@go-to-k/cdkd 0.257.4 → 0.258.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as getBootstrapMarkerKey, A as refStateLookupFromResource, At as resolveBucketRegion, B as S3StateBackend, Bt as LocalMigrateError, C as findActionableSilentDrops, Ct as CFN_TEMPLATE_URL_LIMIT, D as isTerminationProtectionPropagationError, Dt as expectedOwnerParam, E as disableInstanceApiTermination, Et as uploadCfnTemplate, F as applyRoleArnIfSet, G as WorkGraph, Gt as PartialFailureError, H as shouldRetainResource, I as DiffCalculator, It as CdkdError, J as loadPublishableAssetManifest, Jt as ResourceUpdateNotSupportedError, K as buildAssetRedirectMap, Kt as ProvisioningError, L as DagBuilder, M as normalizeAwsTagsToCfn, Mt as getAwsClients, N as resolveExplicitPhysicalId, Nt as resetAwsClients, O as IntrinsicFunctionResolver, Ot as AssemblyReader, P as assertRegionMatch, Pt as setAwsClients, Q as ensureAssetStorage, R as TemplateParser, S as ProviderRegistry, St as CFN_TEMPLATE_BODY_LIMIT, T as slowCcOperationTimeoutMs, Tt as findLargeInlineResources, U as AssetPublisher, Ut as MissingCdkCliError, V as rebuildClientForBucketRegion, Vt as LocalStartServiceError, W as stringifyValue, Wt as NestedStackChildDirectDestroyError, X as AssetModeResolver, Xt as StackTerminationProtectionError, Y as rewriteTemplateAssetReferences, Yt as StackHasActiveImportsError, Z as BOOTSTRAP_MARKER_PREFIX, _ as green, _t as resolveSkipPrefix, a as withRetry, at as getDockerCmd, b as IAMRoleProvider, bt as resolveUseCdkBootstrapAssets, c as computeImplicitDeleteEdges, ct as AssetManifestLoader, d as isStatefulRecreateTargetSync, dt as synthesisStatusMessage, et as parseBootstrapMarker, f as renderStatefulReason, ft as getDefaultStateBucketName, g as gray, gt as resolveCaptureObservedState, h as cyan, ht as resolveAutoAssetStorage, i as withResourceDeadline, it as formatDockerLoginError, j as WAFv2WebACLProvider, jt as AwsClients, k as cfnRefValueFromPhysicalId, l as extractDeploymentEventError, lt as getDockerImageBySourceHash, m as bold, mt as resolveApp, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as withErrorHandling, nt as validateContainerRepoName, o as isRetryableTransientError, ot as runDockerForeground, p as formatResourceLine, pt as getLegacyStateBucketName, q as createAssetRedirectResolver, qt as ResourceTimeoutError, r as DeployEngine, rt as buildDockerImage, s as IMPLICIT_DELETE_DEPENDENCIES, st as runDockerStreaming, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as normalizeAwsError, tt as validateAssetBucketName, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as Synthesizer, v as red, vt as resolveStateBucketWithDefault, w as CloudControlProvider, wt as MIGRATE_TMP_PREFIX, x as collectInlinePolicyNamesManagedBySiblings, xt as warnDeprecatedNoPrefixCliFlag, y as yellow, yt as resolveStateBucketWithDefaultAndSource, z as LockManager, zt as LocalInvokeBuildError$1 } from "./deploy-engine-DMpr3qtv.js";
+import { $ as getBootstrapMarkerKey, A as refStateLookupFromResource, At as resolveBucketRegion, B as S3StateBackend, Bt as LocalMigrateError, C as findActionableSilentDrops, Ct as CFN_TEMPLATE_URL_LIMIT, D as isTerminationProtectionPropagationError, Dt as expectedOwnerParam, E as disableInstanceApiTermination, Et as uploadCfnTemplate, F as applyRoleArnIfSet, G as WorkGraph, Gt as PartialFailureError, H as shouldRetainResource, I as DiffCalculator, It as CdkdError, J as loadPublishableAssetManifest, Jt as ResourceUpdateNotSupportedError, K as buildAssetRedirectMap, Kt as ProvisioningError, L as DagBuilder, M as normalizeAwsTagsToCfn, Mt as getAwsClients, N as resolveExplicitPhysicalId, Nt as resetAwsClients, O as IntrinsicFunctionResolver, Ot as AssemblyReader, P as assertRegionMatch, Pt as setAwsClients, Q as ensureAssetStorage, R as TemplateParser, S as ProviderRegistry, St as CFN_TEMPLATE_BODY_LIMIT, T as slowCcOperationTimeoutMs, Tt as findLargeInlineResources, U as AssetPublisher, Ut as MissingCdkCliError, V as rebuildClientForBucketRegion, Vt as LocalStartServiceError, W as stringifyValue, Wt as NestedStackChildDirectDestroyError, X as AssetModeResolver, Xt as StackTerminationProtectionError, Y as rewriteTemplateAssetReferences, Yt as StackHasActiveImportsError, Z as BOOTSTRAP_MARKER_PREFIX, _ as green, _t as resolveSkipPrefix, a as withRetry, at as getDockerCmd, b as IAMRoleProvider, bt as resolveUseCdkBootstrapAssets, c as computeImplicitDeleteEdges, ct as AssetManifestLoader, d as isStatefulRecreateTargetSync, dt as synthesisStatusMessage, et as parseBootstrapMarker, f as renderStatefulReason, ft as getDefaultStateBucketName, g as gray, gt as resolveCaptureObservedState, h as cyan, ht as resolveAutoAssetStorage, i as withResourceDeadline, it as formatDockerLoginError, j as WAFv2WebACLProvider, jt as AwsClients, k as cfnRefValueFromPhysicalId, l as extractDeploymentEventError, lt as getDockerImageBySourceHash, m as bold, mt as resolveApp, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as withErrorHandling, nt as validateContainerRepoName, o as isRetryableTransientError, ot as runDockerForeground, p as formatResourceLine, pt as getLegacyStateBucketName, q as createAssetRedirectResolver, qt as ResourceTimeoutError, r as DeployEngine, rt as buildDockerImage, s as IMPLICIT_DELETE_DEPENDENCIES, st as runDockerStreaming, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as normalizeAwsError, tt as validateAssetBucketName, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as Synthesizer, v as red, vt as resolveStateBucketWithDefault, w as CloudControlProvider, wt as MIGRATE_TMP_PREFIX, x as collectInlinePolicyNamesManagedBySiblings, xt as warnDeprecatedNoPrefixCliFlag, y as yellow, yt as resolveStateBucketWithDefaultAndSource, z as LockManager, zt as LocalInvokeBuildError$1 } from "./deploy-engine-Dg51mHCV.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BhmMKcnJ.js";
+import { t as ASGProvider } from "./asg-provider-rcNqhfPS.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -22,6 +22,7 @@ import { CloudWatchClient, DeleteAlarmsCommand, DescribeAlarmsCommand, ListTagsF
