@go-to-k/cdkd 0.269.3 → 0.270.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-B-igYtBj.js";
+import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-D3tkYlnl.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-D-XHoXeI.js";
+import { t as ASGProvider } from "./asg-provider-D3Ioxi3j.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -18,11 +18,11 @@ import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, Descri
 import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, GetSecretValueCommand, RemoveRegionsFromReplicationCommand, ReplicateSecretToRegionsCommand, ResourceNotFoundException as ResourceNotFoundException$3, SecretsManagerClient, TagResourceCommand as TagResourceCommand$5, UntagResourceCommand as UntagResourceCommand$5, UpdateSecretCommand } from "@aws-sdk/client-secrets-manager";
 import { AddTagsToResourceCommand, DeleteParameterCommand, DescribeParametersCommand, GetParameterCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$2, ParameterNotFound, PutParameterCommand, RemoveTagsFromResourceCommand, SSMClient } from "@aws-sdk/client-ssm";
 import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, CreateOriginAccessControlCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, DeleteOriginAccessControlCommand, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, GetOriginAccessControlCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, NoSuchOriginAccessControl, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand, UpdateOriginAccessControlCommand } from "@aws-sdk/client-cloudfront";
-import { CloudWatchClient, DeleteAlarmsCommand, DescribeAlarmsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$4, PutMetricAlarmCommand, TagResourceCommand as TagResourceCommand$7, UntagResourceCommand as UntagResourceCommand$7 } from "@aws-sdk/client-cloudwatch";
-import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
-import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
-import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$6, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
-import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ListTagsCommand as ListTagsCommand$1, ResourceNotFoundException as ResourceNotFoundException$7, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
+import { CloudWatchClient, DeleteAlarmsCommand, DeleteAnomalyDetectorCommand, DescribeAlarmsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$4, PutAnomalyDetectorCommand, PutMetricAlarmCommand, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$7, UntagResourceCommand as UntagResourceCommand$7 } from "@aws-sdk/client-cloudwatch";
+import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
+import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$6, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
+import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$7, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
+import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ListTagsCommand as ListTagsCommand$1, ResourceNotFoundException as ResourceNotFoundException$8, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
 import * as fs from "node:fs";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
@@ -48,23 +48,23 @@ import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMach
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
-import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$8, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$9, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$9, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
-import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$10, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$11, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
-import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$11, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
+import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
-import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$12, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
+import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$13, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
 import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import AdmZip from "adm-zip";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$13, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$14, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3vectors";
 import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
@@ -10324,7 +10324,7 @@ var LambdaMicrovmImageProvider = class {
 			try {
 				await this.client.send(new DeleteMicrovmImageCommand({ imageIdentifier: physicalId }));
 			} catch (error) {
-				if (error instanceof ResourceNotFoundException$7) {
+				if (error instanceof ResourceNotFoundException$8) {
 					assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`MicroVM image ${physicalId} does not exist, skipping deletion`);
 					return;
@@ -10369,7 +10369,7 @@ var LambdaMicrovmImageProvider = class {
