@go-to-k/cdkd 0.241.0 → 0.242.0

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
 import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
-import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-BxXIBZoc.js";
+import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-7FfFEJkw.js";
 import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
 import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -51,21 +51,21 @@ import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, Delet
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
 import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreatePrivateDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, UpdatePrivateDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
-import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
+import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetDatabasesCommand, GetJobCommand, GetSecurityConfigurationCommand, GetSecurityConfigurationsCommand, GetTableCommand, GetTablesCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, ListWorkflowsCommand, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeBudgetsCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeBudgetsCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$1, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$1, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19 } from "@aws-sdk/client-s3tables";
+import { CodeCommitClient, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1888,7 +1888,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.241.0";
+	return "0.242.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -27885,34 +27885,53 @@ var ElastiCacheProvider = class {
 *
 * Implements resource provisioning for:
 * - AWS::ServiceDiscovery::PrivateDnsNamespace
+* - AWS::ServiceDiscovery::HttpNamespace
+* - AWS::ServiceDiscovery::PublicDnsNamespace
 * - AWS::ServiceDiscovery::Service
 *
-* WHY: CreatePrivateDnsNamespace is async (returns OperationId) but we handle
-* the polling ourselves, avoiding the CC API's generic polling overhead and
-* giving us direct control over the operation lifecycle.
+* WHY: the Create*Namespace APIs are async (they return an OperationId) but we
+* handle the polling ourselves, avoiding the CC API's generic polling overhead
+* and giving us direct control over the operation lifecycle. HttpNamespace and
+* PublicDnsNamespace are `ProvisioningType: NON_PROVISIONABLE`, so Cloud
+* Control cannot handle them at all — this SDK provider is the only route
+* (issue #1044).
 */
-var ServiceDiscoveryProvider = class {
+var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	client;
 	stsClient;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("ServiceDiscoveryProvider");
-	handledProperties = new Map([["AWS::ServiceDiscovery::PrivateDnsNamespace", new Set([
-		"Name",
-		"Vpc",
-		"Description",
-		"Tags",
-		"Properties"
-	])], ["AWS::ServiceDiscovery::Service", new Set([
-		"Name",
-		"NamespaceId",
-		"DnsConfig",
-		"HealthCheckCustomConfig",
-		"Description",
-		"HealthCheckConfig",
-		"Tags",
-		"Type",
-		"ServiceAttributes"
-	])]]);
+	handledProperties = new Map([
+		["AWS::ServiceDiscovery::PrivateDnsNamespace", new Set([
+			"Name",
+			"Vpc",
+			"Description",
+			"Tags",
+			"Properties"
+		])],
+		["AWS::ServiceDiscovery::HttpNamespace", new Set([
+			"Name",
+			"Description",
+			"Tags"
+		])],
+		["AWS::ServiceDiscovery::PublicDnsNamespace", new Set([
+			"Name",
+			"Description",
+			"Tags",
+			"Properties"
+		])],
+		["AWS::ServiceDiscovery::Service", new Set([
+			"Name",
+			"NamespaceId",
+			"DnsConfig",
+			"HealthCheckCustomConfig",
+			"Description",
+			"HealthCheckConfig",
+			"Tags",
+			"Type",
+			"ServiceAttributes"
+		])]
+	]);
 	getClient() {
 		if (!this.client) this.client = new ServiceDiscoveryClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -27924,20 +27943,26 @@ var ServiceDiscoveryProvider = class {
 	async create(logicalId, resourceType, properties) {
 		switch (resourceType) {
 			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.createNamespace(logicalId, resourceType, properties);
+			case "AWS::ServiceDiscovery::HttpNamespace": return this.createHttpNamespace(logicalId, resourceType, properties);
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.createPublicDnsNamespace(logicalId, resourceType, properties);
 			case "AWS::ServiceDiscovery::Service": return this.createService(logicalId, resourceType, properties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
