@go-to-k/cdkd 0.269.3 → 0.271.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-B-igYtBj.js";
+import { $ as WorkGraph, A as slowCcOperationTimeoutMs, At as warnDeprecatedNoPrefixCliFlag, B as applyRoleArnIfSet, Bt as resolveBucketRegion, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as uploadCfnTemplate, G as DagBuilder, H as describeTypeWithThrottleRetry, Ht as getAwsClients, I as WAFv2WebACLProvider, It as expectedOwnerParam, J as S3StateBackend, K as TemplateParser, Kt as CdkdError, L as normalizeAwsTagsToCfn, Lt as AssemblyReader, M as isTerminationProtectionPropagationError, Mt as CFN_TEMPLATE_URL_LIMIT, N as IntrinsicFunctionResolver, Nt as MIGRATE_TMP_PREFIX, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as findLargeInlineResources, Q as stringifyValue, Qt as LocalStartServiceError, R as resolveExplicitPhysicalId, Rt as processStackMessages, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as resetAwsClients, V as DiffCalculator, Vt as AwsClients, W as isRetryableTransientError, Wt as setAwsClients, X as shouldRetainResource, Xt as LocalInvokeBuildError$1, Y as rebuildClientForBucketRegion, Yt as DeployCancelledError, Z as AssetPublisher, Zt as LocalMigrateError, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as ResourceUpdateNotSupportedError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dt as buildDockerImage, en as MissingCdkCliError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, fn as normalizeAwsError, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as ResourceTimeoutError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_BODY_LIMIT, k as CloudControlProvider, kt as stateBucketExistenceConfirmed, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as PartialFailureError, nt as loadPublishableAssetManifest, o as planFailedOps, on as StackHasActiveImportsError, ot as ensureAssetStorage, p as extractDeploymentEventError, pn as withErrorHandling, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ProvisioningError, rt as rewriteTemplateAssetReferences, s as planRollback, sn as StackTerminationProtectionError, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as NestedStackChildDirectDestroyError, tt as createAssetRedirectResolver, u as withResourceDeadline, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch } from "./deploy-engine-DlTH1ou6.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-D-XHoXeI.js";
+import { t as ASGProvider } from "./asg-provider-CpHXw10b.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -18,11 +18,11 @@ import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, Descri
 import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, GetSecretValueCommand, RemoveRegionsFromReplicationCommand, ReplicateSecretToRegionsCommand, ResourceNotFoundException as ResourceNotFoundException$3, SecretsManagerClient, TagResourceCommand as TagResourceCommand$5, UntagResourceCommand as UntagResourceCommand$5, UpdateSecretCommand } from "@aws-sdk/client-secrets-manager";
 import { AddTagsToResourceCommand, DeleteParameterCommand, DescribeParametersCommand, GetParameterCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$2, ParameterNotFound, PutParameterCommand, RemoveTagsFromResourceCommand, SSMClient } from "@aws-sdk/client-ssm";
 import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, CreateOriginAccessControlCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, DeleteOriginAccessControlCommand, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, GetOriginAccessControlCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, NoSuchOriginAccessControl, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand, UpdateOriginAccessControlCommand } from "@aws-sdk/client-cloudfront";
-import { CloudWatchClient, DeleteAlarmsCommand, DescribeAlarmsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$4, PutMetricAlarmCommand, TagResourceCommand as TagResourceCommand$7, UntagResourceCommand as UntagResourceCommand$7 } from "@aws-sdk/client-cloudwatch";
-import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
-import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
-import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$6, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
-import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ListTagsCommand as ListTagsCommand$1, ResourceNotFoundException as ResourceNotFoundException$7, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
+import { CloudWatchClient, DeleteAlarmsCommand, DeleteAnomalyDetectorCommand, DescribeAlarmsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$4, PutAnomalyDetectorCommand, PutMetricAlarmCommand, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$7, UntagResourceCommand as UntagResourceCommand$7 } from "@aws-sdk/client-cloudwatch";
+import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
+import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$6, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
+import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$7, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
+import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ListTagsCommand as ListTagsCommand$1, ResourceNotFoundException as ResourceNotFoundException$8, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
 import * as fs from "node:fs";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
@@ -48,23 +48,23 @@ import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMach
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
-import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$8, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$9, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
 import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$9, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
-import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$10, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$11, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
-import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$11, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
+import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$12, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$2, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
-import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$12, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
+import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$13, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
 import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import AdmZip from "adm-zip";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$13, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$14, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3vectors";
 import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
@@ -347,32 +347,41 @@ function ensureWarnAfter(opts) {
 	return opts.resourceWarnAfter;
 }
 /**
-* Skip waiting for async-stabilization resources (CloudFront, RDS,
-* ElastiCache, NAT Gateway, EC2 Instance, ELBv2 LoadBalancer, Lambda
-* MicroVM Image) on deploy. Setting the flag mutates
+* Skip waiting for async-stabilization resources (RDS, ElastiCache,
+* NAT Gateway, EC2 Instance, ELBv2 LoadBalancer, Lambda MicroVM Image)
+* on deploy. Setting the flag mutates
 * `process.env.CDKD_NO_WAIT='true'`; provider code checks that env
 * var, not the parsed CLI option (this lets nested call paths — e.g.
 * asset publish, lifecycle hooks — see the same setting without
 * threading the flag through every function signature).
 *
+* CloudFront Distribution left this list with issue #1282: its
+* `Deployed` wait is skipped by DEFAULT now, so under `--no-wait` it
+* simply behaves the same as the default (`--full-wait` opts back in).
+*
 * Deploy-only. NAT Gateway destroy always waits regardless (a
 * still-`deleting` gateway blocks downstream Subnet / IGW / VPC
-* delete with DependencyViolation), and CloudFront / RDS / ElastiCache
-* destroy paths don't wait to begin with — so `destroy --no-wait`
-* would be a no-op flag.
