@go-to-k/cdkd 0.241.0 → 0.243.0

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
 import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
-import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-BxXIBZoc.js";
+import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-DNqZHDA5.js";
 import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
 import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -23,7 +23,7 @@ import { AddTagsToResourceCommand, DeleteParameterCommand, DescribeParametersCom
 import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, ListDistributionsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand } from "@aws-sdk/client-cloudfront";
 import { CloudWatchClient, DeleteAlarmsCommand, DescribeAlarmsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$4, PutMetricAlarmCommand, TagResourceCommand as TagResourceCommand$7, UntagResourceCommand as UntagResourceCommand$7 } from "@aws-sdk/client-cloudwatch";
 import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
-import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, DeleteAgentRuntimeCommand, GetAgentRuntimeCommand, ResourceNotFoundException as ResourceNotFoundException$5, UpdateAgentRuntimeCommand } from "@aws-sdk/client-bedrock-agentcore-control";
+import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
 import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListCertificatesCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$6, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
 import * as fs from "node:fs";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -31,14 +31,14 @@ import * as path from "node:path";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
-import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListHostedZonesCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
+import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListHostedZonesCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$7, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand } from "@aws-sdk/client-elastic-load-balancing-v2";
-import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
+import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
-import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$7, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10 } from "@aws-sdk/client-ecr";
+import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$8, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11 } from "@aws-sdk/client-ecr";
 import graphlib from "graphlib";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBProxyCommand, CreateDBProxyEndpointCommand, CreateDBSubnetGroupCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeleteDBSubnetGroupCommand, DeregisterDBProxyTargetsCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, ModifyDBSubnetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-rds";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$9, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-elasticache";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBProxyCommand, CreateDBProxyEndpointCommand, CreateDBSubnetGroupCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeleteDBSubnetGroupCommand, DeregisterDBProxyTargetsCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$9, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, ModifyDBSubnetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-rds";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-elasticache";
 import { Command, Option } from "commander";
 import * as readline$1 from "node:readline/promises";
 import readline from "node:readline/promises";
@@ -46,26 +46,26 @@ import { writeFileSync as writeFileSync$1 } from "fs";
 import * as zlib from "node:zlib";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
-import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListStateMachinesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$10, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
-import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListClustersCommand, ListServicesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
-import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreatePrivateDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, UpdatePrivateDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
-import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
+import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListStateMachinesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
+import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListClustersCommand, ListServicesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$12, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetDatabasesCommand, GetJobCommand, GetSecurityConfigurationCommand, GetSecurityConfigurationsCommand, GetTableCommand, GetTablesCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, ListWorkflowsCommand, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeBudgetsCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeBudgetsCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$17, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$1, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$1, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19 } from "@aws-sdk/client-s3tables";
+import { CodeCommitClient, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$21, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1888,7 +1888,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.241.0";
+	return "0.243.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -20364,37 +20364,43 @@ var CloudFrontDistributionProvider = class {
 };
 
 //#endregion
-//#region src/provisioning/providers/agentcore-runtime-provider.ts
+//#region src/provisioning/providers/agentcore-case-convert.ts
 /**
-* SDK Provider for AWS::BedrockAgentCore::Runtime
+* PascalCase <-> camelCase key conversion helpers shared by the
+* BedrockAgentCore SDK Providers (`agentcore-runtime-provider.ts`,
+* `agentcore-browser-provider.ts`, `agentcore-code-interpreter-provider.ts`,
+* `agentcore-evaluator-provider.ts`).
 *
-* Uses direct SDK calls instead of Cloud Control API because:
-* 1. CC API CREATE is async - it returns IN_PROGRESS, then polls for completion
-* 2. IAM role propagation to BedrockAgentCore is very slow (30-60+ seconds)
-* 3. When CC API polling returns FAILED (role validation), cdkd retries CREATE
-* 4. But the first CREATE actually succeeded asynchronously in the background
-* 5. The retry then fails with "already exists"
-* 6. CC API ClientToken caches the failure result, making it worse
+* CloudFormation templates carry PascalCase property keys while the
+* `bedrock-agentcore-control` SDK expects camelCase input shapes (and
+* returns camelCase output shapes). The BedrockAgentCore CFn schemas mirror
+* the SDK shapes 1:1 modulo casing, so a mechanical first-letter case flip
+* round-trips cleanly — including union members (`LlmAsAJudge` <->
+* `llmAsAJudge`, `CodeBased` <-> `codeBased`).
 *
-* With direct SDK calls, we can:
-* - Call CreateAgentRuntime synchronously
-* - Get immediate error responses for IAM propagation issues
-* - Retry with proper exponential backoff
-* - Avoid the async CREATE + polling + retry conflict
+* `preserveKeys` opts specific keys out of DEEP conversion: the key itself
+* is still case-flipped, but its VALUE subtree is copied verbatim. Needed
+* for free-form JSON document properties whose inner keys are user-defined
+* model/request fields, NOT CFn property names — e.g. the Evaluator's
+* `AdditionalModelRequestFields` (model-specific request fields like
+* `top_k` that must reach the service byte-identical).
 */
 /**
 * Recursively convert PascalCase object keys to camelCase.
 * Only converts keys of plain objects; string values, arrays of strings,
 * and other primitives are left untouched.
+*
+* @param preserveKeys - PascalCase key names whose value subtree is copied
+*   verbatim (the key itself is still converted to camelCase).
 */
-function pascalToCamelCaseKeys(value) {
+function pascalToCamelCaseKeys(value, preserveKeys) {
 	if (value === null || value === void 0) return value;
-	if (Array.isArray(value)) return value.map(pascalToCamelCaseKeys);
+	if (Array.isArray(value)) return value.map((item) => pascalToCamelCaseKeys(item, preserveKeys));
 	if (typeof value === "object") {
 		const result = {};
 		for (const [key, val] of Object.entries(value)) {
 			const camelKey = key.charAt(0).toLowerCase() + key.slice(1);
-			result[camelKey] = pascalToCamelCaseKeys(val);
+			result[camelKey] = preserveKeys?.has(key) ? val : pascalToCamelCaseKeys(val, preserveKeys);
 		}
 		return result;
 	}
@@ -20402,22 +20408,46 @@ function pascalToCamelCaseKeys(value) {
 }
 /**
 * Recursively convert camelCase object keys to PascalCase. Inverse of
-* `pascalToCamelCaseKeys`. Used by `readCurrentState` to re-shape AWS
-* SDK responses back into the CFn property names cdkd state stores.
+* `pascalToCamelCaseKeys`. Used by `readCurrentState` implementations to
+* re-shape AWS SDK responses back into the CFn property names cdkd state
+* stores.
+*
+* @param preserveKeys - camelCase key names whose value subtree is copied
+*   verbatim (the key itself is still converted to PascalCase).
 */
-function camelToPascalCaseKeys(value) {
+function camelToPascalCaseKeys(value, preserveKeys) {
 	if (value === null || value === void 0) return value;
-	if (Array.isArray(value)) return value.map(camelToPascalCaseKeys);
+	if (Array.isArray(value)) return value.map((item) => camelToPascalCaseKeys(item, preserveKeys));
 	if (typeof value === "object") {
 		const result = {};
 		for (const [key, val] of Object.entries(value)) {
 			const pascalKey = key.charAt(0).toUpperCase() + key.slice(1);
-			result[pascalKey] = camelToPascalCaseKeys(val);
+			result[pascalKey] = preserveKeys?.has(key) ? val : camelToPascalCaseKeys(val, preserveKeys);
 		}
 		return result;
 	}
 	return value;
 }
+
+//#endregion
+//#region src/provisioning/providers/agentcore-runtime-provider.ts
+/**
+* SDK Provider for AWS::BedrockAgentCore::Runtime
+*
+* Uses direct SDK calls instead of Cloud Control API because:
+* 1. CC API CREATE is async - it returns IN_PROGRESS, then polls for completion
+* 2. IAM role propagation to BedrockAgentCore is very slow (30-60+ seconds)
+* 3. When CC API polling returns FAILED (role validation), cdkd retries CREATE
+* 4. But the first CREATE actually succeeded asynchronously in the background
+* 5. The retry then fails with "already exists"
+* 6. CC API ClientToken caches the failure result, making it worse
+*
+* With direct SDK calls, we can:
+* - Call CreateAgentRuntime synchronously
+* - Get immediate error responses for IAM propagation issues
+* - Retry with proper exponential backoff
+* - Avoid the async CREATE + polling + retry conflict
+*/
 /**
 * AWS BedrockAgentCore Runtime Provider
 *
@@ -20627,6 +20657,502 @@ var AgentCoreRuntimeProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/agentcore-browser-provider.ts
+/**
+* SDK Provider for AWS::BedrockAgentCore::Browser (adopt-only singleton).
+*
+* The CloudFormation registry schema declares this type as a READ-ONLY
+* resource "representing the default service-managed browser"
+* (`aws.browser.v1`): every schema property (`BrowserArn` / `BrowserId` /
+* `Name` / `Status`) is read-only, the only handlers are read/list, and the
+* `BrowserId` pattern is hard-locked to `^aws\.browser\.v1$`. The registry
+* marks it `NON_PROVISIONABLE`, so Cloud Control cannot deploy it and cdkd's
+* pre-flight used to reject it (issue #1038).
+*
+* cdkd therefore provisions it as an ADOPT operation, not a create:
+* - `create` verifies the AWS-managed default browser exists in the deploy
+*   region via `GetBrowser` and records its ARN as the physical id (the
+*   type's primaryIdentifier, matching CFn `Ref` semantics).
+* - `update` is a no-op (no writable properties exist).
+* - `delete` is a no-op — the default browser is AWS-owned and must never
+*   be deleted when a stack is destroyed.
+* - `getAttribute` serves the read-only attributes live from `GetBrowser`.
