@go-to-k/cdkd 0.240.0 → 0.242.0

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
 import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
-import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-D_OJrSGP.js";
+import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-7FfFEJkw.js";
 import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
 import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -51,20 +51,21 @@ import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, Delet
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
 import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreatePrivateDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, UpdatePrivateDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
-import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
+import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetDatabasesCommand, GetJobCommand, GetSecurityConfigurationCommand, GetSecurityConfigurationsCommand, GetTableCommand, GetTablesCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, ListWorkflowsCommand, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeBudgetsCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$1, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$1, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$5, S3TablesClient, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18 } from "@aws-sdk/client-s3tables";
+import { CodeCommitClient, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1887,7 +1888,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.240.0";
+	return "0.242.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -27884,34 +27885,53 @@ var ElastiCacheProvider = class {
 *
 * Implements resource provisioning for:
 * - AWS::ServiceDiscovery::PrivateDnsNamespace
+* - AWS::ServiceDiscovery::HttpNamespace
+* - AWS::ServiceDiscovery::PublicDnsNamespace
 * - AWS::ServiceDiscovery::Service
 *
-* WHY: CreatePrivateDnsNamespace is async (returns OperationId) but we handle
-* the polling ourselves, avoiding the CC API's generic polling overhead and
-* giving us direct control over the operation lifecycle.
+* WHY: the Create*Namespace APIs are async (they return an OperationId) but we
+* handle the polling ourselves, avoiding the CC API's generic polling overhead
+* and giving us direct control over the operation lifecycle. HttpNamespace and
+* PublicDnsNamespace are `ProvisioningType: NON_PROVISIONABLE`, so Cloud
+* Control cannot handle them at all — this SDK provider is the only route
+* (issue #1044).
 */
-var ServiceDiscoveryProvider = class {
+var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	client;
 	stsClient;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("ServiceDiscoveryProvider");
-	handledProperties = new Map([["AWS::ServiceDiscovery::PrivateDnsNamespace", new Set([
-		"Name",
-		"Vpc",
-		"Description",
-		"Tags",
-		"Properties"
-	])], ["AWS::ServiceDiscovery::Service", new Set([
-		"Name",
-		"NamespaceId",
-		"DnsConfig",
-		"HealthCheckCustomConfig",
-		"Description",
-		"HealthCheckConfig",
-		"Tags",
-		"Type",
-		"ServiceAttributes"
-	])]]);
+	handledProperties = new Map([
+		["AWS::ServiceDiscovery::PrivateDnsNamespace", new Set([
+			"Name",
+			"Vpc",
+			"Description",
+			"Tags",
+			"Properties"
+		])],
+		["AWS::ServiceDiscovery::HttpNamespace", new Set([
+			"Name",
+			"Description",
+			"Tags"
+		])],
+		["AWS::ServiceDiscovery::PublicDnsNamespace", new Set([
+			"Name",
+			"Description",
+			"Tags",
+			"Properties"
+		])],
+		["AWS::ServiceDiscovery::Service", new Set([
+			"Name",
+			"NamespaceId",
+			"DnsConfig",
+			"HealthCheckCustomConfig",
+			"Description",
+			"HealthCheckConfig",
+			"Tags",
+			"Type",
+			"ServiceAttributes"
+		])]
+	]);
 	getClient() {
 		if (!this.client) this.client = new ServiceDiscoveryClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -27923,20 +27943,26 @@ var ServiceDiscoveryProvider = class {
 	async create(logicalId, resourceType, properties) {
 		switch (resourceType) {
 			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.createNamespace(logicalId, resourceType, properties);
+			case "AWS::ServiceDiscovery::HttpNamespace": return this.createHttpNamespace(logicalId, resourceType, properties);
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.createPublicDnsNamespace(logicalId, resourceType, properties);
 			case "AWS::ServiceDiscovery::Service": return this.createService(logicalId, resourceType, properties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
 	update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		switch (resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.updateNamespace(logicalId, physicalId, resourceType, properties);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ServiceDiscovery::HttpNamespace": return this.updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::ServiceDiscovery::Service": return this.updateService(logicalId, physicalId, resourceType, properties, previousProperties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		switch (resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.deleteNamespace(logicalId, physicalId, resourceType, context);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace":
+			case "AWS::ServiceDiscovery::HttpNamespace":
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.deleteNamespace(logicalId, physicalId, resourceType, context);
 			case "AWS::ServiceDiscovery::Service": return this.deleteService(logicalId, physicalId, resourceType, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -27950,8 +27976,7 @@ var ServiceDiscoveryProvider = class {
 		const tags = properties["Tags"];
 		if (!name) throw new ProvisioningError(`Name is required for PrivateDnsNamespace ${logicalId}`, resourceType, logicalId);
 		if (!vpc) throw new ProvisioningError(`Vpc is required for PrivateDnsNamespace ${logicalId}`, resourceType, logicalId);
-		const soa = (properties["Properties"]?.["DnsProperties"])?.["SOA"];
-		const inputProperties = soa?.TTL !== void 0 ? { DnsProperties: { SOA: { TTL: Number(soa.TTL) } } } : void 0;
+		const inputProperties = this.extractSoaTtlProperties(properties);
 		try {
 			const operationId = (await client.send(new CreatePrivateDnsNamespaceCommand({
 				Name: name,
@@ -27987,30 +28012,29 @@ var ServiceDiscoveryProvider = class {
 	* `Name` and `Vpc` are immutable; the deploy engine's
 	* replacement-detection layer routes those through DELETE+CREATE
 	* before this method is ever called, so we do not validate them here.
+	* Tags ride on the separate `TagResource` / `UntagResource` APIs
+	* (see {@link syncNamespaceTags} — wired in with issue #1044 so a
+	* Tags-only change is no longer silently dropped, the ECR #981 class).
 	*
 	* Empty-string Description is intentionally allowed through (`!== undefined`
 	* gate, not truthy) so `cdkd drift --revert` can clear a console-side ADD.
 	*/
-	async updateNamespace(logicalId, physicalId, resourceType, properties) {
+	async updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating private DNS namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const namespaceChange = {};
 		if (properties["Description"] !== void 0) namespaceChange.Description = properties["Description"];
-		const soa = (properties["Properties"]?.["DnsProperties"])?.["SOA"];
-		if (soa?.TTL !== void 0) namespaceChange.Properties = { DnsProperties: { SOA: { TTL: Number(soa.TTL) } } };
-		if (Object.keys(namespaceChange).length === 0) {
-			this.logger.debug(`No mutable diff for PrivateDnsNamespace ${logicalId}, skipping update`);
-			return {
-				physicalId,
-				wasReplaced: false
-			};
-		}
+		const soaProperties = this.extractSoaTtlProperties(properties);
+		if (soaProperties) namespaceChange.Properties = soaProperties;
 		try {
-			const operationId = (await client.send(new UpdatePrivateDnsNamespaceCommand({
-				Id: physicalId,
-				Namespace: namespaceChange
-			}))).OperationId;
-			if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			if (Object.keys(namespaceChange).length > 0) {
+				const operationId = (await client.send(new UpdatePrivateDnsNamespaceCommand({
+					Id: physicalId,
+					Namespace: namespaceChange
+				}))).OperationId;
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			} else this.logger.debug(`No mutable namespace-body diff for PrivateDnsNamespace ${logicalId}`);
+			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
 			this.logger.debug(`Successfully updated private DNS namespace ${logicalId}`);
 			return {
 				physicalId,
@@ -28022,21 +28046,172 @@ var ServiceDiscoveryProvider = class {
 			throw new ProvisioningError(`Failed to update private DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	/**
+	* Delete a Cloud Map namespace (shared by PrivateDnsNamespace,
+	* HttpNamespace, and PublicDnsNamespace — `DeleteNamespace` is
+	* kind-agnostic and operation-based for all three).