 	update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		switch (resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.updateNamespace(logicalId, physicalId, resourceType, properties);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ServiceDiscovery::HttpNamespace": return this.updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::ServiceDiscovery::Service": return this.updateService(logicalId, physicalId, resourceType, properties, previousProperties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		switch (resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.deleteNamespace(logicalId, physicalId, resourceType, context);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace":
+			case "AWS::ServiceDiscovery::HttpNamespace":
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.deleteNamespace(logicalId, physicalId, resourceType, context);
 			case "AWS::ServiceDiscovery::Service": return this.deleteService(logicalId, physicalId, resourceType, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -27951,8 +27976,7 @@ var ServiceDiscoveryProvider = class {
 		const tags = properties["Tags"];
 		if (!name) throw new ProvisioningError(`Name is required for PrivateDnsNamespace ${logicalId}`, resourceType, logicalId);
 		if (!vpc) throw new ProvisioningError(`Vpc is required for PrivateDnsNamespace ${logicalId}`, resourceType, logicalId);
-		const soa = (properties["Properties"]?.["DnsProperties"])?.["SOA"];
-		const inputProperties = soa?.TTL !== void 0 ? { DnsProperties: { SOA: { TTL: Number(soa.TTL) } } } : void 0;
+		const inputProperties = this.extractSoaTtlProperties(properties);
 		try {
 			const operationId = (await client.send(new CreatePrivateDnsNamespaceCommand({
 				Name: name,
@@ -27988,30 +28012,29 @@ var ServiceDiscoveryProvider = class {
 	* `Name` and `Vpc` are immutable; the deploy engine's
 	* replacement-detection layer routes those through DELETE+CREATE
 	* before this method is ever called, so we do not validate them here.
+	* Tags ride on the separate `TagResource` / `UntagResource` APIs
+	* (see {@link syncNamespaceTags} — wired in with issue #1044 so a
+	* Tags-only change is no longer silently dropped, the ECR #981 class).
 	*
 	* Empty-string Description is intentionally allowed through (`!== undefined`
 	* gate, not truthy) so `cdkd drift --revert` can clear a console-side ADD.
 	*/
-	async updateNamespace(logicalId, physicalId, resourceType, properties) {
+	async updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating private DNS namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const namespaceChange = {};
 		if (properties["Description"] !== void 0) namespaceChange.Description = properties["Description"];
-		const soa = (properties["Properties"]?.["DnsProperties"])?.["SOA"];
-		if (soa?.TTL !== void 0) namespaceChange.Properties = { DnsProperties: { SOA: { TTL: Number(soa.TTL) } } };
-		if (Object.keys(namespaceChange).length === 0) {
-			this.logger.debug(`No mutable diff for PrivateDnsNamespace ${logicalId}, skipping update`);
-			return {
-				physicalId,
-				wasReplaced: false
-			};
-		}
+		const soaProperties = this.extractSoaTtlProperties(properties);
+		if (soaProperties) namespaceChange.Properties = soaProperties;
 		try {
-			const operationId = (await client.send(new UpdatePrivateDnsNamespaceCommand({
-				Id: physicalId,
-				Namespace: namespaceChange
-			}))).OperationId;
-			if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			if (Object.keys(namespaceChange).length > 0) {
+				const operationId = (await client.send(new UpdatePrivateDnsNamespaceCommand({
+					Id: physicalId,
+					Namespace: namespaceChange
+				}))).OperationId;
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			} else this.logger.debug(`No mutable namespace-body diff for PrivateDnsNamespace ${logicalId}`);
+			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
 			this.logger.debug(`Successfully updated private DNS namespace ${logicalId}`);
 			return {
 				physicalId,
@@ -28023,21 +28046,172 @@ var ServiceDiscoveryProvider = class {
 			throw new ProvisioningError(`Failed to update private DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	/**
+	* Delete a Cloud Map namespace (shared by PrivateDnsNamespace,
+	* HttpNamespace, and PublicDnsNamespace — `DeleteNamespace` is
+	* kind-agnostic and operation-based for all three).