+*
+* Custom, user-created browsers are a DIFFERENT CFn type
+* (`AWS::BedrockAgentCore::BrowserCustom`, FULLY_MUTABLE) which Cloud
+* Control handles; the `CreateBrowser` / `DeleteBrowser` control-plane ops
+* belong to that type's lifecycle, not this one's.
+*/
+/** The only valid browser id for this type per the CFn schema pattern. */
+const DEFAULT_BROWSER_ID = "aws.browser.v1";
+/**
+* AWS BedrockAgentCore default-Browser Provider (adopt-only).
+*/
+var AgentCoreBrowserProvider = class {
+	client;
+	logger = getLogger().child("AgentCoreBrowserProvider");
+	handledProperties = new Map([["AWS::BedrockAgentCore::Browser", /* @__PURE__ */ new Set([])]]);
+	constructor() {
+		const awsClients = getAwsClients();
+		this.client = awsClients.bedrockAgentCoreControl;
+	}
+	/**
+	* "Create" = adopt the AWS-managed default browser: verify it exists in
+	* the deploy region and record its ARN (the CFn primaryIdentifier) as the
+	* physical id. Nothing is created in AWS.
+	*/
+	async create(logicalId, resourceType, _properties) {
+		this.logger.debug(`Adopting AWS-managed default browser for ${logicalId}`);
+		try {
+			const response = await this.client.send(new GetBrowserCommand({ browserId: DEFAULT_BROWSER_ID }));
+			const browserArn = response.browserArn;
+			this.logger.debug(`Adopted default browser ${DEFAULT_BROWSER_ID} (${browserArn})`);
+			return {
+				physicalId: browserArn,
+				attributes: {
+					BrowserArn: browserArn,
+					BrowserId: response.browserId ?? "aws.browser.v1",
+					Name: response.name ?? "",
+					Status: response.status ?? ""
+				}
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to adopt the AWS-managed default browser for ${logicalId}: ${error instanceof Error ? error.message : String(error)}. Bedrock AgentCore may not be available in this region.`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Every property on this type is read-only, so there is nothing to
+	* update — keep the existing physical id.
+	*/
+	async update(logicalId, physicalId, _resourceType, _properties, _previousProperties) {
+		this.logger.debug(`No-op update for default browser ${logicalId}`);
+		return {
+			physicalId,
+			wasReplaced: false,
+			attributes: {}
+		};
+	}
+	/**
+	* The default browser is AWS-owned; destroying a stack must never delete
+	* it. Pure no-op.
+	*/
+	async delete(logicalId, _physicalId, _resourceType) {
+		this.logger.debug(`No-op delete for AWS-managed default browser ${logicalId}`);
+	}
+	/**
+	* Get resource attribute (for Fn::GetAtt resolution). The CFn read-only
+	* attribute set is BrowserArn / BrowserId / Name / Status.
+	*/
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "BrowserArn") return physicalId;
+		if (attributeName === "BrowserId") return DEFAULT_BROWSER_ID;
+		if (attributeName === "Name" || attributeName === "Status") {
+			const response = await this.client.send(new GetBrowserCommand({ browserId: DEFAULT_BROWSER_ID }));
+			return attributeName === "Name" ? response.name : response.status;
+		}
+		throw new Error(`Unsupported attribute: ${attributeName} for AWS::BedrockAgentCore::Browser`);
+	}
+	/** No managed properties → nothing can drift. */
+	async readCurrentState() {
+		return {};
+	}
+	/**
+	* Import: the type is a singleton pointing at the AWS-managed default
+	* browser, so auto-lookup is trivial — resolve it live via `GetBrowser`
+	* (no `--resource` override needed; a supplied override is ignored in
+	* favor of the live ARN, which is the only valid physical id).
+	*/
+	async import(_input) {
+		const response = await this.client.send(new GetBrowserCommand({ browserId: DEFAULT_BROWSER_ID }));
+		return {
+			physicalId: response.browserArn,
+			attributes: {
+				BrowserArn: response.browserArn,
+				BrowserId: response.browserId ?? "aws.browser.v1",
+				Name: response.name ?? "",
+				Status: response.status ?? ""
+			}
+		};
+	}
+};
+
+//#endregion
+//#region src/provisioning/providers/agentcore-code-interpreter-provider.ts
+/**
+* SDK Provider for AWS::BedrockAgentCore::CodeInterpreter (adopt-only
+* singleton).
+*
+* The CloudFormation registry schema declares this type as a READ-ONLY
+* resource "representing the AWS-managed default code interpreter
+* (aws.codeinterpreter.v1)": every schema property (`CodeInterpreterArn` /
+* `CodeInterpreterId` / `Status`) is read-only, the only handlers are
+* read/list, and the `CodeInterpreterId` pattern is hard-locked to
+* `^aws\.codeinterpreter\.v1$`. The registry marks it `NON_PROVISIONABLE`,
+* so Cloud Control cannot deploy it and cdkd's pre-flight used to reject it
+* (issue #1039).
+*
+* cdkd therefore provisions it as an ADOPT operation, not a create — see
+* `agentcore-browser-provider.ts` (the exactly-parallel sibling) for the
+* full rationale. Custom, user-created code interpreters are a DIFFERENT
+* CFn type (`AWS::BedrockAgentCore::CodeInterpreterCustom`, FULLY_MUTABLE)
+* which Cloud Control handles.
+*/
+/** The only valid code interpreter id for this type per the CFn schema pattern. */
+const DEFAULT_CODE_INTERPRETER_ID = "aws.codeinterpreter.v1";
+/**
+* AWS BedrockAgentCore default-CodeInterpreter Provider (adopt-only).
+*/
+var AgentCoreCodeInterpreterProvider = class {
+	client;
+	logger = getLogger().child("AgentCoreCodeInterpreterProvider");
+	handledProperties = new Map([["AWS::BedrockAgentCore::CodeInterpreter", /* @__PURE__ */ new Set([])]]);
+	constructor() {
+		const awsClients = getAwsClients();
+		this.client = awsClients.bedrockAgentCoreControl;
+	}
+	/**
+	* "Create" = adopt the AWS-managed default code interpreter: verify it
+	* exists in the deploy region and record its ARN (the CFn
+	* primaryIdentifier) as the physical id. Nothing is created in AWS.
+	*/
+	async create(logicalId, resourceType, _properties) {
+		this.logger.debug(`Adopting AWS-managed default code interpreter for ${logicalId}`);
+		try {
+			const response = await this.client.send(new GetCodeInterpreterCommand({ codeInterpreterId: DEFAULT_CODE_INTERPRETER_ID }));
+			const codeInterpreterArn = response.codeInterpreterArn;
+			this.logger.debug(`Adopted default code interpreter ${DEFAULT_CODE_INTERPRETER_ID} (${codeInterpreterArn})`);
+			return {
+				physicalId: codeInterpreterArn,
+				attributes: {
+					CodeInterpreterArn: codeInterpreterArn,
+					CodeInterpreterId: response.codeInterpreterId ?? "aws.codeinterpreter.v1",
+					Status: response.status ?? ""
+				}
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to adopt the AWS-managed default code interpreter for ${logicalId}: ${error instanceof Error ? error.message : String(error)}. Bedrock AgentCore may not be available in this region.`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Every property on this type is read-only, so there is nothing to
+	* update — keep the existing physical id.
+	*/
+	async update(logicalId, physicalId, _resourceType, _properties, _previousProperties) {
+		this.logger.debug(`No-op update for default code interpreter ${logicalId}`);
+		return {
+			physicalId,
+			wasReplaced: false,
+			attributes: {}
+		};
+	}
+	/**
+	* The default code interpreter is AWS-owned; destroying a stack must
+	* never delete it. Pure no-op.
+	*/
+	async delete(logicalId, _physicalId, _resourceType) {
+		this.logger.debug(`No-op delete for AWS-managed default code interpreter ${logicalId}`);
+	}
+	/**
+	* Get resource attribute (for Fn::GetAtt resolution). The CFn read-only
+	* attribute set is CodeInterpreterArn / CodeInterpreterId / Status.
+	*/
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "CodeInterpreterArn") return physicalId;
+		if (attributeName === "CodeInterpreterId") return DEFAULT_CODE_INTERPRETER_ID;
+		if (attributeName === "Status") return (await this.client.send(new GetCodeInterpreterCommand({ codeInterpreterId: DEFAULT_CODE_INTERPRETER_ID }))).status;
+		throw new Error(`Unsupported attribute: ${attributeName} for AWS::BedrockAgentCore::CodeInterpreter`);
+	}
+	/** No managed properties → nothing can drift. */
+	async readCurrentState() {
+		return {};
+	}
+	/**
+	* Import: the type is a singleton pointing at the AWS-managed default
+	* code interpreter, so auto-lookup is trivial — resolve it live via
+	* `GetCodeInterpreter` (no `--resource` override needed; a supplied
+	* override is ignored in favor of the live ARN, which is the only valid
+	* physical id).
+	*/
+	async import(_input) {
+		const response = await this.client.send(new GetCodeInterpreterCommand({ codeInterpreterId: DEFAULT_CODE_INTERPRETER_ID }));
+		return {
+			physicalId: response.codeInterpreterArn,
+			attributes: {
+				CodeInterpreterArn: response.codeInterpreterArn,
+				CodeInterpreterId: response.codeInterpreterId ?? "aws.codeinterpreter.v1",
+				Status: response.status ?? ""
+			}
+		};
+	}
+};
+
+//#endregion
+//#region src/provisioning/providers/agentcore-evaluator-provider.ts
+/**
+* SDK Provider for AWS::BedrockAgentCore::Evaluator
+*
+* Provisions custom evaluators (LLM-as-a-Judge or code-based Lambda
+* configs) for AgentCore quality evaluations via the
+* `bedrock-agentcore-control` control plane (issue #1058).
+*
+* Uses direct SDK calls (`CreateEvaluator` / `UpdateEvaluator` /
+* `DeleteEvaluator` / `GetEvaluator`) instead of Cloud Control for the same
+* reasons as the sibling `agentcore-runtime-provider.ts`: synchronous
+* responses, immediate error surfaces, and no CC-API polling overhead.