 import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
 import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$6, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
+import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ResourceNotFoundException as ResourceNotFoundException$7, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
 import * as fs from "node:fs";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
@@ -30,9 +31,9 @@ import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$7, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand } from "@aws-sdk/client-elastic-load-balancing-v2";
-import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
+import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
-import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$8, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11 } from "@aws-sdk/client-ecr";
+import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$8, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
 import graphlib from "graphlib";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBProxyCommand, CreateDBProxyEndpointCommand, CreateDBSubnetGroupCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeleteDBSubnetGroupCommand, DeregisterDBProxyTargetsCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$9, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, ModifyDBSubnetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-rds";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-elasticache";
@@ -43,29 +44,29 @@ import { writeFileSync as writeFileSync$1 } from "fs";
 import * as zlib from "node:zlib";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
-import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
-import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
+import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
+import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
-import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
-import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$8, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
-import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
+import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$9, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$10, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
-import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
+import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
-import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
+import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$11, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
-import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$12, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
+import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import AdmZip from "adm-zip";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3tables";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$13, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1900,7 +1901,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.257.4";
+	return "0.258.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -10392,6 +10393,394 @@ var LambdaEventInvokeConfigProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/lambda-microvm-image-provider.ts
+/**
+* AWS Lambda MicroVM Image Provider
+*
+* Implements `AWS::Lambda::MicrovmImage` using the dedicated `lambda-microvms`
+* service SDK (`@aws-sdk/client-lambda-microvms`) — NOT `@aws-sdk/client-lambda`.
+* The MicroVM image APIs (`CreateMicrovmImage` / `GetMicrovmImage` /
+* `UpdateMicrovmImage` / `DeleteMicrovmImage`) live in their own service model.
+*
+* **The build is asynchronous.** `CreateMicrovmImage` returns immediately with
+* the image in `CREATING` state; Lambda then downloads the code artifact zip
+* from S3, runs the Dockerfile, starts the application, and captures a
+* Firecracker snapshot. The image reaches `CREATED` on success or
+* `CREATE_FAILED` on failure (build logs land in CloudWatch under
+* `/aws/lambda/microvms/<name>`). `create()` polls `GetMicrovmImage` until the
+* image reaches `CREATED`. `UpdateMicrovmImage` triggers the same async rebuild
+* (`UPDATING` -> `UPDATED` / `UPDATE_FAILED`).
+*
+* `CDKD_NO_WAIT=true` (or `cdkd deploy --no-wait`) short-circuits the create /
+* update poll and returns immediately with the image ARN. The build continues
+* asynchronously on the AWS side — cdkd will NOT observe a later
+* `CREATE_FAILED`, and an immediate `destroy` may race the in-flight build.
+* The Cloud Control fallback path does NOT honor `--no-wait` (it always polls
+* its request token to a terminal state), so this SDK provider is what makes
+* `--no-wait` effective for this resource type.
+*
+* **Physical id is the image ARN** (`primaryIdentifier` = `/properties/ImageArn`,
+* an AWS-assigned read-only attribute). CFn `Ref` returns the ARN. `Name` is a
+* create-only property, so a `Name` change is routed to REPLACEMENT by cdkd's
+* create-only detection (`getCreateOnlyPropertyPaths`) and never reaches
+* `update()`.
+*
+* **CFn <-> SDK shape translation.** The template carries CloudFormation-schema
+* PascalCase properties (e.g. `CodeArtifact: { Uri }`, `Tags: [{Key, Value}]`,
+* `Logging: { Disabled: true }`); the SDK expects camelCase with different
+* container shapes (`codeArtifact: { uri }`, `tags: Record<string,string>`,
+* `logging: { disabled: {} }`). The mapping helpers below translate each field
+* explicitly so this provider accepts the exact same template the Cloud Control
+* fallback would.
+*
+* **Tags update out-of-band.** `Tags` is `tagUpdatable` but is NOT a field on
+* `UpdateMicrovmImage`, so `update()` reconciles tag changes via `TagResource`
+* / `UntagResource` (no rebuild). A change limited to `Tags` skips the
+* `UpdateMicrovmImage` rebuild entirely; only a build-affecting property change
+* ({@link BUILD_AFFECTING_CFN_KEYS}) issues the async rebuild.