+* delete with DependencyViolation), RDS / ElastiCache destroy paths
+* don't wait to begin with, and CloudFront's destroy-side
+* disable-then-wait is an API requirement no flag may skip — so
+* `destroy --no-wait` would be a no-op flag.
 */
-const noWaitOption = new Option("--no-wait", "Skip waiting for async resources to stabilize (CloudFront, RDS, ElastiCache, NAT Gateway, EC2 Instance, ELBv2 LoadBalancer, Lambda MicroVM Image)");
+const noWaitOption = new Option("--no-wait", "Skip waiting for async resources to stabilize (RDS, ElastiCache, NAT Gateway, EC2 Instance, ELBv2 LoadBalancer, Lambda MicroVM Image)");
 /**
-* Opt in to the stabilization waits cdkd deliberately SKIPS by default:
-* the ones where CloudFormation waits and Terraform does not. Today that
-* is ECS Service steady state (create and update).
+* Opt in to the stabilization waits cdkd deliberately SKIPS by default.
+* Today that is ECS Service steady state (create and update; a
+* "CloudFormation waits, Terraform does not" disagree-case) and
+* CloudFront Distribution `Deployed` (create and update; both engines
+* wait, but the wait has no in-deploy consumer and no failure signal —
+* the fast-side clause, issue #1282).
 *
 * `--no-wait`, the default, and `--full-wait` are three points on one
 * axis, from least to most waiting:
 *
 * - `--no-wait`      skip the stabilization waits cdkd performs by default
-* - (default)        wait where CloudFormation and Terraform agree
-* - `--full-wait`    also wait where only CloudFormation waits
+* - (default)        wait where the wait is load-bearing (in-deploy
+*                    consumers / failure detection)
+* - `--full-wait`    also wait everywhere CloudFormation waits
 *
 * Which one is right depends on whether anything downstream needs the
 * resource to actually be serving, NOT on where the deploy runs: cutting
@@ -390,7 +399,7 @@ const noWaitOption = new Option("--no-wait", "Skip waiting for async resources t
 *
 * Deploy-only, like `--no-wait`.
 */
-const fullWaitOption = new Option("--full-wait", "Also wait for stabilizations cdkd skips by default, matching CloudFormation (ECS Service steady state)");
+const fullWaitOption = new Option("--full-wait", "Also wait for stabilizations cdkd skips by default, matching CloudFormation (ECS Service steady state, CloudFront Distribution Deployed)");
 /**
 * Reject `--no-wait --full-wait`. They sit at opposite ends of one axis,
 * so a combination has no coherent meaning: the user is asking to both
@@ -10324,7 +10333,7 @@ var LambdaMicrovmImageProvider = class {
 			try {
 				await this.client.send(new DeleteMicrovmImageCommand({ imageIdentifier: physicalId }));
 			} catch (error) {
-				if (error instanceof ResourceNotFoundException$7) {
+				if (error instanceof ResourceNotFoundException$8) {
 					assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`MicroVM image ${physicalId} does not exist, skipping deletion`);
 					return;
@@ -10369,7 +10378,7 @@ var LambdaMicrovmImageProvider = class {
 				attributes: { ImageArn: arn }
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$7) return null;
+			if (error instanceof ResourceNotFoundException$8) return null;
 			throw error;
 		}
 	}
@@ -10395,7 +10404,7 @@ var LambdaMicrovmImageProvider = class {
 		try {
 			name = (await this.client.send(new GetMicrovmImageCommand({ imageIdentifier: physicalId }))).name;
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$7) return void 0;
+			if (error instanceof ResourceNotFoundException$8) return void 0;
 			throw error;
 		}
 		const result = {};
@@ -10454,7 +10463,7 @@ var LambdaMicrovmImageProvider = class {
 			try {
 				resp = await this.client.send(new GetMicrovmImageCommand({ imageIdentifier: imageArn }));
 			} catch (error) {
-				if (error instanceof ResourceNotFoundException$7) return;
+				if (error instanceof ResourceNotFoundException$8) return;
 				throw error;
 			}
 			if (resp.state === "DELETE_FAILED") throw new Error(`MicroVM image ${logicalId} (${imageArn}) entered DELETE_FAILED. Check the CloudWatch build logs under /aws/lambda/microvms/ to diagnose.`);
@@ -13070,7 +13079,7 @@ var LogsLogGroupProvider = class {
 		} else try {
 			await this.logsClient.send(new DeleteIndexPolicyCommand({ logGroupIdentifier: physicalId }));
 		} catch (err) {
-			if (!(err instanceof ResourceNotFoundException$4)) throw err;
+			if (!(err instanceof ResourceNotFoundException$5)) throw err;
 		}
 		const newTags = properties["Tags"];
 		const oldTags = previousProperties["Tags"];
@@ -13116,7 +13125,7 @@ var LogsLogGroupProvider = class {
 			await this.logsClient.send(new DeleteLogGroupCommand({ logGroupName: physicalId }));
 			this.logger.debug(`Successfully deleted log group ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$4) {
+			if (error instanceof ResourceNotFoundException$5) {
 				assertRegionMatch(await this.logsClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Log group ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -13207,7 +13216,7 @@ var LogsLogGroupProvider = class {
 				try {
 					tags = normalizeAwsTagsToCfn((await this.logsClient.send(new ListTagsForResourceCommand$5({ resourceArn: arnForTags }))).tags);
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException$4) return void 0;
+					if (err instanceof ResourceNotFoundException$5) return void 0;
 					throw err;
 				}
 			}
@@ -13236,7 +13245,7 @@ var LogsLogGroupProvider = class {
 			result["FieldIndexPolicies"] = fieldIndexPolicies;
 			return result;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$4) return void 0;
+			if (err instanceof ResourceNotFoundException$5) return void 0;
 			throw err;
 		}
 	}
@@ -13255,7 +13264,7 @@ var LogsLogGroupProvider = class {
 				attributes: {}
 			} : null;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$4) return null;
+			if (err instanceof ResourceNotFoundException$5) return null;
 			throw err;
 		}
 		return null;
@@ -13584,6 +13593,233 @@ var CloudWatchAlarmProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/cloudwatch-anomaly-detector-provider.ts
+/**
+* AWS CloudWatch AnomalyDetector Provider (issue #1304)
+*
+* Implements resource provisioning for AWS::CloudWatch::AnomalyDetector using
+* the CloudWatch SDK. The type is NON_PROVISIONABLE in the CloudFormation
+* registry (no Cloud Control handlers), so without this provider cdkd's
+* pre-flight rejects any template that declares it.