+*
+* CFn <-> SDK mapping notes (verified against the registry schema and
+* `@aws-sdk/client-bedrock-agentcore-control` typings):
+* - The physical id is the Evaluator ARN (the type's primaryIdentifier, so
+*   `Ref` matches CloudFormation); the SDK ops take the evaluator ID, which
+*   is the ARN's final `evaluator/<id>` path segment.
+* - `EvaluatorConfig` is a union (`LlmAsAJudge` | `CodeBased`) whose member
+*   and field names map 1:1 to the SDK's camelCase shapes — EXCEPT the
+*   free-form `AdditionalModelRequestFields` document, whose inner keys are
+*   model-specific request fields (e.g. `top_k`) and must be passed
+*   verbatim (see `agentcore-case-convert.ts`).
+* - CFn `Tags` is a `[{Key, Value}]` list; the SDK's create/tag ops take a
+*   `Record<string, string>` map. `UpdateEvaluator` does not accept tags,
+*   so tag changes go through `TagResource` / `UntagResource`.
+* - `EvaluatorName` is the type's only createOnly property; a name change
+*   is classified as replacement by the deploy engine's registry-schema
+*   createOnly fallback (`create-only-properties.ts`) — no per-provider
+*   replacement logic needed.
+*/
+/**
+* The `EvaluatorConfig` subtree keys whose values are free-form JSON
+* documents (user/model-defined keys) that must NOT be case-converted.
+*/
+const CFN_PRESERVE_KEYS = new Set(["AdditionalModelRequestFields"]);
+const SDK_PRESERVE_KEYS = new Set(["additionalModelRequestFields"]);
+/**
+* Extract the evaluator ID from an evaluator ARN
+* (`arn:...:evaluator/<id>` → `<id>`). Falls back to the input verbatim
+* when it does not look like an ARN (already an ID).
+*/
+function evaluatorIdFromArn(arnOrId) {
+	const idx = arnOrId.indexOf(":evaluator/");
+	return idx >= 0 ? arnOrId.slice(idx + 11) : arnOrId;
+}
+/** CFn `[{Key, Value}]` tag list → SDK `Record<string, string>` map. */
+function cfnTagListToMap(tags) {
+	const map = {};
+	if (Array.isArray(tags)) {
+		for (const tag of tags) if (tag !== null && typeof tag === "object" && typeof tag["Key"] === "string") map[tag["Key"]] = String(tag["Value"] ?? "");
+	}
+	return map;
+}
+/** SDK `Record<string, string>` tag map → CFn `[{Key, Value}]` list. */
+function tagMapToCfnList(tags) {
+	return Object.entries(tags).map(([Key, Value]) => ({
+		Key,
+		Value
+	}));
+}
+/**
+* AWS BedrockAgentCore Evaluator Provider
+*/
+var AgentCoreEvaluatorProvider = class {
+	client;
+	logger = getLogger().child("AgentCoreEvaluatorProvider");
+	handledProperties = new Map([["AWS::BedrockAgentCore::Evaluator", new Set([
+		"EvaluatorName",
+		"Description",
+		"EvaluatorConfig",
+		"Level",
+		"KmsKeyArn",
+		"Tags"
+	])]]);
+	constructor() {
+		const awsClients = getAwsClients();
+		this.client = awsClients.bedrockAgentCoreControl;
+	}
+	/**
+	* Create a BedrockAgentCore Evaluator
+	*/
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating BedrockAgentCore Evaluator ${logicalId}`);
+		const evaluatorName = properties["EvaluatorName"];
+		if (!evaluatorName) throw new ProvisioningError(`EvaluatorName is required for ${logicalId}`, resourceType, logicalId);
+		if (properties["EvaluatorConfig"] === void 0) throw new ProvisioningError(`EvaluatorConfig is required for ${logicalId}`, resourceType, logicalId);
+		if (properties["Level"] === void 0) throw new ProvisioningError(`Level is required for ${logicalId}`, resourceType, logicalId);
+		try {
+			const input = {
+				evaluatorName,
+				evaluatorConfig: pascalToCamelCaseKeys(properties["EvaluatorConfig"], CFN_PRESERVE_KEYS),
+				level: properties["Level"]
+			};
+			if (properties["Description"] !== void 0) input["description"] = properties["Description"];
+			if (properties["KmsKeyArn"] !== void 0) input["kmsKeyArn"] = properties["KmsKeyArn"];
+			if (properties["Tags"] !== void 0) {
+				const tags = cfnTagListToMap(properties["Tags"]);
+				if (Object.keys(tags).length > 0) input["tags"] = tags;
+			}
+			const response = await this.client.send(new CreateEvaluatorCommand(input));
+			const evaluatorArn = response.evaluatorArn;
+			const evaluatorId = response.evaluatorId;
+			this.logger.debug(`Created BedrockAgentCore Evaluator: ${evaluatorId} (${evaluatorArn})`);
+			return {
+				physicalId: evaluatorArn,
+				attributes: {
+					EvaluatorArn: evaluatorArn,
+					EvaluatorId: evaluatorId,
+					Status: response.status ?? "",
+					CreatedAt: response.createdAt?.toISOString() ?? ""
+				}
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create BedrockAgentCore Evaluator ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update a BedrockAgentCore Evaluator.
+	*
+	* `UpdateEvaluator` covers Description / EvaluatorConfig / Level /
+	* KmsKeyArn; tag changes are applied via TagResource / UntagResource
+	* (the update op does not accept tags). `EvaluatorName` is createOnly —
+	* the deploy engine replaces the resource instead of calling this.
+	*/
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating BedrockAgentCore Evaluator ${logicalId}: ${physicalId}`);
+		try {
+			const input = { evaluatorId: evaluatorIdFromArn(physicalId) };
+			if (properties["Description"] !== void 0) input["description"] = properties["Description"];
+			if (properties["EvaluatorConfig"] !== void 0) input["evaluatorConfig"] = pascalToCamelCaseKeys(properties["EvaluatorConfig"], CFN_PRESERVE_KEYS);
+			if (properties["Level"] !== void 0) input["level"] = properties["Level"];
+			if (properties["KmsKeyArn"] !== void 0) input["kmsKeyArn"] = properties["KmsKeyArn"];
+			const response = await this.client.send(new UpdateEvaluatorCommand(input));
+			await this.syncTags(physicalId, properties["Tags"], previousProperties["Tags"]);
+			const evaluatorArn = response.evaluatorArn ?? physicalId;
+			this.logger.debug(`Successfully updated BedrockAgentCore Evaluator ${logicalId}`);
+			return {
+				physicalId: evaluatorArn,
+				wasReplaced: false,
+				attributes: {
+					EvaluatorArn: evaluatorArn,
+					EvaluatorId: response.evaluatorId ?? evaluatorIdFromArn(evaluatorArn),
+					Status: response.status ?? "",
+					UpdatedAt: response.updatedAt?.toISOString() ?? ""
+				}
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update BedrockAgentCore Evaluator ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Apply CFn tag-list changes via TagResource / UntagResource.
+	*/
+	async syncTags(evaluatorArn, nextTagsRaw, previousTagsRaw) {
+		const nextTags = cfnTagListToMap(nextTagsRaw);
+		const previousTags = cfnTagListToMap(previousTagsRaw);
+		const removedKeys = Object.keys(previousTags).filter((key) => !(key in nextTags));
+		const upserts = {};
+		for (const [key, value] of Object.entries(nextTags)) if (previousTags[key] !== value) upserts[key] = value;
+		if (removedKeys.length > 0) await this.client.send(new UntagResourceCommand$9({
+			resourceArn: evaluatorArn,
+			tagKeys: removedKeys
+		}));
+		if (Object.keys(upserts).length > 0) await this.client.send(new TagResourceCommand$9({
+			resourceArn: evaluatorArn,
+			tags: upserts
+		}));
+	}
+	/**
+	* Delete a BedrockAgentCore Evaluator
+	*/
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(`Deleting BedrockAgentCore Evaluator ${logicalId}: ${physicalId}`);
+		try {
+			await this.client.send(new DeleteEvaluatorCommand({ evaluatorId: evaluatorIdFromArn(physicalId) }));
+			this.logger.debug(`Successfully deleted BedrockAgentCore Evaluator ${logicalId}`);
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$5) {
+				assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`Evaluator ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete BedrockAgentCore Evaluator ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Get resource attribute (for Fn::GetAtt resolution). The CFn read-only
+	* attribute set is EvaluatorArn / EvaluatorId / Status / CreatedAt /
+	* UpdatedAt.
+	*/
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "EvaluatorArn") return physicalId;
+		if (attributeName === "EvaluatorId") return evaluatorIdFromArn(physicalId);
+		if (attributeName === "Status" || attributeName === "CreatedAt" || attributeName === "UpdatedAt") {
+			const response = await this.client.send(new GetEvaluatorCommand({ evaluatorId: evaluatorIdFromArn(physicalId) }));
+			if (attributeName === "Status") return response.status;
+			if (attributeName === "CreatedAt") return response.createdAt?.toISOString();
+			return response.updatedAt?.toISOString();
+		}
+		throw new Error(`Unsupported attribute: ${attributeName} for AWS::BedrockAgentCore::Evaluator`);
+	}
+	/**
+	* Read the AWS-current Evaluator configuration in CFn-property shape.
+	*
+	* Issues `GetEvaluator` + `ListTagsForResource` and surfaces the keys
+	* `create()` accepts, re-shaped to PascalCase (the free-form
+	* `additionalModelRequestFields` document is passed through verbatim).
+	* Returns `undefined` when the evaluator is gone
+	* (`ResourceNotFoundException`).