+	*/
 	async deleteNamespace(logicalId, physicalId, resourceType, context) {
-		this.logger.debug(`Deleting private DNS namespace ${logicalId}: ${physicalId}`);
+		this.logger.debug(`Deleting Cloud Map namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		try {
 			const operationId = (await client.send(new DeleteNamespaceCommand({ Id: physicalId }))).OperationId;
 			if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
-			this.logger.debug(`Successfully deleted private DNS namespace ${logicalId}`);
+			this.logger.debug(`Successfully deleted Cloud Map namespace ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NamespaceNotFound) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Namespace ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete Cloud Map namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async createHttpNamespace(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating HTTP namespace ${logicalId}`);
+		const client = this.getClient();
+		const name = properties["Name"];
+		const description = properties["Description"];
+		const tags = properties["Tags"];
+		if (!name) throw new ProvisioningError(`Name is required for HttpNamespace ${logicalId}`, resourceType, logicalId);
+		try {
+			const operationId = (await client.send(new CreateHttpNamespaceCommand({
+				Name: name,
+				...description && { Description: description },
+				...tags && tags.length > 0 && { Tags: tags }
+			}))).OperationId;
+			if (!operationId) throw new Error("CreateHttpNamespace did not return OperationId");
+			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType);
+			const arn = await this.resolveNamespaceArn(namespaceId);
+			this.logger.debug(`Successfully created HTTP namespace ${logicalId}: ${namespaceId}`);
+			return {
+				physicalId: namespaceId,
+				attributes: {
+					Id: namespaceId,
+					Arn: arn
+				}
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete private DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to create HTTP namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update an HTTP namespace.
+	*
+	* `UpdateHttpNamespace` exposes exactly one mutable field: `Description`
+	* (the SDK's `HttpNamespaceChange` shape). `Name` is createOnly — the
+	* replacement-detection layer routes a Name change through DELETE+CREATE
+	* before this method is ever called. Tags ride on the separate
+	* `TagResource` / `UntagResource` APIs (see {@link syncNamespaceTags}).
+	*
+	* Empty-string Description is intentionally allowed through
+	* (`!== undefined` gate, not truthy) so `cdkd drift --revert` can clear a
+	* console-side ADD.
+	*/
+	async updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating HTTP namespace ${logicalId}: ${physicalId}`);
+		const client = this.getClient();
+		try {
+			if (properties["Description"] !== void 0) {
+				const namespaceChange = { Description: properties["Description"] };
+				const operationId = (await client.send(new UpdateHttpNamespaceCommand({
+					Id: physicalId,
+					Namespace: namespaceChange
+				}))).OperationId;
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			}
+			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
+			this.logger.debug(`Successfully updated HTTP namespace ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update HTTP namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async createPublicDnsNamespace(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating public DNS namespace ${logicalId}`);
+		const client = this.getClient();
+		const name = properties["Name"];
+		const description = properties["Description"];
+		const tags = properties["Tags"];
+		if (!name) throw new ProvisioningError(`Name is required for PublicDnsNamespace ${logicalId}`, resourceType, logicalId);
+		const inputProperties = this.extractSoaTtlProperties(properties);
+		try {
+			const operationId = (await client.send(new CreatePublicDnsNamespaceCommand({
+				Name: name,
+				...description && { Description: description },
+				...tags && tags.length > 0 && { Tags: tags },
+				...inputProperties && { Properties: inputProperties }
+			}))).OperationId;
+			if (!operationId) throw new Error("CreatePublicDnsNamespace did not return OperationId");
+			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType);
+			let arn;
+			let hostedZoneId;
+			try {
+				const nsResp = await client.send(new GetNamespaceCommand({ Id: namespaceId }));
+				arn = nsResp.Namespace?.Arn;
+				hostedZoneId = nsResp.Namespace?.Properties?.DnsProperties?.HostedZoneId;
+			} catch (err) {
+				this.logger.debug(`GetNamespace(${namespaceId}) after create failed: ${err instanceof Error ? err.message : String(err)}`);
+			}
+			if (!arn) arn = await this.buildNamespaceArn(namespaceId);
+			this.logger.debug(`Successfully created public DNS namespace ${logicalId}: ${namespaceId}`);
+			return {
+				physicalId: namespaceId,
+				attributes: {
+					Id: namespaceId,
+					Arn: arn,
+					...hostedZoneId && { HostedZoneId: hostedZoneId }
+				}
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create public DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update a public DNS namespace.
+	*
+	* `UpdatePublicDnsNamespace` exposes two mutable surfaces (the SDK's
+	* `PublicDnsNamespaceChange` shape): `Description` and
+	* `Properties.DnsProperties.SOA.TTL`. `Name` is createOnly — replacement
+	* is routed through DELETE+CREATE upstream. Tags ride on the separate
+	* `TagResource` / `UntagResource` APIs (see {@link syncNamespaceTags}).
+	*/
+	async updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating public DNS namespace ${logicalId}: ${physicalId}`);
+		const client = this.getClient();
+		const namespaceChange = {};
+		if (properties["Description"] !== void 0) namespaceChange.Description = properties["Description"];
+		const soaProperties = this.extractSoaTtlProperties(properties);
+		if (soaProperties) namespaceChange.Properties = soaProperties;
+		try {
+			if (Object.keys(namespaceChange).length > 0) {
+				const operationId = (await client.send(new UpdatePublicDnsNamespaceCommand({
+					Id: physicalId,
+					Namespace: namespaceChange
+				}))).OperationId;
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			}
+			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
+			this.logger.debug(`Successfully updated public DNS namespace ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update public DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createService(logicalId, resourceType, properties) {
@@ -28186,6 +28361,59 @@ var ServiceDiscoveryProvider = class {
 		}
 	}
 	/**
+	* Extract the CFn `Properties.DnsProperties.SOA.TTL` nested field (the only
+	* mutable entry in the namespace `Properties` bag, shared by the private
+	* and public DNS namespace kinds) into the SDK's input shape. Returns
+	* `undefined` when the template does not set a TTL.
