@go-to-k/cdkd 0.260.7 → 0.260.9

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as getBootstrapMarkerKey, A as refStateLookupFromResource, At as resolveBucketRegion, B as S3StateBackend, Bt as LocalMigrateError, C as findActionableSilentDrops, Ct as CFN_TEMPLATE_URL_LIMIT, D as isTerminationProtectionPropagationError, Dt as expectedOwnerParam, E as disableInstanceApiTermination, Et as uploadCfnTemplate, F as applyRoleArnIfSet, G as WorkGraph, Gt as PartialFailureError, H as shouldRetainResource, I as DiffCalculator, It as CdkdError, J as loadPublishableAssetManifest, Jt as ResourceUpdateNotSupportedError, K as buildAssetRedirectMap, Kt as ProvisioningError, L as DagBuilder, M as normalizeAwsTagsToCfn, Mt as getAwsClients, N as resolveExplicitPhysicalId, Nt as resetAwsClients, O as IntrinsicFunctionResolver, Ot as AssemblyReader, P as assertRegionMatch, Pt as setAwsClients, Q as ensureAssetStorage, R as TemplateParser, S as ProviderRegistry, St as CFN_TEMPLATE_BODY_LIMIT, T as slowCcOperationTimeoutMs, Tt as findLargeInlineResources, U as AssetPublisher, Ut as MissingCdkCliError, V as rebuildClientForBucketRegion, Vt as LocalStartServiceError, W as stringifyValue, Wt as NestedStackChildDirectDestroyError, X as AssetModeResolver, Xt as StackTerminationProtectionError, Y as rewriteTemplateAssetReferences, Yt as StackHasActiveImportsError, Z as BOOTSTRAP_MARKER_PREFIX, _ as green, _t as resolveSkipPrefix, a as withRetry, at as getDockerCmd, b as IAMRoleProvider, bt as resolveUseCdkBootstrapAssets, c as computeImplicitDeleteEdges, ct as AssetManifestLoader, d as isStatefulRecreateTargetSync, dt as synthesisStatusMessage, et as parseBootstrapMarker, f as renderStatefulReason, ft as getDefaultStateBucketName, g as gray, gt as resolveCaptureObservedState, h as cyan, ht as resolveAutoAssetStorage, i as withResourceDeadline, it as formatDockerLoginError, j as WAFv2WebACLProvider, jt as AwsClients, k as cfnRefValueFromPhysicalId, l as extractDeploymentEventError, lt as getDockerImageBySourceHash, m as bold, mt as resolveApp, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as withErrorHandling, nt as validateContainerRepoName, o as isRetryableTransientError, ot as runDockerForeground, p as formatResourceLine, pt as getLegacyStateBucketName, q as createAssetRedirectResolver, qt as ResourceTimeoutError, r as DeployEngine, rt as buildDockerImage, s as IMPLICIT_DELETE_DEPENDENCIES, st as runDockerStreaming, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as normalizeAwsError, tt as validateAssetBucketName, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as Synthesizer, v as red, vt as resolveStateBucketWithDefault, w as CloudControlProvider, wt as MIGRATE_TMP_PREFIX, x as collectInlinePolicyNamesManagedBySiblings, xt as warnDeprecatedNoPrefixCliFlag, y as yellow, yt as resolveStateBucketWithDefaultAndSource, z as LockManager, zt as LocalInvokeBuildError$1 } from "./deploy-engine-Dg51mHCV.js";
+import { $ as getBootstrapMarkerKey, A as refStateLookupFromResource, At as resolveBucketRegion, B as S3StateBackend, Bt as LocalMigrateError, C as findActionableSilentDrops, Ct as CFN_TEMPLATE_URL_LIMIT, D as isTerminationProtectionPropagationError, Dt as expectedOwnerParam, E as disableInstanceApiTermination, Et as uploadCfnTemplate, F as applyRoleArnIfSet, G as WorkGraph, Gt as PartialFailureError, H as shouldRetainResource, I as DiffCalculator, It as CdkdError, J as loadPublishableAssetManifest, Jt as ResourceUpdateNotSupportedError, K as buildAssetRedirectMap, Kt as ProvisioningError, L as DagBuilder, M as normalizeAwsTagsToCfn, Mt as getAwsClients, N as resolveExplicitPhysicalId, Nt as resetAwsClients, O as IntrinsicFunctionResolver, Ot as AssemblyReader, P as