@go-to-k/cdkd 0.231.0 → 0.231.2

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./import-helpers-DayvBD4T.js";
+import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-uvVnteGl.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as resolveStateBucketWithDefaultAndSource, A as TemplateParser, B as getDockerCmd, C as findActionableSilentDrops, D as applyRoleArnIfSet, E as cfnRefValueFromPhysicalId, F as AssetPublisher, G as Synthesizer, H as runDockerStreaming, I as stringifyValue, J as getLegacyStateBucketName, K as synthesisStatusMessage, L as WorkGraph, M as S3StateBackend, N as rebuildClientForBucketRegion, O as DiffCalculator, P as shouldRetainResource, Q as resolveStateBucketWithDefault, R as buildDockerImage, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as AssetManifestLoader, V as runDockerForeground, W as getDockerImageBySourceHash, X as resolveCaptureObservedState, Y as resolveApp, Z as resolveSkipPrefix, _ as green, a as withRetry, at as uploadCfnTemplate, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveBucketRegion, d as isStatefulRecreateTargetSync, et as warnDeprecatedNoPrefixCliFlag, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as findLargeInlineResources, j as LockManager, k as DagBuilder, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as CFN_TEMPLATE_URL_LIMIT, o as isRetryableTransientError, ot as AssemblyReader, p as formatResourceLine, q as getDefaultStateBucketName, r as DeployEngine, rt as MIGRATE_TMP_PREFIX, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as CFN_TEMPLATE_BODY_LIMIT, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as formatDockerLoginError } from "./deploy-engine-IqXCHYxE.js";
-import { t as ASGProvider } from "./asg-provider-Dgj3loIG.js";
+import { $ as resolveStateBucketWithDefault, A as DagBuilder, B as formatDockerLoginError, C as findActionableSilentDrops, D as WAFv2WebACLProvider, E as cfnRefValueFromPhysicalId, F as shouldRetainResource, G as getDockerImageBySourceHash, H as runDockerForeground, I as AssetPublisher, J as getDefaultStateBucketName, K as Synthesizer, L as stringifyValue, M as LockManager, N as S3StateBackend, O as applyRoleArnIfSet, P as rebuildClientForBucketRegion, Q as resolveSkipPrefix, R as WorkGraph, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as runDockerStreaming, V as getDockerCmd, W as AssetManifestLoader, X as resolveApp, Y as getLegacyStateBucketName, Z as resolveCaptureObservedState, _ as green, a as withRetry, at as findLargeInlineResources, b as IAMRoleProvider, c as computeImplicitDeleteEdges, d as isStatefulRecreateTargetSync, et as resolveStateBucketWithDefaultAndSource, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as MIGRATE_TMP_PREFIX, j as TemplateParser, k as DiffCalculator, l as extractDeploymentEventError, lt as resolveBucketRegion, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as CFN_TEMPLATE_BODY_LIMIT, o as isRetryableTransientError, ot as uploadCfnTemplate, p as formatResourceLine, q as synthesisStatusMessage, r as DeployEngine, rt as CFN_TEMPLATE_URL_LIMIT, s as IMPLICIT_DELETE_DEPENDENCIES, st as AssemblyReader, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as warnDeprecatedNoPrefixCliFlag, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as buildDockerImage } from "./deploy-engine-B9NOJeGf.js";
+import { t as ASGProvider } from "./asg-provider-Dd9Xze-T.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -48,20 +48,19 @@ import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMach
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListClustersCommand, ListServicesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$11, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
-import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListWebACLsCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$12, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
-import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreatePrivateDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, UpdatePrivateDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
-import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$13, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { CreatePrivateDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, UpdatePrivateDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$12, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetDatabasesCommand, GetJobCommand, GetSecurityConfigurationCommand, GetSecurityConfigurationsCommand, GetTableCommand, GetTablesCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, ListWorkflowsCommand, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$14, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$13, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$1, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$1, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$15 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$5, S3TablesClient, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$16 } from "@aws-sdk/client-s3tables";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$14 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$18, NotFoundException as NotFoundException$5, S3TablesClient, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$15 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1446,7 +1445,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.231.0";
+	return "0.231.2";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -9153,6 +9152,25 @@ function classifyEventSource(resp) {
 	if (arn.startsWith("arn:aws:rds:") || arn.startsWith("arn:aws-cn:rds:")) return "documentdb";
 	return "unknown";
 }
+/**
+* Classify an event source mapping from its CFn property bag (as opposed to
+* `classifyEventSource`, which reads an AWS `GetEventSourceMapping` response).