+	*/
+	extractSoaTtlProperties(properties) {
+		const soa = (properties["Properties"]?.["DnsProperties"])?.["SOA"];
+		return soa?.TTL !== void 0 ? { DnsProperties: { SOA: { TTL: Number(soa.TTL) } } } : void 0;
+	}
+	/**
+	* Resolve a namespace's ARN — authoritative via `GetNamespace`, with a
+	* deterministic STS-based construction as fallback so a transient read
+	* failure right after create does not fail the whole resource.
+	*/
+	async resolveNamespaceArn(namespaceId) {
+		try {
+			const resp = await this.getClient().send(new GetNamespaceCommand({ Id: namespaceId }));
+			if (resp.Namespace?.Arn) return resp.Namespace.Arn;
+		} catch (err) {
+			this.logger.debug(`GetNamespace(${namespaceId}) failed while resolving ARN: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		return this.buildNamespaceArn(namespaceId);
+	}
+	/**
+	* Diff-and-apply namespace tags via `TagResource` / `UntagResource`.
+	*
+	* `TagResource` is additive-only, so a tag dropped from the template
+	* (partial removal) — or the entire `Tags` property removed (full removal,
+	* `newTags === undefined`) — would survive on AWS unless we explicitly
+	* `UntagResource` the removed keys (the ECR #981 regression class).
+	* Failures THROW (never warn-swallow) so cdkd state is never written
+	* as-if-applied; the next deploy retries naturally.
+	*/
+	async syncNamespaceTags(logicalId, physicalId, properties, previousProperties) {
+		const newTags = properties["Tags"];
+		const oldTags = previousProperties["Tags"];
+		if (JSON.stringify(newTags) === JSON.stringify(oldTags)) return;
+		const newKeys = new Set((newTags ?? []).map((t) => t.Key).filter((k) => !!k));
+		const removedKeys = (oldTags ?? []).map((t) => t.Key).filter((k) => !!k && !newKeys.has(k));
+		const hasAdds = !!newTags && newTags.length > 0;
+		if (removedKeys.length === 0 && !hasAdds) return;
+		const arn = await this.resolveNamespaceArn(physicalId);
+		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$13({
+			ResourceARN: arn,
+			TagKeys: removedKeys
+		}));
+		if (hasAdds) await this.getClient().send(new TagResourceCommand$13({
+			ResourceARN: arn,
+			Tags: newTags
+		}));
+		this.logger.debug(`Updated tags for namespace ${logicalId} (${physicalId})`);
+	}
+	/**
 	* Poll a Service Discovery operation until it completes.
 	* Returns the target resource ID from the operation result.
 	*/
@@ -28208,6 +28436,44 @@ var ServiceDiscoveryProvider = class {
 		throw new ProvisioningError(`Operation timed out for ${logicalId} (operationId: ${operationId})`, resourceType, logicalId);
 	}
 	/**
+	* Resolve a `Fn::GetAtt` attribute live from AWS (used by `cdkd orphan`'s
+	* sibling-reference rewriting and other post-deploy attribute reads).
+	*
+	* Namespace kinds resolve `Id` / `Arn` (plus `HostedZoneId` for the DNS
+	* namespace kinds, read from `GetNamespace`'s
+	* `Properties.DnsProperties.HostedZoneId`); Services resolve `Id` / `Arn` /
+	* `Name` via `GetService`. Returns `undefined` for unknown attributes and
+	* for gone resources.
+	*/
+	async getAttribute(physicalId, resourceType, attributeName) {
+		switch (resourceType) {
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace":
+			case "AWS::ServiceDiscovery::HttpNamespace":
+			case "AWS::ServiceDiscovery::PublicDnsNamespace":
+				if (attributeName === "Id") return physicalId;
+				if (attributeName !== "Arn" && attributeName !== "HostedZoneId") return void 0;
+				try {
+					const resp = await this.getClient().send(new GetNamespaceCommand({ Id: physicalId }));
+					if (attributeName === "Arn") return resp.Namespace?.Arn;
+					return resp.Namespace?.Properties?.DnsProperties?.HostedZoneId;
+				} catch (err) {
+					if (err instanceof NamespaceNotFound) return void 0;
+					throw err;
+				}
+			case "AWS::ServiceDiscovery::Service":
+				if (attributeName === "Id") return physicalId;
+				if (attributeName !== "Arn" && attributeName !== "Name") return void 0;
+				try {
+					const resp = await this.getClient().send(new GetServiceCommand({ Id: physicalId }));
+					return attributeName === "Arn" ? resp.Service?.Arn : resp.Service?.Name;
+				} catch (err) {
+					if (err instanceof ServiceNotFound) return void 0;
+					throw err;
+				}
+			default: return;
+		}
+	}
+	/**
 	* Adopt an existing Cloud Map (Service Discovery) resource into cdkd state.
 	*
 	*  - **AWS::ServiceDiscovery::PrivateDnsNamespace**: tag-based auto-lookup
@@ -28241,7 +28507,9 @@ var ServiceDiscoveryProvider = class {
 	*/
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		switch (resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.readNamespace(physicalId);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace":
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.readNamespace(physicalId, { includeProperties: true });
+			case "AWS::ServiceDiscovery::HttpNamespace": return this.readNamespace(physicalId, { includeProperties: false });
 			case "AWS::ServiceDiscovery::Service": return this.readService(physicalId);
 			default: return;
 		}
@@ -28262,7 +28530,7 @@ var ServiceDiscoveryProvider = class {
 		if (resourceType === "AWS::ServiceDiscovery::PrivateDnsNamespace") return ["Vpc"];
 		return [];
 	}
-	async readNamespace(physicalId) {
+	async readNamespace(physicalId, options) {
 		let ns;
 		try {
 			ns = (await this.getClient().send(new GetNamespaceCommand({ Id: physicalId }))).Namespace;
@@ -28274,9 +28542,11 @@ var ServiceDiscoveryProvider = class {
 		const result = {};
 		if (ns.Name !== void 0) result["Name"] = ns.Name;
 		result["Description"] = ns.Description ?? "";
-		const soa = ns.Properties?.DnsProperties?.SOA;
-		if (soa?.TTL !== void 0) result["Properties"] = { DnsProperties: { SOA: { TTL: soa.TTL } } };
-		else result["Properties"] = {};
+		if (options.includeProperties) {
+			const soa = ns.Properties?.DnsProperties?.SOA;
+			if (soa?.TTL !== void 0) result["Properties"] = { DnsProperties: { SOA: { TTL: soa.TTL } } };
+			else result["Properties"] = {};
+		}
 		if (ns.Arn) await this.attachTags(result, ns.Arn);
 		return result;
 	}
@@ -28332,14 +28602,32 @@ var ServiceDiscoveryProvider = class {
 	}
 	async import(input) {
 		switch (input.resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.importNamespaceResource(input);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace":
+			case "AWS::ServiceDiscovery::HttpNamespace":
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.importNamespaceResource(input);
 			case "AWS::ServiceDiscovery::Service": return this.importServiceResource(input);
 			default: return null;
 		}
 	}
+	/**
+	* Map each namespace CFn type to its Cloud Map `Namespace.Type` value so
+	* the import walk never adopts a same-named namespace of a different kind
+	* (Cloud Map names are NOT unique across kinds; adopting the wrong one
+	* would make a later destroy delete the wrong resource).