+*
+* API mapping: `PutAnomalyDetector` is an UPSERT keyed by the metric
+* descriptor (the single-metric tuple or the metric-math query set), and
+* `DeleteAnomalyDetector` takes the same descriptor. There is no
+* server-generated identifier; the registry schema's read-only `Id`
+* primaryIdentifier has no Cloud Control handler to mint it. cdkd therefore
+* derives a DETERMINISTIC physical id from the descriptor (see
+* {@link derivePhysicalId}) — every descriptor field is createOnly in the
+* registry schema, so the id is stable across in-place updates
+* (`Configuration` is the only mutable property).
+*/
+var CloudWatchAnomalyDetectorProvider = class {
+	cloudWatchClient;
+	logger = getLogger().child("CloudWatchAnomalyDetectorProvider");
+	/**
+	* NON_PROVISIONABLE type: Cloud Control has no handlers for it, so the
+	* #614 unhandled-property auto-route must never send an
+	* AnomalyDetector template to the CC path (it would fail at deploy time
+	* with no handler). All properties are handled here instead.
+	*/
+	disableCcApiFallback = true;
+	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudWatch::AnomalyDetector", /* @__PURE__ */ new Set([
+		"Namespace",
+		"MetricName",
+		"Stat",
+		"Dimensions",
+		"Configuration",
+		"MetricCharacteristics",
+		"SingleMetricAnomalyDetector",
+		"MetricMathAnomalyDetector"
+	])]]);
+	constructor() {
+		const awsClients = getAwsClients();
+		this.cloudWatchClient = awsClients.cloudWatch;
+	}
+	/**
+	* Create an anomaly detection model via `PutAnomalyDetector`.
+	*/
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating CloudWatch anomaly detector ${logicalId}`);
+		const params = buildPutParams(properties);
+		if (!hasDescriptor(params)) throw new ProvisioningError(`AnomalyDetector ${logicalId} needs a metric descriptor: either SingleMetricAnomalyDetector, MetricMathAnomalyDetector, or the top-level Namespace/MetricName/Stat fields`, resourceType, logicalId);
+		try {
+			await this.cloudWatchClient.send(new PutAnomalyDetectorCommand(params));
+			const physicalId = derivePhysicalId(properties);
+			this.logger.debug(`Successfully created CloudWatch anomaly detector ${logicalId}: ${physicalId}`);
+			return {
+				physicalId,
+				attributes: { Id: physicalId }
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create CloudWatch anomaly detector ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update an anomaly detection model.
+	*
+	* Every descriptor field (Namespace / MetricName / Stat / Dimensions /
+	* SingleMetricAnomalyDetector / MetricMathAnomalyDetector /
+	* MetricCharacteristics) is createOnly in the registry schema, so the
+	* diff layer classifies a change to any of them as a REPLACEMENT and this
+	* method never sees it. The only in-place change is `Configuration`
+	* (excluded time ranges / time zone), which `PutAnomalyDetector` upserts
+	* for the unchanged descriptor.
+	*
+	* Removal semantics: `PutAnomalyDetector` REPLACES the stored
+	* Configuration rather than merging (live-verified 2026-07-31 — a Put
+	* with no `Configuration` resets MetricTimezone + ExcludedTimeRanges to
+	* defaults), so re-putting the full desired properties matches CFn's
+	* "removed property resets to default" behavior with no extra clearing.
+	*/
+	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+		this.logger.debug(`Updating CloudWatch anomaly detector ${logicalId}: ${physicalId}`);
+		try {
+			await this.cloudWatchClient.send(new PutAnomalyDetectorCommand(buildPutParams(properties)));
+			this.logger.debug(`Successfully updated CloudWatch anomaly detector ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: { Id: physicalId }
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update CloudWatch anomaly detector ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Delete an anomaly detection model via `DeleteAnomalyDetector`.
+	*
+	* The API takes the metric DESCRIPTOR (not an id), so the state-recorded
+	* `properties` are required to address the model. `ResourceNotFoundException`
+	* is treated as idempotent success (after the shared region check).
+	*/
+	async delete(logicalId, physicalId, resourceType, properties, context) {
+		this.logger.debug(`Deleting CloudWatch anomaly detector ${logicalId}: ${physicalId}`);
+		if (!properties) throw new ProvisioningError(`Cannot delete AnomalyDetector ${logicalId}: the state record carries no properties, and DeleteAnomalyDetector addresses the model by its metric descriptor. Use 'cdkd state orphan <stack>' to drop the record and delete the detector manually.`, resourceType, logicalId, physicalId);
+		try {
+			await this.cloudWatchClient.send(new DeleteAnomalyDetectorCommand(buildDeleteParams(properties)));
+			this.logger.debug(`Successfully deleted CloudWatch anomaly detector ${logicalId}`);
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$4) {
+				assertRegionMatch(await this.cloudWatchClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`Anomaly detector ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete CloudWatch anomaly detector ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Resolve a `Fn::GetAtt` attribute. The registry schema exposes a single
+	* read-only attribute, `Id` — cdkd's deterministic physical id.