 				attributes: { ImageArn: arn }
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$7) return null;
+			if (error instanceof ResourceNotFoundException$8) return null;
 			throw error;
 		}
 	}
@@ -10395,7 +10395,7 @@ var LambdaMicrovmImageProvider = class {
 		try {
 			name = (await this.client.send(new GetMicrovmImageCommand({ imageIdentifier: physicalId }))).name;
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$7) return void 0;
+			if (error instanceof ResourceNotFoundException$8) return void 0;
 			throw error;
 		}
 		const result = {};
@@ -10454,7 +10454,7 @@ var LambdaMicrovmImageProvider = class {
 			try {
 				resp = await this.client.send(new GetMicrovmImageCommand({ imageIdentifier: imageArn }));
 			} catch (error) {
-				if (error instanceof ResourceNotFoundException$7) return;
+				if (error instanceof ResourceNotFoundException$8) return;
 				throw error;
 			}
 			if (resp.state === "DELETE_FAILED") throw new Error(`MicroVM image ${logicalId} (${imageArn}) entered DELETE_FAILED. Check the CloudWatch build logs under /aws/lambda/microvms/ to diagnose.`);
@@ -13070,7 +13070,7 @@ var LogsLogGroupProvider = class {
 		} else try {
 			await this.logsClient.send(new DeleteIndexPolicyCommand({ logGroupIdentifier: physicalId }));
 		} catch (err) {
-			if (!(err instanceof ResourceNotFoundException$4)) throw err;
+			if (!(err instanceof ResourceNotFoundException$5)) throw err;
 		}
 		const newTags = properties["Tags"];
 		const oldTags = previousProperties["Tags"];
@@ -13116,7 +13116,7 @@ var LogsLogGroupProvider = class {
 			await this.logsClient.send(new DeleteLogGroupCommand({ logGroupName: physicalId }));
 			this.logger.debug(`Successfully deleted log group ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$4) {
+			if (error instanceof ResourceNotFoundException$5) {
 				assertRegionMatch(await this.logsClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Log group ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -13207,7 +13207,7 @@ var LogsLogGroupProvider = class {
 				try {
 					tags = normalizeAwsTagsToCfn((await this.logsClient.send(new ListTagsForResourceCommand$5({ resourceArn: arnForTags }))).tags);
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException$4) return void 0;
+					if (err instanceof ResourceNotFoundException$5) return void 0;
 					throw err;
 				}
 			}
@@ -13236,7 +13236,7 @@ var LogsLogGroupProvider = class {
 			result["FieldIndexPolicies"] = fieldIndexPolicies;
 			return result;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$4) return void 0;
+			if (err instanceof ResourceNotFoundException$5) return void 0;
 			throw err;
 		}
 	}
@@ -13255,7 +13255,7 @@ var LogsLogGroupProvider = class {
 				attributes: {}
 			} : null;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$4) return null;
+			if (err instanceof ResourceNotFoundException$5) return null;
 			throw err;
 		}
 		return null;
@@ -13584,6 +13584,233 @@ var CloudWatchAlarmProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/cloudwatch-anomaly-detector-provider.ts
+/**
+* AWS CloudWatch AnomalyDetector Provider (issue #1304)
+*
+* Implements resource provisioning for AWS::CloudWatch::AnomalyDetector using
+* the CloudWatch SDK. The type is NON_PROVISIONABLE in the CloudFormation
+* registry (no Cloud Control handlers), so without this provider cdkd's
+* pre-flight rejects any template that declares it.
+*
+* API mapping: `PutAnomalyDetector` is an UPSERT keyed by the metric
+* descriptor (the single-metric tuple or the metric-math query set), and
+* `DeleteAnomalyDetector` takes the same descriptor. There is no
+* server-generated identifier; the registry schema's read-only `Id`
+* primaryIdentifier has no Cloud Control handler to mint it. cdkd therefore
+* derives a DETERMINISTIC physical id from the descriptor (see
+* {@link derivePhysicalId}) — every descriptor field is createOnly in the
+* registry schema, so the id is stable across in-place updates
+* (`Configuration` is the only mutable property).
+*/
+var CloudWatchAnomalyDetectorProvider = class {
+	cloudWatchClient;
+	logger = getLogger().child("CloudWatchAnomalyDetectorProvider");
+	/**
+	* NON_PROVISIONABLE type: Cloud Control has no handlers for it, so the
+	* #614 unhandled-property auto-route must never send an
+	* AnomalyDetector template to the CC path (it would fail at deploy time
+	* with no handler). All properties are handled here instead.
+	*/
+	disableCcApiFallback = true;
+	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudWatch::AnomalyDetector", /* @__PURE__ */ new Set([
+		"Namespace",
+		"MetricName",
+		"Stat",
+		"Dimensions",
+		"Configuration",
+		"MetricCharacteristics",
+		"SingleMetricAnomalyDetector",
+		"MetricMathAnomalyDetector"
+	])]]);
+	constructor() {
+		const awsClients = getAwsClients();
+		this.cloudWatchClient = awsClients.cloudWatch;
+	}
+	/**
+	* Create an anomaly detection model via `PutAnomalyDetector`.