+	*/
+	static NAMESPACE_KIND_BY_TYPE = {
+		"AWS::ServiceDiscovery::PrivateDnsNamespace": "DNS_PRIVATE",
+		"AWS::ServiceDiscovery::HttpNamespace": "HTTP",
+		"AWS::ServiceDiscovery::PublicDnsNamespace": "DNS_PUBLIC"
+	};
 	async importNamespaceResource(input) {
+		const expectedKind = ServiceDiscoveryProvider.NAMESPACE_KIND_BY_TYPE[input.resourceType];
 		if (input.knownPhysicalId) try {
-			await this.getClient().send(new GetNamespaceCommand({ Id: input.knownPhysicalId }));
+			const resp = await this.getClient().send(new GetNamespaceCommand({ Id: input.knownPhysicalId }));
+			if (expectedKind && resp.Namespace?.Type && resp.Namespace.Type !== expectedKind) {
+				this.logger.debug(`Namespace ${input.knownPhysicalId} is kind ${resp.Namespace.Type}, expected ${expectedKind} for ${input.resourceType} — refusing to adopt`);
+				return null;
+			}
 			return {
 				physicalId: input.knownPhysicalId,
 				attributes: {}
@@ -28354,6 +28642,7 @@ var ServiceDiscoveryProvider = class {
 			const list = await this.getClient().send(new ListNamespacesCommand({ ...token && { NextToken: token } }));
 			for (const ns of list.Namespaces ?? []) {
 				if (!ns.Id || !ns.Arn) continue;
+				if (expectedKind && ns.Type && ns.Type !== expectedKind) continue;
 				if (desiredName && ns.Name === desiredName) return {
 					physicalId: ns.Id,
 					attributes: {}
@@ -28780,7 +29069,7 @@ var AppSyncProvider = class {
 		const tagsToAdd = {};
 		for (const [k, v] of Object.entries(newMap)) if (oldMap[k] !== v) tagsToAdd[k] = v;
 		if (tagKeysToRemove.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$13({
+			await this.getClient().send(new UntagResourceCommand$14({
 				resourceArn: arn,
 				tagKeys: tagKeysToRemove
 			}));
@@ -28788,7 +29077,7 @@ var AppSyncProvider = class {
 			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi (untag)");
 		}
 		if (Object.keys(tagsToAdd).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$13({
+			await this.getClient().send(new TagResourceCommand$14({
 				resourceArn: arn,
 				tags: tagsToAdd
 			}));
@@ -31580,6 +31869,492 @@ var KMSProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/budgets-budget-provider.ts
+/**
+* SDK Provider for AWS::Budgets::Budget (issue #1041).
+*
+* The type is `ProvisioningType: NON_PROVISIONABLE`, so the Cloud Control
+* fallback cannot handle it — without this provider cdkd's pre-flight
+* rejects the type outright.
+*
+* **Global endpoint / region semantics**: the Budgets API is a global,
+* per-account service served from `us-east-1`. The `@aws-sdk/client-budgets`
+* endpoint ruleset resolves EVERY aws-partition region to the single global
+* endpoint (`budgets.amazonaws.com`, SigV4 scope `us-east-1`), so the client
+* below is deliberately created with the deploy region like every other
+* provider — the SDK itself pins the endpoint. This also keeps
+* `client.config.region()` equal to the deploy region, so the standard
+* `assertRegionMatch` idempotent-delete guard behaves exactly like it does
+* for regional services: a destroy run with a mismatched `--region` still
+* refuses to trust a NotFound. (For a global namespace a NotFound would
+* actually be trustworthy from any region, but keeping the guard uniform is
+* strictly safer and costs nothing.)
+*
+* **AccountId**: every Budgets API call requires the account id. It is
+* resolved once per provider instance via STS `GetCallerIdentity` (shared
+* `AwsClients.sts`) and cached as a single-flight promise for the deploy
+* lifetime; failed resolutions are not cached so a transient STS throttle
+* cannot poison the rest of the run (mirrors
+* `src/utils/expected-bucket-owner.ts`).
+*
+* **Physical id**: the budget NAME. `Budget.BudgetName` is createOnly —
+* a rename is classified as replacement by the `AWS::Budgets::Budget`
+* conditional rule in `src/analyzer/replacement-rules.ts`.
+*
+* **NotificationsWithSubscribers**: CloudFormation treats the whole property
+* as createOnly (replacement on any change). cdkd does better — `update()`
+* reconciles in place via CreateNotification / DeleteNotification /
+* CreateSubscriber / DeleteSubscriber, so alert history and the budget
+* itself survive a notification edit.
+*/
+var BudgetsBudgetProvider = class {
+	client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("BudgetsBudgetProvider");
+	accountIdPromise;
+	handledProperties = new Map([["AWS::Budgets::Budget", new Set([
+		"Budget",
+		"NotificationsWithSubscribers",
+		"ResourceTags"
+	])]]);
+	getClient() {
+		if (!this.client) this.client = new BudgetsClient(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.client;
+	}
+	/**
+	* Resolve the caller's AWS account id (required on every Budgets call).
+	* Cached per provider instance as a single-flight promise; a failed
+	* resolution is evicted so the next call retries instead of replaying a
+	* transient error for the rest of the deploy.
+	*/
+	resolveAccountId() {
+		if (!this.accountIdPromise) this.accountIdPromise = (async () => {
+			try {
+				const identity = await getAwsClients().sts.send(new GetCallerIdentityCommand({}));
+				if (!identity.Account) throw new Error("STS GetCallerIdentity returned no Account");
+				return identity.Account;
+			} catch (error) {
+				this.accountIdPromise = void 0;
+				throw error;
+			}
+		})();
+		return this.accountIdPromise;
+	}
+	/**
+	* Budget ARN for the tagging APIs (`ListTagsForResource` / `TagResource` /
+	* `UntagResource`). Budgets ARNs carry no region component. The `aws`
+	* partition is assumed — consistent with other providers that construct
+	* ARNs; non-`aws` partitions are not supported by cdkd today.
+	*/
+	budgetArn(accountId, budgetName) {
+		return `arn:aws:budgets::${accountId}:budget/${budgetName}`;
+	}
+	/**
+	* Convert a CFn `Spend` shape to the SDK shape. CFn templates carry
+	* `Amount` as a number (CDK synthesizes `budgetLimit: { amount: 10 }` to a
+	* numeric JSON value); the SDK wants a numeric string.