+	*/
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		let resp;
+		try {
+			resp = await this.client.send(new GetEvaluatorCommand({ evaluatorId: evaluatorIdFromArn(physicalId) }));
+		} catch (err) {
+			if (err instanceof ResourceNotFoundException$5) return void 0;
+			throw err;
+		}
+		const result = {};
+		if (resp.evaluatorName !== void 0) result["EvaluatorName"] = resp.evaluatorName;
+		result["Description"] = resp.description ?? "";
+		if (resp.evaluatorConfig !== void 0) result["EvaluatorConfig"] = camelToPascalCaseKeys(resp.evaluatorConfig, SDK_PRESERVE_KEYS);
+		if (resp.level !== void 0) result["Level"] = resp.level;
+		if (resp.kmsKeyArn !== void 0) result["KmsKeyArn"] = resp.kmsKeyArn;
+		try {
+			result["Tags"] = tagMapToCfnList((await this.client.send(new ListTagsForResourceCommand$6({ resourceArn: physicalId }))).tags ?? {});
+		} catch (err) {
+			this.logger.debug(`Failed to read tags for evaluator ${physicalId}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		return result;
+	}
+	/**
+	* Adopt an existing BedrockAgentCore Evaluator into cdkd state.
+	*
+	* **Explicit override only.** Pass `--resource <logicalId>=<value>` where
+	* `<value>` is the evaluator ARN or the bare evaluator ID; an ID is
+	* resolved to the canonical ARN (the physical id shape `create()`
+	* records) via `GetEvaluator`.
+	*/
+	async import(input) {
+		if (!input.knownPhysicalId) return null;
+		if (input.knownPhysicalId.includes(":evaluator/")) return {
+			physicalId: input.knownPhysicalId,
+			attributes: {
+				EvaluatorArn: input.knownPhysicalId,
+				EvaluatorId: evaluatorIdFromArn(input.knownPhysicalId)
+			}
+		};
+		const response = await this.client.send(new GetEvaluatorCommand({ evaluatorId: input.knownPhysicalId }));
+		return {
+			physicalId: response.evaluatorArn,
+			attributes: {
+				EvaluatorArn: response.evaluatorArn,
+				EvaluatorId: response.evaluatorId ?? input.knownPhysicalId
+			}
+		};
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/stepfunctions-provider.ts
 /**
@@ -20823,7 +21349,7 @@ var StepFunctionsProvider = class {
 			result["EncryptionConfiguration"] = ec;
 		}
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$10({ resourceArn: physicalId }))).tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: physicalId }))).tags);
 		} catch (err) {
 			if (!(err instanceof StateMachineDoesNotExist)) throw err;
 		}
@@ -20861,7 +21387,7 @@ var StepFunctionsProvider = class {
 			const list = await this.getClient().send(new ListStateMachinesCommand({ ...nextToken && { nextToken } }));
 			for (const sm of list.stateMachines ?? []) {
 				if (!sm.stateMachineArn) continue;
-				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$10({ resourceArn: sm.stateMachineArn }));
+				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: sm.stateMachineArn }));
 				if (this.tagsMatchCdkPath(tagsResp.tags, input.cdkPath)) return {
 					physicalId: sm.stateMachineArn,
 					attributes: {}
@@ -20892,14 +21418,14 @@ var StepFunctionsProvider = class {
 		const tagsToRemove = [];
 		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$11({
+			await this.getClient().send(new UntagResourceCommand$12({
 				resourceArn: stateMachineArn,
 				tagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from SFN state machine ${stateMachineArn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$11({
+			await this.getClient().send(new TagResourceCommand$12({
 				resourceArn: stateMachineArn,
 				tags: tagsToAdd
 			}));
@@ -21519,14 +22045,14 @@ var ECSProvider = class {
 		const tagsToRemove = [];
 		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$12({
+			await this.getClient().send(new UntagResourceCommand$13({
 				resourceArn,
 				tagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from ECS resource ${resourceArn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$12({
+			await this.getClient().send(new TagResourceCommand$13({
 				resourceArn,
 				tags: tagsToAdd
 			}));
@@ -22097,7 +22623,7 @@ var ECSProvider = class {
 		do {
 			const list = await this.getClient().send(new ListClustersCommand({ ...nextToken && { nextToken } }));
 			for (const arn of list.clusterArns ?? []) {
-				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: arn }));
+				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$12({ resourceArn: arn }));
 				if (this.tagsMatchCdkPath(tagsResp.tags, input.cdkPath)) return {
 					physicalId: arn.substring(arn.lastIndexOf("/") + 1),
 					attributes: {}
@@ -22124,7 +22650,7 @@ var ECSProvider = class {
 						...svcToken && { nextToken: svcToken }
 					}));
 					for (const svcArn of svcList.serviceArns ?? []) {
-						const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: svcArn }));
+						const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$12({ resourceArn: svcArn }));
 						if (this.tagsMatchCdkPath(tagsResp.tags, input.cdkPath)) return {
 							physicalId: `${clusterArn}|${svcArn.substring(svcArn.lastIndexOf("/") + 1)}`,
 							attributes: {}
@@ -23622,7 +24148,7 @@ var RDSProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$8({ ResourceName: arn }))).TagList);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$9({ ResourceName: arn }))).TagList);
 		} catch (err) {
 			this.logger.debug(`RDS ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -23645,7 +24171,7 @@ var RDSProvider = class {
 			const list = await this.getClient().send(new DescribeDBInstancesCommand({ ...marker && { Marker: marker } }));
 			for (const inst of list.DBInstances ?? []) {
 				if (!inst.DBInstanceIdentifier || !inst.DBInstanceArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$8({ ResourceName: inst.DBInstanceArn }))).TagList, input.cdkPath)) return {
+				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$9({ ResourceName: inst.DBInstanceArn }))).TagList, input.cdkPath)) return {
 					physicalId: inst.DBInstanceIdentifier,
 					attributes: {}
 				};
@@ -23672,7 +24198,7 @@ var RDSProvider = class {
 			const list = await this.getClient().send(new DescribeDBClustersCommand({ ...marker && { Marker: marker } }));
 			for (const c of list.DBClusters ?? []) {
 				if (!c.DBClusterIdentifier || !c.DBClusterArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$8({ ResourceName: c.DBClusterArn }))).TagList, input.cdkPath)) return {
+				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$9({ ResourceName: c.DBClusterArn }))).TagList, input.cdkPath)) return {
 					physicalId: c.DBClusterIdentifier,
 					attributes: {}
 				};
@@ -23699,7 +24225,7 @@ var RDSProvider = class {
 			const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand({ ...marker && { Marker: marker } }));
 			for (const sg of list.DBSubnetGroups ?? []) {
 				if (!sg.DBSubnetGroupName || !sg.DBSubnetGroupArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$8({ ResourceName: sg.DBSubnetGroupArn }))).TagList, input.cdkPath)) return {
+				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$9({ ResourceName: sg.DBSubnetGroupArn }))).TagList, input.cdkPath)) return {
 					physicalId: sg.DBSubnetGroupName,
 					attributes: {}
 				};
@@ -23929,7 +24455,7 @@ var RDSDBProxyProvider = class {
 			for (const proxy of describe.DBProxies ?? []) {
 				if (!proxy.DBProxyArn) continue;
 				try {
-					if (matchesCdkPath((await client.send(new ListTagsForResourceCommand$8({ ResourceName: proxy.DBProxyArn }))).TagList ?? [], input.cdkPath)) return this.buildImportResult(proxy.DBProxyName ?? "");
+					if (matchesCdkPath((await client.send(new ListTagsForResourceCommand$9({ ResourceName: proxy.DBProxyArn }))).TagList ?? [], input.cdkPath)) return this.buildImportResult(proxy.DBProxyName ?? "");
 				} catch (error) {
 					this.logger.debug(`ListTagsForResource failed for ${proxy.DBProxyName}: ${error instanceof Error ? error.message : String(error)}`);
 				}
@@ -23972,7 +24498,7 @@ var RDSDBProxyProvider = class {
 			}))
 		};
 		if (p.DBProxyArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsForResourceCommand$8({ ResourceName: p.DBProxyArn }))).TagList ?? []);
+			result["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsForResourceCommand$9({ ResourceName: p.DBProxyArn }))).TagList ?? []);
 		} catch (error) {
 			this.logger.debug(`ListTagsForResource failed for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 			result["Tags"] = [];
@@ -24271,7 +24797,7 @@ var RDSDBProxyEndpointProvider = class {
 			for (const ep of describe.DBProxyEndpoints ?? []) {
 				if (!ep.DBProxyEndpointArn) continue;
 				try {
-					if (matchesCdkPath((await client.send(new ListTagsForResourceCommand$8({ ResourceName: ep.DBProxyEndpointArn }))).TagList ?? [], input.cdkPath)) return this.buildImportResult(ep.DBProxyEndpointName ?? "");
+					if (matchesCdkPath((await client.send(new ListTagsForResourceCommand$9({ ResourceName: ep.DBProxyEndpointArn }))).TagList ?? [], input.cdkPath)) return this.buildImportResult(ep.DBProxyEndpointName ?? "");
 				} catch (error) {
 					this.logger.debug(`ListTagsForResource failed for ${ep.DBProxyEndpointName}: ${error instanceof Error ? error.message : String(error)}`);
 				}
@@ -24299,7 +24825,7 @@ var RDSDBProxyEndpointProvider = class {
 			TargetRole: e.TargetRole ?? "READ_WRITE"
 		};
 		if (e.DBProxyEndpointArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsForResourceCommand$8({ ResourceName: e.DBProxyEndpointArn }))).TagList ?? []);
+			result["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsForResourceCommand$9({ ResourceName: e.DBProxyEndpointArn }))).TagList ?? []);
 		} catch (error) {
 			this.logger.debug(`ListTagsForResource failed for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 			result["Tags"] = [];
@@ -25268,7 +25794,7 @@ var DocDBProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$12({ ResourceName: arn }))).TagList);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: arn }))).TagList);
 		} catch (err) {
 			this.logger.debug(`DocDB ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -25291,7 +25817,7 @@ var DocDBProvider = class {
 			const list = await this.getClient().send(new DescribeDBInstancesCommand$1({ ...marker && { Marker: marker } }));
 			for (const inst of list.DBInstances ?? []) {
 				if (!inst.DBInstanceIdentifier || !inst.DBInstanceArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$12({ ResourceName: inst.DBInstanceArn }))).TagList, input.cdkPath)) return {
+				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: inst.DBInstanceArn }))).TagList, input.cdkPath)) return {
 					physicalId: inst.DBInstanceIdentifier,
 					attributes: {}
 				};
@@ -25318,7 +25844,7 @@ var DocDBProvider = class {