+	*/
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating CloudWatch anomaly detector ${logicalId}`);
+		const params = buildPutParams(properties);
+		if (!hasDescriptor(params)) throw new ProvisioningError(`AnomalyDetector ${logicalId} needs a metric descriptor: either SingleMetricAnomalyDetector, MetricMathAnomalyDetector, or the top-level Namespace/MetricName/Stat fields`, resourceType, logicalId);
+		try {
+			await this.cloudWatchClient.send(new PutAnomalyDetectorCommand(params));
+			const physicalId = derivePhysicalId(properties);
+			this.logger.debug(`Successfully created CloudWatch anomaly detector ${logicalId}: ${physicalId}`);
+			return {
+				physicalId,
+				attributes: { Id: physicalId }
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create CloudWatch anomaly detector ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update an anomaly detection model.
+	*
+	* Every descriptor field (Namespace / MetricName / Stat / Dimensions /
+	* SingleMetricAnomalyDetector / MetricMathAnomalyDetector /
+	* MetricCharacteristics) is createOnly in the registry schema, so the
+	* diff layer classifies a change to any of them as a REPLACEMENT and this
+	* method never sees it. The only in-place change is `Configuration`
+	* (excluded time ranges / time zone), which `PutAnomalyDetector` upserts
+	* for the unchanged descriptor.
+	*
+	* Removal semantics: `PutAnomalyDetector` REPLACES the stored
+	* Configuration rather than merging (live-verified 2026-07-31 — a Put
+	* with no `Configuration` resets MetricTimezone + ExcludedTimeRanges to
+	* defaults), so re-putting the full desired properties matches CFn's
+	* "removed property resets to default" behavior with no extra clearing.
+	*/
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+		this.logger.debug(`Updating CloudWatch anomaly detector ${logicalId}: ${physicalId}`);
+		try {
+			await this.cloudWatchClient.send(new PutAnomalyDetectorCommand(buildPutParams(properties)));
+			this.logger.debug(`Successfully updated CloudWatch anomaly detector ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: { Id: physicalId }
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update CloudWatch anomaly detector ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Delete an anomaly detection model via `DeleteAnomalyDetector`.
+	*
+	* The API takes the metric DESCRIPTOR (not an id), so the state-recorded
+	* `properties` are required to address the model. `ResourceNotFoundException`
+	* is treated as idempotent success (after the shared region check).
+	*/
+	async delete(logicalId, physicalId, resourceType, properties, context) {
+		this.logger.debug(`Deleting CloudWatch anomaly detector ${logicalId}: ${physicalId}`);
+		if (!properties) throw new ProvisioningError(`Cannot delete AnomalyDetector ${logicalId}: the state record carries no properties, and DeleteAnomalyDetector addresses the model by its metric descriptor. Use 'cdkd state orphan <stack>' to drop the record and delete the detector manually.`, resourceType, logicalId, physicalId);
+		try {
+			await this.cloudWatchClient.send(new DeleteAnomalyDetectorCommand(buildDeleteParams(properties)));
+			this.logger.debug(`Successfully deleted CloudWatch anomaly detector ${logicalId}`);
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$4) {
+				assertRegionMatch(await this.cloudWatchClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`Anomaly detector ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete CloudWatch anomaly detector ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Resolve a `Fn::GetAtt` attribute. The registry schema exposes a single
+	* read-only attribute, `Id` — cdkd's deterministic physical id.
+	*/
+	async getAttribute(physicalId, resourceType, attributeName) {
+		if (attributeName === "Id") return physicalId;
+		throw new ProvisioningError(`Unknown attribute ${attributeName} for ${resourceType} (only 'Id' is defined)`, resourceType, physicalId);
+	}
+	/**
+	* Adopt an existing anomaly detector into cdkd state.
+	*
+	* **Explicit override only.** Anomaly detectors are addressed by their
+	* metric descriptor, carry no tags, and have no name property — there is
+	* nothing to auto-look them up by. Users adopting one should pass
+	* `--resource <logicalId>=<id>` where `<id>` is any stable identifier
+	* (cdkd re-derives the canonical one on the next replacement).
+	*/
+	async import(input) {
+		if (input.knownPhysicalId) return {
+			physicalId: input.knownPhysicalId,
+			attributes: { Id: input.knownPhysicalId }
+		};
+		return null;
+	}
+};
+/**
+* Map CFn-shaped properties onto the `PutAnomalyDetector` input. CloudWatch's
+* SDK uses the same PascalCase field names as the CloudFormation schema, so
+* the mapping is structural: the only shape conversion is
+* `Configuration.ExcludedTimeRanges[].StartTime/EndTime`, which CFn carries
+* as ISO-8601 strings and the SDK models as `Date`.