+	*/
+	toSdkSpend(raw) {
+		if (raw === void 0 || raw === null || typeof raw !== "object") return void 0;
+		const spend = raw;
+		const amount = spend["Amount"];
+		return {
+			Amount: typeof amount === "string" ? amount : typeof amount === "number" ? String(amount) : void 0,
+			Unit: spend["Unit"]
+		};
+	}
+	/**
+	* Convert a CFn `TimePeriod` `Start` / `End` value to a `Date`. CFn accepts
+	* a UTC date string (`2026-07-01T00:00:00Z`) or an epoch timestamp in
+	* seconds (possibly as a numeric string).
+	*/
+	toSdkDate(raw, field, logicalId, resourceType) {
+		let date;
+		if (typeof raw === "number") date = new Date(raw < 0xe8d4a51000 ? raw * 1e3 : raw);
+		else if (typeof raw === "string" && /^\d+$/.test(raw)) {
+			const num = Number(raw);
+			date = new Date(num < 0xe8d4a51000 ? num * 1e3 : num);
+		} else if (typeof raw === "string") date = new Date(raw);
+		else throw new ProvisioningError(`Invalid TimePeriod.${field} for budget ${logicalId}: expected a date string or epoch timestamp, got ${JSON.stringify(raw)}`, resourceType, logicalId);
+		if (Number.isNaN(date.getTime())) throw new ProvisioningError(`Invalid TimePeriod.${field} for budget ${logicalId}: ${JSON.stringify(raw)} is not a parseable date`, resourceType, logicalId);
+		return date;
+	}
+	/**
+	* Map the CFn `Budget` (BudgetData) property to the SDK `Budget` shape.
+	* The two are PascalCase-identical except: `BudgetLimit` /
+	* `PlannedBudgetLimits` amounts are numeric strings on the wire, and
+	* `TimePeriod.Start` / `.End` are `Date`s. `FilterExpression` / `Metrics` /
+	* `CostFilters` / `CostTypes` / `AutoAdjustData` pass through verbatim.
+	*/
+	toSdkBudget(raw, budgetName, logicalId, resourceType) {
+		if (raw === void 0 || raw === null || typeof raw !== "object") throw new ProvisioningError(`The Budget property is required for ${logicalId}`, resourceType, logicalId);
+		const src = raw;
+		const budget = {
+			...src,
+			BudgetName: budgetName
+		};
+		if (src["BudgetLimit"] !== void 0) budget["BudgetLimit"] = this.toSdkSpend(src["BudgetLimit"]);
+		if (src["PlannedBudgetLimits"] !== void 0 && typeof src["PlannedBudgetLimits"] === "object") {
+			const limits = {};
+			for (const [key, value] of Object.entries(src["PlannedBudgetLimits"])) limits[key] = this.toSdkSpend(value);
+			budget["PlannedBudgetLimits"] = limits;
+		}
+		if (src["TimePeriod"] !== void 0 && typeof src["TimePeriod"] === "object") {
+			const rawPeriod = src["TimePeriod"];
+			const period = {};
+			if (rawPeriod["Start"] !== void 0) period.Start = this.toSdkDate(rawPeriod["Start"], "Start", logicalId, resourceType);
+			if (rawPeriod["End"] !== void 0) period.End = this.toSdkDate(rawPeriod["End"], "End", logicalId, resourceType);
+			budget["TimePeriod"] = period;
+		}
+		return budget;
+	}
+	/** Normalize a CFn notification block to the SDK `Notification` shape. */
+	toSdkNotification(raw) {
+		return {
+			NotificationType: raw["NotificationType"],
+			ComparisonOperator: raw["ComparisonOperator"],
+			Threshold: raw["Threshold"] !== void 0 ? Number(raw["Threshold"]) : void 0,
+			...raw["ThresholdType"] !== void 0 && { ThresholdType: raw["ThresholdType"] }
+		};
+	}
+	/** Normalize a CFn subscriber block to the SDK `Subscriber` shape. */
+	toSdkSubscriber(raw) {
+		return {
+			SubscriptionType: raw["SubscriptionType"],
+			Address: raw["Address"]
+		};
+	}
+	/**
+	* Parse the CFn `NotificationsWithSubscribers` property into SDK shape.
+	* Tolerates absent / non-array values (returns `[]`).
+	*/
+	toSdkNotificationsWithSubscribers(raw) {
+		if (!Array.isArray(raw)) return [];
+		const out = [];
+		for (const item of raw) {
+			if (item === null || typeof item !== "object") continue;
+			const entry = item;
+			const notification = entry["Notification"];
+			const subscribers = entry["Subscribers"];
+			out.push({
+				Notification: notification && typeof notification === "object" ? this.toSdkNotification(notification) : void 0,
+				Subscribers: Array.isArray(subscribers) ? subscribers.filter((s) => s !== null && typeof s === "object").map((s) => this.toSdkSubscriber(s)) : void 0
+			});
+		}
+		return out;
+	}
+	/**
+	* Identity key for a notification. The Budgets API addresses notifications
+	* by their full value (there is no notification id), so the reconciler
+	* treats a change to any of these fields as delete-old + create-new.
+	* `ThresholdType` defaults to `PERCENTAGE` service-side — normalize the
+	* absent case so an explicit `PERCENTAGE` and an omitted one compare equal.
+	*/
+	notificationKey(n) {
+		return JSON.stringify([
+			n.NotificationType,
+			n.ComparisonOperator,
+			n.Threshold,
+			n.ThresholdType ?? "PERCENTAGE"
+		]);
+	}
+	/** Identity key for a subscriber. */
+	subscriberKey(s) {
+		return JSON.stringify([s.SubscriptionType, s.Address]);
+	}
+	/** Normalize the CFn `ResourceTags` property (`{Key,Value}[]`). */
+	toSdkResourceTags(raw) {
+		if (!Array.isArray(raw)) return [];
+		const out = [];
+		for (const item of raw) {
+			if (item === null || typeof item !== "object") continue;
+			const tag = item;
+			if (typeof tag["Key"] !== "string") continue;
+			const value = tag["Value"];
+			out.push({
+				Key: tag["Key"],
+				Value: typeof value === "string" ? value : typeof value === "number" || typeof value === "boolean" ? String(value) : ""
+			});
+		}
+		return out;
+	}
+	/**
+	* Create a budget via `CreateBudget` (a single call carries the budget,
+	* its notifications with subscribers, and resource tags — no post-create
+	* wiring to clean up on partial failure).