+* The discriminating keys are identical in both shapes (`EventSourceArn` plus
+* the four `*EventSourceConfig` / `SelfManagedEventSource` markers), so this
+* is a thin type-narrowing adapter over the same logic. Used by `update()`'s
+* removal-clear path (issue #976) to gate source-kind-specific clears
+* (`FunctionResponseTypes` / `SourceAccessConfigurations` /
+* `MaximumBatchingWindowInSeconds`).
+*/
+function classifyEventSourceFromProperties(properties) {
+	return classifyEventSource({
+		EventSourceArn: properties["EventSourceArn"],
+		SelfManagedEventSource: properties["SelfManagedEventSource"],
+		AmazonManagedKafkaEventSourceConfig: properties["AmazonManagedKafkaEventSourceConfig"],
+		SelfManagedKafkaEventSourceConfig: properties["SelfManagedKafkaEventSourceConfig"],
+		DocumentDBEventSourceConfig: properties["DocumentDBEventSourceConfig"]
+	});
+}
 const KINDS_WITH_FUNCTION_RESPONSE_TYPES = new Set([
 	"sqs",
 	"kinesis",
@@ -9164,6 +9182,28 @@ const KINDS_WITH_SOURCE_ACCESS_CONFIGURATIONS = new Set([
 	"documentdb"
 ]);
 /**
+* Source kinds whose `MaximumBatchingWindowInSeconds` default is `0` seconds
+* (SQS / Kinesis / DynamoDB). The poll-based kinds (Kafka / MSK / MQ /
+* DocumentDB) default to 500 ms, which cannot be restored via
+* `UpdateEventSourceMapping` (the field only accepts whole-second increments),
+* so the removal-on-UPDATE path only restores `0` for these kinds — see the
+* comment at the `MaximumBatchingWindowInSeconds` clear in `update()`.
+*/
+const KINDS_WITH_ZERO_BATCHING_WINDOW_DEFAULT = new Set([
+	"sqs",
+	"kinesis",
+	"dynamodb"
+]);
+/**
+* Source kinds that accept the stream-processing numeric parameters
+* (`MaximumRetryAttempts` / `MaximumRecordAgeInSeconds` /
+* `ParallelizationFactor` / `TumblingWindowInSeconds`) — Kinesis / DynamoDB
+* streams only. AWS rejects these on SQS / Kafka / MQ / DocumentDB, so the
+* removal-on-UPDATE default-restore path is gated on this set (see the numeric
+* restores in `update()`).
+*/
+const KINDS_WITH_STREAM_NUMERICS = new Set(["kinesis", "dynamodb"]);
+/**
 * AWS Lambda Event Source Mapping Provider
 *
 * Implements resource provisioning for AWS::Lambda::EventSourceMapping using the Lambda SDK.