 			const list = await this.getClient().send(new DescribeDBClustersCommand$1({ ...marker && { Marker: marker } }));
 			for (const c of list.DBClusters ?? []) {
 				if (!c.DBClusterIdentifier || !c.DBClusterArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$12({ ResourceName: c.DBClusterArn }))).TagList, input.cdkPath)) return {
+				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: c.DBClusterArn }))).TagList, input.cdkPath)) return {
 					physicalId: c.DBClusterIdentifier,
 					attributes: {}
 				};
@@ -25345,7 +25871,7 @@ var DocDBProvider = class {
 			const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand$1({ ...marker && { Marker: marker } }));
 			for (const sg of list.DBSubnetGroups ?? []) {
 				if (!sg.DBSubnetGroupName || !sg.DBSubnetGroupArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$12({ ResourceName: sg.DBSubnetGroupArn }))).TagList, input.cdkPath)) return {
+				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: sg.DBSubnetGroupArn }))).TagList, input.cdkPath)) return {
 					physicalId: sg.DBSubnetGroupName,
 					attributes: {}
 				};
@@ -25938,7 +26464,7 @@ var NeptuneProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: arn }))).TagList);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceName: arn }))).TagList);
 		} catch (err) {
 			this.logger.debug(`Neptune ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -25961,7 +26487,7 @@ var NeptuneProvider = class {
 			const list = await this.getClient().send(new DescribeDBInstancesCommand$2({ ...marker && { Marker: marker } }));
 			for (const inst of list.DBInstances ?? []) {
 				if (!inst.DBInstanceIdentifier || !inst.DBInstanceArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: inst.DBInstanceArn }))).TagList, input.cdkPath)) return {
+				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceName: inst.DBInstanceArn }))).TagList, input.cdkPath)) return {
 					physicalId: inst.DBInstanceIdentifier,
 					attributes: {}
 				};
@@ -25988,7 +26514,7 @@ var NeptuneProvider = class {
 			const list = await this.getClient().send(new DescribeDBClustersCommand$2({ ...marker && { Marker: marker } }));
 			for (const c of list.DBClusters ?? []) {
 				if (!c.DBClusterIdentifier || !c.DBClusterArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: c.DBClusterArn }))).TagList, input.cdkPath)) return {
+				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceName: c.DBClusterArn }))).TagList, input.cdkPath)) return {
 					physicalId: c.DBClusterIdentifier,
 					attributes: {}
 				};
@@ -26015,7 +26541,7 @@ var NeptuneProvider = class {
 			const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand$2({ ...marker && { Marker: marker } }));
 			for (const sg of list.DBSubnetGroups ?? []) {
 				if (!sg.DBSubnetGroupName || !sg.DBSubnetGroupArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: sg.DBSubnetGroupArn }))).TagList, input.cdkPath)) return {
+				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceName: sg.DBSubnetGroupArn }))).TagList, input.cdkPath)) return {
 					physicalId: sg.DBSubnetGroupName,
 					attributes: {}
 				};
@@ -26641,7 +27167,7 @@ var Route53Provider = class {
 		});
 		const idTail = physicalId.replace(/^\/hostedzone\//, "");
 		try {
-			result["HostedZoneTags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$6({
+			result["HostedZoneTags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$7({
 				ResourceType: "hostedzone",
 				ResourceId: idTail
 			}))).ResourceTagSet?.Tags);
@@ -26766,7 +27292,7 @@ var Route53Provider = class {
 				if (!zone.Id) continue;
 				const zoneId = zone.Id.replace("/hostedzone/", "");
 				try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$6({
+					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$7({
 						ResourceType: "hostedzone",
 						ResourceId: zoneId
 					}))).ResourceTagSet?.Tags, input.cdkPath)) return {
@@ -27338,7 +27864,7 @@ var CognitoUserPoolProvider = class {
 				if (input.cdkPath) try {
 					const arn = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: pool.Id }))).UserPool?.Arn;
 					if (!arn) continue;
-					if ((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceArn: arn }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceArn: arn }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: pool.Id,
 						attributes: {}
 					};
@@ -27776,7 +28302,7 @@ var ElastiCacheProvider = class {
 	/** Best-effort tag fetch — failures omit the key without breaking the read. */
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$9({ ResourceName: arn }))).TagList);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }))).TagList);
 		} catch (err) {
 			this.logger.debug(`ElastiCache ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -27822,7 +28348,7 @@ var ElastiCacheProvider = class {
 			for (const c of list.CacheClusters ?? []) {
 				if (!c.CacheClusterId) continue;
 				const arn = c.ARN ?? await this.buildClusterArn(c.CacheClusterId);
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$9({ ResourceName: arn }))).TagList, input.cdkPath)) return {
+				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }))).TagList, input.cdkPath)) return {
 					physicalId: c.CacheClusterId,
 					attributes: {}
 				};
@@ -27850,7 +28376,7 @@ var ElastiCacheProvider = class {
 			for (const g of list.CacheSubnetGroups ?? []) {
 				if (!g.CacheSubnetGroupName) continue;
 				const arn = g.ARN ?? await this.buildSubnetGroupArn(g.CacheSubnetGroupName);
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$9({ ResourceName: arn }))).TagList, input.cdkPath)) return {
+				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }))).TagList, input.cdkPath)) return {
 					physicalId: g.CacheSubnetGroupName,
 					attributes: {}
 				};
@@ -27885,34 +28411,53 @@ var ElastiCacheProvider = class {
 *
 * Implements resource provisioning for:
 * - AWS::ServiceDiscovery::PrivateDnsNamespace
+* - AWS::ServiceDiscovery::HttpNamespace
+* - AWS::ServiceDiscovery::PublicDnsNamespace
 * - AWS::ServiceDiscovery::Service
 *
-* WHY: CreatePrivateDnsNamespace is async (returns OperationId) but we handle
-* the polling ourselves, avoiding the CC API's generic polling overhead and
-* giving us direct control over the operation lifecycle.
+* WHY: the Create*Namespace APIs are async (they return an OperationId) but we
+* handle the polling ourselves, avoiding the CC API's generic polling overhead
+* and giving us direct control over the operation lifecycle. HttpNamespace and
+* PublicDnsNamespace are `ProvisioningType: NON_PROVISIONABLE`, so Cloud
+* Control cannot handle them at all — this SDK provider is the only route
+* (issue #1044).
 */
-var ServiceDiscoveryProvider = class {
+var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	client;
 	stsClient;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("ServiceDiscoveryProvider");
-	handledProperties = new Map([["AWS::ServiceDiscovery::PrivateDnsNamespace", new Set([
-		"Name",
-		"Vpc",
-		"Description",
-		"Tags",
-		"Properties"
-	])], ["AWS::ServiceDiscovery::Service", new Set([
-		"Name",
-		"NamespaceId",
-		"DnsConfig",
-		"HealthCheckCustomConfig",
-		"Description",
-		"HealthCheckConfig",
-		"Tags",
-		"Type",
-		"ServiceAttributes"
-	])]]);
+	handledProperties = new Map([
+		["AWS::ServiceDiscovery::PrivateDnsNamespace", new Set([
+			"Name",
+			"Vpc",
+			"Description",
+			"Tags",
+			"Properties"
+		])],
+		["AWS::ServiceDiscovery::HttpNamespace", new Set([
+			"Name",
+			"Description",
+			"Tags"
+		])],
+		["AWS::ServiceDiscovery::PublicDnsNamespace", new Set([
+			"Name",
+			"Description",
+			"Tags",
+			"Properties"
+		])],
+		["AWS::ServiceDiscovery::Service", new Set([
+			"Name",
+			"NamespaceId",
+			"DnsConfig",
+			"HealthCheckCustomConfig",
+			"Description",
+			"HealthCheckConfig",
+			"Tags",
+			"Type",
+			"ServiceAttributes"
+		])]
+	]);
 	getClient() {
 		if (!this.client) this.client = new ServiceDiscoveryClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -27924,20 +28469,26 @@ var ServiceDiscoveryProvider = class {
 	async create(logicalId, resourceType, properties) {
 		switch (resourceType) {
 			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.createNamespace(logicalId, resourceType, properties);
+			case "AWS::ServiceDiscovery::HttpNamespace": return this.createHttpNamespace(logicalId, resourceType, properties);
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.createPublicDnsNamespace(logicalId, resourceType, properties);
 			case "AWS::ServiceDiscovery::Service": return this.createService(logicalId, resourceType, properties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		}
 	}
 	update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		switch (resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.updateNamespace(logicalId, physicalId, resourceType, properties);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ServiceDiscovery::HttpNamespace": return this.updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::ServiceDiscovery::Service": return this.updateService(logicalId, physicalId, resourceType, properties, previousProperties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		switch (resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.deleteNamespace(logicalId, physicalId, resourceType, context);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace":
+			case "AWS::ServiceDiscovery::HttpNamespace":
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.deleteNamespace(logicalId, physicalId, resourceType, context);
 			case "AWS::ServiceDiscovery::Service": return this.deleteService(logicalId, physicalId, resourceType, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -27951,8 +28502,7 @@ var ServiceDiscoveryProvider = class {
 		const tags = properties["Tags"];
 		if (!name) throw new ProvisioningError(`Name is required for PrivateDnsNamespace ${logicalId}`, resourceType, logicalId);
 		if (!vpc) throw new ProvisioningError(`Vpc is required for PrivateDnsNamespace ${logicalId}`, resourceType, logicalId);
-		const soa = (properties["Properties"]?.["DnsProperties"])?.["SOA"];
-		const inputProperties = soa?.TTL !== void 0 ? { DnsProperties: { SOA: { TTL: Number(soa.TTL) } } } : void 0;
+		const inputProperties = this.extractSoaTtlProperties(properties);
 		try {
 			const operationId = (await client.send(new CreatePrivateDnsNamespaceCommand({
 				Name: name,
@@ -27988,30 +28538,29 @@ var ServiceDiscoveryProvider = class {
 	* `Name` and `Vpc` are immutable; the deploy engine's
 	* replacement-detection layer routes those through DELETE+CREATE
 	* before this method is ever called, so we do not validate them here.
