@go-to-k/cdkd 0.230.33 → 0.231.1

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./import-helpers-DayvBD4T.js";
+import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-uvVnteGl.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as resolveStateBucketWithDefaultAndSource, A as TemplateParser, B as getDockerCmd, C as findActionableSilentDrops, D as applyRoleArnIfSet, E as cfnRefValueFromPhysicalId, F as AssetPublisher, G as Synthesizer, H as runDockerStreaming, I as stringifyValue, J as getLegacyStateBucketName, K as synthesisStatusMessage, L as WorkGraph, M as S3StateBackend, N as rebuildClientForBucketRegion, O as DiffCalculator, P as shouldRetainResource, Q as resolveStateBucketWithDefault, R as buildDockerImage, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as AssetManifestLoader, V as runDockerForeground, W as getDockerImageBySourceHash, X as resolveCaptureObservedState, Y as resolveApp, Z as resolveSkipPrefix, _ as green, a as withRetry, at as uploadCfnTemplate, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveBucketRegion, d as isStatefulRecreateTargetSync, et as warnDeprecatedNoPrefixCliFlag, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as findLargeInlineResources, j as LockManager, k as DagBuilder, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as CFN_TEMPLATE_URL_LIMIT, o as isRetryableTransientError, ot as AssemblyReader, p as formatResourceLine, q as getDefaultStateBucketName, r as DeployEngine, rt as MIGRATE_TMP_PREFIX, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as CFN_TEMPLATE_BODY_LIMIT, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as formatDockerLoginError } from "./deploy-engine-BEZF8ku-.js";
-import { t as ASGProvider } from "./asg-provider-Dgj3loIG.js";
+import { $ as resolveStateBucketWithDefault, A as DagBuilder, B as formatDockerLoginError, C as findActionableSilentDrops, D as WAFv2WebACLProvider, E as cfnRefValueFromPhysicalId, F as shouldRetainResource, G as getDockerImageBySourceHash, H as runDockerForeground, I as AssetPublisher, J as getDefaultStateBucketName, K as Synthesizer, L as stringifyValue, M as LockManager, N as S3StateBackend, O as applyRoleArnIfSet, P as rebuildClientForBucketRegion, Q as resolveSkipPrefix, R as WorkGraph, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as runDockerStreaming, V as getDockerCmd, W as AssetManifestLoader, X as resolveApp, Y as getLegacyStateBucketName, Z as resolveCaptureObservedState, _ as green, a as withRetry, at as findLargeInlineResources, b as IAMRoleProvider, c as computeImplicitDeleteEdges, d as isStatefulRecreateTargetSync, et as resolveStateBucketWithDefaultAndSource, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as MIGRATE_TMP_PREFIX, j as TemplateParser, k as DiffCalculator, l as extractDeploymentEventError, lt as resolveBucketRegion, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as CFN_TEMPLATE_BODY_LIMIT, o as isRetryableTransientError, ot as uploadCfnTemplate, p as formatResourceLine, q as synthesisStatusMessage, r as DeployEngine, rt as CFN_TEMPLATE_URL_LIMIT, s as IMPLICIT_DELETE_DEPENDENCIES, st as AssemblyReader, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as warnDeprecatedNoPrefixCliFlag, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as buildDockerImage } from "./deploy-engine-B9NOJeGf.js";
+import { t as ASGProvider } from "./asg-provider-Dd9Xze-T.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -48,20 +48,19 @@ import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMach
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListClustersCommand, ListServicesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$11, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
-import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListWebACLsCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$12, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
-import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreatePrivateDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, UpdatePrivateDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
