifest from: ${manifestPath}`);
-			const content = await readFile(manifestPath, "utf-8");
-			const manifest = JSON.parse(content);
-			this.logger.debug(`Loaded asset manifest: ${Object.keys(manifest.files).length} file assets, ${Object.keys(manifest.dockerImages).length} docker image assets`);
-			return manifest;
-		} catch (error) {
-			if (error.code === "ENOENT") {
-				this.logger.debug(`Asset manifest not found: ${manifestPath}`);
-				return null;
-			}
-			throw new Error(`Failed to load asset manifest from ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`);
-		}
-	}
-	/**
-	* Get file assets from manifest (excludes CloudFormation templates)
-	*
-	* @param manifest Asset manifest
-	* @returns Map of asset hash to file asset
-	*/
-	getFileAssets(manifest) {
-		const fileAssets = /* @__PURE__ */ new Map();
-		for (const [assetHash, asset] of Object.entries(manifest.files)) {
-			if (asset.source.path.endsWith(".json") || asset.source.path.endsWith(".template.json")) {
-				this.logger.debug(`Skipping CloudFormation template asset: ${asset.displayName}`);
-				continue;
-			}
-			fileAssets.set(assetHash, asset);
-		}
-		this.logger.debug(`Found ${fileAssets.size} file assets (excluding templates)`);
-		return fileAssets;
-	}
-	/**
-	* Get asset source path (absolute path)
-	*
-	* @param cdkOutputDir CDK output directory
-	* @param asset File asset
-	* @returns Absolute path to asset source
-	*/
-	getAssetSourcePath(cdkOutputDir, asset) {
-		return join$1(cdkOutputDir, asset.source.path);
-	}
-	/**
-	* Resolve asset destination values (replace ${AWS::AccountId}, ${AWS::Region}, etc.)
-	*
-	* @param value Value with placeholders
-	* @param accountId AWS account ID
-	* @param region AWS region
-	* @param partition AWS partition (default: "aws")
-	* @returns Resolved value
-	*/
-	resolveAssetDestinationValue(value, accountId, region, partition = "aws") {
-		return value.replace(/\$\{AWS::AccountId\}/g, accountId).replace(/\$\{AWS::Region\}/g, region).replace(/\$\{AWS::Partition\}/g, partition);
-	}
-};
-/**
-* Look up the docker-image asset that backs a Lambda's `Code.ImageUri`.
-*
-* The CDK template synthesizes `Code.ImageUri` as a `Fn::Sub` whose body
-* references the bootstrap ECR repo and ends in `:<hash>` — that hash is
-* the same key used in `manifest.dockerImages[<hash>]`. cdkd extracts the
-* hash by walking known image-URI shapes; on miss, when the manifest has
-* exactly one Docker image, we fall back to it (single-asset heuristic) so
-* locally-built non-bootstrapped images still work. This is documented as
-* a v1 limitation; immutable digest pins (`@sha256:<digest>`) hit the same
-* fallback path.
-*
-* Returns the `(hash, asset)` pair when matched, or `undefined` when both
-* the regex AND the single-asset fallback miss (typically: 0 docker assets,
-* or 2+ docker assets with no hash match — the caller should treat this as
-* "fall through to the ECR-pull path").
-*
-* Exported as a free function (not a method) so the local-invoke modules
-* can reuse it without depending on the `AssetManifestLoader` instance —
-* the manifest itself is a plain JSON shape.
-*/
-function getDockerImageBySourceHash(manifest, imageUri) {
-	const dockerImages = manifest.dockerImages ?? {};
-	const entries = Object.entries(dockerImages);
-	if (entries.length === 0) return void 0;
-	const hash = extractHashFromImageUri(imageUri);
-	if (hash !== void 0) {
-		const asset = dockerImages[hash];
-		if (asset) return {
-			hash,
-			asset
-		};
-	}
-	if (entries.length === 1) {
-		const [singleHash, singleAsset] = entries[0];
-		return {
-			hash: singleHash,
-			asset: singleAsset
-		};
-	}
-}
-/**
-* Extract the source hash from a Lambda `Code.ImageUri` string. CDK's
-* bootstrap layout ends every image URI in `:<hex-hash>`, and that hash
-* is the same key used in the asset manifest's `dockerImages` map.
-*
-* Returns `undefined` for shapes we can't parse (digest pins, missing tag,
-* etc.) — the caller falls back to the single-asset heuristic.
-*/
-function extractHashFromImageUri(imageUri) {
-	if (imageUri.includes("@sha256:")) return void 0;
-	return /:([a-f0-9]{8,})$/.exec(imageUri)?.[1];
-}
-
 //#endregion
 //#region src/utils/single-flight.ts
 /**
@@ -54681,7 +54696,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.226.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.227.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());