+	*/
 	async deleteNamespace(logicalId, physicalId, resourceType, context) {
-		this.logger.debug(`Deleting private DNS namespace ${logicalId}: ${physicalId}`);
+		this.logger.debug(`Deleting Cloud Map namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		try {
 			const operationId = (await client.send(new DeleteNamespaceCommand({ Id: physicalId }))).OperationId;
 			if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
-			this.logger.debug(`Successfully deleted private DNS namespace ${logicalId}`);
+			this.logger.debug(`Successfully deleted Cloud Map namespace ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NamespaceNotFound) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Namespace ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete Cloud Map namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async createHttpNamespace(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating HTTP namespace ${logicalId}`);
+		const client = this.getClient();
+		const name = properties["Name"];
+		const description = properties["Description"];
+		const tags = properties["Tags"];
+		if (!name) throw new ProvisioningError(`Name is required for HttpNamespace ${logicalId}`, resourceType, logicalId);
+		try {
+			const operationId = (await client.send(new CreateHttpNamespaceCommand({
+				Name: name,
+				...description && { Description: description },
+				...tags && tags.length > 0 && { Tags: tags }
+			}))).OperationId;
+			if (!operationId) throw new Error("CreateHttpNamespace did not return OperationId");
+			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType);
+			const arn = await this.resolveNamespaceArn(namespaceId);
+			this.logger.debug(`Successfully created HTTP namespace ${logicalId}: ${namespaceId}`);
+			return {
+				physicalId: namespaceId,
+				attributes: {
+					Id: namespaceId,
+					Arn: arn
+				}
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create HTTP namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update an HTTP namespace.
+	*
+	* `UpdateHttpNamespace` exposes exactly one mutable field: `Description`
+	* (the SDK's `HttpNamespaceChange` shape). `Name` is createOnly — the
+	* replacement-detection layer routes a Name change through DELETE+CREATE
+	* before this method is ever called. Tags ride on the separate
+	* `TagResource` / `UntagResource` APIs (see {@link syncNamespaceTags}).
+	*
+	* Empty-string Description is intentionally allowed through
+	* (`!== undefined` gate, not truthy) so `cdkd drift --revert` can clear a
+	* console-side ADD.
+	*/
+	async updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating HTTP namespace ${logicalId}: ${physicalId}`);
+		const client = this.getClient();
+		try {
+			if (properties["Description"] !== void 0) {
+				const namespaceChange = { Description: properties["Description"] };
+				const operationId = (await client.send(new UpdateHttpNamespaceCommand({
+					Id: physicalId,
+					Namespace: namespaceChange
+				}))).OperationId;
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			}
+			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
+			this.logger.debug(`Successfully updated HTTP namespace ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete private DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update HTTP namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async createPublicDnsNamespace(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating public DNS namespace ${logicalId}`);
+		const client = this.getClient();
+		const name = properties["Name"];
+		const description = properties["Description"];
+		const tags = properties["Tags"];
+		if (!name) throw new ProvisioningError(`Name is required for PublicDnsNamespace ${logicalId}`, resourceType, logicalId);
+		const inputProperties = this.extractSoaTtlProperties(properties);
+		try {
+			const operationId = (await client.send(new CreatePublicDnsNamespaceCommand({
+				Name: name,
+				...description && { Description: description },
+				...tags && tags.length > 0 && { Tags: tags },
+				...inputProperties && { Properties: inputProperties }
+			}))).OperationId;
+			if (!operationId) throw new Error("CreatePublicDnsNamespace did not return OperationId");
+			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType);
+			let arn;
+			let hostedZoneId;
+			try {
+				const nsResp = await client.send(new GetNamespaceCommand({ Id: namespaceId }));
+				arn = nsResp.Namespace?.Arn;
+				hostedZoneId = nsResp.Namespace?.Properties?.DnsProperties?.HostedZoneId;
+			} catch (err) {
+				this.logger.debug(`GetNamespace(${namespaceId}) after create failed: ${err instanceof Error ? err.message : String(err)}`);
+			}
+			if (!arn) arn = await this.buildNamespaceArn(namespaceId);
+			this.logger.debug(`Successfully created public DNS namespace ${logicalId}: ${namespaceId}`);
+			return {
+				physicalId: namespaceId,
+				attributes: {
+					Id: namespaceId,
+					Arn: arn,
+					...hostedZoneId && { HostedZoneId: hostedZoneId }
+				}
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create public DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update a public DNS namespace.