+*/
+function buildPutParams(properties) {
+	const params = {};
+	const single = properties["SingleMetricAnomalyDetector"];
+	if (single !== void 0) params.SingleMetricAnomalyDetector = single;
+	const math = properties["MetricMathAnomalyDetector"];
+	if (math !== void 0) params.MetricMathAnomalyDetector = math;
+	if (properties["Namespace"] !== void 0) params.Namespace = properties["Namespace"];
+	if (properties["MetricName"] !== void 0) params.MetricName = properties["MetricName"];
+	if (properties["Stat"] !== void 0) params.Stat = properties["Stat"];
+	if (properties["Dimensions"] !== void 0) params.Dimensions = properties["Dimensions"];
+	const configuration = properties["Configuration"];
+	if (configuration !== void 0) {
+		const mapped = {};
+		if (configuration["MetricTimeZone"] !== void 0) mapped.MetricTimezone = configuration["MetricTimeZone"];
+		const ranges = configuration["ExcludedTimeRanges"];
+		if (ranges !== void 0) mapped.ExcludedTimeRanges = ranges.map((r) => ({
+			StartTime: toDate(r["StartTime"]),
+			EndTime: toDate(r["EndTime"])
+		}));
+		params.Configuration = mapped;
+	}
+	const characteristics = properties["MetricCharacteristics"];
+	if (characteristics !== void 0) params.MetricCharacteristics = characteristics;
+	return params;
+}
+/**
+* `DeleteAnomalyDetector` addresses the model by the same descriptor shape as
+* Put, minus the mutable `Configuration` / `MetricCharacteristics`.
+*/
+function buildDeleteParams(properties) {
+	const params = {};
+	const single = properties["SingleMetricAnomalyDetector"];
+	if (single !== void 0) params.SingleMetricAnomalyDetector = single;
+	const math = properties["MetricMathAnomalyDetector"];
+	if (math !== void 0) params.MetricMathAnomalyDetector = math;
+	if (properties["Namespace"] !== void 0) params.Namespace = properties["Namespace"];
+	if (properties["MetricName"] !== void 0) params.MetricName = properties["MetricName"];
+	if (properties["Stat"] !== void 0) params.Stat = properties["Stat"];
+	if (properties["Dimensions"] !== void 0) params.Dimensions = properties["Dimensions"];
+	return params;
+}
+/** CFn carries Range times as ISO-8601 strings; the SDK models them as Date. */
+function toDate(value) {
+	if (value === void 0) return void 0;
+	if (value instanceof Date) return value;
+	const parsed = new Date(String(value));
+	if (Number.isNaN(parsed.getTime())) throw new Error(`Configuration.ExcludedTimeRanges contains an unparsable time value: ${String(value)}`);
+	return parsed;
+}
+/**
+* Derive the deterministic physical id from the metric descriptor.
+*
+* Single-metric detectors get a readable composite
+* (`<Namespace>:<MetricName>:<Stat>[:<Name=Value,...>]`, dimensions sorted by
+* name so template ordering does not change the id); metric-math detectors
+* get a content hash of their query set (`math:<sha256-16>`). Descriptor
+* fields are all createOnly, so the id never changes across in-place updates.