assertRegionMatch, Pt as setAwsClients, Q as ensureAssetStorage, R as TemplateParser, S as ProviderRegistry, St as CFN_TEMPLATE_BODY_LIMIT, T as slowCcOperationTimeoutMs, Tt as findLargeInlineResources, U as AssetPublisher, Ut as MissingCdkCliError, V as rebuildClientForBucketRegion, Vt as LocalStartServiceError, W as stringifyValue, Wt as NestedStackChildDirectDestroyError, X as AssetModeResolver, Xt as StackTerminationProtectionError, Y as rewriteTemplateAssetReferences, Yt as StackHasActiveImportsError, Z as BOOTSTRAP_MARKER_PREFIX, _ as green, _t as resolveSkipPrefix, a as withRetry, at as getDockerCmd, b as IAMRoleProvider, bt as resolveUseCdkBootstrapAssets, c as computeImplicitDeleteEdges, ct as AssetManifestLoader, d as isStatefulRecreateTargetSync, dt as synthesisStatusMessage, et as parseBootstrapMarker, f as renderStatefulReason, ft as getDefaultStateBucketName, g as gray, gt as resolveCaptureObservedState, h as cyan, ht as resolveAutoAssetStorage, i as withResourceDeadline, it as formatDockerLoginError, j as WAFv2WebACLProvider, jt as AwsClients, k as cfnRefValueFromPhysicalId, l as extractDeploymentEventError, lt as getDockerImageBySourceHash, m as bold, mt as resolveApp, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as withErrorHandling, nt as validateContainerRepoName, o as isRetryableTransientError, ot as runDockerForeground, p as formatResourceLine, pt as getLegacyStateBucketName, q as createAssetRedirectResolver, qt as ResourceTimeoutError, r as DeployEngine, rt as buildDockerImage, s as IMPLICIT_DELETE_DEPENDENCIES, st as runDockerStreaming, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as normalizeAwsError, tt as validateAssetBucketName, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as Synthesizer, v as red, vt as resolveStateBucketWithDefault, w as CloudControlProvider, wt as MIGRATE_TMP_PREFIX, x as collectInlinePolicyNamesManagedBySiblings, xt as warnDeprecatedNoPrefixCliFlag, y as yellow, yt as resolveStateBucketWithDefaultAndSource, z as LockManager, zt as LocalInvokeBuildError$1 } from "./deploy-engine-CM5GZI1O.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-rcNqhfPS.js";
+import { t as ASGProvider } from "./asg-provider-GUSV9-p0.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -10,7 +10,7 @@ import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQ
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
+import { AllocateAddressCommand, AssociateAddressCommand, AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAddressesCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateAddressCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReleaseAddressCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStackEventsCommand, DescribeStackResourcesCommand, DescribeStacksCommand, DescribeTypeCommand, ExecuteChangeSetCommand, GetTemplateCommand, UpdateStackCommand, waitUntilChangeSetCreateComplete, waitUntilStackDeleteComplete, waitUntilStackImportComplete, waitUntilStackUpdateComplete } from "@aws-sdk/client-cloudformation";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteMethodCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetDeploymentCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
@@ -1901,7 +1901,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.260.7";
+	return "0.260.9";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -15032,6 +15032,13 @@ var EC2Provider = class {
 			"Tags"
 		])],
 		["AWS::EC2::InternetGateway", /* @__PURE__ */ new Set(["Tags"])],
+		["AWS::EC2::EIP", /* @__PURE__ */ new Set([
+			"Domain",
+			"InstanceId",
+			"NetworkBorderGroup",
+			"PublicIpv4Pool",
+			"Tags"
+		])],
 		["AWS::EC2::VPCGatewayAttachment", /* @__PURE__ */ new Set(["VpcId", "InternetGatewayId"])],