+*/
+var LambdaMicrovmImageProvider = class {
+	client;
+	logger = getLogger().child("LambdaMicrovmImageProvider");
+	maxPollAttempts = Number(process.env["CDKD_MICROVM_IMAGE_POLL_ATTEMPTS"] ?? 180);
+	pollIntervalMs = Number(process.env["CDKD_MICROVM_IMAGE_POLL_INTERVAL_MS"] ?? 1e4);
+	constructor() {
+		this.client = getAwsClients().lambdaMicrovms;
+	}
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::MicrovmImage", /* @__PURE__ */ new Set([
+		"Name",
+		"BaseImageArn",
+		"BaseImageVersion",
+		"BuildRoleArn",
+		"Description",
+		"CodeArtifact",
+		"Logging",
+		"EgressNetworkConnectors",
+		"CpuConfigurations",
+		"Resources",
+		"AdditionalOsCapabilities",
+		"Hooks",
+		"EnvironmentVariables",
+		"Tags"
+	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Lambda::MicrovmImage", /* @__PURE__ */ new Map([
+		["ImageArn", "AWS-managed read-only attribute (primaryIdentifier / physical id)"],
+		["State", "AWS-managed read-only attribute"],
+		["LatestActiveImageVersion", "AWS-managed read-only attribute"],
+		["LatestFailedImageVersion", "AWS-managed read-only attribute"],
+		["CreatedAt", "AWS-managed read-only attribute"],
+		["UpdatedAt", "AWS-managed read-only attribute"]
+	])]]);
+	getMinResourceTimeoutMs() {
+		return this.maxPollAttempts * this.pollIntervalMs;
+	}
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating MicroVM image ${logicalId}`);
+		const name = properties["Name"];
+		const baseImageArn = properties["BaseImageArn"];
+		const buildRoleArn = properties["BuildRoleArn"];
+		const codeArtifact = mapCodeArtifact(properties["CodeArtifact"]);
+		const missing = [
+			!name && "Name",
+			!baseImageArn && "BaseImageArn",
+			!buildRoleArn && "BuildRoleArn",
+			!codeArtifact && "CodeArtifact.Uri"
+		].filter(Boolean);
+		if (missing.length > 0) throw new ProvisioningError(`${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} required for MicroVM image ${logicalId}`, resourceType, logicalId);
+		const input = {
+			name,
+			baseImageArn,
+			buildRoleArn,
+			codeArtifact,
+			...buildCommonImageInput(properties)
+		};
+		const tags = mapKeyValueListToRecord(properties["Tags"]);
+		if (tags) input.tags = tags;
+		try {
+			const response = await this.client.send(new CreateMicrovmImageCommand(input));
+			const imageArn = response.imageArn;
+			if (!imageArn) throw new ProvisioningError(`CreateMicrovmImage succeeded but no imageArn returned for ${logicalId}`, resourceType, logicalId);
+			this.logger.debug(`Created MicroVM image ${logicalId}: ${imageArn} (state=${response.state})`);
+			const noWait = process.env["CDKD_NO_WAIT"] === "true";
+			let latest = {
+				state: response.state,
+				latestActiveImageVersion: response.latestActiveImageVersion,
+				latestFailedImageVersion: response.latestFailedImageVersion,
+				createdAt: response.createdAt,
+				updatedAt: response.updatedAt
+			};
+			if (!noWait) latest = await this.waitForTerminalState(imageArn, logicalId, "create");
+			else this.logger.warn(`Skipping wait for MicroVM image ${logicalId} (CDKD_NO_WAIT=true). The build continues asynchronously; a CREATE_FAILED will not be observed here.`);
+			return {
+				physicalId: imageArn,
+				attributes: this.buildAttributes(imageArn, latest.state, {
+					latestActiveImageVersion: latest.latestActiveImageVersion,
+					latestFailedImageVersion: latest.latestFailedImageVersion,
+					createdAt: latest.createdAt,
+					updatedAt: latest.updatedAt
+				})
+			};
+		} catch (error) {
+			throw this.wrapError("create", logicalId, resourceType, void 0, error);
+		}
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating MicroVM image ${logicalId}: ${physicalId}`);
+		if (properties["Name"] !== previousProperties["Name"]) throw new ProvisioningError(`MicroVM image ${logicalId} Name is create-only and cannot be changed in place (${String(previousProperties["Name"])} -> ${String(properties["Name"])}); this requires replacement.`, resourceType, logicalId, physicalId);
+		try {
+			await this.reconcileTags(physicalId, properties["Tags"], previousProperties["Tags"]);
+			if (!BUILD_AFFECTING_CFN_KEYS.some((key) => JSON.stringify(properties[key]) !== JSON.stringify(previousProperties[key]))) {
+				this.logger.debug(`MicroVM image ${logicalId}: only tags changed, skipping UpdateMicrovmImage rebuild`);
+				const current = await this.client.send(new GetMicrovmImageCommand({ imageIdentifier: physicalId }));
+				return {
+					physicalId,
+					wasReplaced: false,
+					attributes: this.buildAttributes(physicalId, current.state, current)
+				};
+			}
+			const baseImageArn = properties["BaseImageArn"];
+			const buildRoleArn = properties["BuildRoleArn"];
+			const codeArtifact = mapCodeArtifact(properties["CodeArtifact"]);
+			if (!baseImageArn || !buildRoleArn || !codeArtifact) throw new ProvisioningError(`BaseImageArn, BuildRoleArn, and CodeArtifact.Uri are required to update MicroVM image ${logicalId}`, resourceType, logicalId, physicalId);
+			const input = {
+				imageIdentifier: physicalId,
+				baseImageArn,
+				buildRoleArn,
+				codeArtifact,
+				...buildCommonImageInput(properties),
+				environmentVariables: mapKeyValueListToRecord(properties["EnvironmentVariables"]) ?? {}
+			};
+			await this.client.send(new UpdateMicrovmImageCommand(input));
