@go-to-k/cdkd 0.280.18 → 0.280.20

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-mvkiu-7h.js";
+import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-CC3BV-Gp.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-C6cQkX3h.js";
+import { t as ASGProvider } from "./asg-provider-BWT5cpBO.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -49,7 +49,7 @@ import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, Delet
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
 import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$9, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
@@ -26391,6 +26391,15 @@ const DEPLOYMENT_CONFIG_PRESERVE_KEYS = /* @__PURE__ */ new Set(["HookDetails"])
 */
 const DEPLOYMENT_CONFIG_PRESERVE_KEYS_CAMEL = /* @__PURE__ */ new Set(["hookDetails"]);
 /**
+* `ServiceConnectConfiguration.LogConfiguration.Options` is a free-form
+* log-driver option map (e.g. `awslogs-group`) whose keys are user data, NOT
+* CloudFormation property names — copy the value subtree verbatim while the
+* `Options` key itself still flips to `options` (issue #609; same rule as
+* `DEPLOYMENT_CONFIG_PRESERVE_KEYS` above and the container-level
+* `LogConfiguration.Options` handling in `convertLogConfiguration`).
+*/
+const SERVICE_CONNECT_PRESERVE_KEYS = /* @__PURE__ */ new Set(["Options"]);
+/**
 * Derive the cluster name from a long-format ECS Service ARN
 * (`arn:<partition>:ecs:<region>:<account>:service/<clusterName>/<serviceName>`)
 * so `DescribeServices` can be scoped to the right cluster (issue #1170).
@@ -26418,6 +26427,12 @@ function clusterNameFromServiceArn(arn) {
 * The CC API adds unnecessary polling overhead for operations that
 * complete immediately. This SDK provider eliminates that polling.
 */
+/**
+* Test seam for `settleService`'s post-stability rollout poll (the sibling of
+* `finalSnapshotDelays` / `describeTypeRetryDelays`) — tests replace `sleep`
+* to skip the real 3s waits.
+*/
+const settleRolloutDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
 var ECSProvider = class {
 	ecsClient;
 	providerRegion = process.env["AWS_REGION"];
@@ -26470,10 +26485,18 @@ var ECSProvider = class {
 			"PropagateTags",
 			"EnableExecuteCommand",
 			"ServiceRegistries",
-			"Tags"
+			"Tags",
+			"AvailabilityZoneRebalancing",
+			"DeploymentController",
+			"ForceNewDeployment",
+			"Monitoring",
+			"Role",
+			"ServiceConnectConfiguration",
+			"VolumeConfigurations",
+			"VpcLatticeConfigurations"
 		])]
 	]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ECS::Service", /* @__PURE__ */ new Map([["Role", "Legacy classic-ELB service-linked-role override; AWS uses the AWSServiceRoleForECS service-linked role automatically since 2017"]])], ["AWS::ECS::TaskDefinition", /* @__PURE__ */ new Map([["InferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ECS::TaskDefinition", /* @__PURE__ */ new Map([["InferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])]]);
 	getClient() {
 		if (!this.ecsClient) this.ecsClient = new ECSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.ecsClient;
@@ -26688,7 +26711,14 @@ var ECSProvider = class {
 				propagateTags: properties["PropagateTags"],
 				enableExecuteCommand: properties["EnableExecuteCommand"],
 				serviceRegistries: this.convertServiceRegistries(properties["ServiceRegistries"]),
-				tags: convertTags(properties["Tags"])
+				tags: convertTags(properties["Tags"]),
+				availabilityZoneRebalancing: properties["AvailabilityZoneRebalancing"],
+				deploymentController: this.convertDeploymentController(properties["DeploymentController"]),
+				role: properties["Role"],
+				serviceConnectConfiguration: this.convertServiceConnectConfiguration(properties["ServiceConnectConfiguration"]),