 		["AWS::EC2::NatGateway", /* @__PURE__ */ new Set([
 			"AllocationId",
@@ -15111,7 +15118,12 @@ var EC2Provider = class {
 	unhandledByDesign = /* @__PURE__ */ new Map([
 		["AWS::EC2::Instance", /* @__PURE__ */ new Map([["ElasticGpuSpecifications", "AWS Elastic GPU end-of-life (announced 2023-11); no replacement API"], ["ElasticInferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])],
 		["AWS::EC2::SecurityGroupIngress", /* @__PURE__ */ new Map([["GroupName", "EC2-Classic-only — use GroupId for VPC security groups (EC2-Classic retired 2022-08-15)"], ["SourceSecurityGroupName", "EC2-Classic-only — use SourceSecurityGroupId for VPC peer security groups (EC2-Classic retired 2022-08-15)"]])],
-		["AWS::EC2::NatGateway", /* @__PURE__ */ new Map([["VpcId", "AWS derives the VPC from SubnetId; the ec2:CreateNatGateway API has no VpcId parameter"]])]
+		["AWS::EC2::NatGateway", /* @__PURE__ */ new Map([["VpcId", "AWS derives the VPC from SubnetId; the ec2:CreateNatGateway API has no VpcId parameter"]])],
+		["AWS::EC2::EIP", /* @__PURE__ */ new Map([
+			["Address", "Bring-your-own-IP: allocating a specific address you own is not yet supported; cdkd allocates an Amazon-owned address"],
+			["IpamPoolId", "Allocation from an IPAM pool is not yet supported"],
+			["TransferAddress", "Accepting a transferred Elastic IP is not yet supported (out-of-band EIP transfer flow)"]
+		])]
 	]);
 	constructor() {
 		const awsClients = getAwsClients();
@@ -15122,6 +15134,7 @@ var EC2Provider = class {
 			case "AWS::EC2::VPC": return this.createVpc(logicalId, resourceType, properties);
 			case "AWS::EC2::Subnet": return this.createSubnet(logicalId, resourceType, properties);
 			case "AWS::EC2::InternetGateway": return this.createInternetGateway(logicalId, resourceType, properties);
+			case "AWS::EC2::EIP": return this.createEip(logicalId, resourceType, properties);
 			case "AWS::EC2::VPCGatewayAttachment": return this.createVpcGatewayAttachment(logicalId, resourceType, properties);
 			case "AWS::EC2::NatGateway": return this.createNatGateway(logicalId, resourceType, properties);
 			case "AWS::EC2::RouteTable": return this.createRouteTable(logicalId, resourceType, properties);
@@ -15141,6 +15154,7 @@ var EC2Provider = class {
 			case "AWS::EC2::VPC": return this.updateVpc(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::EC2::Subnet": return this.updateSubnet(logicalId, physicalId);
 			case "AWS::EC2::InternetGateway": return this.updateInternetGateway(logicalId, physicalId);
+			case "AWS::EC2::EIP": return this.updateEip(logicalId, physicalId, properties, previousProperties);
 			case "AWS::EC2::VPCGatewayAttachment": return this.updateVpcGatewayAttachment(logicalId, physicalId);
 			case "AWS::EC2::NatGateway": return this.updateNatGateway(logicalId, physicalId);
 			case "AWS::EC2::RouteTable": return this.updateRouteTable(logicalId, physicalId);
@@ -15160,6 +15174,7 @@ var EC2Provider = class {
 			case "AWS::EC2::VPC": return this.deleteVpc(logicalId, physicalId, resourceType, context);
 			case "AWS::EC2::Subnet": return this.deleteSubnet(logicalId, physicalId, resourceType, context);
 			case "AWS::EC2::InternetGateway": return this.deleteInternetGateway(logicalId, physicalId, resourceType, context);
+			case "AWS::EC2::EIP": return this.deleteEip(logicalId, physicalId, resourceType, context);
 			case "AWS::EC2::VPCGatewayAttachment": return this.deleteVpcGatewayAttachment(logicalId, physicalId, resourceType, context);
 			case "AWS::EC2::NatGateway": return this.deleteNatGateway(logicalId, physicalId, resourceType, context);
 			case "AWS::EC2::RouteTable": return this.deleteRouteTable(logicalId, physicalId, resourceType, context);