+			const noWait = process.env["CDKD_NO_WAIT"] === "true";
+			let latest;
+			if (!noWait) latest = await this.waitForTerminalState(physicalId, logicalId, "update");
+			else this.logger.warn(`Skipping wait for MicroVM image ${logicalId} update (CDKD_NO_WAIT=true). The rebuild continues asynchronously.`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: this.buildAttributes(physicalId, latest?.state, {
+					latestActiveImageVersion: latest?.latestActiveImageVersion,
+					latestFailedImageVersion: latest?.latestFailedImageVersion,
+					createdAt: latest?.createdAt,
+					updatedAt: latest?.updatedAt
+				})
+			};
+		} catch (error) {
+			throw this.wrapError("update", logicalId, resourceType, physicalId, error);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(`Deleting MicroVM image ${logicalId}: ${physicalId}`);
+		try {
+			try {
+				await this.client.send(new DeleteMicrovmImageCommand({ imageIdentifier: physicalId }));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$7) {
+					assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					this.logger.debug(`MicroVM image ${physicalId} does not exist, skipping deletion`);
+					return;
+				}
+				throw error;
+			}
+			await this.waitForDeleted(physicalId, logicalId);
+			this.logger.debug(`Successfully deleted MicroVM image ${logicalId}`);
+		} catch (error) {
+			throw this.wrapError("delete", logicalId, resourceType, physicalId, error);
+		}
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "ImageArn") return physicalId;
+		const resp = await this.client.send(new GetMicrovmImageCommand({ imageIdentifier: physicalId }));
+		switch (attributeName) {
+			case "State": return resp.state;
+			case "LatestActiveImageVersion": return resp.latestActiveImageVersion;
+			case "LatestFailedImageVersion": return resp.latestFailedImageVersion;
+			case "CreatedAt": return resp.createdAt?.toISOString();
+			case "UpdatedAt": return resp.updatedAt?.toISOString();
+			default: return;
+		}
+	}
+	buildAttributes(imageArn, state, extra) {
+		const attributes = { ImageArn: imageArn };
+		if (state !== void 0) attributes["State"] = state;
+		if (extra.latestActiveImageVersion !== void 0) attributes["LatestActiveImageVersion"] = extra.latestActiveImageVersion;
+		if (extra.latestFailedImageVersion !== void 0) attributes["LatestFailedImageVersion"] = extra.latestFailedImageVersion;
+		if (extra.createdAt !== void 0) attributes["CreatedAt"] = extra.createdAt.toISOString();
+		if (extra.updatedAt !== void 0) attributes["UpdatedAt"] = extra.updatedAt.toISOString();
+		return attributes;
+	}
+	/**
+	* Poll `GetMicrovmImage` until the image reaches a terminal success state
+	* (`CREATED` after create, `CREATED` / `UPDATED` after update). Throws on the
+	* matching failure state (`CREATE_FAILED` / `UPDATE_FAILED`) or on
+	* poll-cap exhaustion.
+	*/
+	async waitForTerminalState(imageArn, logicalId, operation) {
+		this.logger.debug(`Waiting for MicroVM image ${imageArn} to finish ${operation}...`);
+		for (let attempt = 1; attempt <= this.maxPollAttempts; attempt++) {
+			const resp = await this.client.send(new GetMicrovmImageCommand({ imageIdentifier: imageArn }));
+			const state = resp.state;
+			if (state === "CREATED" || state === "UPDATED") {
+				this.logger.debug(`MicroVM image ${imageArn} reached ${state}`);
+				return resp;
+			}
+			if (state === "CREATE_FAILED" || state === "UPDATE_FAILED") throw new Error(`MicroVM image ${logicalId} (${imageArn}) entered ${state} during ${operation}. Check the build logs in CloudWatch under /aws/lambda/microvms/ to diagnose.`);
+			this.logger.debug(`MicroVM image ${imageArn} state: ${state} (attempt ${attempt}/${this.maxPollAttempts})`);
+			await sleep$2(this.pollIntervalMs);
+		}
+		throw new Error(`MicroVM image ${logicalId} (${imageArn}) did not finish ${operation} within ${this.maxPollAttempts * this.pollIntervalMs / 1e3}s. Increase --resource-timeout AWS::Lambda::MicrovmImage=<duration> or set CDKD_NO_WAIT=true.`);
+	}
+	/**
+	* Poll `GetMicrovmImage` until it 404s (image fully deleted). Throws on
+	* `DELETE_FAILED` or poll-cap exhaustion.
+	*/
+	async waitForDeleted(imageArn, logicalId) {
+		for (let attempt = 1; attempt <= this.maxPollAttempts; attempt++) {
+			let resp;
+			try {
+				resp = await this.client.send(new GetMicrovmImageCommand({ imageIdentifier: imageArn }));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$7) return;
+				throw error;
+			}
+			if (resp.state === "DELETE_FAILED") throw new Error(`MicroVM image ${logicalId} (${imageArn}) entered DELETE_FAILED. Check the CloudWatch build logs under /aws/lambda/microvms/ to diagnose.`);
+			this.logger.debug(`MicroVM image ${imageArn} state: ${resp.state} (delete attempt ${attempt}/${this.maxPollAttempts})`);
+			await sleep$2(this.pollIntervalMs);
+		}
+		throw new Error(`MicroVM image ${logicalId} (${imageArn}) was not fully deleted within ${this.maxPollAttempts * this.pollIntervalMs / 1e3}s.`);
+	}
+	/**
+	* Reconcile the resource's tags to the desired set via TagResource /
+	* UntagResource (diff of the CFn `Tags` list, old vs new). Tags are NOT a
+	* field on UpdateMicrovmImage, so this is the only way a tag change reaches
+	* AWS on update — and it applies without an image rebuild.