+				volumeConfigurations: this.convertServiceVolumeConfigurations(properties["VolumeConfigurations"]),
+				vpcLatticeConfigurations: this.convertVpcLatticeConfigurations(properties["VpcLatticeConfigurations"]),
+				monitoring: this.convertMonitoringConfiguration(properties["Monitoring"])
 			}))).service;
 			if (!service || !service.serviceArn) throw new Error("CreateService did not return service ARN");
 			this.logger.debug(`Successfully created ECS service ${logicalId}: ${service.serviceArn}`);
@@ -26753,6 +26783,20 @@ var ECSProvider = class {
 				cluster,
 				services: [serviceRef]
 			});
+			const rolloutDeadline = Date.now() + 12e4;
+			for (;;) {
+				const deployments = (await this.getClient().send(new DescribeServicesCommand({
+					cluster,
+					services: [serviceRef]
+				})))?.services?.[0]?.deployments;
+				const rolloutState = deployments && deployments.length === 1 ? deployments[0]?.rolloutState : void 0;
+				if (rolloutState === void 0 || rolloutState === "COMPLETED") break;
+				if (Date.now() >= rolloutDeadline) {
+					this.logger.warn(`ECS service ${logicalId} is steady but its rollout is still ${rolloutState} after the post-stability grace window; continuing`);
+					break;
+				}
+				await settleRolloutDelays.sleep(3e3);
+			}
 			this.logger.debug(`ECS service ${logicalId} reached steady state`);
 			return;
 		}
@@ -26786,6 +26830,13 @@ var ECSProvider = class {
 		const enableECSManagedTagsInput = clearOnUpdateRemoval(properties["EnableECSManagedTags"], previousProperties["EnableECSManagedTags"], false);
 		const propagateTagsInput = clearOnUpdateRemoval(properties["PropagateTags"], previousProperties["PropagateTags"], "NONE");
 		const enableExecuteCommandInput = clearOnUpdateRemoval(properties["EnableExecuteCommand"], previousProperties["EnableExecuteCommand"], false);
+		const availabilityZoneRebalancingInput = JSON.stringify(previousProperties["AvailabilityZoneRebalancing"] ?? null) !== JSON.stringify(properties["AvailabilityZoneRebalancing"] ?? null) && properties["AvailabilityZoneRebalancing"] !== void 0 ? properties["AvailabilityZoneRebalancing"] : void 0;
+		const deploymentControllerInput = JSON.stringify(previousProperties["DeploymentController"] ?? null) !== JSON.stringify(properties["DeploymentController"] ?? null) && properties["DeploymentController"] != null ? this.convertDeploymentController(properties["DeploymentController"]) : void 0;
+		const serviceConnectConfigurationInput = JSON.stringify(previousProperties["ServiceConnectConfiguration"] ?? null) !== JSON.stringify(properties["ServiceConnectConfiguration"] ?? null) ? clearOnUpdateRemoval(this.convertServiceConnectConfiguration(properties["ServiceConnectConfiguration"]), previousProperties["ServiceConnectConfiguration"], { enabled: false }) : void 0;
+		const volumeConfigurationsInput = JSON.stringify(previousProperties["VolumeConfigurations"] ?? null) !== JSON.stringify(properties["VolumeConfigurations"] ?? null) ? clearOnUpdateRemoval(this.convertServiceVolumeConfigurations(properties["VolumeConfigurations"]), previousProperties["VolumeConfigurations"], []) : void 0;
+		const vpcLatticeConfigurationsInput = JSON.stringify(previousProperties["VpcLatticeConfigurations"] ?? null) !== JSON.stringify(properties["VpcLatticeConfigurations"] ?? null) ? clearOnUpdateRemoval(this.convertVpcLatticeConfigurations(properties["VpcLatticeConfigurations"]), previousProperties["VpcLatticeConfigurations"], []) : void 0;
+		const monitoringInput = JSON.stringify(previousProperties["Monitoring"] ?? null) !== JSON.stringify(properties["Monitoring"] ?? null) && properties["Monitoring"] != null ? this.convertMonitoringConfiguration(properties["Monitoring"]) : void 0;
+		const forceNewDeploymentInput = this.resolveForceNewDeployment(properties, previousProperties);
 		try {