@@ -9288,6 +9328,22 @@ var LambdaEventSourceMappingProvider = class {
 		if (properties["LoggingConfig"] !== void 0) updateParams.LoggingConfig = properties["LoggingConfig"];
 		if (properties["MetricsConfig"] !== void 0) updateParams.MetricsConfig = properties["MetricsConfig"];
 		if (properties["ProvisionedPollerConfig"] !== void 0) updateParams.ProvisionedPollerConfig = properties["ProvisionedPollerConfig"];
+		const wasSet = (key) => previousProperties[key] !== void 0 && properties[key] === void 0;
+		const prevKind = classifyEventSourceFromProperties(previousProperties);
+		if (wasSet("FilterCriteria")) updateParams.FilterCriteria = {};
+		if (wasSet("ScalingConfig")) updateParams.ScalingConfig = {};
+		if (wasSet("DestinationConfig")) updateParams.DestinationConfig = {};
+		if (wasSet("FunctionResponseTypes") && KINDS_WITH_FUNCTION_RESPONSE_TYPES.has(prevKind)) updateParams.FunctionResponseTypes = [];
+		if (wasSet("SourceAccessConfigurations") && KINDS_WITH_SOURCE_ACCESS_CONFIGURATIONS.has(prevKind)) updateParams.SourceAccessConfigurations = [];
+		if (wasSet("MetricsConfig")) updateParams.MetricsConfig = { Metrics: [] };
+		if (wasSet("KmsKeyArn")) updateParams.KMSKeyArn = "";
+		if (KINDS_WITH_STREAM_NUMERICS.has(prevKind)) {
+			if (wasSet("MaximumRetryAttempts")) updateParams.MaximumRetryAttempts = -1;
+			if (wasSet("MaximumRecordAgeInSeconds")) updateParams.MaximumRecordAgeInSeconds = -1;
+			if (wasSet("ParallelizationFactor")) updateParams.ParallelizationFactor = 1;
+			if (wasSet("TumblingWindowInSeconds")) updateParams.TumblingWindowInSeconds = 0;
+		}
+		if (wasSet("MaximumBatchingWindowInSeconds") && KINDS_WITH_ZERO_BATCHING_WINDOW_DEFAULT.has(prevKind)) updateParams.MaximumBatchingWindowInSeconds = 0;
 		const eventSourceMappingArn = (await this.lambdaClient.send(new UpdateEventSourceMappingCommand(updateParams))).EventSourceMappingArn;
 		if (eventSourceMappingArn) await this.applyTagDiff(eventSourceMappingArn, previousProperties["Tags"], properties["Tags"]);
 		this.logger.debug(`Successfully updated event source mapping ${logicalId}`);
@@ -26016,344 +26072,6 @@ var Route53Provider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/providers/wafv2-provider.ts
-/**
-* Translate the empty-string placeholder `readCurrentState` emits for an
-* absent `Description` to `undefined` before shipping it to AWS.
-*
-* `readCurrentState` always-emits `Description: ''` on a WebACL with no
-* description (the comparator's top-level walk is state-keys-only, so
-* the placeholder is required to detect a console-side description add).
-* AWS WAFv2 `CreateWebACL` / `UpdateWebACL` reject `Description: ''`
-* with `Member must have length greater than or equal to 1` (min 1 / max
-* 256). On `cdkd drift --revert` the placeholder would round-trip
-* through `update()` and surface as a hard AWS rejection, so we sanitize
-* the wire-layer payload while keeping the read-side placeholder
-* intact. This is the Class 2 pattern from
-* `docs/provider-development.md § 3b`.
-*/
-function sanitizeDescription(value) {
-	if (value === void 0 || value === null) return void 0;
-	if (typeof value === "string" && value.length === 0) return void 0;
-	return value;
-}
-/**
-* Parse WAFv2 WebACL ARN to extract Id, Name, and Scope.
-*
-* ARN format:
-*   arn:aws:wafv2:{region}:{account}:regional/webacl/{name}/{id}
-*   arn:aws:wafv2:{region}:{account}:global/webacl/{name}/{id}
-*/
-function parseWebACLArn(arn) {
-	const segments = arn.split(":").slice(5).join(":").split("/");
-	const scopeRaw = segments[0];
-	const name = segments[2];
-	return {
-		id: segments[3],
-		name,
-		scope: scopeRaw === "global" ? "CLOUDFRONT" : "REGIONAL"
-	};
-}
-/**
-* AWS WAFv2 WebACL Provider
-*
-* Implements resource provisioning for AWS::WAFv2::WebACL using the WAFv2 SDK.
-* WHY: WAFv2 CreateWebACL is synchronous - the CC API adds unnecessary polling
-* overhead for an operation that completes immediately.
-* This SDK provider eliminates that polling and returns instantly.