+	*/
+	async reconcileTags(physicalId, newTags, oldTags) {
+		const newMap = mapKeyValueListToRecord(newTags) ?? {};
+		const oldMap = mapKeyValueListToRecord(oldTags) ?? {};
+		const keysToRemove = Object.keys(oldMap).filter((k) => !(k in newMap));
+		const tagsToAdd = {};
+		for (const [k, v] of Object.entries(newMap)) if (oldMap[k] !== v) tagsToAdd[k] = v;
+		if (keysToRemove.length > 0) await this.client.send(new UntagResourceCommand$10({
+			Resource: physicalId,
+			TagKeys: keysToRemove
+		}));
+		if (Object.keys(tagsToAdd).length > 0) await this.client.send(new TagResourceCommand$10({
+			Resource: physicalId,
+			Tags: tagsToAdd
+		}));
+	}
+	wrapError(operation, logicalId, resourceType, physicalId, error) {
+		if (error instanceof ProvisioningError) return error;
+		const cause = error instanceof Error ? error : void 0;
+		return new ProvisioningError(`Failed to ${operation} MicroVM image ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+	}
+};
+/**
+* CFn property names whose change requires an UpdateMicrovmImage call (an async
+* image rebuild). Everything the SDK's UpdateMicrovmImage accepts EXCEPT tags
+* (which reconcile out-of-band via TagResource / UntagResource) and Name
+* (create-only). A change limited to `Tags` skips the rebuild.
+*/
+const BUILD_AFFECTING_CFN_KEYS = [
+	"BaseImageArn",
+	"BaseImageVersion",
+	"BuildRoleArn",
+	"Description",
+	"CodeArtifact",
+	"Logging",
+	"EgressNetworkConnectors",
+	"CpuConfigurations",
+	"Resources",
+	"AdditionalOsCapabilities",
+	"Hooks",
+	"EnvironmentVariables"
+];
+function sleep$2(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+* Build the optional create/update input fields shared by both operations,
+* translating each from its CloudFormation-schema shape to the SDK shape.
+* Only defined fields are included so the request never carries `undefined`.
+*/
+function buildCommonImageInput(properties) {
+	const input = {};
+	if (typeof properties["BaseImageVersion"] === "string") input.baseImageVersion = properties["BaseImageVersion"];
+	if (typeof properties["Description"] === "string") input.description = properties["Description"];
+	const logging = mapLogging(properties["Logging"]);
+	if (logging) input.logging = logging;
+	if (Array.isArray(properties["EgressNetworkConnectors"])) input.egressNetworkConnectors = properties["EgressNetworkConnectors"];
+	const cpuConfigurations = mapCpuConfigurations(properties["CpuConfigurations"]);
+	if (cpuConfigurations) input.cpuConfigurations = cpuConfigurations;
+	const resources = mapResources(properties["Resources"]);
+	if (resources) input.resources = resources;
+	if (Array.isArray(properties["AdditionalOsCapabilities"])) input.additionalOsCapabilities = properties["AdditionalOsCapabilities"];
+	const hooks = mapHooks(properties["Hooks"]);
+	if (hooks) input.hooks = hooks;
+	const environmentVariables = mapKeyValueListToRecord(properties["EnvironmentVariables"]);
+	if (environmentVariables) input.environmentVariables = environmentVariables;
+	return input;
+}
+function mapCodeArtifact(value) {
+	if (!isRecord(value)) return void 0;
+	const uri = value["Uri"];
+	return typeof uri === "string" ? { uri } : void 0;
+}
+function mapLogging(value) {
+	if (!isRecord(value)) return void 0;
+	if (value["Disabled"] === true) return { disabled: {} };
+	const cloudWatch = value["CloudWatch"];
+	if (isRecord(cloudWatch)) {
+		const cw = {};
+		if (typeof cloudWatch["LogGroup"] === "string") cw.logGroup = cloudWatch["LogGroup"];
+		if (typeof cloudWatch["LogStream"] === "string") cw.logStream = cloudWatch["LogStream"];
+		return { cloudWatch: cw };
+	}
+}
+function mapCpuConfigurations(value) {
+	if (!Array.isArray(value)) return void 0;
+	return value.filter(isRecord).map((c) => ({ architecture: c["Architecture"] }));
+}
+function mapResources(value) {
+	if (!Array.isArray(value)) return void 0;
+	return value.filter(isRecord).map((r) => Number(r["MinimumMemoryInMiB"])).filter((n) => Number.isFinite(n)).map((minimumMemoryInMiB) => ({ minimumMemoryInMiB }));
+}
+/**
+* Translate the CFn `Hooks` structure (PascalCase keys throughout, all leaf
+* values are strings/numbers) to the SDK `hooks` shape (camelCase keys). Safe
+* to lower-case the first character of every key recursively because Hooks
+* carries no tagged unions and no array-of-record members.
+*/
+function mapHooks(value) {
+	if (!isRecord(value)) return void 0;
+	return lowerFirstKeysDeep(value);
+}
+/**
+* Convert a CFn `[{Key, Value}]` list (used by both `Tags` and
+* `EnvironmentVariables`) to the SDK `Record<string, string>` shape. Returns
+* `undefined` for an empty / absent list so the request omits the field.