+*/
+function derivePhysicalId(properties) {
+	const single = properties["SingleMetricAnomalyDetector"];
+	const namespace = single?.Namespace ?? properties["Namespace"];
+	const metricName = single?.MetricName ?? properties["MetricName"];
+	const stat = single?.Stat ?? properties["Stat"];
+	const dimensions = single?.Dimensions ?? properties["Dimensions"];
+	if (namespace !== void 0 || metricName !== void 0) {
+		const dims = (dimensions ?? []).map((d) => `${d.Name}=${d.Value}`).sort().join(",");
+		const base = `${single?.AccountId !== void 0 ? `${single.AccountId}:` : ""}${namespace ?? ""}:${metricName ?? ""}:${stat ?? ""}`;
+		return dims.length > 0 ? `${base}:${dims}` : base;
+	}
+	const math = properties["MetricMathAnomalyDetector"];
+	return `math:${createHash("sha256").update(JSON.stringify(math ?? {})).digest("hex").slice(0, 16)}`;
+}
+function hasDescriptor(params) {
+	return params.SingleMetricAnomalyDetector !== void 0 || params.MetricMathAnomalyDetector !== void 0 || params.Namespace !== void 0 || params.MetricName !== void 0;
+}
+
 //#endregion
 //#region src/provisioning/providers/secretsmanager-secret-provider.ts
 /**
@@ -21208,7 +21435,7 @@ var AgentCoreRuntimeProvider = class {
 			await this.client.send(new DeleteAgentRuntimeCommand({ agentRuntimeId: physicalId }));
 			this.logger.debug(`Successfully deleted BedrockAgentCore Runtime ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$5) {
+			if (error instanceof ResourceNotFoundException$6) {
 				assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Runtime ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -21303,7 +21530,7 @@ var AgentCoreRuntimeProvider = class {
 		try {
 			resp = await this.client.send(new GetAgentRuntimeCommand({ agentRuntimeId: physicalId }));
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$5) return void 0;
+			if (err instanceof ResourceNotFoundException$6) return void 0;
 			throw err;
 		}
 		const result = {};
@@ -21778,7 +22005,7 @@ var AgentCoreEvaluatorProvider = class {
 			await this.client.send(new DeleteEvaluatorCommand({ evaluatorId: evaluatorIdFromArn(physicalId) }));
 			this.logger.debug(`Successfully deleted BedrockAgentCore Evaluator ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$5) {
+			if (error instanceof ResourceNotFoundException$6) {
 				assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Evaluator ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -21817,7 +22044,7 @@ var AgentCoreEvaluatorProvider = class {
 		try {
 			resp = await this.client.send(new GetEvaluatorCommand({ evaluatorId: evaluatorIdFromArn(physicalId) }));
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$5) return void 0;
+			if (err instanceof ResourceNotFoundException$6) return void 0;
 			throw err;
 		}
 		const result = {};
@@ -28625,7 +28852,7 @@ var CognitoUserPoolProvider = class {
 				if (!templatedActive) try {
 					needsFlip = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool?.DeletionProtection === "ACTIVE";
 				} catch (descError) {
-					if (descError instanceof ResourceNotFoundException$8) {
+					if (descError instanceof ResourceNotFoundException$9) {
 						assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 						this.logger.debug(`Cognito User Pool ${physicalId} does not exist, skipping deletion`);
 						return;
@@ -28648,7 +28875,7 @@ var CognitoUserPoolProvider = class {
 			await this.getClient().send(new DeleteUserPoolCommand({ UserPoolId: physicalId }));
 			this.logger.debug(`Successfully deleted Cognito User Pool ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$8) {
+			if (error instanceof ResourceNotFoundException$9) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Cognito User Pool ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -28681,7 +28908,7 @@ var CognitoUserPoolProvider = class {
 		try {
 			resp = await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }));
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$8) return void 0;
+			if (err instanceof ResourceNotFoundException$9) return void 0;
 			throw err;
 		}
 		const pool = resp.UserPool;
@@ -28755,7 +28982,7 @@ var CognitoUserPoolProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$8) return null;
+			if (err instanceof ResourceNotFoundException$9) return null;
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["UserPoolName"] === "string" ? input.properties["UserPoolName"] : void 0;
@@ -33784,7 +34011,7 @@ var KinesisStreamProvider = class {
 			}));
 			this.logger.debug(`Successfully deleted Kinesis stream ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$9) {
+			if (error instanceof ResourceNotFoundException$10) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Kinesis stream ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -33859,7 +34086,7 @@ var KinesisStreamProvider = class {