-import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$13, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { CreatePrivateDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, UpdatePrivateDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$12, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetDatabasesCommand, GetJobCommand, GetSecurityConfigurationCommand, GetSecurityConfigurationsCommand, GetTableCommand, GetTablesCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, ListWorkflowsCommand, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$14, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$13, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$1, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$1, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$15 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$5, S3TablesClient, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$16 } from "@aws-sdk/client-s3tables";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$14 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$18, NotFoundException as NotFoundException$5, S3TablesClient, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$15 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1446,7 +1445,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.230.33";
+	return "0.231.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -16603,7 +16602,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			"Description",
 			"Tags",
 			"TracingEnabled",
-			"Variables"
+			"Variables",
+			"MethodSettings"
 		])],
 		["AWS::ApiGateway::Method", new Set([
 			"RestApiId",
@@ -17096,6 +17096,25 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				variables: properties["Variables"],
 				tags: this.cfnTagsToRecord(properties["Tags"])
 			}));
+			const methodSettings = properties["MethodSettings"];
+			const methodSettingsOps = buildMethodSettingsPatchOps(void 0, methodSettings);
+			if (methodSettingsOps.length > 0) try {
+				await this.apiGatewayClient.send(new UpdateStageCommand({
+					restApiId,
+					stageName,
+					patchOperations: methodSettingsOps
+				}));
+			} catch (patchError) {
+				try {
+					await this.apiGatewayClient.send(new DeleteStageCommand({
+						restApiId,
+						stageName
+					}));
+				} catch (cleanupError) {
+					this.logger.warn(`Failed to clean up stage ${stageName} after a MethodSettings patch failure: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+				}
+				throw patchError;
+			}
 			this.logger.debug(`Successfully created API Gateway Stage ${logicalId}: ${stageName}`);
 			return {
 				physicalId: stageName,
@@ -17146,6 +17165,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			op: "remove",
 			path: `/variables/${key}`
 		});
+		patchOperations.push(...buildMethodSettingsPatchOps(previousProperties["MethodSettings"], properties["MethodSettings"]));
 		try {
 			if (patchOperations.length > 0) await this.apiGatewayClient.send(new UpdateStageCommand({
 				restApiId,
@@ -17650,6 +17670,15 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			result["Description"] = resp.description ?? "";
 			if (resp.tracingEnabled !== void 0) result["TracingEnabled"] = resp.tracingEnabled;
 			if (resp.variables !== void 0) result["Variables"] = resp.variables;
+			const stateMethodSettings = properties?.["MethodSettings"];
+			if (stateMethodSettings && stateMethodSettings.length > 0) result["MethodSettings"] = stateMethodSettings.map((stateEntry) => {
+				const awsEntry = (resp.methodSettings ?? {})[methodSettingKey(stateEntry)];
+				const entry = {};
+				if (stateEntry.ResourcePath !== void 0) entry["ResourcePath"] = stateEntry.ResourcePath;
+				if (stateEntry.HttpMethod !== void 0) entry["HttpMethod"] = stateEntry.HttpMethod;
+				for (const { cfnKey, responseKey } of METHOD_SETTING_PATCH_FIELDS) if (stateEntry[cfnKey] !== void 0 && awsEntry?.[responseKey] !== void 0) entry[cfnKey] = awsEntry[responseKey];
+				return entry;
+			});
 			return result;
 		} catch (err) {
 			if (err instanceof NotFoundException$1) return void 0;
@@ -17720,6 +17749,122 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 	}
 };
 /**
+* CFn MethodSetting field → UpdateStage patch-path suffix under
+* `/{method_setting_key}/`. The get-stage response field for each is the
+* camelCase of the CFn name (used by the drift readback).