+	*
+	* `UpdatePublicDnsNamespace` exposes two mutable surfaces (the SDK's
+	* `PublicDnsNamespaceChange` shape): `Description` and
+	* `Properties.DnsProperties.SOA.TTL`. `Name` is createOnly — replacement
+	* is routed through DELETE+CREATE upstream. Tags ride on the separate
+	* `TagResource` / `UntagResource` APIs (see {@link syncNamespaceTags}).
+	*/
+	async updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating public DNS namespace ${logicalId}: ${physicalId}`);
+		const client = this.getClient();
+		const namespaceChange = {};
+		if (properties["Description"] !== void 0) namespaceChange.Description = properties["Description"];
+		const soaProperties = this.extractSoaTtlProperties(properties);
+		if (soaProperties) namespaceChange.Properties = soaProperties;
+		try {
+			if (Object.keys(namespaceChange).length > 0) {
+				const operationId = (await client.send(new UpdatePublicDnsNamespaceCommand({
+					Id: physicalId,
+					Namespace: namespaceChange
+				}))).OperationId;
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			}
+			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
+			this.logger.debug(`Successfully updated public DNS namespace ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update public DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createService(logicalId, resourceType, properties) {
@@ -28187,6 +28361,59 @@ var ServiceDiscoveryProvider = class {
 		}
 	}
 	/**
+	* Extract the CFn `Properties.DnsProperties.SOA.TTL` nested field (the only
+	* mutable entry in the namespace `Properties` bag, shared by the private
+	* and public DNS namespace kinds) into the SDK's input shape. Returns
+	* `undefined` when the template does not set a TTL.
+	*/
+	extractSoaTtlProperties(properties) {
+		const soa = (properties["Properties"]?.["DnsProperties"])?.["SOA"];
+		return soa?.TTL !== void 0 ? { DnsProperties: { SOA: { TTL: Number(soa.TTL) } } } : void 0;
+	}
+	/**
+	* Resolve a namespace's ARN — authoritative via `GetNamespace`, with a
+	* deterministic STS-based construction as fallback so a transient read
+	* failure right after create does not fail the whole resource.
+	*/
+	async resolveNamespaceArn(namespaceId) {
+		try {
+			const resp = await this.getClient().send(new GetNamespaceCommand({ Id: namespaceId }));
+			if (resp.Namespace?.Arn) return resp.Namespace.Arn;
+		} catch (err) {
+			this.logger.debug(`GetNamespace(${namespaceId}) failed while resolving ARN: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		return this.buildNamespaceArn(namespaceId);
+	}
+	/**
+	* Diff-and-apply namespace tags via `TagResource` / `UntagResource`.
+	*
+	* `TagResource` is additive-only, so a tag dropped from the template
+	* (partial removal) — or the entire `Tags` property removed (full removal,
+	* `newTags === undefined`) — would survive on AWS unless we explicitly
+	* `UntagResource` the removed keys (the ECR #981 regression class).
+	* Failures THROW (never warn-swallow) so cdkd state is never written
+	* as-if-applied; the next deploy retries naturally.