+	*/
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating budget ${logicalId}`);
+		const rawName = (properties["Budget"] ?? {})["BudgetName"];
+		const name = typeof rawName === "string" && rawName.length > 0 ? rawName : generateResourceName(logicalId, {
+			maxLength: 100,
+			allowedPattern: /[^a-zA-Z0-9\-_.]/g
+		});
+		try {
+			const accountId = await this.resolveAccountId();
+			const notifications = this.toSdkNotificationsWithSubscribers(properties["NotificationsWithSubscribers"]);
+			const resourceTags = this.toSdkResourceTags(properties["ResourceTags"]);
+			await this.getClient().send(new CreateBudgetCommand({
+				AccountId: accountId,
+				Budget: this.toSdkBudget(properties["Budget"], name, logicalId, resourceType),
+				...notifications.length > 0 && { NotificationsWithSubscribers: notifications },
+				...resourceTags.length > 0 && { ResourceTags: resourceTags }
+			}));
+			this.logger.debug(`Successfully created budget ${logicalId}: ${name}`);
+			return {
+				physicalId: name,
+				attributes: { Arn: this.budgetArn(accountId, name) }
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create budget ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update a budget: `UpdateBudget` for the budget definition, then
+	* reconcile `NotificationsWithSubscribers` in place (CloudFormation would
+	* replace the whole budget instead) and diff `ResourceTags`.
+	*/
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating budget ${logicalId}: ${physicalId}`);
+		try {
+			const accountId = await this.resolveAccountId();
+			await this.getClient().send(new UpdateBudgetCommand({
+				AccountId: accountId,
+				NewBudget: this.toSdkBudget(properties["Budget"], physicalId, logicalId, resourceType)
+			}));
+			await this.reconcileNotifications(accountId, physicalId, this.toSdkNotificationsWithSubscribers(previousProperties["NotificationsWithSubscribers"]), this.toSdkNotificationsWithSubscribers(properties["NotificationsWithSubscribers"]));
+			await this.reconcileResourceTags(accountId, physicalId, this.toSdkResourceTags(previousProperties["ResourceTags"]), this.toSdkResourceTags(properties["ResourceTags"]));
+			this.logger.debug(`Successfully updated budget ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: { Arn: this.budgetArn(accountId, physicalId) }
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update budget ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Send a reconciler DELETE call, treating `NotFoundException` as success.
+	* The reconciler must be idempotent: after a partial failure the deploy
+	* engine retries the update forward (re-deleting an already-deleted
+	* notification/subscriber) or rolls it back with the reversed diff
+	* (deleting a notification the forward pass never created) — both land
+	* here as NotFound and must not fail the recovery.
+	*/
+	async sendDeleteIdempotent(command, what) {
+		try {
+			await this.getClient().send(command);
+		} catch (error) {
+			if (error instanceof NotFoundException$5) {
+				this.logger.debug(`${what} already absent, skipping delete`);
+				return;
+			}
+			throw error;
+		}
+	}
+	/**
+	* Send a reconciler CREATE call, treating `DuplicateRecordException` as
+	* success — the retry/rollback twin of {@link sendDeleteIdempotent} for
+	* re-creating a notification/subscriber a previous partial pass already
+	* created.
+	*/
+	async sendCreateIdempotent(command, what) {
+		try {
+			await this.getClient().send(command);
+		} catch (error) {
+			if (error instanceof DuplicateRecordException) {
+				this.logger.debug(`${what} already exists, skipping create`);
+				return;
+			}
+			throw error;
+		}
+	}
+	/**
+	* Reconcile the notification set: delete removed notifications first
+	* (frees the 10-notifications-per-budget cap before additions), create
+	* added ones, then diff subscribers on retained notifications. Every
+	* step is idempotent (NotFound on delete / DuplicateRecord on create are
+	* success) so a partial failure can be retried forward or rolled back.
+	*/
+	async reconcileNotifications(accountId, budgetName, oldList, newList) {
+		const buildKeyed = (list, side) => {
+			const byKey = /* @__PURE__ */ new Map();
+			for (const nws of list) {
+				if (!nws.Notification) continue;
+				const key = this.notificationKey(nws.Notification);
+				if (byKey.has(key)) this.logger.warn(`Duplicate notification key ${key} in ${side} NotificationsWithSubscribers for budget ${budgetName}; the last entry's subscribers win`);
+				byKey.set(key, nws);
+			}
+			return byKey;
+		};
+		const oldByKey = buildKeyed(oldList, "previous");
+		const newByKey = buildKeyed(newList, "desired");
+		for (const [key, nws] of oldByKey) {
+			if (newByKey.has(key)) continue;
+			await this.sendDeleteIdempotent(new DeleteNotificationCommand({
+				AccountId: accountId,
+				BudgetName: budgetName,
+				Notification: nws.Notification
+			}), `Notification ${key} on budget ${budgetName}`);
+			this.logger.debug(`Deleted notification ${key} from budget ${budgetName}`);
+		}
+		for (const [key, nws] of newByKey) {
+			if (oldByKey.has(key)) continue;
+			await this.sendCreateIdempotent(new CreateNotificationCommand({
+				AccountId: accountId,
+				BudgetName: budgetName,
+				Notification: nws.Notification,
+				Subscribers: nws.Subscribers
+			}), `Notification ${key} on budget ${budgetName}`);
+			this.logger.debug(`Created notification ${key} on budget ${budgetName}`);
+		}
+		for (const [key, newNws] of newByKey) {
+			const oldNws = oldByKey.get(key);
+			if (!oldNws) continue;
+			const oldSubs = /* @__PURE__ */ new Map();
+			for (const s of oldNws.Subscribers ?? []) oldSubs.set(this.subscriberKey(s), s);
+			const newSubs = /* @__PURE__ */ new Map();
+			for (const s of newNws.Subscribers ?? []) newSubs.set(this.subscriberKey(s), s);
+			for (const [subKey, subscriber] of newSubs) {
+				if (oldSubs.has(subKey)) continue;
+				await this.sendCreateIdempotent(new CreateSubscriberCommand({
+					AccountId: accountId,
+					BudgetName: budgetName,
+					Notification: newNws.Notification,
+					Subscriber: subscriber
+				}), `Subscriber ${subKey} on notification ${key}`);
+				this.logger.debug(`Created subscriber ${subKey} on notification ${key}`);
+			}
+			for (const [subKey, subscriber] of oldSubs) {
+				if (newSubs.has(subKey)) continue;
+				await this.sendDeleteIdempotent(new DeleteSubscriberCommand({
+					AccountId: accountId,
+					BudgetName: budgetName,
+					Notification: newNws.Notification,
+					Subscriber: subscriber
+				}), `Subscriber ${subKey} on notification ${key}`);
+				this.logger.debug(`Deleted subscriber ${subKey} from notification ${key}`);
+			}
+		}
+	}
+	/** Diff `ResourceTags` via `UntagResource` (removed keys) + `TagResource` (upsert). */
+	async reconcileResourceTags(accountId, budgetName, oldTags, newTags) {
+		const sortedJson = (tags) => JSON.stringify([...tags].sort((a, b) => (a.Key ?? "").localeCompare(b.Key ?? "")));
+		if (sortedJson(oldTags) === sortedJson(newTags)) return;
+		const arn = this.budgetArn(accountId, budgetName);
+		const newKeys = new Set(newTags.map((t) => t.Key));
+		const removedKeys = oldTags.map((t) => t.Key).filter((k) => {
+			return typeof k === "string" && !newKeys.has(k);
+		});
+		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$15({
+			ResourceARN: arn,
+			ResourceTagKeys: removedKeys
+		}));
+		if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$15({
+			ResourceARN: arn,
+			ResourceTags: newTags
+		}));
+		this.logger.debug(`Updated resource tags for budget ${budgetName}`);
+	}
+	/**
+	* Delete a budget (`DeleteBudget` also deletes all of its notifications
+	* and subscribers). NotFound is idempotent success — after the standard
+	* region assertion (see the class doc for why the guard stays uniform
+	* even though the Budgets namespace is global).