 			const service = (await client.send(new UpdateServiceCommand({
 				cluster: properties["Cluster"],
@@ -26803,7 +26854,14 @@ var ECSProvider = class {
 				propagateTags: propagateTagsInput,
 				enableExecuteCommand: enableExecuteCommandInput,
 				loadBalancers: loadBalancersInput,
-				serviceRegistries: serviceRegistriesInput
+				serviceRegistries: serviceRegistriesInput,
+				availabilityZoneRebalancing: availabilityZoneRebalancingInput,
+				deploymentController: deploymentControllerInput,
+				serviceConnectConfiguration: serviceConnectConfigurationInput,
+				volumeConfigurations: volumeConfigurationsInput,
+				vpcLatticeConfigurations: vpcLatticeConfigurationsInput,
+				monitoring: monitoringInput,
+				forceNewDeployment: forceNewDeploymentInput
 			}))).service;
 			if (service?.serviceArn) await this.applyTagDiff(service.serviceArn, previousProperties["Tags"], properties["Tags"]);
 			await this.settleService(logicalId, service?.serviceName ?? physicalId, properties["Cluster"]);
@@ -27537,6 +27595,96 @@ var ECSProvider = class {
 		return pascalToCamelCaseKeys(items);
 	}
 	/**
+	* Convert the CFn PascalCase `DeploymentController` block (`{Type}`) to the
+	* ECS SDK camelCase input shape (`{type}`) — a pure first-letter flip
+	* (issue #609).
+	*/
+	convertDeploymentController(config) {
+		if (!config) return void 0;
+		return pascalToCamelCaseKeys(config);
+	}
+	/**
+	* Convert the CFn PascalCase `ServiceConnectConfiguration` block to the ECS
+	* SDK camelCase input shape (issue #609). Every key in the subtree is a pure
+	* first-letter flip (`Enabled` / `Namespace` / `Services[].{PortName,
+	* DiscoveryName, ClientAliases, IngressPortOverride, Timeout, Tls}` /
+	* `LogConfiguration` / `AccessLogConfiguration`), so the shared recursive
+	* converter delivers the whole subtree — EXCEPT
+	* `LogConfiguration.Options`, a free-form log-driver option map copied
+	* verbatim (see {@link SERVICE_CONNECT_PRESERVE_KEYS}).
+	*/
+	convertServiceConnectConfiguration(config) {
+		if (!config) return void 0;
+		return pascalToCamelCaseKeys(config, SERVICE_CONNECT_PRESERVE_KEYS);
+	}
+	/**
+	* Convert the CFn PascalCase `VolumeConfigurations` array to the ECS SDK
+	* camelCase input shape (issue #609). Every key is a pure first-letter flip
+	* — including the two spellings worth calling out: `ManagedEBSVolume` ->
+	* `managedEBSVolume` and `SizeInGiB` -> `sizeInGiB` (both verified against
+	* the SDK model; only the FIRST character flips, the interior case is
+	* identical), so the shared recursive converter delivers the whole subtree
+	* (`Encrypted` / `KmsKeyId` / `VolumeType` / `SnapshotId` /
+	* `VolumeInitializationRate` / `Iops` / `Throughput` / `TagSpecifications`
+	* / `RoleArn` / `FilesystemType`).
+	*/
+	convertServiceVolumeConfigurations(items) {
+		if (!items) return void 0;
+		return pascalToCamelCaseKeys(items);
+	}
+	/**
+	* Convert the CFn PascalCase `VpcLatticeConfigurations` array to the ECS
+	* SDK camelCase input shape (issue #609). Each element `{RoleArn,
+	* TargetGroupArn, PortName}` is a pure first-letter flip.
+	*/
+	convertVpcLatticeConfigurations(items) {
+		if (!items) return void 0;
+		return pascalToCamelCaseKeys(items);
+	}
+	/**
+	* Convert the CFn PascalCase `Monitoring` block to the ECS SDK camelCase
+	* `monitoring` input shape (issue #609). Every key is a pure first-letter
+	* flip (`MetricConfigurations[].{MetricNames, ResolutionSeconds}`).
+	*/
+	convertMonitoringConfiguration(config) {
+		if (!config) return void 0;
+		return pascalToCamelCaseKeys(config);
+	}
+	/**
+	* Translate the CFn-only `ForceNewDeployment` trigger object
+	* (`{EnableForceNewDeployment, ForceNewDeploymentNonce}`) into the SDK's
+	* plain `forceNewDeployment` boolean on UpdateService (issue #609).