+*/
+const METHOD_SETTING_PATCH_FIELDS = [
+	{
+		cfnKey: "ThrottlingRateLimit",
+		patchSuffix: "throttling/rateLimit",
+		responseKey: "throttlingRateLimit"
+	},
+	{
+		cfnKey: "ThrottlingBurstLimit",
+		patchSuffix: "throttling/burstLimit",
+		responseKey: "throttlingBurstLimit"
+	},
+	{
+		cfnKey: "MetricsEnabled",
+		patchSuffix: "metrics/enabled",
+		responseKey: "metricsEnabled"
+	},
+	{
+		cfnKey: "LoggingLevel",
+		patchSuffix: "logging/loglevel",
+		responseKey: "loggingLevel"
+	},
+	{
+		cfnKey: "DataTraceEnabled",
+		patchSuffix: "logging/dataTrace",
+		responseKey: "dataTraceEnabled"
+	},
+	{
+		cfnKey: "CachingEnabled",
+		patchSuffix: "caching/enabled",
+		responseKey: "cachingEnabled"
+	},
+	{
+		cfnKey: "CacheTtlInSeconds",
+		patchSuffix: "caching/ttlInSeconds",
+		responseKey: "cacheTtlInSeconds"
+	},
+	{
+		cfnKey: "CacheDataEncrypted",
+		patchSuffix: "caching/dataEncrypted",
+		responseKey: "cacheDataEncrypted"
+	},
+	{
+		cfnKey: "RequireAuthorizationForCacheControl",
+		patchSuffix: "caching/requireAuthorizationForCacheControl",
+		responseKey: "requireAuthorizationForCacheControl"
+	},
+	{
+		cfnKey: "UnauthorizedCacheControlHeaderStrategy",
+		patchSuffix: "caching/unauthorizedCacheControlHeaderStrategy",
+		responseKey: "unauthorizedCacheControlHeaderStrategy"
+	}
+];
+/**
+* The `{method_setting_key}` API Gateway keys a stage's method settings by:
+* `{resource_path}/{http_method}` with the resource path's leading slash
+* stripped — CDK's stage-level `deployOptions` (`ResourcePath: '/*',
+* HttpMethod: '*'`) keys as the star-slash-star wildcard (the get-stage
+* `methodSettings` map key and the UpdateStage patch-path segment are the
+* same string).
+*/
+function methodSettingKey(setting) {
+	const resourcePath = setting.ResourcePath ?? "/*";
+	const httpMethod = setting.HttpMethod ?? "*";
+	return `${resourcePath === "/" ? "~1" : resourcePath.replace(/^\//, "")}/${httpMethod}`;
+}
+/**
+* Build the UpdateStage patch operations that take a stage's method settings
+* from `previous` to `next` (both in the CFn `MethodSettings` list shape):
+*   - an entry present only in `next`: `replace` each specified field
+*     (`replace` both adds and changes a method-setting override)
+*   - an entry present in both with NO fields dropped: `replace` only the
+*     changed fields
+*   - an entry present in both with a field DROPPED: `remove /{key}` then
+*     `replace` every remaining specified field — API Gateway REJECTS a
+*     field-level `remove` (`remove <key>/throttling/rateLimit` fails with
+*     "Cannot remove method setting ... because there is no method setting
+*     for this method"), while whole-key remove followed by field replaces
+*     in the SAME UpdateStage call applies sequentially (both verified live
+*     2026-07-03), so the dropped field reverts to its default (CFn
+*     absent-field semantics)
+*   - an entry present only in `previous`: `remove /{key}` — drops every
+*     override for that method path at once (CFn absent-entry semantics)
+* Values are rendered as strings (the UpdateStage wire format).