 		try {
 			stream = (await this.getClient().send(new DescribeStreamCommand({ StreamName: physicalId }))).StreamDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$9) return void 0;
+			if (err instanceof ResourceNotFoundException$10) return void 0;
 			throw err;
 		}
 		if (!stream) return void 0;
@@ -33877,7 +34104,7 @@ var KinesisStreamProvider = class {
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForStreamCommand({ StreamName: physicalId }))).Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$9) return void 0;
+			if (err instanceof ResourceNotFoundException$10) return void 0;
 			this.logger.debug(`Kinesis ListTagsForStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
 		return result;
@@ -33891,7 +34118,7 @@ var KinesisStreamProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$9) return null;
+			if (err instanceof ResourceNotFoundException$10) return null;
 			throw err;
 		}
 		return null;
@@ -34079,7 +34306,7 @@ var KinesisStreamConsumerProvider = class {
 			await this.getClient().send(new DeregisterStreamConsumerCommand({ ConsumerARN: physicalId }));
 			this.logger.debug(`Successfully deregistered Kinesis stream consumer ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$9) {
+			if (error instanceof ResourceNotFoundException$10) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Kinesis stream consumer ${physicalId} not found, skipping`);
 				return;
@@ -34125,7 +34352,7 @@ var KinesisStreamConsumerProvider = class {
 		try {
 			desc = (await this.getClient().send(new DescribeStreamConsumerCommand({ ConsumerARN: physicalId }))).ConsumerDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$9) return void 0;
+			if (err instanceof ResourceNotFoundException$10) return void 0;
 			throw err;
 		}
 		if (!desc) return void 0;
@@ -34135,7 +34362,7 @@ var KinesisStreamConsumerProvider = class {
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: physicalId }))).Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$9) return void 0;
+			if (err instanceof ResourceNotFoundException$10) return void 0;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
 		}
@@ -34341,7 +34568,7 @@ var SchedulerScheduleProvider = class {
 			}));
 			this.logger.debug(`Deleted Schedule ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) {
+			if (error instanceof ResourceNotFoundException$11) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Schedule ${logicalId} already deleted (not found), treating as success`);
 				return;
@@ -34363,7 +34590,7 @@ var SchedulerScheduleProvider = class {
 			return (await this.getClient().send(new GetScheduleCommand({ Name: physicalId }))).Arn;
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const customGroupHint = error instanceof ResourceNotFoundException$10 ? " Schedules in a custom group cannot be looked up by bare name; the Arn is normally served from cdkd state attributes." : "";
+			const customGroupHint = error instanceof ResourceNotFoundException$11 ? " Schedules in a custom group cannot be looked up by bare name; the Arn is normally served from cdkd state attributes." : "";
 			throw new ProvisioningError(`Failed to resolve Arn for Schedule ${physicalId}: ${cause?.message ?? String(error)}.${customGroupHint}`, resourceType, physicalId, physicalId, cause);
 		}
 	}
@@ -34393,7 +34620,7 @@ var SchedulerScheduleProvider = class {
 				...response.Target !== void 0 && { Target: response.Target }
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) return;
+			if (error instanceof ResourceNotFoundException$11) return;
 			throw error;
 		}
 	}
@@ -34419,7 +34646,7 @@ var SchedulerScheduleProvider = class {
 				attributes: response.Arn ? { Arn: response.Arn } : {}
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) return null;
+			if (error instanceof ResourceNotFoundException$11) return null;
 			throw error;
 		}
 	}
@@ -38078,7 +38305,7 @@ var FirehoseProvider = class {
 			await this.getClient().send(new DeleteDeliveryStreamCommand({ DeliveryStreamName: physicalId }));
 			this.logger.debug(`Successfully deleted Firehose delivery stream ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$11) {
+			if (error instanceof ResourceNotFoundException$12) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Firehose delivery stream ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -38615,7 +38842,7 @@ var FirehoseProvider = class {
 		try {
 			desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$11) return void 0;
+			if (err instanceof ResourceNotFoundException$12) return void 0;
 			throw err;
 		}
 		if (!desc) return void 0;
@@ -38646,7 +38873,7 @@ var FirehoseProvider = class {
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$11) return void 0;
+			if (err instanceof ResourceNotFoundException$12) return void 0;