+	*/
+	async getAttribute(physicalId, resourceType, attributeName) {
+		if (attributeName === "Id") return physicalId;
+		throw new ProvisioningError(`Unknown attribute ${attributeName} for ${resourceType} (only 'Id' is defined)`, resourceType, physicalId);
+	}
+	/**
+	* Adopt an existing anomaly detector into cdkd state.
+	*
+	* **Explicit override only.** Anomaly detectors are addressed by their
+	* metric descriptor, carry no tags, and have no name property — there is
+	* nothing to auto-look them up by. Users adopting one should pass
+	* `--resource <logicalId>=<id>` where `<id>` is any stable identifier
+	* (cdkd re-derives the canonical one on the next replacement).
+	*/
+	async import(input) {
+		if (input.knownPhysicalId) return {
+			physicalId: input.knownPhysicalId,
+			attributes: { Id: input.knownPhysicalId }
+		};
+		return null;
+	}
+};
+/**
+* Map CFn-shaped properties onto the `PutAnomalyDetector` input. CloudWatch's
+* SDK uses the same PascalCase field names as the CloudFormation schema, so
+* the mapping is structural: the only shape conversion is
+* `Configuration.ExcludedTimeRanges[].StartTime/EndTime`, which CFn carries
+* as ISO-8601 strings and the SDK models as `Date`.
+*/
+function buildPutParams(properties) {
+	const params = {};
+	const single = properties["SingleMetricAnomalyDetector"];
+	if (single !== void 0) params.SingleMetricAnomalyDetector = single;
+	const math = properties["MetricMathAnomalyDetector"];
+	if (math !== void 0) params.MetricMathAnomalyDetector = math;
+	if (properties["Namespace"] !== void 0) params.Namespace = properties["Namespace"];
+	if (properties["MetricName"] !== void 0) params.MetricName = properties["MetricName"];
+	if (properties["Stat"] !== void 0) params.Stat = properties["Stat"];
+	if (properties["Dimensions"] !== void 0) params.Dimensions = properties["Dimensions"];
+	const configuration = properties["Configuration"];
+	if (configuration !== void 0) {
+		const mapped = {};
+		if (configuration["MetricTimeZone"] !== void 0) mapped.MetricTimezone = configuration["MetricTimeZone"];
+		const ranges = configuration["ExcludedTimeRanges"];
+		if (ranges !== void 0) mapped.ExcludedTimeRanges = ranges.map((r) => ({
+			StartTime: toDate(r["StartTime"]),
+			EndTime: toDate(r["EndTime"])
+		}));
+		params.Configuration = mapped;
+	}
+	const characteristics = properties["MetricCharacteristics"];
+	if (characteristics !== void 0) params.MetricCharacteristics = characteristics;
+	return params;
+}
+/**
+* `DeleteAnomalyDetector` addresses the model by the same descriptor shape as
+* Put, minus the mutable `Configuration` / `MetricCharacteristics`.
+*/
+function buildDeleteParams(properties) {
+	const params = {};
+	const single = properties["SingleMetricAnomalyDetector"];
+	if (single !== void 0) params.SingleMetricAnomalyDetector = single;
+	const math = properties["MetricMathAnomalyDetector"];
+	if (math !== void 0) params.MetricMathAnomalyDetector = math;
+	if (properties["Namespace"] !== void 0) params.Namespace = properties["Namespace"];
+	if (properties["MetricName"] !== void 0) params.MetricName = properties["MetricName"];
+	if (properties["Stat"] !== void 0) params.Stat = properties["Stat"];
+	if (properties["Dimensions"] !== void 0) params.Dimensions = properties["Dimensions"];
+	return params;
+}
+/** CFn carries Range times as ISO-8601 strings; the SDK models them as Date. */
+function toDate(value) {
+	if (value === void 0) return void 0;
+	if (value instanceof Date) return value;
+	const parsed = new Date(String(value));
+	if (Number.isNaN(parsed.getTime())) throw new Error(`Configuration.ExcludedTimeRanges contains an unparsable time value: ${String(value)}`);
+	return parsed;
+}
+/**
+* Derive the deterministic physical id from the metric descriptor.
+*
+* Single-metric detectors get a readable composite
+* (`<Namespace>:<MetricName>:<Stat>[:<Name=Value,...>]`, dimensions sorted by
+* name so template ordering does not change the id); metric-math detectors
+* get a content hash of their query set (`math:<sha256-16>`). Descriptor
+* fields are all createOnly, so the id never changes across in-place updates.
+*/
+function derivePhysicalId(properties) {
+	const single = properties["SingleMetricAnomalyDetector"];
+	const namespace = single?.Namespace ?? properties["Namespace"];
+	const metricName = single?.MetricName ?? properties["MetricName"];
+	const stat = single?.Stat ?? properties["Stat"];
+	const dimensions = single?.Dimensions ?? properties["Dimensions"];
+	if (namespace !== void 0 || metricName !== void 0) {
+		const dims = (dimensions ?? []).map((d) => `${d.Name}=${d.Value}`).sort().join(",");
+		const base = `${single?.AccountId !== void 0 ? `${single.AccountId}:` : ""}${namespace ?? ""}:${metricName ?? ""}:${stat ?? ""}`;
+		return dims.length > 0 ? `${base}:${dims}` : base;
+	}
+	const math = properties["MetricMathAnomalyDetector"];
+	return `math:${createHash("sha256").update(JSON.stringify(math ?? {})).digest("hex").slice(0, 16)}`;
+}
+function hasDescriptor(params) {
+	return params.SingleMetricAnomalyDetector !== void 0 || params.MetricMathAnomalyDetector !== void 0 || params.Namespace !== void 0 || params.MetricName !== void 0;
+}
+
 //#endregion
 //#region src/provisioning/providers/secretsmanager-secret-provider.ts
 /**
@@ -20377,6 +20613,32 @@ var CloudFrontOACProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/resource-timeout-registry.ts
+let resolved;
+/**
+* Seed the registry with the validated `--resource-timeout` input. Call once
+* per CLI invocation, right after `validateResourceTimeouts`. Passing
+* `undefined` (flag not supplied) clears the registry, so consumers fall back
+* to their own compile-time floors.