+*/
+function buildMethodSettingsPatchOps(previous, next) {
+	const ops = [];
+	const prevByKey = new Map((previous ?? []).map((s) => [methodSettingKey(s), s]));
+	const nextByKey = new Map((next ?? []).map((s) => [methodSettingKey(s), s]));
+	for (const key of prevByKey.keys()) if (!nextByKey.has(key)) ops.push({
+		op: "remove",
+		path: `/${key}`
+	});
+	for (const [key, setting] of nextByKey) {
+		const prevSetting = prevByKey.get(key);
+		const fieldDropped = prevSetting !== void 0 && METHOD_SETTING_PATCH_FIELDS.some(({ cfnKey }) => prevSetting[cfnKey] !== void 0 && setting[cfnKey] === void 0);
+		if (fieldDropped) ops.push({
+			op: "remove",
+			path: `/${key}`
+		});
+		for (const { cfnKey, patchSuffix } of METHOD_SETTING_PATCH_FIELDS) {
+			const nextValue = setting[cfnKey];
+			const prevValue = fieldDropped ? void 0 : prevSetting?.[cfnKey];
+			if (nextValue !== void 0 && String(nextValue) !== String(prevValue ?? "")) ops.push({
+				op: "replace",
+				path: `/${key}/${patchSuffix}`,
+				value: String(nextValue)
+			});
+		}
+	}
+	return ops;
+}
+/**
 * Append RFC 6902 patch operations describing the diff between two map-shaped
 * properties (e.g. API Gateway Method `RequestParameters` /
 * `RequestModels`). For each key:
@@ -25870,344 +26015,6 @@ var Route53Provider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/wafv2-provider.ts
-/**
-* Translate the empty-string placeholder `readCurrentState` emits for an
-* absent `Description` to `undefined` before shipping it to AWS.
-*
-* `readCurrentState` always-emits `Description: ''` on a WebACL with no
-* description (the comparator's top-level walk is state-keys-only, so
-* the placeholder is required to detect a console-side description add).
-* AWS WAFv2 `CreateWebACL` / `UpdateWebACL` reject `Description: ''`
-* with `Member must have length greater than or equal to 1` (min 1 / max
-* 256). On `cdkd drift --revert` the placeholder would round-trip
-* through `update()` and surface as a hard AWS rejection, so we sanitize
-* the wire-layer payload while keeping the read-side placeholder
-* intact. This is the Class 2 pattern from
-* `docs/provider-development.md § 3b`.
-*/
-function sanitizeDescription(value) {
-	if (value === void 0 || value === null) return void 0;
-	if (typeof value === "string" && value.length === 0) return void 0;
-	return value;
-}
-/**
-* Parse WAFv2 WebACL ARN to extract Id, Name, and Scope.
-*
-* ARN format:
-*   arn:aws:wafv2:{region}:{account}:regional/webacl/{name}/{id}
-*   arn:aws:wafv2:{region}:{account}:global/webacl/{name}/{id}
-*/
-function parseWebACLArn(arn) {
-	const segments = arn.split(":").slice(5).join(":").split("/");
-	const scopeRaw = segments[0];
-	const name = segments[2];
-	return {
-		id: segments[3],
-		name,
-		scope: scopeRaw === "global" ? "CLOUDFRONT" : "REGIONAL"
-	};
-}
-/**
-* AWS WAFv2 WebACL Provider
-*
-* Implements resource provisioning for AWS::WAFv2::WebACL using the WAFv2 SDK.
-* WHY: WAFv2 CreateWebACL is synchronous - the CC API adds unnecessary polling
-* overhead for an operation that completes immediately.
-* This SDK provider eliminates that polling and returns instantly.