+	*/
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(`Deleting budget ${logicalId}: ${physicalId}`);
+		try {
+			const accountId = await this.resolveAccountId();
+			await this.getClient().send(new DeleteBudgetCommand({
+				AccountId: accountId,
+				BudgetName: physicalId
+			}));
+			this.logger.debug(`Successfully deleted budget ${logicalId}`);
+		} catch (error) {
+			if (error instanceof NotFoundException$5) {
+				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`Budget ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete budget ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* `Fn::GetAtt` support. CloudFormation documents no attributes for
+	* `AWS::Budgets::Budget`; `Arn` is served as a cdkd convenience (computed
+	* — Budgets ARNs are `arn:aws:budgets::{account}:budget/{name}`, verified
+	* to exist via `DescribeBudget` first).
+	*/
+	async getAttribute(physicalId, resourceType, attributeName) {
+		if (attributeName !== "Arn") throw new ProvisioningError(`Unknown attribute ${attributeName} for ${resourceType}`, resourceType, physicalId);
+		try {
+			const accountId = await this.resolveAccountId();
+			await this.getClient().send(new DescribeBudgetCommand({
+				AccountId: accountId,
+				BudgetName: physicalId
+			}));
+			return this.budgetArn(accountId, physicalId);
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to resolve Arn for budget ${physicalId}: ${cause?.message ?? String(error)}`, resourceType, physicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Adopt an existing budget into cdkd state.
+	*
+	* Lookup order:
+	*  1. `--resource` override or `Properties.Budget.BudgetName` → verify via
+	*     `DescribeBudget`.
+	*  2. `aws:cdk:path` tag match: walk `DescribeBudgets` and check each
+	*     budget's tags via `ListTagsForResource` (budget ARNs are
+	*     region-free, so the lookup works from any deploy region).
+	*/
+	async import(input) {
+		const rawBudget = input.properties["Budget"] ?? {};
+		const explicit = input.knownPhysicalId ?? (typeof rawBudget["BudgetName"] === "string" && rawBudget["BudgetName"].length > 0 ? rawBudget["BudgetName"] : void 0);
+		const accountId = await this.resolveAccountId();
+		const client = this.getClient();
+		if (explicit) try {
+			await client.send(new DescribeBudgetCommand({
+				AccountId: accountId,
+				BudgetName: explicit
+			}));
+			return {
+				physicalId: explicit,
+				attributes: { Arn: this.budgetArn(accountId, explicit) }
+			};
+		} catch (error) {
+			if (error instanceof NotFoundException$5) return null;
+			throw error;
+		}
+		if (!input.cdkPath) return null;
+		let nextToken;
+		do {
+			const list = await client.send(new DescribeBudgetsCommand({
+				AccountId: accountId,
+				...nextToken && { NextToken: nextToken }
+			}));
+			for (const budget of list.Budgets ?? []) {
+				if (!budget.BudgetName) continue;
+				if (matchesCdkPath((await client.send(new ListTagsForResourceCommand$16({ ResourceARN: this.budgetArn(accountId, budget.BudgetName) }))).ResourceTags, input.cdkPath)) return {
+					physicalId: budget.BudgetName,
+					attributes: { Arn: this.budgetArn(accountId, budget.BudgetName) }
+				};
+			}
+			nextToken = list.NextToken;
+		} while (nextToken);
+		return null;
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/kinesis-provider.ts
 /**
@@ -32140,7 +32915,7 @@ var KinesisStreamConsumerProvider = class {
 		if (desc.ConsumerName !== void 0) result["ConsumerName"] = desc.ConsumerName;
 		if (desc.StreamARN !== void 0) result["StreamARN"] = desc.StreamARN;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: physicalId }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ ResourceARN: physicalId }))).Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$8) return void 0;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -32164,14 +32939,14 @@ var KinesisStreamConsumerProvider = class {
 		const tagsToRemove = [];
 		for (const k of Object.keys(oldMap)) if (!(k in newMap)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$14({
+			await this.getClient().send(new UntagResourceCommand$16({
 				ResourceARN: consumerArn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from Kinesis stream consumer ${consumerArn}`);
 		}
 		if (Object.keys(tagsToAdd).length > 0) {
-			await this.getClient().send(new TagResourceCommand$14({
+			await this.getClient().send(new TagResourceCommand$16({
 				ResourceARN: consumerArn,
 				Tags: tagsToAdd
 			}));
@@ -35322,11 +36097,11 @@ var CodeCommitRepositoryProvider = class {
 				const repoArn = metadata?.Arn;
 				if (repoArn) {
 					const removedKeys = Object.keys(oldTagMap).filter((k) => !(k in newTagMap));
-					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$15({
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$17({
 						resourceArn: repoArn,
 						tagKeys: removedKeys
 					}));
-					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$15({
+					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$17({
 						resourceArn: repoArn,
 						tags: newTagMap
 					}));
@@ -35433,7 +36208,7 @@ var CodeCommitRepositoryProvider = class {
 					throw err;
 				}
 				if (!metadata?.Arn) continue;
-				if ((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: metadata.Arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+				if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: metadata.Arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 					physicalId: repo.repositoryName,
 					attributes: this.toAttributes(metadata)
 				};
@@ -35583,7 +36358,7 @@ var DLMLifecyclePolicyProvider = class {
 			if (tagsChanged && arn) {
 				const removedKeys = Object.keys(oldTags).filter((k) => !(k in newTags));
 				if (removedKeys.length > 0) {
-					await this.getClient().send(new UntagResourceCommand$16({
+					await this.getClient().send(new UntagResourceCommand$18({
 						ResourceArn: arn,
 						TagKeys: removedKeys
 					}));
@@ -35592,7 +36367,7 @@ var DLMLifecyclePolicyProvider = class {
 				const tagsToAdd = {};
 				for (const [k, v] of Object.entries(newTags)) if (oldTags[k] !== v) tagsToAdd[k] = v;
 				if (Object.keys(tagsToAdd).length > 0) {
-					await this.getClient().send(new TagResourceCommand$16({
+					await this.getClient().send(new TagResourceCommand$18({
 						ResourceArn: arn,
 						Tags: tagsToAdd
 					}));
@@ -35795,11 +36570,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${physicalId}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$17({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$19({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$17({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$19({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -35927,7 +36702,7 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.vectorBucketArn }))).tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.vectorBucketArn }))).tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
@@ -35963,7 +36738,7 @@ var S3VectorsProvider = class {
 			for (const bucket of list.vectorBuckets ?? []) {
 				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) continue;