+*/
+function setResolvedResourceTimeouts(opt) {
+	resolved = opt;
+}
+/**
+* The user's resolved timeout for `resourceType` in milliseconds, or
+* `undefined` when the user supplied nothing applicable. Resolution matches
+* the outer-deadline sites: per-type override wins, else the explicit global
+* value. The compile-time default (`DEFAULT_RESOURCE_TIMEOUT_MS`) is
+* deliberately NOT applied here — an inner waiter's own floor (e.g. ECS 600s)
+* must only be raised by an EXPLICIT user value, never by the generic 30m
+* default silently multiplying every `--full-wait` failure by 3x.
+*/
+function resolvedResourceTimeoutMs(resourceType) {
+	if (!resolved) return void 0;
+	return resolved.perTypeMs?.[resourceType] ?? resolved.globalMs;
+}
+
 //#endregion
 //#region src/provisioning/providers/cloudfront-distribution-provider.ts
 /**
@@ -20449,10 +20711,7 @@ var CloudFrontDistributionProvider = class {
 			const distributionId = distribution.Id;
 			const domainName = distribution.DomainName;
 			this.logger.debug(`Created CloudFront Distribution: ${distributionId} (${domainName})`);
-			if (process.env["CDKD_NO_WAIT"] !== "true") {
-				this.logger.debug(`Waiting for Distribution ${distributionId} to reach Deployed status...`);
-				await this.waitForDistributionStable(distributionId);
-			}
+			await this.settleDistribution(logicalId, distributionId);
 			return {
 				physicalId: distributionId,
 				attributes: {
@@ -20492,6 +20751,7 @@ var CloudFrontDistributionProvider = class {
 			const domainName = getResponse.Distribution?.DomainName ?? "";
 			const arn = getResponse.Distribution?.ARN;
 			await this.applyTagDiff(arn, previousProperties["Tags"], properties["Tags"], physicalId, logicalId, resourceType);
+			await this.settleDistribution(logicalId, physicalId);
 			this.logger.debug(`Updated CloudFront Distribution ${physicalId}`);
 			return {
 				physicalId,
@@ -20542,7 +20802,7 @@ var CloudFrontDistributionProvider = class {
 					IfMatch: etag,
 					DistributionConfig: config
 				}))).ETag;
-				await this.waitForDistributionStable(physicalId, false);
+				if (!await this.waitForDistributionStable(physicalId, false)) this.logger.warn(`Distribution ${physicalId} disable did not settle (Deployed + disabled) within the wait budget; attempting delete anyway. If it fails with DistributionNotDisabled, retry the destroy or raise the budget with --resource-timeout AWS::CloudFront::Distribution=<duration>.`);
 				etag = (await this.cloudFrontClient.send(new GetDistributionConfigCommand({ Id: physicalId }))).ETag;
 			}
 			await this.cloudFrontClient.send(new DeleteDistributionCommand({
@@ -20642,17 +20902,39 @@ var CloudFrontDistributionProvider = class {
 		throw new Error(`Unsupported attribute: ${attributeName} for AWS::CloudFront::Distribution`);
 	}
 	/**
-	* Wait for a distribution to reach a stable state.
+	* Settle a CloudFront Distribution according to the run's wait mode.
 	*
-	* "Stable" means Status === 'Deployed'. When `expectedEnabled` is provided,
-	* we additionally require DistributionConfig.Enabled === expectedEnabled —
-	* this guards against CloudFront's eventually-consistent reads that can
-	* briefly return the pre-update snapshot after UpdateDistribution returns.
+	* cdkd does NOT wait for `Deployed` by default (issue #1282). Both
+	* CloudFormation and Terraform (`wait_for_deployment`, default `true`) wait
+	* here, so this is a deliberate divergence under the wait-semantics policy's
+	* fast-side clause: every `Fn::GetAtt` (Id / DomainName) is final in the
+	* Create/Update response so nothing in-deploy consumes `Deployed`, the wait
+	* carries no failure signal (a distribution deploy cannot fail — a long
+	* wait means slow edge propagation, not brokenness), and Terraform's
+	* `wait_for_deployment` toggle keeps the benchmark comparison measurable in
+	* both modes. `--full-wait` opts back into the CloudFormation behavior.
+	*/
+	async settleDistribution(logicalId, distributionId) {
+		if (process.env["CDKD_FULL_WAIT"] === "true") {
+			this.logger.debug(`Waiting for Distribution ${distributionId} to reach Deployed status...`);
+			if (!await this.waitForDistributionStable(distributionId)) this.logger.warn(`CloudFront Distribution ${logicalId} (${distributionId}) did not reach Deployed within the wait budget; continuing (propagation finishes in the background). To wait manually: aws cloudfront wait distribution-deployed --id ${distributionId}. Raise the budget with --resource-timeout AWS::CloudFront::Distribution=<duration>.`);
+			return;
+		}
+		const fullWaitHint = process.env["CDKD_WAIT_FLAGS_AVAILABLE"] === "true" ? "; pass --full-wait to wait" : "";
+		this.logger.info(`CloudFront Distribution ${logicalId} accepted (not waiting for Deployed${fullWaitHint}). To wait manually: aws cloudfront wait distribution-deployed --id ${distributionId}`);
+	}
+	/**
+	* Poll until the distribution reports `Status: Deployed` (and, when
+	* `expectedEnabled` is given, the matching `Enabled` value — the delete
+	* path's disable-then-delete requirement).