-*/
-var WAFv2WebACLProvider = class {
-	wafv2Client;
-	providerRegion = process.env["AWS_REGION"];
-	logger = getLogger().child("WAFv2WebACLProvider");
-	handledProperties = new Map([["AWS::WAFv2::WebACL", new Set([
-		"Name",
-		"Scope",
-		"Tags",
-		"DefaultAction",
-		"Description",
-		"Rules",
-		"VisibilityConfig",
-		"CustomResponseBodies",
-		"CaptchaConfig",
-		"ChallengeConfig",
-		"TokenDomains",
-		"AssociationConfig"
-	])]]);
-	getClient() {
-		if (!this.wafv2Client) this.wafv2Client = new WAFV2Client(this.providerRegion ? { region: this.providerRegion } : {});
-		return this.wafv2Client;
-	}
-	/**
-	* Create a WAFv2 WebACL
-	*/
-	async create(logicalId, resourceType, properties) {
-		this.logger.debug(`Creating WAFv2 WebACL ${logicalId}`);
-		const name = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
-		const scope = properties["Scope"] || "REGIONAL";
-		try {
-			const tags = [];
-			if (properties["Tags"]) {
-				const tagList = properties["Tags"];
-				for (const tag of tagList) tags.push({
-					Key: tag.Key,
-					Value: tag.Value
-				});
-			}
-			const summary = (await this.getClient().send(new CreateWebACLCommand({
-				Name: name,
-				Scope: scope,
-				DefaultAction: properties["DefaultAction"],
-				Description: sanitizeDescription(properties["Description"]),
-				Rules: properties["Rules"] || [],
-				VisibilityConfig: properties["VisibilityConfig"],
-				...tags.length > 0 && { Tags: tags },
-				CustomResponseBodies: properties["CustomResponseBodies"],
-				CaptchaConfig: properties["CaptchaConfig"],
-				ChallengeConfig: properties["ChallengeConfig"],
-				TokenDomains: properties["TokenDomains"],
-				AssociationConfig: properties["AssociationConfig"]
-			}))).Summary;
-			if (!summary?.ARN || !summary?.Id) throw new Error("CreateWebACL did not return Summary with ARN and Id");
-			this.logger.debug(`Successfully created WAFv2 WebACL ${logicalId}: ${summary.ARN}`);
-			return {
-				physicalId: summary.ARN,
-				attributes: {
-					Arn: summary.ARN,
-					Id: summary.Id,
-					LabelNamespace: summary["LabelNamespace"]
-				}
-			};
-		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
-		}
-	}
-	/**
-	* Update a WAFv2 WebACL
-	*
-	* Name and Scope are immutable - changes to those require replacement.
-	* UpdateWebACL requires LockToken obtained from GetWebACL.
-	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
-		this.logger.debug(`Updating WAFv2 WebACL ${logicalId}: ${physicalId}`);
-		try {
-			const { id, name, scope } = parseWebACLArn(physicalId);
-			const getResponse = await this.getClient().send(new GetWebACLCommand({
-				Name: name,
-				Scope: scope,
-				Id: id
-			}));
-			const lockToken = getResponse.LockToken;
-			if (!lockToken) throw new Error("GetWebACL did not return LockToken");
-			await this.getClient().send(new UpdateWebACLCommand({
-				Name: name,
-				Scope: scope,
-				Id: id,
-				LockToken: lockToken,
-				DefaultAction: properties["DefaultAction"],
-				Description: sanitizeDescription(properties["Description"]),
-				Rules: properties["Rules"] || [],
-				VisibilityConfig: properties["VisibilityConfig"],
-				CustomResponseBodies: properties["CustomResponseBodies"],
-				CaptchaConfig: properties["CaptchaConfig"],
-				ChallengeConfig: properties["ChallengeConfig"],
-				TokenDomains: properties["TokenDomains"],
-				AssociationConfig: properties["AssociationConfig"]
-			}));
-			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
-			this.logger.debug(`Successfully updated WAFv2 WebACL ${logicalId}`);
-			return {
-				physicalId,
-				wasReplaced: false,
-				attributes: {
-					Arn: physicalId,
-					Id: id,
-					LabelNamespace: getResponse.WebACL?.LabelNamespace
-				}
-			};
-		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
-		}
-	}
-	/**
-	* Delete a WAFv2 WebACL
-	*
-	* DeleteWebACL requires LockToken obtained from GetWebACL.
-	* WAFNonexistentItemException is treated as success (idempotent delete).