-*/
-var WAFv2WebACLProvider = class {
-	wafv2Client;
-	providerRegion = process.env["AWS_REGION"];
-	logger = getLogger().child("WAFv2WebACLProvider");
-	handledProperties = new Map([["AWS::WAFv2::WebACL", new Set([
-		"Name",
-		"Scope",
-		"Tags",
-		"DefaultAction",
-		"Description",
-		"Rules",
-		"VisibilityConfig",
-		"CustomResponseBodies",
-		"CaptchaConfig",
-		"ChallengeConfig",
-		"TokenDomains",
-		"AssociationConfig"
-	])]]);
-	getClient() {
-		if (!this.wafv2Client) this.wafv2Client = new WAFV2Client(this.providerRegion ? { region: this.providerRegion } : {});
-		return this.wafv2Client;
-	}
-	/**
-	* Create a WAFv2 WebACL
-	*/
-	async create(logicalId, resourceType, properties) {
-		this.logger.debug(`Creating WAFv2 WebACL ${logicalId}`);
-		const name = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
-		const scope = properties["Scope"] || "REGIONAL";
-		try {
-			const tags = [];
-			if (properties["Tags"]) {
-				const tagList = properties["Tags"];
-				for (const tag of tagList) tags.push({
-					Key: tag.Key,
-					Value: tag.Value
-				});
-			}
-			const summary = (await this.getClient().send(new CreateWebACLCommand({
-				Name: name,
-				Scope: scope,
-				DefaultAction: properties["DefaultAction"],
-				Description: sanitizeDescription(properties["Description"]),
-				Rules: properties["Rules"] || [],
-				VisibilityConfig: properties["VisibilityConfig"],
-				...tags.length > 0 && { Tags: tags },
-				CustomResponseBodies: properties["CustomResponseBodies"],
-				CaptchaConfig: properties["CaptchaConfig"],
-				ChallengeConfig: properties["ChallengeConfig"],
-				TokenDomains: properties["TokenDomains"],
-				AssociationConfig: properties["AssociationConfig"]
-			}))).Summary;
-			if (!summary?.ARN || !summary?.Id) throw new Error("CreateWebACL did not return Summary with ARN and Id");
-			this.logger.debug(`Successfully created WAFv2 WebACL ${logicalId}: ${summary.ARN}`);
-			return {
-				physicalId: summary.ARN,
-				attributes: {
-					Arn: summary.ARN,
-					Id: summary.Id,
-					LabelNamespace: summary["LabelNamespace"]
-				}
-			};
-		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
-		}
-	}
-	/**
-	* Update a WAFv2 WebACL
-	*
-	* Name and Scope are immutable - changes to those require replacement.
-	* UpdateWebACL requires LockToken obtained from GetWebACL.
-	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
-		this.logger.debug(`Updating WAFv2 WebACL ${logicalId}: ${physicalId}`);
-		try {
-			const { id, name, scope } = parseWebACLArn(physicalId);
-			const getResponse = await this.getClient().send(new GetWebACLCommand({
-				Name: name,
-				Scope: scope,
-				Id: id
-			}));
-			const lockToken = getResponse.LockToken;
-			if (!lockToken) throw new Error("GetWebACL did not return LockToken");
-			await this.getClient().send(new UpdateWebACLCommand({
-				Name: name,
-				Scope: scope,
-				Id: id,
-				LockToken: lockToken,
-				DefaultAction: properties["DefaultAction"],
-				Description: sanitizeDescription(properties["Description"]),
-				Rules: properties["Rules"] || [],
-				VisibilityConfig: properties["VisibilityConfig"],
-				CustomResponseBodies: properties["CustomResponseBodies"],
-				CaptchaConfig: properties["CaptchaConfig"],
-				ChallengeConfig: properties["ChallengeConfig"],
-				TokenDomains: properties["TokenDomains"],
-				AssociationConfig: properties["AssociationConfig"]
-			}));
-			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
-			this.logger.debug(`Successfully updated WAFv2 WebACL ${logicalId}`);
-			return {
-				physicalId,
-				wasReplaced: false,
-				attributes: {
-					Arn: physicalId,
-					Id: id,
-					LabelNamespace: getResponse.WebACL?.LabelNamespace
-				}
-			};
-		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to update WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
-		}
-	}
-	/**
-	* Delete a WAFv2 WebACL
-	*
-	* DeleteWebACL requires LockToken obtained from GetWebACL.