 				try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: bucket.vectorBucketName,
 						attributes: {}
 					};
@@ -36314,7 +37089,7 @@ var S3TablesProvider = class {
 			await this.getClient().send(new DeleteTableBucketCommand({ tableBucketARN: physicalId }));
 			this.logger.debug(`Successfully deleted S3 Table Bucket ${logicalId}`);
 		} catch (error) {
-			if (error instanceof NotFoundException$5) {
+			if (error instanceof NotFoundException$6) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`S3 Table Bucket ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -36355,7 +37130,7 @@ var S3TablesProvider = class {
 								name: table.name
 							}));
 						} catch (error) {
-							if (!(error instanceof NotFoundException$5)) throw error;
+							if (!(error instanceof NotFoundException$6)) throw error;
 						}
 					}
 					tableContinuationToken = tablesResult.continuationToken;
@@ -36367,7 +37142,7 @@ var S3TablesProvider = class {
 						namespace: namespaceName
 					}));
 				} catch (error) {
-					if (!(error instanceof NotFoundException$5)) throw error;
+					if (!(error instanceof NotFoundException$6)) throw error;
 				}
 			}
 			namespaceContinuationToken = namespacesResult.continuationToken;
@@ -36409,7 +37184,7 @@ var S3TablesProvider = class {
 			}));
 			this.logger.debug(`Successfully deleted S3 Tables Namespace ${logicalId}`);
 		} catch (error) {
-			if (error instanceof NotFoundException$5) {
+			if (error instanceof NotFoundException$6) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`S3 Tables Namespace ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -36483,7 +37258,7 @@ var S3TablesProvider = class {
 		try {
 			bucket = await this.getClient().send(new GetTableBucketCommand({ tableBucketARN: physicalId }));
 		} catch (err) {
-			if (err instanceof NotFoundException$5) return void 0;
+			if (err instanceof NotFoundException$6) return void 0;
 			throw err;
 		}
 		const result = {};
@@ -36512,7 +37287,7 @@ var S3TablesProvider = class {
 				name
 			}));
 		} catch (err) {
-			if (err instanceof NotFoundException$5) return void 0;
+			if (err instanceof NotFoundException$6) return void 0;
 			throw err;
 		}
 		const tableNameValue = resp.name ?? name;
@@ -36559,7 +37334,7 @@ var S3TablesProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof NotFoundException$5) return null;
+			if (err instanceof NotFoundException$6) return null;
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["TableBucketName"] === "string" ? input.properties["TableBucketName"] : void 0;
@@ -36573,12 +37348,12 @@ var S3TablesProvider = class {
 					attributes: {}
 				};
 				if (input.cdkPath) try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: bucket.arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: bucket.arn,
 						attributes: {}
 					};
 				} catch (err) {
-					if (err instanceof NotFoundException$5) continue;
+					if (err instanceof NotFoundException$6) continue;
 					throw err;
 				}
 			}
@@ -36607,7 +37382,7 @@ var S3TablesProvider = class {
 					attributes: {}
 				};
 			} catch (err) {
-				if (err instanceof NotFoundException$5) return null;
+				if (err instanceof NotFoundException$6) return null;
 				throw err;
 			}
 			return {
@@ -36640,12 +37415,12 @@ var S3TablesProvider = class {
 							for (const table of tables.tables ?? []) {
 								if (!table.name || !table.tableARN) continue;
 								try {
-									if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: table.tableARN }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+									if ((await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: table.tableARN }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 										physicalId: `${bucket.arn}|${namespaceName}|${table.name}`,
 										attributes: {}
 									};
 								} catch (err) {
-									if (err instanceof NotFoundException$5) continue;
+									if (err instanceof NotFoundException$6) continue;
 									throw err;
 								}
 							}
@@ -36674,7 +37449,7 @@ var S3TablesProvider = class {
 			}));
 			this.logger.debug(`Successfully deleted S3 Tables Table ${logicalId}`);
 		} catch (error) {
-			if (error instanceof NotFoundException$5) {
+			if (error instanceof NotFoundException$6) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`S3 Tables Table ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -36724,7 +37499,7 @@ var S3TablesProvider = class {
 				name
 			}))).tableARN ?? null;
 		} catch (err) {
-			if (err instanceof NotFoundException$5) return null;
+			if (err instanceof NotFoundException$6) return null;
 			throw err;
 		}
 	}
@@ -36736,7 +37511,7 @@ var S3TablesProvider = class {
 	*/
 	async readTagsBestEffort(resourceArn) {
 		try {
-			const tags = (await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn }))).tags ?? {};
+			const tags = (await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn }))).tags ?? {};
 			const out = [];
 			for (const [Key, Value] of Object.entries(tags)) out.push({
 				Key,
@@ -36790,7 +37565,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$18({
+			await this.getClient().send(new UntagResourceCommand$20({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -36799,7 +37574,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$18({
+			await this.getClient().send(new TagResourceCommand$20({
 				resourceArn,
 				tags: upserts
 			}));
@@ -36831,7 +37606,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$18({
+			await this.getClient().send(new UntagResourceCommand$20({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -36840,7 +37615,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$18({
+			await this.getClient().send(new TagResourceCommand$20({
 				resourceArn,
 				tags: upserts
 			}));
@@ -38457,6 +39232,8 @@ function registerAllProviders(registry) {
 	registry.register("AWS::ElastiCache::CacheCluster", elasticacheProvider);
 	const serviceDiscoveryProvider = new ServiceDiscoveryProvider();
 	registry.register("AWS::ServiceDiscovery::PrivateDnsNamespace", serviceDiscoveryProvider);
+	registry.register("AWS::ServiceDiscovery::HttpNamespace", serviceDiscoveryProvider);
+	registry.register("AWS::ServiceDiscovery::PublicDnsNamespace", serviceDiscoveryProvider);
 	registry.register("AWS::ServiceDiscovery::Service", serviceDiscoveryProvider);
 	registry.register("AWS::BedrockAgentCore::Runtime", new AgentCoreRuntimeProvider());
 	const appSyncProvider = new AppSyncProvider();
@@ -38496,6 +39273,7 @@ function registerAllProviders(registry) {
 	registry.register("AWS::S3Tables::TableBucket", s3TablesProvider);
 	registry.register("AWS::S3Tables::Namespace", s3TablesProvider);
 	registry.register("AWS::S3Tables::Table", s3TablesProvider);
+	registry.register("AWS::Budgets::Budget", new BudgetsBudgetProvider());
 	registry.register("AWS::CloudFormation::Stack", new NestedStackProvider());
 	registry.register("AWS::CloudFormation::WaitConditionHandle", new WaitConditionHandleProvider());
 }
@@ -57761,7 +58539,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.240.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.242.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());