@@ -15182,6 +15197,7 @@ var EC2Provider = class {
 			case "AWS::EC2::Subnet": return this.getSubnetAttribute(physicalId, attributeName);
 			case "AWS::EC2::SecurityGroup": return this.getSecurityGroupAttribute(physicalId, attributeName);
 			case "AWS::EC2::Instance": return this.getInstanceAttribute(physicalId, attributeName);
+			case "AWS::EC2::EIP": return this.getEipAttribute(physicalId, attributeName);
 			default: return;
 		}
 	}
@@ -15490,6 +15506,111 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to delete InternetGateway ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	eipPhysicalId(publicIp, allocationId) {
+		return `${publicIp}|${allocationId}`;
+	}
+	parseEipPhysicalId(physicalId) {
+		if (physicalId.includes("|")) {
+			const [publicIp, allocationId] = physicalId.split("|");
+			return {
+				publicIp,
+				allocationId
+			};
+		}
+		if (physicalId.startsWith("eipalloc-")) return { allocationId: physicalId };
+		return { publicIp: physicalId };
+	}
+	async createEip(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating EIP ${logicalId}`);
+		try {
+			const response = await this.ec2Client.send(new AllocateAddressCommand({
+				Domain: properties["Domain"] ?? "vpc",
+				NetworkBorderGroup: properties["NetworkBorderGroup"],
+				PublicIpv4Pool: properties["PublicIpv4Pool"]
+			}));
+			const allocationId = response.AllocationId;
+			const publicIp = response.PublicIp;
+			await this.applyTags(allocationId, properties, logicalId);
+			const instanceId = properties["InstanceId"];
+			if (instanceId) {
+				await this.ec2Client.send(new AssociateAddressCommand({
+					AllocationId: allocationId,
+					InstanceId: instanceId
+				}));
+				this.logger.debug(`Associated EIP ${logicalId} (${allocationId}) to ${instanceId}`);
+			}
+			this.logger.debug(`Successfully created EIP ${logicalId}: ${allocationId} (${publicIp})`);
+			return {
+				physicalId: this.eipPhysicalId(publicIp, allocationId),
+				attributes: {
+					AllocationId: allocationId,
+					PublicIp: publicIp
+				}
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create EIP ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	async updateEip(logicalId, physicalId, properties, previousProperties) {
+		this.logger.debug(`Updating EIP ${logicalId}: ${physicalId}`);
+		const { allocationId } = this.parseEipPhysicalId(physicalId);
+		if (allocationId) {
+			await this.applyTagDiff(allocationId, previousProperties["Tags"], properties["Tags"]);
+			const oldInstanceId = previousProperties["InstanceId"];
+			const newInstanceId = properties["InstanceId"];
+			if (oldInstanceId !== newInstanceId) if (newInstanceId) await this.ec2Client.send(new AssociateAddressCommand({
+				AllocationId: allocationId,
+				InstanceId: newInstanceId,
+				AllowReassociation: true
+			}));
+			else {
+				const associationId = (await this.ec2Client.send(new DescribeAddressesCommand({ AllocationIds: [allocationId] }))).Addresses?.[0]?.AssociationId;
+				if (associationId) await this.ec2Client.send(new DisassociateAddressCommand({ AssociationId: associationId }));
+			}
+		}
+		return {
+			physicalId,
+			wasReplaced: false
+		};
+	}
+	async deleteEip(logicalId, physicalId, resourceType, context) {
+		this.logger.debug(`Deleting EIP ${logicalId}: ${physicalId}`);
+		const parsed = this.parseEipPhysicalId(physicalId);
+		let allocationId = parsed.allocationId;
+		if (!allocationId && parsed.publicIp) {
+			allocationId = (await this.ec2Client.send(new DescribeAddressesCommand({ PublicIps: [parsed.publicIp] }))).Addresses?.[0]?.AllocationId;
+			if (!allocationId) {
+				this.logger.debug(`EIP ${physicalId} not found on lookup, skipping deletion`);
+				return;
+			}
+		}
+		try {