+	* Tags ride on the separate `TagResource` / `UntagResource` APIs
+	* (see {@link syncNamespaceTags} — wired in with issue #1044 so a
+	* Tags-only change is no longer silently dropped, the ECR #981 class).
 	*
 	* Empty-string Description is intentionally allowed through (`!== undefined`
 	* gate, not truthy) so `cdkd drift --revert` can clear a console-side ADD.
 	*/
-	async updateNamespace(logicalId, physicalId, resourceType, properties) {
+	async updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating private DNS namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const namespaceChange = {};
 		if (properties["Description"] !== void 0) namespaceChange.Description = properties["Description"];
-		const soa = (properties["Properties"]?.["DnsProperties"])?.["SOA"];
-		if (soa?.TTL !== void 0) namespaceChange.Properties = { DnsProperties: { SOA: { TTL: Number(soa.TTL) } } };
-		if (Object.keys(namespaceChange).length === 0) {
-			this.logger.debug(`No mutable diff for PrivateDnsNamespace ${logicalId}, skipping update`);
-			return {
-				physicalId,
-				wasReplaced: false
-			};
-		}
+		const soaProperties = this.extractSoaTtlProperties(properties);
+		if (soaProperties) namespaceChange.Properties = soaProperties;
 		try {
-			const operationId = (await client.send(new UpdatePrivateDnsNamespaceCommand({
-				Id: physicalId,
-				Namespace: namespaceChange
-			}))).OperationId;
-			if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			if (Object.keys(namespaceChange).length > 0) {
+				const operationId = (await client.send(new UpdatePrivateDnsNamespaceCommand({
+					Id: physicalId,
+					Namespace: namespaceChange
+				}))).OperationId;
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			} else this.logger.debug(`No mutable namespace-body diff for PrivateDnsNamespace ${logicalId}`);
+			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
 			this.logger.debug(`Successfully updated private DNS namespace ${logicalId}`);
 			return {
 				physicalId,
@@ -28023,21 +28572,172 @@ var ServiceDiscoveryProvider = class {
 			throw new ProvisioningError(`Failed to update private DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	/**
+	* Delete a Cloud Map namespace (shared by PrivateDnsNamespace,
+	* HttpNamespace, and PublicDnsNamespace — `DeleteNamespace` is
+	* kind-agnostic and operation-based for all three).
+	*/
 	async deleteNamespace(logicalId, physicalId, resourceType, context) {
-		this.logger.debug(`Deleting private DNS namespace ${logicalId}: ${physicalId}`);
+		this.logger.debug(`Deleting Cloud Map namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		try {
 			const operationId = (await client.send(new DeleteNamespaceCommand({ Id: physicalId }))).OperationId;
 			if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
-			this.logger.debug(`Successfully deleted private DNS namespace ${logicalId}`);
+			this.logger.debug(`Successfully deleted Cloud Map namespace ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NamespaceNotFound) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Namespace ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete Cloud Map namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async createHttpNamespace(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating HTTP namespace ${logicalId}`);
+		const client = this.getClient();
+		const name = properties["Name"];
+		const description = properties["Description"];
+		const tags = properties["Tags"];
+		if (!name) throw new ProvisioningError(`Name is required for HttpNamespace ${logicalId}`, resourceType, logicalId);
+		try {
+			const operationId = (await client.send(new CreateHttpNamespaceCommand({
+				Name: name,
+				...description && { Description: description },
+				...tags && tags.length > 0 && { Tags: tags }
+			}))).OperationId;
+			if (!operationId) throw new Error("CreateHttpNamespace did not return OperationId");
+			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType);
+			const arn = await this.resolveNamespaceArn(namespaceId);
+			this.logger.debug(`Successfully created HTTP namespace ${logicalId}: ${namespaceId}`);
+			return {
+				physicalId: namespaceId,
+				attributes: {
+					Id: namespaceId,
+					Arn: arn
+				}
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create HTTP namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update an HTTP namespace.
+	*
+	* `UpdateHttpNamespace` exposes exactly one mutable field: `Description`
+	* (the SDK's `HttpNamespaceChange` shape). `Name` is createOnly — the
+	* replacement-detection layer routes a Name change through DELETE+CREATE
+	* before this method is ever called. Tags ride on the separate
+	* `TagResource` / `UntagResource` APIs (see {@link syncNamespaceTags}).
+	*
+	* Empty-string Description is intentionally allowed through
+	* (`!== undefined` gate, not truthy) so `cdkd drift --revert` can clear a
+	* console-side ADD.
+	*/
+	async updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating HTTP namespace ${logicalId}: ${physicalId}`);
+		const client = this.getClient();
+		try {
+			if (properties["Description"] !== void 0) {
+				const namespaceChange = { Description: properties["Description"] };
+				const operationId = (await client.send(new UpdateHttpNamespaceCommand({
+					Id: physicalId,
+					Namespace: namespaceChange
+				}))).OperationId;
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			}
+			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
+			this.logger.debug(`Successfully updated HTTP namespace ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to delete private DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+			throw new ProvisioningError(`Failed to update HTTP namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async createPublicDnsNamespace(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating public DNS namespace ${logicalId}`);
+		const client = this.getClient();
+		const name = properties["Name"];
+		const description = properties["Description"];
+		const tags = properties["Tags"];
+		if (!name) throw new ProvisioningError(`Name is required for PublicDnsNamespace ${logicalId}`, resourceType, logicalId);
+		const inputProperties = this.extractSoaTtlProperties(properties);
+		try {
+			const operationId = (await client.send(new CreatePublicDnsNamespaceCommand({
+				Name: name,
+				...description && { Description: description },
+				...tags && tags.length > 0 && { Tags: tags },
+				...inputProperties && { Properties: inputProperties }
+			}))).OperationId;
+			if (!operationId) throw new Error("CreatePublicDnsNamespace did not return OperationId");
+			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType);
+			let arn;
+			let hostedZoneId;
+			try {
+				const nsResp = await client.send(new GetNamespaceCommand({ Id: namespaceId }));
+				arn = nsResp.Namespace?.Arn;
+				hostedZoneId = nsResp.Namespace?.Properties?.DnsProperties?.HostedZoneId;
+			} catch (err) {
+				this.logger.debug(`GetNamespace(${namespaceId}) after create failed: ${err instanceof Error ? err.message : String(err)}`);
+			}
+			if (!arn) arn = await this.buildNamespaceArn(namespaceId);
+			this.logger.debug(`Successfully created public DNS namespace ${logicalId}: ${namespaceId}`);
+			return {
+				physicalId: namespaceId,
+				attributes: {
+					Id: namespaceId,
+					Arn: arn,
+					...hostedZoneId && { HostedZoneId: hostedZoneId }
+				}
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create public DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update a public DNS namespace.
+	*
+	* `UpdatePublicDnsNamespace` exposes two mutable surfaces (the SDK's
+	* `PublicDnsNamespaceChange` shape): `Description` and
+	* `Properties.DnsProperties.SOA.TTL`. `Name` is createOnly — replacement
+	* is routed through DELETE+CREATE upstream. Tags ride on the separate
+	* `TagResource` / `UntagResource` APIs (see {@link syncNamespaceTags}).
+	*/
+	async updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating public DNS namespace ${logicalId}: ${physicalId}`);
+		const client = this.getClient();
+		const namespaceChange = {};
+		if (properties["Description"] !== void 0) namespaceChange.Description = properties["Description"];
+		const soaProperties = this.extractSoaTtlProperties(properties);
+		if (soaProperties) namespaceChange.Properties = soaProperties;
+		try {
+			if (Object.keys(namespaceChange).length > 0) {
+				const operationId = (await client.send(new UpdatePublicDnsNamespaceCommand({
+					Id: physicalId,
+					Namespace: namespaceChange
+				}))).OperationId;
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			}
+			await this.syncNamespaceTags(logicalId, physicalId, properties, previousProperties);
+			this.logger.debug(`Successfully updated public DNS namespace ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update public DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
 	async createService(logicalId, resourceType, properties) {
@@ -28187,6 +28887,59 @@ var ServiceDiscoveryProvider = class {
 		}
 	}
 	/**
+	* Extract the CFn `Properties.DnsProperties.SOA.TTL` nested field (the only
+	* mutable entry in the namespace `Properties` bag, shared by the private
+	* and public DNS namespace kinds) into the SDK's input shape. Returns
+	* `undefined` when the template does not set a TTL.
+	*/
+	extractSoaTtlProperties(properties) {
+		const soa = (properties["Properties"]?.["DnsProperties"])?.["SOA"];
+		return soa?.TTL !== void 0 ? { DnsProperties: { SOA: { TTL: Number(soa.TTL) } } } : void 0;
+	}
+	/**
+	* Resolve a namespace's ARN — authoritative via `GetNamespace`, with a
+	* deterministic STS-based construction as fallback so a transient read
+	* failure right after create does not fail the whole resource.