-	* WAFNonexistentItemException is treated as success (idempotent delete).
-	*/
-	async delete(logicalId, physicalId, resourceType, _properties, context) {
-		this.logger.debug(`Deleting WAFv2 WebACL ${logicalId}: ${physicalId}`);
-		try {
-			const { id, name, scope } = parseWebACLArn(physicalId);
-			const lockToken = (await this.getClient().send(new GetWebACLCommand({
-				Name: name,
-				Scope: scope,
-				Id: id
-			}))).LockToken;
-			if (!lockToken) throw new Error("GetWebACL did not return LockToken");
-			await this.getClient().send(new DeleteWebACLCommand({
-				Name: name,
-				Scope: scope,
-				Id: id,
-				LockToken: lockToken
-			}));
-			this.logger.debug(`Successfully deleted WAFv2 WebACL ${logicalId}`);
-		} catch (error) {
-			if (error instanceof WAFNonexistentItemException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`WAFv2 WebACL ${physicalId} does not exist, skipping deletion`);
-				return;
-			}
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
-		}
-	}
-	/**
-	* Apply a diff between old and new CFn-shape Tags arrays via WAFv2's
-	* `TagResource` / `UntagResource` APIs (keyed by `ResourceARN`).
-	*/
-	async applyTagDiff(arn, oldTagsRaw, newTagsRaw) {
-		const toMap = (tags) => {
-			const m = /* @__PURE__ */ new Map();
-			for (const t of tags ?? []) if (t.Key !== void 0 && t.Value !== void 0) m.set(t.Key, t.Value);
-			return m;
-		};
-		const oldMap = toMap(oldTagsRaw);
-		const newMap = toMap(newTagsRaw);
-		const tagsToAdd = [];
-		for (const [k, v] of newMap) if (oldMap.get(k) !== v) tagsToAdd.push({
-			Key: k,
-			Value: v
-		});
-		const tagsToRemove = [];
-		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
-		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$12({
-				ResourceARN: arn,
-				TagKeys: tagsToRemove
-			}));
-			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from WAFv2 WebACL ${arn}`);
-		}
-		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$13({
-				ResourceARN: arn,
-				Tags: tagsToAdd
-			}));
-			this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on WAFv2 WebACL ${arn}`);
-		}
-	}
-	/**
-	* Read the AWS-current WAFv2 WebACL configuration in CFn-property shape.
-	*
-	* The cdkd physicalId is the WebACL ARN; we parse it back to
-	* `(id, name, scope)` and call `GetWebACL`. The response holds Name,
-	* Description, DefaultAction, Rules, VisibilityConfig,
-	* CustomResponseBodies, CaptchaConfig, ChallengeConfig, TokenDomains,
-	* and AssociationConfig — every key cdkd state declares as
-	* `handledProperties`. `Scope` is recovered from the ARN parse.
-	*
-	* Tags are surfaced via a follow-up `ListTagsForResource(ResourceARN)`
-	* call. CDK's `aws:*` auto-tags are filtered out and the result key is
-	* omitted when AWS reports no user tags. Returns `undefined`
-	* when the ARN can't be parsed or the WebACL is gone
-	* (`WAFNonexistentItemException`).