+			await this.withDependencyViolationRetry(() => this.ec2Client.send(new ReleaseAddressCommand({ AllocationId: allocationId })), { description: `ReleaseAddress ${logicalId} (${allocationId})` });
+			this.logger.debug(`Successfully deleted EIP ${logicalId}`);
+		} catch (error) {
+			if (this.isNotFoundError(error)) {
+				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`EIP ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete EIP ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async getEipAttribute(physicalId, attributeName) {
+		const { publicIp, allocationId } = this.parseEipPhysicalId(physicalId);
+		if (attributeName === "AllocationId" && allocationId) return allocationId;
+		if (attributeName === "PublicIp" && publicIp) return publicIp;
+		const filter = allocationId ? { AllocationIds: [allocationId] } : { PublicIps: publicIp ? [publicIp] : [] };
+		const addr = (await this.ec2Client.send(new DescribeAddressesCommand(filter))).Addresses?.[0];
+		if (!addr) return void 0;
+		switch (attributeName) {
+			case "AllocationId": return addr.AllocationId;
+			case "PublicIp": return addr.PublicIp;
+			default: return;
+		}
+	}
 	async createVpcGatewayAttachment(logicalId, resourceType, properties) {
 		this.logger.debug(`Creating VPCGatewayAttachment ${logicalId}`);
 		const vpcId = properties["VpcId"];
@@ -15554,7 +15675,9 @@ var EC2Provider = class {
 				this.logger.debug(`Waiting for NatGateway ${natGatewayId} to reach available state...`);
 				await waitUntilNatGatewayAvailable({
 					client: this.ec2Client,
-					maxWaitTime: 900
+					maxWaitTime: 900,
+					minDelay: 5,
+					maxDelay: 15
 				}, { NatGatewayIds: [natGatewayId] });
 				this.logger.debug(`NatGateway ${natGatewayId} is available`);
 			} else this.logger.debug(`NatGateway ${natGatewayId} created (skipping available-state wait per --no-wait)`);
@@ -15588,7 +15711,9 @@ var EC2Provider = class {
 		try {
 			await waitUntilNatGatewayDeleted({
 				client: this.ec2Client,
-				maxWaitTime: 900
+				maxWaitTime: 900,
+				minDelay: 5,
+				maxDelay: 15
 			}, { NatGatewayIds: [physicalId] });
 		} catch (error) {
 			this.logger.warn(`Wait for NatGateway ${physicalId} deletion did not complete cleanly: ${error instanceof Error ? error.message : String(error)} — proceeding with downstream delete steps`);
@@ -15996,7 +16121,9 @@ var EC2Provider = class {
 				this.logger.debug(`Waiting for instance ${instanceId} to be running...`);
 				await waitUntilInstanceRunning({
 					client: this.ec2Client,
-					maxWaitTime: 300
+					maxWaitTime: 300,
+					minDelay: 5,
+					maxDelay: 15
 				}, { InstanceIds: [instanceId] });
 				if (iamInstanceProfile) await this.ensureIamInstanceProfileAssociated(instanceId, iamInstanceProfile.arn, iamInstanceProfile.name, logicalId);
 				const runningInstance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [instanceId] }))).Reservations?.[0]?.Instances?.[0];
@@ -16245,7 +16372,9 @@ var EC2Provider = class {
 			this.logger.debug(`Terminate requested for EC2 Instance ${logicalId}, waiting...`);
 			await waitUntilInstanceTerminated({
 				client: this.ec2Client,
-				maxWaitTime: 300
+				maxWaitTime: 300,
+				minDelay: 5,
+				maxDelay: 15
 			}, { InstanceIds: [physicalId] });
 			this.logger.debug(`EC2 Instance ${logicalId} terminated: ${physicalId}`);
 			return;
@@ -16748,7 +16877,7 @@ var EC2Provider = class {
 		if (!(error instanceof Error)) return false;
 		const message = error.message.toLowerCase();
 		const name = error.name ?? "";