 	*
-	* Uses exponential backoff polling.
+	* Returns `true` when the stable state was observed (or the wait was
+	* interrupted by SIGINT — the caller is shutting down, so no timeout
+	* warning applies), `false` on budget exhaustion.
 	*/
 	async waitForDistributionStable(distributionId, expectedEnabled) {
-		const maxAttempts = 120;
+		const budgetMs = Math.max(1200 * 1e3, resolvedResourceTimeoutMs("AWS::CloudFront::Distribution") ?? 0);
+		const deadline = Date.now() + budgetMs;
 		let delay = 5e3;
 		const maxDelay = 1e4;
 		let interrupted = false;
@@ -20661,24 +20943,37 @@ var CloudFrontDistributionProvider = class {
 		};
 		process.on("SIGINT", sigintHandler);
 		try {
-			for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+			while (Date.now() < deadline) {
 				if (interrupted) {
 					this.logger.debug(`Distribution ${distributionId} wait interrupted by SIGINT, proceeding`);
-					return;
+					return true;
 				}
-				const response = await this.cloudFrontClient.send(new GetDistributionCommand({ Id: distributionId }));
-				const status = response.Distribution?.Status;
-				const enabled = response.Distribution?.DistributionConfig?.Enabled;
-				if (status === "Deployed" && (expectedEnabled === void 0 || enabled === expectedEnabled)) {
-					this.logger.debug(`Distribution ${distributionId} is stable (Status=Deployed, Enabled=${enabled})`);
-					return;
+				let response;
+				try {
+					response = await this.cloudFrontClient.send(new GetDistributionCommand({ Id: distributionId }));
+				} catch (error) {
+					if (error instanceof NoSuchDistribution) throw error;
+					this.logger.debug(`Distribution ${distributionId} status read failed (${error instanceof Error ? error.message : String(error)}); retrying`);
+				}
+				if (response) {
+					const status = response.Distribution?.Status;
+					const enabled = response.Distribution?.DistributionConfig?.Enabled;
+					if (status === "Deployed" && (expectedEnabled === void 0 || enabled === expectedEnabled)) {
+						this.logger.debug(`Distribution ${distributionId} is stable (Status=Deployed, Enabled=${enabled})`);
+						return true;
+					}
+					this.logger.debug(`Distribution ${distributionId} status: ${status}, enabled: ${enabled}` + (expectedEnabled === void 0 ? "" : ` (waiting for Enabled=${expectedEnabled})`));
 				}
-				this.logger.debug(`Distribution ${distributionId} status: ${status}, enabled: ${enabled}` + (expectedEnabled === void 0 ? "" : ` (waiting for Enabled=${expectedEnabled})`) + ` (attempt ${attempt}/${maxAttempts})`);
 				const sleepEnd = Date.now() + delay;
 				while (Date.now() < sleepEnd && !interrupted) await new Promise((resolve) => setTimeout(resolve, 1e3));
 				delay = Math.min(delay * 1.5, maxDelay);
 			}
+			if (interrupted) {
+				this.logger.debug(`Distribution ${distributionId} wait interrupted by SIGINT, proceeding`);
+				return true;
+			}
 			this.logger.debug(`Distribution ${distributionId} did not reach stable state within timeout, proceeding with next step`);
+			return false;
 		} finally {
 			process.removeListener("SIGINT", sigintHandler);
 		}
@@ -21208,7 +21503,7 @@ var AgentCoreRuntimeProvider = class {
 			await this.client.send(new DeleteAgentRuntimeCommand({ agentRuntimeId: physicalId }));
 			this.logger.debug(`Successfully deleted BedrockAgentCore Runtime ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$5) {
+			if (error instanceof ResourceNotFoundException$6) {
 				assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Runtime ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -21303,7 +21598,7 @@ var AgentCoreRuntimeProvider = class {
 		try {
 			resp = await this.client.send(new GetAgentRuntimeCommand({ agentRuntimeId: physicalId }));
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$5) return void 0;
+			if (err instanceof ResourceNotFoundException$6) return void 0;
 			throw err;
 		}
 		const result = {};
@@ -21778,7 +22073,7 @@ var AgentCoreEvaluatorProvider = class {
 			await this.client.send(new DeleteEvaluatorCommand({ evaluatorId: evaluatorIdFromArn(physicalId) }));
 			this.logger.debug(`Successfully deleted BedrockAgentCore Evaluator ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$5) {
+			if (error instanceof ResourceNotFoundException$6) {
 				assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Evaluator ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -21817,7 +22112,7 @@ var AgentCoreEvaluatorProvider = class {
 		try {
 			resp = await this.client.send(new GetEvaluatorCommand({ evaluatorId: evaluatorIdFromArn(physicalId) }));
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$5) return void 0;
+			if (err instanceof ResourceNotFoundException$6) return void 0;
 			throw err;
 		}
 		const result = {};
@@ -22304,32 +22599,6 @@ function wasMeaningfullyConfigured(value, discriminatorKey) {
 	return value[discriminatorKey] !== void 0;
 }
 
-//#endregion
-//#region src/provisioning/resource-timeout-registry.ts
-let resolved;
-/**
-* Seed the registry with the validated `--resource-timeout` input. Call once
-* per CLI invocation, right after `validateResourceTimeouts`. Passing
-* `undefined` (flag not supplied) clears the registry, so consumers fall back
-* to their own compile-time floors.