+*/
+function mapKeyValueListToRecord(value) {
+	if (!Array.isArray(value)) return void 0;
+	const out = {};
+	for (const entry of value) if (isRecord(entry) && typeof entry["Key"] === "string") out[entry["Key"]] = typeof entry["Value"] === "string" ? entry["Value"] : "";
+	return Object.keys(out).length > 0 ? out : void 0;
+}
+function lowerFirstKeysDeep(value) {
+	if (Array.isArray(value)) return value.map(lowerFirstKeysDeep);
+	if (isRecord(value)) {
+		const out = {};
+		for (const [k, v] of Object.entries(value)) out[k.charAt(0).toLowerCase() + k.slice(1)] = lowerFirstKeysDeep(v);
+		return out;
+	}
+	return value;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
 /**
@@ -21037,14 +21426,14 @@ var StepFunctionsProvider = class {
 		const tagsToRemove = [];
 		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$12({
+			await this.getClient().send(new UntagResourceCommand$13({
 				resourceArn: stateMachineArn,
 				tagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from SFN state machine ${stateMachineArn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$12({
+			await this.getClient().send(new TagResourceCommand$13({
 				resourceArn: stateMachineArn,
 				tags: tagsToAdd
 			}));
@@ -21656,14 +22045,14 @@ var ECSProvider = class {
 		const tagsToRemove = [];
 		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$13({
+			await this.getClient().send(new UntagResourceCommand$14({
 				resourceArn,
 				tagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from ECS resource ${resourceArn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$13({
+			await this.getClient().send(new TagResourceCommand$14({
 				resourceArn,
 				tags: tagsToAdd
 			}));
@@ -27075,7 +27464,7 @@ var CognitoUserPoolProvider = class {
 				if (!templatedActive) try {
 					needsFlip = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool?.DeletionProtection === "ACTIVE";
 				} catch (descError) {
-					if (descError instanceof ResourceNotFoundException$7) {
+					if (descError instanceof ResourceNotFoundException$8) {
 						assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 						this.logger.debug(`Cognito User Pool ${physicalId} does not exist, skipping deletion`);
 						return;
@@ -27098,7 +27487,7 @@ var CognitoUserPoolProvider = class {
 			await this.getClient().send(new DeleteUserPoolCommand({ UserPoolId: physicalId }));
 			this.logger.debug(`Successfully deleted Cognito User Pool ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$7) {
+			if (error instanceof ResourceNotFoundException$8) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Cognito User Pool ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -27131,7 +27520,7 @@ var CognitoUserPoolProvider = class {
 		try {
 			resp = await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }));
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$7) return void 0;
+			if (err instanceof ResourceNotFoundException$8) return void 0;
 			throw err;
 		}
 		const pool = resp.UserPool;
@@ -27205,7 +27594,7 @@ var CognitoUserPoolProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$7) return null;
+			if (err instanceof ResourceNotFoundException$8) return null;
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["UserPoolName"] === "string" ? input.properties["UserPoolName"] : void 0;
@@ -28223,11 +28612,11 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		const hasAdds = !!newTags && newTags.length > 0;
 		if (removedKeys.length === 0 && !hasAdds) return;
 		const arn = await this.resolveNamespaceArn(physicalId);
-		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$14({
+		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$15({
 			ResourceARN: arn,
 			TagKeys: removedKeys
 		}));
-		if (hasAdds) await this.getClient().send(new TagResourceCommand$14({
+		if (hasAdds) await this.getClient().send(new TagResourceCommand$15({
 			ResourceARN: arn,
 			Tags: newTags
 		}));
@@ -28863,7 +29252,7 @@ var AppSyncProvider = class {
 		const tagsToAdd = {};
 		for (const [k, v] of Object.entries(newMap)) if (oldMap[k] !== v) tagsToAdd[k] = v;
 		if (tagKeysToRemove.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$15({
+			await this.getClient().send(new UntagResourceCommand$16({
 				resourceArn: arn,
 				tagKeys: tagKeysToRemove
 			}));
@@ -28871,7 +29260,7 @@ var AppSyncProvider = class {
 			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi (untag)");
 		}
 		if (Object.keys(tagsToAdd).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$15({
+			await this.getClient().send(new TagResourceCommand$16({
 				resourceArn: arn,
 				tags: tagsToAdd
 			}));
@@ -31316,14 +31705,14 @@ var KMSProvider = class {
 		const tagsToRemove = [];
 		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$10({
+			await this.getClient().send(new UntagResourceCommand$11({
 				KeyId: keyId,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from KMS Key ${keyId}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$10({
+			await this.getClient().send(new TagResourceCommand$11({
 				KeyId: keyId,
 				Tags: tagsToAdd
 			}));
@@ -31919,11 +32308,11 @@ var BudgetsBudgetProvider = class {
 		const removedKeys = oldTags.map((t) => t.Key).filter((k) => {
 			return typeof k === "string" && !newKeys.has(k);
 		});
-		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$16({
+		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$17({
 			ResourceARN: arn,
 			ResourceTagKeys: removedKeys
 		}));
-		if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$16({
+		if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$17({
 			ResourceARN: arn,
 			ResourceTags: newTags
 		}));
@@ -32206,7 +32595,7 @@ var KinesisStreamProvider = class {
 			}));
 			this.logger.debug(`Successfully deleted Kinesis stream ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$8) {
+			if (error instanceof ResourceNotFoundException$9) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Kinesis stream ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -32281,7 +32670,7 @@ var KinesisStreamProvider = class {
 		try {
 			stream = (await this.getClient().send(new DescribeStreamCommand({ StreamName: physicalId }))).StreamDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$8) return void 0;