-	*/
-	async readCurrentState(physicalId, _logicalId, _resourceType) {
-		let id;
-		let name;
-		let scope;
-		try {
-			({id, name, scope} = parseWebACLArn(physicalId));
-		} catch {
-			return;
-		}
-		let webACL;
-		try {
-			webACL = (await this.getClient().send(new GetWebACLCommand({
-				Id: id,
-				Name: name,
-				Scope: scope
-			}))).WebACL;
-		} catch (err) {
-			if (err instanceof WAFNonexistentItemException) return void 0;
-			throw err;
-		}
-		if (!webACL) return void 0;
-		const result = {};
-		if (webACL.Name !== void 0) result["Name"] = webACL.Name;
-		result["Scope"] = scope;
-		result["Description"] = webACL.Description ?? "";
-		if (webACL.DefaultAction) result["DefaultAction"] = webACL.DefaultAction;
-		result["Rules"] = (webACL.Rules ?? []).map((r) => r);
-		if (webACL.VisibilityConfig) result["VisibilityConfig"] = webACL.VisibilityConfig;
-		result["CustomResponseBodies"] = webACL.CustomResponseBodies ?? {};
-		if (webACL.CaptchaConfig) result["CaptchaConfig"] = webACL.CaptchaConfig;
-		if (webACL.ChallengeConfig) result["ChallengeConfig"] = webACL.ChallengeConfig;
-		result["TokenDomains"] = webACL.TokenDomains ? [...webACL.TokenDomains] : [];
-		if (webACL.AssociationConfig) result["AssociationConfig"] = webACL.AssociationConfig;
-		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: physicalId }))).TagInfoForResource?.TagList);
-		} catch (err) {
-			this.logger.debug(`WAFv2 ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
-		}
-		return result;
-	}
-	/**
-	* Adopt an existing WAFv2 WebACL into cdkd state.
-	*
-	* Lookup order:
-	*  1. `--resource <id>=<arn>` override → verify with `GetWebACL` (parses
-	*     Name/Id/Scope back out of the ARN).
-	*  2. Walk `ListWebACLs(Scope)` → match `aws:cdk:path` via
-	*     `ListTagsForResource(ResourceARN)` (returns
-	*     `TagInfoForResource.TagList`, standard `Key`/`Value` shape).
-	*
-	* `Scope` is required by `ListWebACLs` — read from
-	* `Properties.Scope` (`REGIONAL` is the default).
-	*/
-	async import(input) {
-		if (input.knownPhysicalId) try {
-			const { id, name, scope } = parseWebACLArn(input.knownPhysicalId);
-			await this.getClient().send(new GetWebACLCommand({
-				Id: id,
-				Name: name,
-				Scope: scope
-			}));
-			return {
-				physicalId: input.knownPhysicalId,
-				attributes: {}
-			};
-		} catch (err) {
-			if (err instanceof WAFNonexistentItemException) return null;
-			throw err;
-		}
-		if (!input.cdkPath) return null;
-		const scope = input.properties["Scope"] || "REGIONAL";
-		let nextMarker;
-		do {
-			const list = await this.getClient().send(new ListWebACLsCommand({
-				Scope: scope,
-				...nextMarker && { NextMarker: nextMarker }
-			}));
-			for (const item of list.WebACLs ?? []) {
-				if (!item.ARN) continue;
-				const tagList = (await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: item.ARN }))).TagInfoForResource?.TagList;
-				if (matchesCdkPath(tagList, input.cdkPath)) return {
-					physicalId: item.ARN,
-					attributes: {}
-				};
-			}
-			nextMarker = list.NextMarker;
-		} while (nextMarker);
-		return null;
-	}
-};
-
 //#endregion
 //#region src/provisioning/providers/cognito-provider.ts
 /**
@@ -26908,7 +26626,7 @@ var CognitoUserPoolProvider = class {
 				if (input.cdkPath) try {
 					const arn = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: pool.Id }))).UserPool?.Arn;
 					if (!arn) continue;
-					if ((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceArn: arn }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceArn: arn }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: pool.Id,
 						attributes: {}
 					};
@@ -27896,7 +27614,7 @@ var ServiceDiscoveryProvider = class {
 	/** Best-effort tag fetch via `ListTagsForResource(ResourceARN)`. */
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: arn }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: arn }))).Tags);
 		} catch (err) {
 			this.logger.debug(`ServiceDiscovery ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -27930,7 +27648,7 @@ var ServiceDiscoveryProvider = class {
 					attributes: {}
 				};
 				if (input.cdkPath) try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: ns.Arn }))).Tags, input.cdkPath)) return {
+					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: ns.Arn }))).Tags, input.cdkPath)) return {
 						physicalId: ns.Id,
 						attributes: {}
 					};
@@ -27961,7 +27679,7 @@ var ServiceDiscoveryProvider = class {
 			for (const svc of list.Services ?? []) {
 				if (!svc.Id || !svc.Arn) continue;
 				try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: svc.Arn }))).Tags, input.cdkPath)) return {
+					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: svc.Arn }))).Tags, input.cdkPath)) return {
 						physicalId: svc.Id,
 						attributes: {}
 					};