+	*
+	* A forced rollout is requested when EITHER the template says
+	* `EnableForceNewDeployment: true` OR the nonce changed vs the previous
+	* deploy's recorded value (introducing a nonce counts as a change). On any
+	* other shape — block absent, malformed, enable false with an unchanged
+	* nonce — return `undefined` so the field is omitted (AWS's documented
+	* default: deployments are not forced).
+	*
+	* Create-path: deliberate no-op — CreateService has no such member, and the
+	* initial deployment IS a fresh rollout by definition.
+	*
+	* This is UPDATE-path code, so a malformed desired block WARNS and skips
+	* rather than throwing (the config-shape doctrine: a rollback replays
+	* `update()` with a historical state record as the desired bag).
+	*/
+	resolveForceNewDeployment(properties, previousProperties) {
+		const desired = properties["ForceNewDeployment"];
+		if (desired == null) return void 0;
+		if (typeof desired !== "object" || Array.isArray(desired)) {
+			this.logger.warn(`AWS::ECS::Service ForceNewDeployment is not an object (got ${Array.isArray(desired) ? "array" : typeof desired}); skipping the forced-rollout translation`);
+			return;
+		}
+		const block = desired;
+		const enable = this.coerceBool(block["EnableForceNewDeployment"]);
+		const nonce = block["ForceNewDeploymentNonce"];
+		const previous = previousProperties["ForceNewDeployment"];
+		const previousNonce = previous != null && typeof previous === "object" && !Array.isArray(previous) ? previous["ForceNewDeploymentNonce"] : void 0;
+		const nonceChanged = nonce !== void 0 && JSON.stringify(nonce) !== JSON.stringify(previousNonce);
+		return enable === true || nonceChanged ? true : void 0;
+	}
+	/**
 	* Convert the CFn PascalCase `TaskDefinition.RuntimePlatform` to the ECS SDK
 	* camelCase input shape (issue #1165). `{CpuArchitecture,
 	* OperatingSystemFamily}` -> `{cpuArchitecture, operatingSystemFamily}`.
@@ -27645,6 +27793,35 @@ var ECSProvider = class {
 		return false;
 	}
 	/**
+	* State property paths `readCurrentState` deliberately cannot read back
+	* from AWS (issue #609) — fed into the drift comparator's `ignorePaths` so
+	* a template that sets them does not phantom-drift as "removed" on every
+	* run:
+	*   - `ServiceConnectConfiguration` / `VolumeConfigurations` /
+	*     `VpcLatticeConfigurations`: DescribeServices does not return them on
+	*     the top-level `Service` shape (they surface only per-deployment
+	*     under `deployments[]`, which is rollout metadata, not service
+	*     config). `VolumeConfigurations` is also registry-recorded write-only.
+	*   - `Monitoring`: not returned by DescribeServices at all.
+	*   - `ForceNewDeployment`: a write-only rollout trigger, not persisted
+	*     service state.
+	*   - `Role`: AWS reports `Service.roleArn` as the service-linked
+	*     AWSServiceRoleForECS ARN when the template omits Role, and always as
+	*     a full ARN when the template may carry a bare role name — a
+	*     mechanical reverse-map would manufacture drift in both directions.
+	*/
+	getDriftUnknownPaths(resourceType) {
+		if (resourceType === "AWS::ECS::Service") return [
+			"ServiceConnectConfiguration",
+			"VolumeConfigurations",
+			"VpcLatticeConfigurations",
+			"Monitoring",
+			"ForceNewDeployment",
+			"Role"
+		];
+		return [];
+	}
+	/**
 	* Read the AWS-current ECS resource configuration in CFn-property shape.