-	*/
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
-		this.logger.debug(`Deleting WAFv2 WebACL ${logicalId}: ${physicalId}`);
-		try {
-			const { id, name, scope } = parseWebACLArn(physicalId);
-			const lockToken = (await this.getClient().send(new GetWebACLCommand({
-				Name: name,
-				Scope: scope,
-				Id: id
-			}))).LockToken;
-			if (!lockToken) throw new Error("GetWebACL did not return LockToken");
-			await this.getClient().send(new DeleteWebACLCommand({
-				Name: name,
-				Scope: scope,
-				Id: id,
-				LockToken: lockToken
-			}));
-			this.logger.debug(`Successfully deleted WAFv2 WebACL ${logicalId}`);
-		} catch (error) {
-			if (error instanceof WAFNonexistentItemException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`WAFv2 WebACL ${physicalId} does not exist, skipping deletion`);
-				return;
-			}
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
-		}
-	}
-	/**
-	* Apply a diff between old and new CFn-shape Tags arrays via WAFv2's
-	* `TagResource` / `UntagResource` APIs (keyed by `ResourceARN`).
-	*/
-	async applyTagDiff(arn, oldTagsRaw, newTagsRaw) {
-		const toMap = (tags) => {
-			const m = /* @__PURE__ */ new Map();
-			for (const t of tags ?? []) if (t.Key !== void 0 && t.Value !== void 0) m.set(t.Key, t.Value);
-			return m;
-		};
-		const oldMap = toMap(oldTagsRaw);
-		const newMap = toMap(newTagsRaw);
-		const tagsToAdd = [];
-		for (const [k, v] of newMap) if (oldMap.get(k) !== v) tagsToAdd.push({
-			Key: k,
-			Value: v
-		});
-		const tagsToRemove = [];
-		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
-		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$12({
-				ResourceARN: arn,
-				TagKeys: tagsToRemove
-			}));
-			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from WAFv2 WebACL ${arn}`);
-		}
-		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$13({
-				ResourceARN: arn,
-				Tags: tagsToAdd
-			}));
-			this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on WAFv2 WebACL ${arn}`);
-		}
-	}
-	/**
-	* Read the AWS-current WAFv2 WebACL configuration in CFn-property shape.
-	*
-	* The cdkd physicalId is the WebACL ARN; we parse it back to
-	* `(id, name, scope)` and call `GetWebACL`. The response holds Name,
-	* Description, DefaultAction, Rules, VisibilityConfig,
-	* CustomResponseBodies, CaptchaConfig, ChallengeConfig, TokenDomains,
-	* and AssociationConfig — every key cdkd state declares as
-	* `handledProperties`. `Scope` is recovered from the ARN parse.
-	*
-	* Tags are surfaced via a follow-up `ListTagsForResource(ResourceARN)`
-	* call. CDK's `aws:*` auto-tags are filtered out and the result key is
-	* omitted when AWS reports no user tags. Returns `undefined`
-	* when the ARN can't be parsed or the WebACL is gone
-	* (`WAFNonexistentItemException`).
-	*/
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
-		let id;
-		let name;
-		let scope;
-		try {
-			({id, name, scope} = parseWebACLArn(physicalId));
-		} catch {
-			return;
-		}
-		let webACL;
-		try {
-			webACL = (await this.getClient().send(new GetWebACLCommand({
-				Id: id,
-				Name: name,
-				Scope: scope
-			}))).WebACL;
-		} catch (err) {
-			if (err instanceof WAFNonexistentItemException) return void 0;
-			throw err;
-		}
-		if (!webACL) return void 0;
-		const result = {};
-		if (webACL.Name !== void 0) result["Name"] = webACL.Name;
-		result["Scope"] = scope;
-		result["Description"] = webACL.Description ?? "";
-		if (webACL.DefaultAction) result["DefaultAction"] = webACL.DefaultAction;
-		result["Rules"] = (webACL.Rules ?? []).map((r) => r);
-		if (webACL.VisibilityConfig) result["VisibilityConfig"] = webACL.VisibilityConfig;
-		result["CustomResponseBodies"] = webACL.CustomResponseBodies ?? {};
-		if (webACL.CaptchaConfig) result["CaptchaConfig"] = webACL.CaptchaConfig;
-		if (webACL.ChallengeConfig) result["ChallengeConfig"] = webACL.ChallengeConfig;
-		result["TokenDomains"] = webACL.TokenDomains ? [...webACL.TokenDomains] : [];
-		if (webACL.AssociationConfig) result["AssociationConfig"] = webACL.AssociationConfig;
-		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: physicalId }))).TagInfoForResource?.TagList);
-		} catch (err) {
-			this.logger.debug(`WAFv2 ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
-		}
-		return result;
-	}
-	/**
-	* Adopt an existing WAFv2 WebACL into cdkd state.