@@ -28351,7 +28069,7 @@ var AppSyncProvider = class {
 		const tagsToAdd = {};
 		for (const [k, v] of Object.entries(newMap)) if (oldMap[k] !== v) tagsToAdd[k] = v;
 		if (tagKeysToRemove.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$13({
+			await this.getClient().send(new UntagResourceCommand$12({
 				resourceArn: arn,
 				tagKeys: tagKeysToRemove
 			}));
@@ -28359,7 +28077,7 @@ var AppSyncProvider = class {
 			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi (untag)");
 		}
 		if (Object.keys(tagsToAdd).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$14({
+			await this.getClient().send(new TagResourceCommand$13({
 				resourceArn: arn,
 				tags: tagsToAdd
 			}));
@@ -31711,7 +31429,7 @@ var KinesisStreamConsumerProvider = class {
 		if (desc.ConsumerName !== void 0) result["ConsumerName"] = desc.ConsumerName;
 		if (desc.StreamARN !== void 0) result["StreamARN"] = desc.StreamARN;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ ResourceARN: physicalId }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: physicalId }))).Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$8) return void 0;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -31735,14 +31453,14 @@ var KinesisStreamConsumerProvider = class {
 		const tagsToRemove = [];
 		for (const k of Object.keys(oldMap)) if (!(k in newMap)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$14({
+			await this.getClient().send(new UntagResourceCommand$13({
 				ResourceARN: consumerArn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from Kinesis stream consumer ${consumerArn}`);
 		}
 		if (Object.keys(tagsToAdd).length > 0) {
-			await this.getClient().send(new TagResourceCommand$15({
+			await this.getClient().send(new TagResourceCommand$14({
 				ResourceARN: consumerArn,
 				Tags: tagsToAdd
 			}));
@@ -34808,11 +34526,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${physicalId}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$16({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$15({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$15({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$14({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -34940,7 +34658,7 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.vectorBucketArn }))).tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }))).tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
@@ -34976,7 +34694,7 @@ var S3VectorsProvider = class {
 			for (const bucket of list.vectorBuckets ?? []) {
 				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) continue;
 				try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: bucket.vectorBucketName,
 						attributes: {}
 					};
@@ -35586,7 +35304,7 @@ var S3TablesProvider = class {
 					attributes: {}
 				};
 				if (input.cdkPath) try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: bucket.arn,
 						attributes: {}
 					};
@@ -35653,7 +35371,7 @@ var S3TablesProvider = class {
 							for (const table of tables.tables ?? []) {
 								if (!table.name || !table.tableARN) continue;
 								try {
-									if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: table.tableARN }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+									if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: table.tableARN }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 										physicalId: `${bucket.arn}|${namespaceName}|${table.name}`,
 										attributes: {}
 									};
@@ -35749,7 +35467,7 @@ var S3TablesProvider = class {
 	*/
 	async readTagsBestEffort(resourceArn) {
 		try {
-			const tags = (await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn }))).tags ?? {};
+			const tags = (await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn }))).tags ?? {};
 			const out = [];
 			for (const [Key, Value] of Object.entries(tags)) out.push({
 				Key,
@@ -35803,7 +35521,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$16({
+			await this.getClient().send(new UntagResourceCommand$15({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -35812,7 +35530,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$17({
+			await this.getClient().send(new TagResourceCommand$16({
 				resourceArn,
 				tags: upserts
 			}));
@@ -35844,7 +35562,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$16({
+			await this.getClient().send(new UntagResourceCommand$15({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -35853,7 +35571,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$17({
+			await this.getClient().send(new TagResourceCommand$16({
 				resourceArn,
 				tags: upserts
 			}));
@@ -55796,7 +55514,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.231.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.231.2");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());