-		return message.includes("not found") || message.includes("does not exist") || message.includes("invalidparametervalue") || name === "InvalidVpcID.NotFound" || name === "InvalidSubnetID.NotFound" || name === "InvalidInternetGatewayID.NotFound" || name === "InvalidRouteTableID.NotFound" || name === "InvalidGroup.NotFound" || name === "InvalidAssociationID.NotFound" || name === "InvalidRoute.NotFound" || name === "InvalidInstanceID.NotFound" || name === "InvalidNetworkAclID.NotFound" || name === "InvalidNetworkAclEntry.NotFound";
+		return message.includes("not found") || message.includes("does not exist") || message.includes("invalidparametervalue") || name === "InvalidVpcID.NotFound" || name === "InvalidSubnetID.NotFound" || name === "InvalidInternetGatewayID.NotFound" || name === "InvalidRouteTableID.NotFound" || name === "InvalidGroup.NotFound" || name === "InvalidAssociationID.NotFound" || name === "InvalidRoute.NotFound" || name === "InvalidInstanceID.NotFound" || name === "InvalidNetworkAclID.NotFound" || name === "InvalidNetworkAclEntry.NotFound" || name === "InvalidAllocationID.NotFound" || name === "InvalidAddressID.NotFound";
 	}
 	/**
 	* Adopt an existing EC2 networking resource into cdkd state.
@@ -17289,6 +17418,19 @@ var EC2Provider = class {
 					physicalId,
 					attributes: {}
 				} : null;
+				case "AWS::EC2::EIP": {
+					const { allocationId, publicIp } = this.parseEipPhysicalId(physicalId);
+					const filter = allocationId ? { AllocationIds: [allocationId] } : { PublicIps: publicIp ? [publicIp] : [] };
+					const addr = (await this.ec2Client.send(new DescribeAddressesCommand(filter))).Addresses?.[0];
+					if (!addr?.AllocationId || !addr.PublicIp) return null;
+					return {
+						physicalId: this.eipPhysicalId(addr.PublicIp, addr.AllocationId),
+						attributes: {
+							AllocationId: addr.AllocationId,
+							PublicIp: addr.PublicIp
+						}
+					};
+				}
 				default: return null;
 			}
 		} catch (error) {
@@ -20251,9 +20393,9 @@ var CloudFrontDistributionProvider = class {
 	* Uses exponential backoff polling.
 	*/
 	async waitForDistributionStable(distributionId, expectedEnabled) {
-		const maxAttempts = 60;
+		const maxAttempts = 120;
 		let delay = 5e3;
-		const maxDelay = 3e4;
+		const maxDelay = 1e4;
 		let interrupted = false;
 		const sigintHandler = () => {
 			interrupted = true;
@@ -22376,7 +22518,19 @@ var ECSProvider = class {
 			startTimeout: def["StartTimeout"],
 			stopTimeout: def["StopTimeout"],
 			interactive: def["Interactive"],
-			pseudoTerminal: def["PseudoTerminal"]
+			pseudoTerminal: def["PseudoTerminal"],
+			repositoryCredentials: def["RepositoryCredentials"] ? pascalToCamelCaseKeys(def["RepositoryCredentials"]) : void 0,
+			firelensConfiguration: this.convertFirelensConfiguration(def["FirelensConfiguration"]),
+			resourceRequirements: def["ResourceRequirements"] ? pascalToCamelCaseKeys(def["ResourceRequirements"]) : void 0,
+			systemControls: def["SystemControls"] ? pascalToCamelCaseKeys(def["SystemControls"]) : void 0,
+			extraHosts: def["ExtraHosts"] ? pascalToCamelCaseKeys(def["ExtraHosts"]) : void 0,
+			restartPolicy: def["RestartPolicy"] ? pascalToCamelCaseKeys(def["RestartPolicy"]) : void 0,
+			dnsServers: def["DnsServers"],
+			dnsSearchDomains: def["DnsSearchDomains"],
+			dockerSecurityOptions: def["DockerSecurityOptions"],
+			credentialSpecs: def["CredentialSpecs"],
+			hostname: def["Hostname"],
+			versionConsistency: def["VersionConsistency"]
 		}));
 	}
 	/**
@@ -22494,6 +22648,20 @@ var ECSProvider = class {
 		};
 	}
 	/**
+	* Convert CFn `ContainerDefinitions[].FirelensConfiguration` to the ECS SDK
+	* shape (issue #1173). `Type` flips to `type`, but `Options` is a free-form
+	* map of user-supplied FireLens options (e.g. `enable-ecs-log-metadata`,
+	* `config-file-value`) whose keys are NOT CFn property names, so it is copied
+	* verbatim rather than case-flipped.