-	*
-	* Lookup order:
-	*  1. `--resource <id>=<arn>` override → verify with `GetWebACL` (parses
-	*     Name/Id/Scope back out of the ARN).
-	*  2. Walk `ListWebACLs(Scope)` → match `aws:cdk:path` via
-	*     `ListTagsForResource(ResourceARN)` (returns
-	*     `TagInfoForResource.TagList`, standard `Key`/`Value` shape).
-	*
-	* `Scope` is required by `ListWebACLs` — read from
-	* `Properties.Scope` (`REGIONAL` is the default).
-	*/
-	async import(input) {
-		if (input.knownPhysicalId) try {
-			const { id, name, scope } = parseWebACLArn(input.knownPhysicalId);
-			await this.getClient().send(new GetWebACLCommand({
-				Id: id,
-				Name: name,
-				Scope: scope
-			}));
-			return {
-				physicalId: input.knownPhysicalId,
-				attributes: {}
-			};
-		} catch (err) {
-			if (err instanceof WAFNonexistentItemException) return null;
-			throw err;
-		}
-		if (!input.cdkPath) return null;
-		const scope = input.properties["Scope"] || "REGIONAL";
-		let nextMarker;
-		do {
-			const list = await this.getClient().send(new ListWebACLsCommand({
-				Scope: scope,
-				...nextMarker && { NextMarker: nextMarker }
-			}));
-			for (const item of list.WebACLs ?? []) {
-				if (!item.ARN) continue;
-				const tagList = (await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: item.ARN }))).TagInfoForResource?.TagList;
-				if (matchesCdkPath(tagList, input.cdkPath)) return {
-					physicalId: item.ARN,
-					attributes: {}
-				};
-			}
-			nextMarker = list.NextMarker;
-		} while (nextMarker);
-		return null;
-	}
-};
-
 //#endregion
 //#region src/provisioning/providers/cognito-provider.ts
 /**
@@ -26762,7 +26569,7 @@ var CognitoUserPoolProvider = class {
 				if (input.cdkPath) try {
 					const arn = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: pool.Id }))).UserPool?.Arn;
 					if (!arn) continue;
-					if ((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceArn: arn }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceArn: arn }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: pool.Id,
 						attributes: {}
 					};
@@ -27750,7 +27557,7 @@ var ServiceDiscoveryProvider = class {
 	/** Best-effort tag fetch via `ListTagsForResource(ResourceARN)`. */
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: arn }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: arn }))).Tags);
 		} catch (err) {
 			this.logger.debug(`ServiceDiscovery ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -27784,7 +27591,7 @@ var ServiceDiscoveryProvider = class {
 					attributes: {}
 				};
 				if (input.cdkPath) try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: ns.Arn }))).Tags, input.cdkPath)) return {
+					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: ns.Arn }))).Tags, input.cdkPath)) return {
 						physicalId: ns.Id,
 						attributes: {}
 					};
@@ -27815,7 +27622,7 @@ var ServiceDiscoveryProvider = class {
 			for (const svc of list.Services ?? []) {
 				if (!svc.Id || !svc.Arn) continue;
 				try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: svc.Arn }))).Tags, input.cdkPath)) return {
+					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: svc.Arn }))).Tags, input.cdkPath)) return {
 						physicalId: svc.Id,
 						attributes: {}
 					};
@@ -28205,7 +28012,7 @@ var AppSyncProvider = class {
 		const tagsToAdd = {};
 		for (const [k, v] of Object.entries(newMap)) if (oldMap[k] !== v) tagsToAdd[k] = v;
 		if (tagKeysToRemove.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$13({
+			await this.getClient().send(new UntagResourceCommand$12({
 				resourceArn: arn,
 				tagKeys: tagKeysToRemove
 			}));
@@ -28213,7 +28020,7 @@ var AppSyncProvider = class {
 			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi (untag)");
 		}
 		if (Object.keys(tagsToAdd).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$14({
+			await this.getClient().send(new TagResourceCommand$13({
 				resourceArn: arn,
 				tags: tagsToAdd
 			}));
@@ -31565,7 +31372,7 @@ var KinesisStreamConsumerProvider = class {