 			this.logger.debug(`Firehose ListTagsForDeliveryStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
 		}
@@ -38683,7 +38910,7 @@ var FirehoseProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$11) return null;
+			if (err instanceof ResourceNotFoundException$12) return null;
 			throw err;
 		}
 		return null;
@@ -39425,7 +39652,7 @@ var CodeBuildProvider = class {
 			await this.getClient().send(new DeleteProjectCommand({ name: physicalId }));
 			this.logger.debug(`Successfully deleted CodeBuild Project ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$12) {
+			if (error instanceof ResourceNotFoundException$13) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CodeBuild Project ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -39480,7 +39707,7 @@ var CodeBuildProvider = class {
 		try {
 			project = (await this.getClient().send(new BatchGetProjectsCommand({ names: [physicalId] }))).projects?.[0];
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$12) return void 0;
+			if (err instanceof ResourceNotFoundException$13) return void 0;
 			throw err;
 		}
 		if (!project) return void 0;
@@ -39625,7 +39852,7 @@ var CodeBuildProvider = class {
 				attributes: {}
 			} : null;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$12) return null;
+			if (err instanceof ResourceNotFoundException$13) return null;
 			throw err;
 		}
 		return null;
@@ -40345,7 +40572,7 @@ var DLMLifecyclePolicyProvider = class {
 			await this.getClient().send(new DeleteLifecyclePolicyCommand$1({ PolicyId: physicalId }));
 			this.logger.debug(`Successfully deleted DLM Lifecycle Policy ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$13) {
+			if (error instanceof ResourceNotFoundException$14) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DLM Lifecycle Policy ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -40396,7 +40623,7 @@ var DLMLifecyclePolicyProvider = class {
 				Tags: normalizeAwsTagsToCfn(policy.Tags)
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$13) return;
+			if (error instanceof ResourceNotFoundException$14) return;
 			throw error;
 		}
 	}
@@ -40432,7 +40659,7 @@ var DLMLifecyclePolicyProvider = class {
 				attributes: response.Policy.PolicyArn ? { Arn: response.Policy.PolicyArn } : {}
 			} : null;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$13) return null;
+			if (err instanceof ResourceNotFoundException$14) return null;
 			throw err;
 		}
 		return null;
@@ -42768,7 +42995,7 @@ var ACMCertificateProvider = class {
 			try {
 				await this.acmClient.send(new DeleteCertificateCommand({ CertificateArn: physicalId }));
 			} catch (error) {
-				if (error instanceof ResourceNotFoundException$6) {
+				if (error instanceof ResourceNotFoundException$7) {
 					assertRegionMatch(await this.acmClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Certificate ${physicalId} does not exist, skipping deletion`);
 					return;
@@ -42806,7 +43033,7 @@ var ACMCertificateProvider = class {
 		try {
 			cert = (await this.acmClient.send(new DescribeCertificateCommand({ CertificateArn: physicalId }))).Certificate;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$6) return void 0;
+			if (err instanceof ResourceNotFoundException$7) return void 0;
 			throw err;
 		}
 		if (!cert) return void 0;
@@ -42820,7 +43047,7 @@ var ACMCertificateProvider = class {
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.acmClient.send(new ListTagsForCertificateCommand({ CertificateArn: physicalId }))).Tags);
 		} catch (err) {
-			if (!(err instanceof ResourceNotFoundException$6)) throw err;
+			if (!(err instanceof ResourceNotFoundException$7)) throw err;
 		}
 		return result;
 	}
@@ -42851,7 +43078,7 @@ var ACMCertificateProvider = class {
 					}
 				};
 			} catch (err) {
-				if (err instanceof ResourceNotFoundException$6) return null;
+				if (err instanceof ResourceNotFoundException$7) return null;
 				throw err;
 			}
 		}
@@ -42973,6 +43200,7 @@ function registerAllProviders(registry) {
 	registry.register("AWS::DynamoDB::GlobalTable", new DynamoDBGlobalTableProvider());
 	registry.register("AWS::Logs::LogGroup", new LogsLogGroupProvider());
 	registry.register("AWS::CloudWatch::Alarm", new CloudWatchAlarmProvider());
+	registry.register("AWS::CloudWatch::AnomalyDetector", new CloudWatchAnomalyDetectorProvider());
 	registry.register("AWS::SecretsManager::Secret", new SecretsManagerSecretProvider());
 	registry.register("AWS::SSM::Parameter", new SSMParameterProvider());
 	registry.register("AWS::Events::Rule", new EventBridgeRuleProvider());
@@ -62934,7 +63162,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.269.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.270.0");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;