+	*/
+	async syncNamespaceTags(logicalId, physicalId, properties, previousProperties) {
+		const newTags = properties["Tags"];
+		const oldTags = previousProperties["Tags"];
+		if (JSON.stringify(newTags) === JSON.stringify(oldTags)) return;
+		const newKeys = new Set((newTags ?? []).map((t) => t.Key).filter((k) => !!k));
+		const removedKeys = (oldTags ?? []).map((t) => t.Key).filter((k) => !!k && !newKeys.has(k));
+		const hasAdds = !!newTags && newTags.length > 0;
+		if (removedKeys.length === 0 && !hasAdds) return;
+		const arn = await this.resolveNamespaceArn(physicalId);
+		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$13({
+			ResourceARN: arn,
+			TagKeys: removedKeys
+		}));
+		if (hasAdds) await this.getClient().send(new TagResourceCommand$13({
+			ResourceARN: arn,
+			Tags: newTags
+		}));
+		this.logger.debug(`Updated tags for namespace ${logicalId} (${physicalId})`);
+	}
+	/**
 	* Poll a Service Discovery operation until it completes.
 	* Returns the target resource ID from the operation result.
 	*/
@@ -28209,6 +28436,44 @@ var ServiceDiscoveryProvider = class {
 		throw new ProvisioningError(`Operation timed out for ${logicalId} (operationId: ${operationId})`, resourceType, logicalId);
 	}
 	/**
+	* Resolve a `Fn::GetAtt` attribute live from AWS (used by `cdkd orphan`'s
+	* sibling-reference rewriting and other post-deploy attribute reads).
+	*
+	* Namespace kinds resolve `Id` / `Arn` (plus `HostedZoneId` for the DNS
+	* namespace kinds, read from `GetNamespace`'s
+	* `Properties.DnsProperties.HostedZoneId`); Services resolve `Id` / `Arn` /
+	* `Name` via `GetService`. Returns `undefined` for unknown attributes and
+	* for gone resources.
+	*/
+	async getAttribute(physicalId, resourceType, attributeName) {
+		switch (resourceType) {
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace":
+			case "AWS::ServiceDiscovery::HttpNamespace":
+			case "AWS::ServiceDiscovery::PublicDnsNamespace":
+				if (attributeName === "Id") return physicalId;
+				if (attributeName !== "Arn" && attributeName !== "HostedZoneId") return void 0;
+				try {
+					const resp = await this.getClient().send(new GetNamespaceCommand({ Id: physicalId }));
+					if (attributeName === "Arn") return resp.Namespace?.Arn;
+					return resp.Namespace?.Properties?.DnsProperties?.HostedZoneId;
+				} catch (err) {
+					if (err instanceof NamespaceNotFound) return void 0;
+					throw err;
+				}
+			case "AWS::ServiceDiscovery::Service":
+				if (attributeName === "Id") return physicalId;
+				if (attributeName !== "Arn" && attributeName !== "Name") return void 0;
+				try {
+					const resp = await this.getClient().send(new GetServiceCommand({ Id: physicalId }));
+					return attributeName === "Arn" ? resp.Service?.Arn : resp.Service?.Name;
+				} catch (err) {
+					if (err instanceof ServiceNotFound) return void 0;
+					throw err;
+				}
+			default: return;
+		}
+	}
+	/**
 	* Adopt an existing Cloud Map (Service Discovery) resource into cdkd state.