 		if (desc.ConsumerName !== void 0) result["ConsumerName"] = desc.ConsumerName;
 		if (desc.StreamARN !== void 0) result["StreamARN"] = desc.StreamARN;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ ResourceARN: physicalId }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: physicalId }))).Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$8) return void 0;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -31589,14 +31396,14 @@ var KinesisStreamConsumerProvider = class {
 		const tagsToRemove = [];
 		for (const k of Object.keys(oldMap)) if (!(k in newMap)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$14({
+			await this.getClient().send(new UntagResourceCommand$13({
 				ResourceARN: consumerArn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from Kinesis stream consumer ${consumerArn}`);
 		}
 		if (Object.keys(tagsToAdd).length > 0) {
-			await this.getClient().send(new TagResourceCommand$15({
+			await this.getClient().send(new TagResourceCommand$14({
 				ResourceARN: consumerArn,
 				Tags: tagsToAdd
 			}));
@@ -34662,11 +34469,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${physicalId}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$16({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$15({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$15({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$14({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -34794,7 +34601,7 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.vectorBucketArn }))).tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }))).tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
@@ -34830,7 +34637,7 @@ var S3VectorsProvider = class {
 			for (const bucket of list.vectorBuckets ?? []) {
 				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) continue;
 				try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: bucket.vectorBucketName,
 						attributes: {}
 					};
@@ -35440,7 +35247,7 @@ var S3TablesProvider = class {
 					attributes: {}
 				};
 				if (input.cdkPath) try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: bucket.arn,
 						attributes: {}
 					};
@@ -35507,7 +35314,7 @@ var S3TablesProvider = class {
 							for (const table of tables.tables ?? []) {
 								if (!table.name || !table.tableARN) continue;
 								try {
-									if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: table.tableARN }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+									if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: table.tableARN }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 										physicalId: `${bucket.arn}|${namespaceName}|${table.name}`,
 										attributes: {}
 									};
@@ -35603,7 +35410,7 @@ var S3TablesProvider = class {
 	*/
 	async readTagsBestEffort(resourceArn) {
 		try {
-			const tags = (await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn }))).tags ?? {};
+			const tags = (await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn }))).tags ?? {};
 			const out = [];
 			for (const [Key, Value] of Object.entries(tags)) out.push({
 				Key,
@@ -35657,7 +35464,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$16({
+			await this.getClient().send(new UntagResourceCommand$15({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -35666,7 +35473,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$17({
+			await this.getClient().send(new TagResourceCommand$16({
 				resourceArn,
 				tags: upserts
 			}));
@@ -35698,7 +35505,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$16({
+			await this.getClient().send(new UntagResourceCommand$15({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -35707,7 +35514,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$17({
+			await this.getClient().send(new TagResourceCommand$16({
 				resourceArn,
 				tags: upserts
 			}));
@@ -55650,7 +55457,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.33");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.231.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());