+	*/
+	async resolveNamespaceArn(namespaceId) {
+		try {
+			const resp = await this.getClient().send(new GetNamespaceCommand({ Id: namespaceId }));
+			if (resp.Namespace?.Arn) return resp.Namespace.Arn;
+		} catch (err) {
+			this.logger.debug(`GetNamespace(${namespaceId}) failed while resolving ARN: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		return this.buildNamespaceArn(namespaceId);
+	}
+	/**
+	* Diff-and-apply namespace tags via `TagResource` / `UntagResource`.
+	*
+	* `TagResource` is additive-only, so a tag dropped from the template
+	* (partial removal) — or the entire `Tags` property removed (full removal,
+	* `newTags === undefined`) — would survive on AWS unless we explicitly
+	* `UntagResource` the removed keys (the ECR #981 regression class).
+	* Failures THROW (never warn-swallow) so cdkd state is never written
+	* as-if-applied; the next deploy retries naturally.
+	*/
+	async syncNamespaceTags(logicalId, physicalId, properties, previousProperties) {
+		const newTags = properties["Tags"];
+		const oldTags = previousProperties["Tags"];
+		if (JSON.stringify(newTags) === JSON.stringify(oldTags)) return;
+		const newKeys = new Set((newTags ?? []).map((t) => t.Key).filter((k) => !!k));
+		const removedKeys = (oldTags ?? []).map((t) => t.Key).filter((k) => !!k && !newKeys.has(k));
+		const hasAdds = !!newTags && newTags.length > 0;
+		if (removedKeys.length === 0 && !hasAdds) return;
+		const arn = await this.resolveNamespaceArn(physicalId);
+		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$14({
+			ResourceARN: arn,
+			TagKeys: removedKeys
+		}));
+		if (hasAdds) await this.getClient().send(new TagResourceCommand$14({
+			ResourceARN: arn,
+			Tags: newTags
+		}));
+		this.logger.debug(`Updated tags for namespace ${logicalId} (${physicalId})`);
+	}
+	/**
 	* Poll a Service Discovery operation until it completes.
 	* Returns the target resource ID from the operation result.
 	*/
@@ -28209,6 +28962,44 @@ var ServiceDiscoveryProvider = class {
 		throw new ProvisioningError(`Operation timed out for ${logicalId} (operationId: ${operationId})`, resourceType, logicalId);
 	}
 	/**
+	* Resolve a `Fn::GetAtt` attribute live from AWS (used by `cdkd orphan`'s
+	* sibling-reference rewriting and other post-deploy attribute reads).
+	*
+	* Namespace kinds resolve `Id` / `Arn` (plus `HostedZoneId` for the DNS
+	* namespace kinds, read from `GetNamespace`'s
+	* `Properties.DnsProperties.HostedZoneId`); Services resolve `Id` / `Arn` /
+	* `Name` via `GetService`. Returns `undefined` for unknown attributes and
+	* for gone resources.
+	*/
+	async getAttribute(physicalId, resourceType, attributeName) {
+		switch (resourceType) {
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace":
+			case "AWS::ServiceDiscovery::HttpNamespace":
+			case "AWS::ServiceDiscovery::PublicDnsNamespace":
+				if (attributeName === "Id") return physicalId;
+				if (attributeName !== "Arn" && attributeName !== "HostedZoneId") return void 0;
+				try {
+					const resp = await this.getClient().send(new GetNamespaceCommand({ Id: physicalId }));
+					if (attributeName === "Arn") return resp.Namespace?.Arn;
+					return resp.Namespace?.Properties?.DnsProperties?.HostedZoneId;
+				} catch (err) {
+					if (err instanceof NamespaceNotFound) return void 0;
+					throw err;
+				}
+			case "AWS::ServiceDiscovery::Service":
+				if (attributeName === "Id") return physicalId;
+				if (attributeName !== "Arn" && attributeName !== "Name") return void 0;
+				try {
+					const resp = await this.getClient().send(new GetServiceCommand({ Id: physicalId }));
+					return attributeName === "Arn" ? resp.Service?.Arn : resp.Service?.Name;
+				} catch (err) {
+					if (err instanceof ServiceNotFound) return void 0;
+					throw err;
+				}
+			default: return;
+		}
+	}
+	/**
 	* Adopt an existing Cloud Map (Service Discovery) resource into cdkd state.
 	*
 	*  - **AWS::ServiceDiscovery::PrivateDnsNamespace**: tag-based auto-lookup
@@ -28242,7 +29033,9 @@ var ServiceDiscoveryProvider = class {
 	*/
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		switch (resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.readNamespace(physicalId);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace":
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.readNamespace(physicalId, { includeProperties: true });
+			case "AWS::ServiceDiscovery::HttpNamespace": return this.readNamespace(physicalId, { includeProperties: false });
 			case "AWS::ServiceDiscovery::Service": return this.readService(physicalId);
 			default: return;
 		}
@@ -28263,7 +29056,7 @@ var ServiceDiscoveryProvider = class {
 		if (resourceType === "AWS::ServiceDiscovery::PrivateDnsNamespace") return ["Vpc"];
 		return [];
 	}
-	async readNamespace(physicalId) {
+	async readNamespace(physicalId, options) {
 		let ns;
 		try {
 			ns = (await this.getClient().send(new GetNamespaceCommand({ Id: physicalId }))).Namespace;
@@ -28275,9 +29068,11 @@ var ServiceDiscoveryProvider = class {
 		const result = {};
 		if (ns.Name !== void 0) result["Name"] = ns.Name;
 		result["Description"] = ns.Description ?? "";
-		const soa = ns.Properties?.DnsProperties?.SOA;
-		if (soa?.TTL !== void 0) result["Properties"] = { DnsProperties: { SOA: { TTL: soa.TTL } } };
-		else result["Properties"] = {};
+		if (options.includeProperties) {
+			const soa = ns.Properties?.DnsProperties?.SOA;
+			if (soa?.TTL !== void 0) result["Properties"] = { DnsProperties: { SOA: { TTL: soa.TTL } } };
+			else result["Properties"] = {};
+		}
 		if (ns.Arn) await this.attachTags(result, ns.Arn);
 		return result;
 	}
@@ -28326,21 +29121,39 @@ var ServiceDiscoveryProvider = class {
 	/** Best-effort tag fetch via `ListTagsForResource(ResourceARN)`. */
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: arn }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: arn }))).Tags);
 		} catch (err) {
 			this.logger.debug(`ServiceDiscovery ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
 	}
 	async import(input) {
 		switch (input.resourceType) {
-			case "AWS::ServiceDiscovery::PrivateDnsNamespace": return this.importNamespaceResource(input);
+			case "AWS::ServiceDiscovery::PrivateDnsNamespace":
+			case "AWS::ServiceDiscovery::HttpNamespace":
+			case "AWS::ServiceDiscovery::PublicDnsNamespace": return this.importNamespaceResource(input);
 			case "AWS::ServiceDiscovery::Service": return this.importServiceResource(input);
 			default: return null;
 		}
 	}
+	/**
+	* Map each namespace CFn type to its Cloud Map `Namespace.Type` value so
+	* the import walk never adopts a same-named namespace of a different kind
+	* (Cloud Map names are NOT unique across kinds; adopting the wrong one
+	* would make a later destroy delete the wrong resource).