-*/
-function setResolvedResourceTimeouts(opt) {
-	resolved = opt;
-}
-/**
-* The user's resolved timeout for `resourceType` in milliseconds, or
-* `undefined` when the user supplied nothing applicable. Resolution matches
-* the outer-deadline sites: per-type override wins, else the explicit global
-* value. The compile-time default (`DEFAULT_RESOURCE_TIMEOUT_MS`) is
-* deliberately NOT applied here — an inner waiter's own floor (e.g. ECS 600s)
-* must only be raised by an EXPLICIT user value, never by the generic 30m
-* default silently multiplying every `--full-wait` failure by 3x.
-*/
-function resolvedResourceTimeoutMs(resourceType) {
-	if (!resolved) return void 0;
-	return resolved.perTypeMs?.[resourceType] ?? resolved.globalMs;
-}
-
 //#endregion
 //#region src/provisioning/providers/ecs-provider.ts
 /**
@@ -28625,7 +28894,7 @@ var CognitoUserPoolProvider = class {
 				if (!templatedActive) try {
 					needsFlip = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool?.DeletionProtection === "ACTIVE";
 				} catch (descError) {
-					if (descError instanceof ResourceNotFoundException$8) {
+					if (descError instanceof ResourceNotFoundException$9) {
 						assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 						this.logger.debug(`Cognito User Pool ${physicalId} does not exist, skipping deletion`);
 						return;
@@ -28648,7 +28917,7 @@ var CognitoUserPoolProvider = class {
 			await this.getClient().send(new DeleteUserPoolCommand({ UserPoolId: physicalId }));
 			this.logger.debug(`Successfully deleted Cognito User Pool ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$8) {
+			if (error instanceof ResourceNotFoundException$9) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Cognito User Pool ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -28681,7 +28950,7 @@ var CognitoUserPoolProvider = class {
 		try {
 			resp = await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }));
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$8) return void 0;
+			if (err instanceof ResourceNotFoundException$9) return void 0;
 			throw err;
 		}
 		const pool = resp.UserPool;
@@ -28755,7 +29024,7 @@ var CognitoUserPoolProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$8) return null;
+			if (err instanceof ResourceNotFoundException$9) return null;
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["UserPoolName"] === "string" ? input.properties["UserPoolName"] : void 0;
@@ -33784,7 +34053,7 @@ var KinesisStreamProvider = class {
 			}));
 			this.logger.debug(`Successfully deleted Kinesis stream ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$9) {
+			if (error instanceof ResourceNotFoundException$10) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Kinesis stream ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -33859,7 +34128,7 @@ var KinesisStreamProvider = class {
 		try {
 			stream = (await this.getClient().send(new DescribeStreamCommand({ StreamName: physicalId }))).StreamDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$9) return void 0;
+			if (err instanceof ResourceNotFoundException$10) return void 0;
 			throw err;
 		}
 		if (!stream) return void 0;
@@ -33877,7 +34146,7 @@ var KinesisStreamProvider = class {
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForStreamCommand({ StreamName: physicalId }))).Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$9) return void 0;
+			if (err instanceof ResourceNotFoundException$10) return void 0;
 			this.logger.debug(`Kinesis ListTagsForStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
 		return result;
@@ -33891,7 +34160,7 @@ var KinesisStreamProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$9) return null;
+			if (err instanceof ResourceNotFoundException$10) return null;
 			throw err;
 		}
 		return null;
@@ -34079,7 +34348,7 @@ var KinesisStreamConsumerProvider = class {
 			await this.getClient().send(new DeregisterStreamConsumerCommand({ ConsumerARN: physicalId }));
 			this.logger.debug(`Successfully deregistered Kinesis stream consumer ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$9) {
+			if (error instanceof ResourceNotFoundException$10) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Kinesis stream consumer ${physicalId} not found, skipping`);
 				return;
@@ -34125,7 +34394,7 @@ var KinesisStreamConsumerProvider = class {
 		try {
 			desc = (await this.getClient().send(new DescribeStreamConsumerCommand({ ConsumerARN: physicalId }))).ConsumerDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$9) return void 0;
+			if (err instanceof ResourceNotFoundException$10) return void 0;
 			throw err;
 		}
 		if (!desc) return void 0;
@@ -34135,7 +34404,7 @@ var KinesisStreamConsumerProvider = class {
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: physicalId }))).Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$9) return void 0;
+			if (err instanceof ResourceNotFoundException$10) return void 0;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
 		}
@@ -34341,7 +34610,7 @@ var SchedulerScheduleProvider = class {
 			}));
 			this.logger.debug(`Deleted Schedule ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) {
+			if (error instanceof ResourceNotFoundException$11) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Schedule ${logicalId} already deleted (not found), treating as success`);
 				return;
@@ -34363,7 +34632,7 @@ var SchedulerScheduleProvider = class {
 			return (await this.getClient().send(new GetScheduleCommand({ Name: physicalId }))).Arn;
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const customGroupHint = error instanceof ResourceNotFoundException$10 ? " Schedules in a custom group cannot be looked up by bare name; the Arn is normally served from cdkd state attributes." : "";
+			const customGroupHint = error instanceof ResourceNotFoundException$11 ? " Schedules in a custom group cannot be looked up by bare name; the Arn is normally served from cdkd state attributes." : "";
 			throw new ProvisioningError(`Failed to resolve Arn for Schedule ${physicalId}: ${cause?.message ?? String(error)}.${customGroupHint}`, resourceType, physicalId, physicalId, cause);
 		}
 	}
@@ -34393,7 +34662,7 @@ var SchedulerScheduleProvider = class {