+	*/
+	convertFirelensConfiguration(config) {
+		if (!config) return void 0;
+		return {
+			type: config["Type"],
+			options: config["Options"]
+		};
+	}
+	/**
 	* Convert CFn HealthCheck to ECS SDK format
 	*/
 	convertHealthCheck(check) {
@@ -22769,6 +22937,23 @@ var ECSProvider = class {
 			if (c.stopTimeout !== void 0) out["StopTimeout"] = c.stopTimeout;
 			if (c.interactive !== void 0) out["Interactive"] = c.interactive;
 			if (c.pseudoTerminal !== void 0) out["PseudoTerminal"] = c.pseudoTerminal;
+			if (c.repositoryCredentials) out["RepositoryCredentials"] = camelToPascalCaseKeys(c.repositoryCredentials);
+			if (c.firelensConfiguration) {
+				const fc = {};
+				if (c.firelensConfiguration.type !== void 0) fc["Type"] = c.firelensConfiguration.type;
+				if (c.firelensConfiguration.options && Object.keys(c.firelensConfiguration.options).length > 0) fc["Options"] = { ...c.firelensConfiguration.options };
+				if (Object.keys(fc).length > 0) out["FirelensConfiguration"] = fc;
+			}
+			if (c.resourceRequirements && c.resourceRequirements.length > 0) out["ResourceRequirements"] = camelToPascalCaseKeys(c.resourceRequirements);
+			if (c.systemControls && c.systemControls.length > 0) out["SystemControls"] = camelToPascalCaseKeys(c.systemControls);
+			if (c.extraHosts && c.extraHosts.length > 0) out["ExtraHosts"] = camelToPascalCaseKeys(c.extraHosts);
+			if (c.restartPolicy) out["RestartPolicy"] = camelToPascalCaseKeys(c.restartPolicy);
+			if (c.dnsServers && c.dnsServers.length > 0) out["DnsServers"] = [...c.dnsServers];
+			if (c.dnsSearchDomains && c.dnsSearchDomains.length > 0) out["DnsSearchDomains"] = [...c.dnsSearchDomains];
+			if (c.dockerSecurityOptions && c.dockerSecurityOptions.length > 0) out["DockerSecurityOptions"] = [...c.dockerSecurityOptions];
+			if (c.credentialSpecs && c.credentialSpecs.length > 0) out["CredentialSpecs"] = [...c.credentialSpecs];
+			if (c.hostname !== void 0) out["Hostname"] = c.hostname;
+			if (c.versionConsistency !== void 0 && c.versionConsistency !== "enabled") out["VersionConsistency"] = c.versionConsistency;
 			return out;
 		});
 	}
@@ -42265,6 +42450,7 @@ function registerAllProviders(registry) {
 	registry.register("AWS::EC2::VPC", ec2Provider);
 	registry.register("AWS::EC2::Subnet", ec2Provider);
 	registry.register("AWS::EC2::InternetGateway", ec2Provider);
+	registry.register("AWS::EC2::EIP", ec2Provider);
 	registry.register("AWS::EC2::VPCGatewayAttachment", ec2Provider);
 	registry.register("AWS::EC2::NatGateway", ec2Provider);
 	registry.register("AWS::EC2::RouteTable", ec2Provider);
@@ -61824,7 +62010,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.260.7");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.260.9");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());