 	*
 	*  - **AWS::ServiceDiscovery::PrivateDnsNamespace**: tag-based auto-lookup
@@ -28242,7 +28507,9 @@ var ServiceDiscoveryProvider = class {
 	*/
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		switch (resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.readNamespace(physicalId);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace":
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.readNamespace(physicalId, { includeProperties: true });
+			case "AWS::ServiceDiscovery::HttpNamespace": return this.readNamespace(physicalId, { includeProperties: false });
 			case "AWS::ServiceDiscovery::Service": return this.readService(physicalId);
 			default: return;
 		}
@@ -28263,7 +28530,7 @@ var ServiceDiscoveryProvider = class {
 		if (resourceType === "AWS::ServiceDiscovery::PrivateDnsNamespace") return ["Vpc"];
 		return [];
 	}
-	async readNamespace(physicalId) {
+	async readNamespace(physicalId, options) {
 		let ns;
 		try {
 			ns = (await this.getClient().send(new GetNamespaceCommand({ Id: physicalId }))).Namespace;
@@ -28275,9 +28542,11 @@ var ServiceDiscoveryProvider = class {
 		const result = {};
 		if (ns.Name !== void 0) result["Name"] = ns.Name;
 		result["Description"] = ns.Description ?? "";
-		const soa = ns.Properties?.DnsProperties?.SOA;
-		if (soa?.TTL !== void 0) result["Properties"] = { DnsProperties: { SOA: { TTL: soa.TTL } } };
-		else result["Properties"] = {};
+		if (options.includeProperties) {
+			const soa = ns.Properties?.DnsProperties?.SOA;
+			if (soa?.TTL !== void 0) result["Properties"] = { DnsProperties: { SOA: { TTL: soa.TTL } } };
+			else result["Properties"] = {};
+		}
 		if (ns.Arn) await this.attachTags(result, ns.Arn);
 		return result;
 	}
@@ -28333,14 +28602,32 @@ var ServiceDiscoveryProvider = class {
 	}
 	async import(input) {
 		switch (input.resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.importNamespaceResource(input);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace":
+			case "AWS::ServiceDiscovery::HttpNamespace":
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.importNamespaceResource(input);
 			case "AWS::ServiceDiscovery::Service": return this.importServiceResource(input);
 			default: return null;
 		}
 	}
+	/**
+	* Map each namespace CFn type to its Cloud Map `Namespace.Type` value so
+	* the import walk never adopts a same-named namespace of a different kind
+	* (Cloud Map names are NOT unique across kinds; adopting the wrong one
+	* would make a later destroy delete the wrong resource).
+	*/
+	static NAMESPACE_KIND_BY_TYPE = {
+		"AWS::ServiceDiscovery::PrivateDnsNamespace": "DNS_PRIVATE",
+		"AWS::ServiceDiscovery::HttpNamespace": "HTTP",
+		"AWS::ServiceDiscovery::PublicDnsNamespace": "DNS_PUBLIC"
+	};
 	async importNamespaceResource(input) {
+		const expectedKind = ServiceDiscoveryProvider.NAMESPACE_KIND_BY_TYPE[input.resourceType];
 		if (input.knownPhysicalId) try {
-			await this.getClient().send(new GetNamespaceCommand({ Id: input.knownPhysicalId }));
+			const resp = await this.getClient().send(new GetNamespaceCommand({ Id: input.knownPhysicalId }));
+			if (expectedKind && resp.Namespace?.Type && resp.Namespace.Type !== expectedKind) {
+				this.logger.debug(`Namespace ${input.knownPhysicalId} is kind ${resp.Namespace.Type}, expected ${expectedKind} for ${input.resourceType} — refusing to adopt`);
+				return null;
+			}
 			return {
 				physicalId: input.knownPhysicalId,
 				attributes: {}
@@ -28355,6 +28642,7 @@ var ServiceDiscoveryProvider = class {
 			const list = await this.getClient().send(new ListNamespacesCommand({ ...token && { NextToken: token } }));
 			for (const ns of list.Namespaces ?? []) {
 				if (!ns.Id || !ns.Arn) continue;
+				if (expectedKind && ns.Type && ns.Type !== expectedKind) continue;
 				if (desiredName && ns.Name === desiredName) return {
 					physicalId: ns.Id,
 					attributes: {}
@@ -28781,7 +29069,7 @@ var AppSyncProvider = class {
 		const tagsToAdd = {};
 		for (const [k, v] of Object.entries(newMap)) if (oldMap[k] !== v) tagsToAdd[k] = v;
 		if (tagKeysToRemove.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$13({
+			await this.getClient().send(new UntagResourceCommand$14({
 				resourceArn: arn,
 				tagKeys: tagKeysToRemove
 			}));
@@ -28789,7 +29077,7 @@ var AppSyncProvider = class {
 			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi (untag)");
 		}
 		if (Object.keys(tagsToAdd).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$13({
+			await this.getClient().send(new TagResourceCommand$14({
 				resourceArn: arn,
 				tags: tagsToAdd
 			}));