+	*/
+	static NAMESPACE_KIND_BY_TYPE = {
+		"AWS::ServiceDiscovery::PrivateDnsNamespace": "DNS_PRIVATE",
+		"AWS::ServiceDiscovery::HttpNamespace": "HTTP",
+		"AWS::ServiceDiscovery::PublicDnsNamespace": "DNS_PUBLIC"
+	};
 	async importNamespaceResource(input) {
+		const expectedKind = ServiceDiscoveryProvider.NAMESPACE_KIND_BY_TYPE[input.resourceType];
 		if (input.knownPhysicalId) try {
-			await this.getClient().send(new GetNamespaceCommand({ Id: input.knownPhysicalId }));
+			const resp = await this.getClient().send(new GetNamespaceCommand({ Id: input.knownPhysicalId }));
+			if (expectedKind && resp.Namespace?.Type && resp.Namespace.Type !== expectedKind) {
+				this.logger.debug(`Namespace ${input.knownPhysicalId} is kind ${resp.Namespace.Type}, expected ${expectedKind} for ${input.resourceType} — refusing to adopt`);
+				return null;
+			}
 			return {
 				physicalId: input.knownPhysicalId,
 				attributes: {}
@@ -28355,12 +29168,13 @@ var ServiceDiscoveryProvider = class {
 			const list = await this.getClient().send(new ListNamespacesCommand({ ...token && { NextToken: token } }));
 			for (const ns of list.Namespaces ?? []) {
 				if (!ns.Id || !ns.Arn) continue;
+				if (expectedKind && ns.Type && ns.Type !== expectedKind) continue;
 				if (desiredName && ns.Name === desiredName) return {
 					physicalId: ns.Id,
 					attributes: {}
 				};
 				if (input.cdkPath) try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: ns.Arn }))).Tags, input.cdkPath)) return {
+					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: ns.Arn }))).Tags, input.cdkPath)) return {
 						physicalId: ns.Id,
 						attributes: {}
 					};
@@ -28391,7 +29205,7 @@ var ServiceDiscoveryProvider = class {
 			for (const svc of list.Services ?? []) {
 				if (!svc.Id || !svc.Arn) continue;
 				try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: svc.Arn }))).Tags, input.cdkPath)) return {
+					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: svc.Arn }))).Tags, input.cdkPath)) return {
 						physicalId: svc.Id,
 						attributes: {}
 					};
@@ -28781,7 +29595,7 @@ var AppSyncProvider = class {
 		const tagsToAdd = {};
 		for (const [k, v] of Object.entries(newMap)) if (oldMap[k] !== v) tagsToAdd[k] = v;
 		if (tagKeysToRemove.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$13({
+			await this.getClient().send(new UntagResourceCommand$15({
 				resourceArn: arn,
 				tagKeys: tagKeysToRemove
 			}));
@@ -28789,7 +29603,7 @@ var AppSyncProvider = class {
 			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi (untag)");
 		}
 		if (Object.keys(tagsToAdd).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$13({
+			await this.getClient().send(new TagResourceCommand$15({
 				resourceArn: arn,
 				tags: tagsToAdd
 			}));
@@ -31342,14 +32156,14 @@ var KMSProvider = class {
 		const tagsToRemove = [];
 		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$9({
+			await this.getClient().send(new UntagResourceCommand$10({
 				KeyId: keyId,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from KMS Key ${keyId}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$9({
+			await this.getClient().send(new TagResourceCommand$10({
 				KeyId: keyId,
 				Tags: tagsToAdd
 			}));
@@ -31964,11 +32778,11 @@ var BudgetsBudgetProvider = class {
 		const removedKeys = oldTags.map((t) => t.Key).filter((k) => {
 			return typeof k === "string" && !newKeys.has(k);
 		});
-		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$14({
+		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$16({
 			ResourceARN: arn,
 			ResourceTagKeys: removedKeys
 		}));
-		if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$14({
+		if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$16({
 			ResourceARN: arn,
 			ResourceTags: newTags
 		}));
@@ -32056,7 +32870,7 @@ var BudgetsBudgetProvider = class {
 			}));
 			for (const budget of list.Budgets ?? []) {
 				if (!budget.BudgetName) continue;
-				if (matchesCdkPath((await client.send(new ListTagsForResourceCommand$16({ ResourceARN: this.budgetArn(accountId, budget.BudgetName) }))).ResourceTags, input.cdkPath)) return {
+				if (matchesCdkPath((await client.send(new ListTagsForResourceCommand$17({ ResourceARN: this.budgetArn(accountId, budget.BudgetName) }))).ResourceTags, input.cdkPath)) return {
 					physicalId: budget.BudgetName,
 					attributes: { Arn: this.budgetArn(accountId, budget.BudgetName) }
 				};
@@ -32627,7 +33441,7 @@ var KinesisStreamConsumerProvider = class {
 		if (desc.ConsumerName !== void 0) result["ConsumerName"] = desc.ConsumerName;
 		if (desc.StreamARN !== void 0) result["StreamARN"] = desc.StreamARN;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ ResourceARN: physicalId }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$18({ ResourceARN: physicalId }))).Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$8) return void 0;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -32651,14 +33465,14 @@ var KinesisStreamConsumerProvider = class {
 		const tagsToRemove = [];
 		for (const k of Object.keys(oldMap)) if (!(k in newMap)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$15({
+			await this.getClient().send(new UntagResourceCommand$17({
 				ResourceARN: consumerArn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from Kinesis stream consumer ${consumerArn}`);
 		}
 		if (Object.keys(tagsToAdd).length > 0) {
-			await this.getClient().send(new TagResourceCommand$15({
+			await this.getClient().send(new TagResourceCommand$17({
 				ResourceARN: consumerArn,
 				Tags: tagsToAdd
 			}));
@@ -35809,11 +36623,11 @@ var CodeCommitRepositoryProvider = class {
 				const repoArn = metadata?.Arn;
 				if (repoArn) {
 					const removedKeys = Object.keys(oldTagMap).filter((k) => !(k in newTagMap));
-					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$16({
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$18({
 						resourceArn: repoArn,
 						tagKeys: removedKeys
 					}));
-					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$16({
+					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$18({
 						resourceArn: repoArn,
 						tags: newTagMap
 					}));
@@ -35920,7 +36734,7 @@ var CodeCommitRepositoryProvider = class {
 					throw err;
 				}
 				if (!metadata?.Arn) continue;
-				if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: metadata.Arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+				if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: metadata.Arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 					physicalId: repo.repositoryName,
 					attributes: this.toAttributes(metadata)
 				};
@@ -36070,7 +36884,7 @@ var DLMLifecyclePolicyProvider = class {
 			if (tagsChanged && arn) {
 				const removedKeys = Object.keys(oldTags).filter((k) => !(k in newTags));
 				if (removedKeys.length > 0) {
-					await this.getClient().send(new UntagResourceCommand$17({
+					await this.getClient().send(new UntagResourceCommand$19({
 						ResourceArn: arn,
 						TagKeys: removedKeys
 					}));
@@ -36079,7 +36893,7 @@ var DLMLifecyclePolicyProvider = class {
 				const tagsToAdd = {};
 				for (const [k, v] of Object.entries(newTags)) if (oldTags[k] !== v) tagsToAdd[k] = v;
 				if (Object.keys(tagsToAdd).length > 0) {
-					await this.getClient().send(new TagResourceCommand$17({
+					await this.getClient().send(new TagResourceCommand$19({
 						ResourceArn: arn,
 						Tags: tagsToAdd
 					}));
@@ -36282,11 +37096,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${physicalId}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$18({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$20({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$18({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$20({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -36414,7 +37228,7 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.vectorBucketArn }))).tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: bucket.vectorBucketArn }))).tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
@@ -36450,7 +37264,7 @@ var S3VectorsProvider = class {
 			for (const bucket of list.vectorBuckets ?? []) {
 				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) continue;
 				try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: bucket.vectorBucketName,
 						attributes: {}
 					};
@@ -37060,7 +37874,7 @@ var S3TablesProvider = class {
 					attributes: {}
 				};
 				if (input.cdkPath) try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: bucket.arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$21({ resourceArn: bucket.arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: bucket.arn,
 						attributes: {}
 					};
@@ -37127,7 +37941,7 @@ var S3TablesProvider = class {
 							for (const table of tables.tables ?? []) {
 								if (!table.name || !table.tableARN) continue;
 								try {
-									if ((await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: table.tableARN }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+									if ((await this.getClient().send(new ListTagsForResourceCommand$21({ resourceArn: table.tableARN }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 										physicalId: `${bucket.arn}|${namespaceName}|${table.name}`,
 										attributes: {}
 									};
@@ -37223,7 +38037,7 @@ var S3TablesProvider = class {
 	*/
 	async readTagsBestEffort(resourceArn) {
 		try {
-			const tags = (await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn }))).tags ?? {};
+			const tags = (await this.getClient().send(new ListTagsForResourceCommand$21({ resourceArn }))).tags ?? {};
 			const out = [];
 			for (const [Key, Value] of Object.entries(tags)) out.push({
 				Key,
@@ -37277,7 +38091,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$19({
+			await this.getClient().send(new UntagResourceCommand$21({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -37286,7 +38100,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$19({
+			await this.getClient().send(new TagResourceCommand$21({
 				resourceArn,
 				tags: upserts
 			}));
@@ -37318,7 +38132,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$19({
+			await this.getClient().send(new UntagResourceCommand$21({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -37327,7 +38141,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$19({
+			await this.getClient().send(new TagResourceCommand$21({
 				resourceArn,
 				tags: upserts
 			}));
@@ -37510,11 +38324,11 @@ var ECRProvider = class {
 				if (repoArn) {
 					const newKeys = new Set((newTags ?? []).map((t) => t.Key).filter((k) => !!k));
 					const removedKeys = (oldTags ?? []).map((t) => t.Key).filter((k) => !!k && !newKeys.has(k));
-					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$10({
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$11({
 						resourceArn: repoArn,
 						tagKeys: removedKeys
 					}));
-					if (newTags && newTags.length > 0) await this.getClient().send(new TagResourceCommand$10({
+					if (newTags && newTags.length > 0) await this.getClient().send(new TagResourceCommand$11({
 						resourceArn: repoArn,
 						tags: newTags
 					}));
@@ -37613,7 +38427,7 @@ var ECRProvider = class {
 			if (!(err instanceof LifecyclePolicyNotFoundException)) throw err;
 		}
 		if (r.repositoryArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$7({ resourceArn: r.repositoryArn }))).tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$8({ resourceArn: r.repositoryArn }))).tags);
 		} catch (err) {
 			if (!(err instanceof RepositoryNotFoundException)) throw err;
 		}
@@ -37646,7 +38460,7 @@ var ECRProvider = class {
 			for (const repo of list.repositories ?? []) {
 				if (!repo.repositoryArn || !repo.repositoryName) continue;
 				try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$7({ resourceArn: repo.repositoryArn }))).tags, input.cdkPath)) return {
+					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$8({ resourceArn: repo.repositoryArn }))).tags, input.cdkPath)) return {
 						physicalId: repo.repositoryName,
 						attributes: {}
 					};
@@ -38944,8 +39758,13 @@ function registerAllProviders(registry) {
 	registry.register("AWS::ElastiCache::CacheCluster", elasticacheProvider);
 	const serviceDiscoveryProvider = new ServiceDiscoveryProvider();
 	registry.register("AWS::ServiceDiscovery::PrivateDnsNamespace", serviceDiscoveryProvider);
+	registry.register("AWS::ServiceDiscovery::HttpNamespace", serviceDiscoveryProvider);
+	registry.register("AWS::ServiceDiscovery::PublicDnsNamespace", serviceDiscoveryProvider);
 	registry.register("AWS::ServiceDiscovery::Service", serviceDiscoveryProvider);
 	registry.register("AWS::BedrockAgentCore::Runtime", new AgentCoreRuntimeProvider());
+	registry.register("AWS::BedrockAgentCore::Browser", new AgentCoreBrowserProvider());
+	registry.register("AWS::BedrockAgentCore::CodeInterpreter", new AgentCoreCodeInterpreterProvider());
+	registry.register("AWS::BedrockAgentCore::Evaluator", new AgentCoreEvaluatorProvider());
 	const appSyncProvider = new AppSyncProvider();
 	registry.register("AWS::AppSync::GraphQLApi", appSyncProvider);
 	registry.register("AWS::AppSync::GraphQLSchema", appSyncProvider);
@@ -58249,7 +59068,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.241.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.243.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());