+			if (err instanceof ResourceNotFoundException$9) return void 0;
 			throw err;
 		}
 		if (!stream) return void 0;
@@ -32299,7 +32688,7 @@ var KinesisStreamProvider = class {
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForStreamCommand({ StreamName: physicalId }))).Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$8) return void 0;
+			if (err instanceof ResourceNotFoundException$9) return void 0;
 			this.logger.debug(`Kinesis ListTagsForStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
 		return result;
@@ -32313,7 +32702,7 @@ var KinesisStreamProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$8) return null;
+			if (err instanceof ResourceNotFoundException$9) return null;
 			throw err;
 		}
 		return null;
@@ -32492,7 +32881,7 @@ var KinesisStreamConsumerProvider = class {
 			await this.getClient().send(new DeregisterStreamConsumerCommand({ ConsumerARN: physicalId }));
 			this.logger.debug(`Successfully deregistered Kinesis stream consumer ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$8) {
+			if (error instanceof ResourceNotFoundException$9) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Kinesis stream consumer ${physicalId} not found, skipping`);
 				return;
@@ -32538,7 +32927,7 @@ var KinesisStreamConsumerProvider = class {
 		try {
 			desc = (await this.getClient().send(new DescribeStreamConsumerCommand({ ConsumerARN: physicalId }))).ConsumerDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$8) return void 0;
+			if (err instanceof ResourceNotFoundException$9) return void 0;
 			throw err;
 		}
 		if (!desc) return void 0;
@@ -32548,7 +32937,7 @@ var KinesisStreamConsumerProvider = class {
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: physicalId }))).Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$8) return void 0;
+			if (err instanceof ResourceNotFoundException$9) return void 0;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
 		}
@@ -32570,14 +32959,14 @@ var KinesisStreamConsumerProvider = class {
 		const tagsToRemove = [];
 		for (const k of Object.keys(oldMap)) if (!(k in newMap)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$17({
+			await this.getClient().send(new UntagResourceCommand$18({
 				ResourceARN: consumerArn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from Kinesis stream consumer ${consumerArn}`);
 		}
 		if (Object.keys(tagsToAdd).length > 0) {
-			await this.getClient().send(new TagResourceCommand$17({
+			await this.getClient().send(new TagResourceCommand$18({
 				ResourceARN: consumerArn,
 				Tags: tagsToAdd
 			}));
@@ -32754,7 +33143,7 @@ var SchedulerScheduleProvider = class {
 			}));
 			this.logger.debug(`Deleted Schedule ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$9) {
+			if (error instanceof ResourceNotFoundException$10) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Schedule ${logicalId} already deleted (not found), treating as success`);
 				return;
@@ -32776,7 +33165,7 @@ var SchedulerScheduleProvider = class {
 			return (await this.getClient().send(new GetScheduleCommand({ Name: physicalId }))).Arn;
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const customGroupHint = error instanceof ResourceNotFoundException$9 ? " Schedules in a custom group cannot be looked up by bare name; the Arn is normally served from cdkd state attributes." : "";
+			const customGroupHint = error instanceof ResourceNotFoundException$10 ? " Schedules in a custom group cannot be looked up by bare name; the Arn is normally served from cdkd state attributes." : "";
 			throw new ProvisioningError(`Failed to resolve Arn for Schedule ${physicalId}: ${cause?.message ?? String(error)}.${customGroupHint}`, resourceType, physicalId, physicalId, cause);
 		}
 	}
@@ -32806,7 +33195,7 @@ var SchedulerScheduleProvider = class {
 				...response.Target !== void 0 && { Target: response.Target }
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$9) return;
+			if (error instanceof ResourceNotFoundException$10) return;
 			throw error;
 		}
 	}
@@ -32832,7 +33221,7 @@ var SchedulerScheduleProvider = class {
 				attributes: response.Arn ? { Arn: response.Arn } : {}
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$9) return null;
+			if (error instanceof ResourceNotFoundException$10) return null;
 			throw error;
 		}
 	}
@@ -34194,11 +34583,11 @@ var FSxFileSystemProvider = class {
 		}
 		const toRemove = [];
 		for (const key of prev.keys()) if (key !== void 0 && !next.has(key)) toRemove.push(key);
-		if (toSet.length > 0) await this.getClient().send(new TagResourceCommand$18({
+		if (toSet.length > 0) await this.getClient().send(new TagResourceCommand$19({
 			ResourceARN: arn,
 			Tags: toSet
 		}));
-		if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$18({
+		if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$19({
 			ResourceARN: arn,
 			TagKeys: toRemove
 		}));
@@ -36482,7 +36871,7 @@ var FirehoseProvider = class {
 			await this.getClient().send(new DeleteDeliveryStreamCommand({ DeliveryStreamName: physicalId }));
 			this.logger.debug(`Successfully deleted Firehose delivery stream ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) {
+			if (error instanceof ResourceNotFoundException$11) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Firehose delivery stream ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -37019,7 +37408,7 @@ var FirehoseProvider = class {
 		try {
 			desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return void 0;
+			if (err instanceof ResourceNotFoundException$11) return void 0;
 			throw err;
 		}
 		if (!desc) return void 0;
@@ -37050,7 +37439,7 @@ var FirehoseProvider = class {
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return void 0;
+			if (err instanceof ResourceNotFoundException$11) return void 0;
 			this.logger.debug(`Firehose ListTagsForDeliveryStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
 		}
@@ -37087,7 +37476,7 @@ var FirehoseProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return null;
+			if (err instanceof ResourceNotFoundException$11) return null;
 			throw err;
 		}
 		return null;