@@ -31964,11 +32252,11 @@ var BudgetsBudgetProvider = class {
 		const removedKeys = oldTags.map((t) => t.Key).filter((k) => {
 			return typeof k === "string" && !newKeys.has(k);
 		});
-		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$14({
+		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$15({
 			ResourceARN: arn,
 			ResourceTagKeys: removedKeys
 		}));
-		if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$14({
+		if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$15({
 			ResourceARN: arn,
 			ResourceTags: newTags
 		}));
@@ -32651,14 +32939,14 @@ var KinesisStreamConsumerProvider = class {
 		const tagsToRemove = [];
 		for (const k of Object.keys(oldMap)) if (!(k in newMap)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$15({
+			await this.getClient().send(new UntagResourceCommand$16({
 				ResourceARN: consumerArn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from Kinesis stream consumer ${consumerArn}`);
 		}
 		if (Object.keys(tagsToAdd).length > 0) {
-			await this.getClient().send(new TagResourceCommand$15({
+			await this.getClient().send(new TagResourceCommand$16({
 				ResourceARN: consumerArn,
 				Tags: tagsToAdd
 			}));
@@ -35809,11 +36097,11 @@ var CodeCommitRepositoryProvider = class {
 				const repoArn = metadata?.Arn;
 				if (repoArn) {
 					const removedKeys = Object.keys(oldTagMap).filter((k) => !(k in newTagMap));
-					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$16({
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$17({
 						resourceArn: repoArn,
 						tagKeys: removedKeys
 					}));
-					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$16({
+					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$17({
 						resourceArn: repoArn,
 						tags: newTagMap
 					}));
@@ -36070,7 +36358,7 @@ var DLMLifecyclePolicyProvider = class {
 			if (tagsChanged && arn) {
 				const removedKeys = Object.keys(oldTags).filter((k) => !(k in newTags));
 				if (removedKeys.length > 0) {
-					await this.getClient().send(new UntagResourceCommand$17({
+					await this.getClient().send(new UntagResourceCommand$18({
 						ResourceArn: arn,
 						TagKeys: removedKeys
 					}));
@@ -36079,7 +36367,7 @@ var DLMLifecyclePolicyProvider = class {
 				const tagsToAdd = {};
 				for (const [k, v] of Object.entries(newTags)) if (oldTags[k] !== v) tagsToAdd[k] = v;
 				if (Object.keys(tagsToAdd).length > 0) {
-					await this.getClient().send(new TagResourceCommand$17({
+					await this.getClient().send(new TagResourceCommand$18({
 						ResourceArn: arn,
 						Tags: tagsToAdd
 					}));
@@ -36282,11 +36570,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${physicalId}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$18({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$19({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$18({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$19({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -37277,7 +37565,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$19({
+			await this.getClient().send(new UntagResourceCommand$20({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -37286,7 +37574,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$19({
+			await this.getClient().send(new TagResourceCommand$20({
 				resourceArn,
 				tags: upserts
 			}));
@@ -37318,7 +37606,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$19({
+			await this.getClient().send(new UntagResourceCommand$20({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -37327,7 +37615,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$19({
+			await this.getClient().send(new TagResourceCommand$20({
 				resourceArn,
 				tags: upserts
 			}));
@@ -38944,6 +39232,8 @@ function registerAllProviders(registry) {
 	registry.register("AWS::ElastiCache::CacheCluster", elasticacheProvider);
 	const serviceDiscoveryProvider = new ServiceDiscoveryProvider();
 	registry.register("AWS::ServiceDiscovery::PrivateDnsNamespace", serviceDiscoveryProvider);
+	registry.register("AWS::ServiceDiscovery::HttpNamespace", serviceDiscoveryProvider);
+	registry.register("AWS::ServiceDiscovery::PublicDnsNamespace", serviceDiscoveryProvider);
 	registry.register("AWS::ServiceDiscovery::Service", serviceDiscoveryProvider);
 	registry.register("AWS::BedrockAgentCore::Runtime", new AgentCoreRuntimeProvider());
 	const appSyncProvider = new AppSyncProvider();
@@ -58249,7 +58539,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.241.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.242.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());