 				...response.Target !== void 0 && { Target: response.Target }
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) return;
+			if (error instanceof ResourceNotFoundException$11) return;
 			throw error;
 		}
 	}
@@ -34419,7 +34688,7 @@ var SchedulerScheduleProvider = class {
 				attributes: response.Arn ? { Arn: response.Arn } : {}
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) return null;
+			if (error instanceof ResourceNotFoundException$11) return null;
 			throw error;
 		}
 	}
@@ -38078,7 +38347,7 @@ var FirehoseProvider = class {
 			await this.getClient().send(new DeleteDeliveryStreamCommand({ DeliveryStreamName: physicalId }));
 			this.logger.debug(`Successfully deleted Firehose delivery stream ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$11) {
+			if (error instanceof ResourceNotFoundException$12) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Firehose delivery stream ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -38615,7 +38884,7 @@ var FirehoseProvider = class {
 		try {
 			desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$11) return void 0;
+			if (err instanceof ResourceNotFoundException$12) return void 0;
 			throw err;
 		}
 		if (!desc) return void 0;
@@ -38646,7 +38915,7 @@ var FirehoseProvider = class {
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$11) return void 0;
+			if (err instanceof ResourceNotFoundException$12) return void 0;
 			this.logger.debug(`Firehose ListTagsForDeliveryStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
 		}
@@ -38683,7 +38952,7 @@ var FirehoseProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$11) return null;
+			if (err instanceof ResourceNotFoundException$12) return null;
 			throw err;
 		}
 		return null;
@@ -39425,7 +39694,7 @@ var CodeBuildProvider = class {
 			await this.getClient().send(new DeleteProjectCommand({ name: physicalId }));
 			this.logger.debug(`Successfully deleted CodeBuild Project ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$12) {
+			if (error instanceof ResourceNotFoundException$13) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CodeBuild Project ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -39480,7 +39749,7 @@ var CodeBuildProvider = class {
 		try {
 			project = (await this.getClient().send(new BatchGetProjectsCommand({ names: [physicalId] }))).projects?.[0];
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$12) return void 0;
+			if (err instanceof ResourceNotFoundException$13) return void 0;
 			throw err;
 		}
 		if (!project) return void 0;
@@ -39625,7 +39894,7 @@ var CodeBuildProvider = class {
 				attributes: {}
 			} : null;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$12) return null;
+			if (err instanceof ResourceNotFoundException$13) return null;
 			throw err;
 		}
 		return null;
@@ -40345,7 +40614,7 @@ var DLMLifecyclePolicyProvider = class {
 			await this.getClient().send(new DeleteLifecyclePolicyCommand$1({ PolicyId: physicalId }));
 			this.logger.debug(`Successfully deleted DLM Lifecycle Policy ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$13) {
+			if (error instanceof ResourceNotFoundException$14) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DLM Lifecycle Policy ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -40396,7 +40665,7 @@ var DLMLifecyclePolicyProvider = class {
 				Tags: normalizeAwsTagsToCfn(policy.Tags)
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$13) return;
+			if (error instanceof ResourceNotFoundException$14) return;
 			throw error;
 		}
 	}
@@ -40432,7 +40701,7 @@ var DLMLifecyclePolicyProvider = class {
 				attributes: response.Policy.PolicyArn ? { Arn: response.Policy.PolicyArn } : {}
 			} : null;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$13) return null;
+			if (err instanceof ResourceNotFoundException$14) return null;
 			throw err;
 		}
 		return null;
@@ -42768,7 +43037,7 @@ var ACMCertificateProvider = class {
 			try {
 				await this.acmClient.send(new DeleteCertificateCommand({ CertificateArn: physicalId }));
 			} catch (error) {
-				if (error instanceof ResourceNotFoundException$6) {
+				if (error instanceof ResourceNotFoundException$7) {
 					assertRegionMatch(await this.acmClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Certificate ${physicalId} does not exist, skipping deletion`);
 					return;
@@ -42806,7 +43075,7 @@ var ACMCertificateProvider = class {
 		try {
 			cert = (await this.acmClient.send(new DescribeCertificateCommand({ CertificateArn: physicalId }))).Certificate;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$6) return void 0;
+			if (err instanceof ResourceNotFoundException$7) return void 0;
 			throw err;
 		}
 		if (!cert) return void 0;
@@ -42820,7 +43089,7 @@ var ACMCertificateProvider = class {
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.acmClient.send(new ListTagsForCertificateCommand({ CertificateArn: physicalId }))).Tags);
 		} catch (err) {
-			if (!(err instanceof ResourceNotFoundException$6)) throw err;
+			if (!(err instanceof ResourceNotFoundException$7)) throw err;
 		}
 		return result;
 	}
@@ -42851,7 +43120,7 @@ var ACMCertificateProvider = class {
 					}
 				};
 			} catch (err) {
-				if (err instanceof ResourceNotFoundException$6) return null;
+				if (err instanceof ResourceNotFoundException$7) return null;
 				throw err;
 			}
 		}
@@ -42973,6 +43242,7 @@ function registerAllProviders(registry) {
 	registry.register("AWS::DynamoDB::GlobalTable", new DynamoDBGlobalTableProvider());
 	registry.register("AWS::Logs::LogGroup", new LogsLogGroupProvider());
 	registry.register("AWS::CloudWatch::Alarm", new CloudWatchAlarmProvider());
+	registry.register("AWS::CloudWatch::AnomalyDetector", new CloudWatchAnomalyDetectorProvider());
 	registry.register("AWS::SecretsManager::Secret", new SecretsManagerSecretProvider());
 	registry.register("AWS::SSM::Parameter", new SSMParameterProvider());
 	registry.register("AWS::Events::Rule", new EventBridgeRuleProvider());
@@ -62934,7 +63204,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.269.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.271.0");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;