@@ -37829,7 +38218,7 @@ var CodeBuildProvider = class {
 			await this.getClient().send(new DeleteProjectCommand({ name: physicalId }));
 			this.logger.debug(`Successfully deleted CodeBuild Project ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$11) {
+			if (error instanceof ResourceNotFoundException$12) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CodeBuild Project ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -37884,7 +38273,7 @@ var CodeBuildProvider = class {
 		try {
 			project = (await this.getClient().send(new BatchGetProjectsCommand({ names: [physicalId] }))).projects?.[0];
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$11) return void 0;
+			if (err instanceof ResourceNotFoundException$12) return void 0;
 			throw err;
 		}
 		if (!project) return void 0;
@@ -38029,7 +38418,7 @@ var CodeBuildProvider = class {
 				attributes: {}
 			} : null;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$11) return null;
+			if (err instanceof ResourceNotFoundException$12) return null;
 			throw err;
 		}
 		return null;
@@ -38269,11 +38658,11 @@ var CodeCommitRepositoryProvider = class {
 				const repoArn = metadata?.Arn;
 				if (repoArn) {
 					const removedKeys = Object.keys(oldTagMap).filter((k) => !(k in newTagMap));
-					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$19({
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$20({
 						resourceArn: repoArn,
 						tagKeys: removedKeys
 					}));
-					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$19({
+					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$20({
 						resourceArn: repoArn,
 						tags: newTagMap
 					}));
@@ -38653,7 +39042,7 @@ var DLMLifecyclePolicyProvider = class {
 			if (tagsChanged && arn) {
 				const removedKeys = Object.keys(oldTags).filter((k) => !(k in newTags));
 				if (removedKeys.length > 0) {
-					await this.getClient().send(new UntagResourceCommand$20({
+					await this.getClient().send(new UntagResourceCommand$21({
 						ResourceArn: arn,
 						TagKeys: removedKeys
 					}));
@@ -38662,7 +39051,7 @@ var DLMLifecyclePolicyProvider = class {
 				const tagsToAdd = {};
 				for (const [k, v] of Object.entries(newTags)) if (oldTags[k] !== v) tagsToAdd[k] = v;
 				if (Object.keys(tagsToAdd).length > 0) {
-					await this.getClient().send(new TagResourceCommand$20({
+					await this.getClient().send(new TagResourceCommand$21({
 						ResourceArn: arn,
 						Tags: tagsToAdd
 					}));
@@ -38686,7 +39075,7 @@ var DLMLifecyclePolicyProvider = class {
 			await this.getClient().send(new DeleteLifecyclePolicyCommand$1({ PolicyId: physicalId }));
 			this.logger.debug(`Successfully deleted DLM Lifecycle Policy ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$12) {
+			if (error instanceof ResourceNotFoundException$13) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DLM Lifecycle Policy ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -38737,7 +39126,7 @@ var DLMLifecyclePolicyProvider = class {
 				Tags: normalizeAwsTagsToCfn(policy.Tags)
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$12) return;
+			if (error instanceof ResourceNotFoundException$13) return;
 			throw error;
 		}
 	}
@@ -38773,7 +39162,7 @@ var DLMLifecyclePolicyProvider = class {
 				attributes: response.Policy.PolicyArn ? { Arn: response.Policy.PolicyArn } : {}
 			} : null;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$12) return null;
+			if (err instanceof ResourceNotFoundException$13) return null;
 			throw err;
 		}
 		return null;
@@ -38853,11 +39242,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${physicalId}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$21({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$22({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$21({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$22({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -39749,7 +40138,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$22({
+			await this.getClient().send(new UntagResourceCommand$23({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -39758,7 +40147,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$22({
+			await this.getClient().send(new TagResourceCommand$23({
 				resourceArn,
 				tags: upserts
 			}));
@@ -39790,7 +40179,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$22({
+			await this.getClient().send(new UntagResourceCommand$23({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -39799,7 +40188,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$22({
+			await this.getClient().send(new TagResourceCommand$23({
 				resourceArn,
 				tags: upserts
 			}));
@@ -39982,11 +40371,11 @@ var ECRProvider = class {
 				if (repoArn) {
 					const newKeys = new Set((newTags ?? []).map((t) => t.Key).filter((k) => !!k));
 					const removedKeys = (oldTags ?? []).map((t) => t.Key).filter((k) => !!k && !newKeys.has(k));
-					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$11({
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$12({
 						resourceArn: repoArn,
 						tagKeys: removedKeys
 					}));
-					if (newTags && newTags.length > 0) await this.getClient().send(new TagResourceCommand$11({
+					if (newTags && newTags.length > 0) await this.getClient().send(new TagResourceCommand$12({
 						resourceArn: repoArn,
 						tags: newTags
 					}));
@@ -41299,6 +41688,7 @@ function registerAllProviders(registry) {
 	registry.register("AWS::Lambda::EventSourceMapping", new LambdaEventSourceMappingProvider());
 	registry.register("AWS::Lambda::LayerVersion", new LambdaLayerVersionProvider());
 	registry.register("AWS::Lambda::EventInvokeConfig", new LambdaEventInvokeConfigProvider());
+	registry.register("AWS::Lambda::MicrovmImage", new LambdaMicrovmImageProvider());
 	registry.register("AWS::DynamoDB::Table", new DynamoDBTableProvider());
 	registry.register("AWS::DynamoDB::GlobalTable", new DynamoDBGlobalTableProvider());
 	registry.register("AWS::Logs::LogGroup", new LogsLogGroupProvider());
@@ -60870,7 +61260,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.257.4");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.258.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());