 	*
 	* Dispatches by resource type:
@@ -27748,6 +27925,8 @@ var ECSProvider = class {
 			result["PlacementStrategies"] = strategy;
 		}
 		result["ServiceRegistries"] = camelToPascalCaseKeys(s.serviceRegistries ?? []);
+		if (s.availabilityZoneRebalancing !== void 0) result["AvailabilityZoneRebalancing"] = s.availabilityZoneRebalancing;
+		result["DeploymentController"] = { Type: s.deploymentController?.type ?? "ECS" };
 		result["Tags"] = normalizeAwsTagsToCfn(s.tags);
 		return result;
 	}
@@ -27873,6 +28052,78 @@ const TARGET_GROUP_ATTRIBUTE_DEFAULTS = {
 	"proxy_protocol_v2.enabled": "false"
 };
 /**
+* Documented AWS defaults for the BOOLEAN / ENUM-valued LoadBalancer and
+* Listener attributes, used to reset a removed `LoadBalancerAttributes` /
+* `ListenerAttributes` entry.
+*
+* Unlike ModifyTargetGroupAttributes — which rejects an empty `Value` for
+* EVERY key — these two APIs accept `Value: ''` for the numeric and
+* free-form string attributes and REJECT it only where the value is
+* validated against a fixed set. Live A/B 2026-08-11 (issue #1609 item 1),
+* via the `alb` integ's removal phase:
+*
+*   idle_timeout.timeout_seconds  -> `Value: ''` ACCEPTED (numeric)
+*   deletion_protection.enabled   -> "The value of 'deletion_protection.enabled'
+*                                     must be 'true' or 'false', but was ''"
+*   routing.http.response.server.enabled (Listener)
+*                                 -> same rejection, same shape
+*
+* A rejection fails the whole Modify* call, so ONE removed boolean took the
+* entire deploy down (and then the rollback with it). Hence: send the
+* documented default for the validated keys, and keep the empty string for
+* everything else — which is both these APIs' own "clear the override"
+* signal and the behaviour every non-boolean key already relied on.
+*
+* That fallback is the deliberate DIVERGENCE from
+* TARGET_GROUP_ATTRIBUTE_DEFAULTS, whose unknown-key arm warns and retains:
+* there the empty string is never valid, here it is valid for the majority
+* of keys, so falling back to it preserves working behaviour instead of
+* silently retaining a value the template asked to drop.
+*
+* A key is listed ONLY when ONE unconditional default is established for it —
+* documented in the SDK model, or (for
+* `routing.http.response.server.enabled`, which the model leaves unstated)
+* proven by the `alb` integ's live removal readback. Two exclusion classes
+* matter, and both are the difference between failing loudly and writing a
+* wrong value silently:
+*
+* - **Default depends on the LOAD BALANCER** — `load_balancing.cross_zone.enabled`
+*   is always-on and unconfigurable for an ALB but defaults to false on an
+*   NLB / GWLB, and `ipv6.deny_all_igw_traffic` is "false for internet-facing
+*   load balancers and true for internal load balancers". cdkd knows neither
+*   the type nor the scheme at diff time, so a hardcoded entry would send the
+*   WRONG value for half of all load balancers — and since it is a valid
+*   boolean, AWS accepts it. For `ipv6.deny_all_igw_traffic` that means
+*   silently un-blocking internet-gateway access on an INTERNAL load balancer.
+* - **No documented default at all** — `dns_record.client_routing_policy`
+*   enumerates its possible values but states no default.
+*
+* Both classes keep the empty-string behaviour they have always had, so a
+* removal there fails loudly (for a validated key) instead of guessing.
+*
+* Source: the `@aws-sdk/client-elastic-load-balancing-v2` model docs for
+* `ModifyLoadBalancerAttributes` / `ModifyListenerAttributes`, checked per key;
+* `routing.http.response.server.enabled`'s default is additionally LIVE-proven
+* by the `alb` integ's removal readback rather than taken from the docs.
+*/
+const LOAD_BALANCER_ATTRIBUTE_DEFAULTS = {
+	"deletion_protection.enabled": "false",
+	"access_logs.s3.enabled": "false",
+	"connection_logs.s3.enabled": "false",
+	"health_check_logs.s3.enabled": "false",
+	"routing.http.desync_mitigation_mode": "defensive",
+	"routing.http.drop_invalid_header_fields.enabled": "false",
+	"routing.http.preserve_host_header.enabled": "false",
+	"routing.http.x_amzn_tls_version_and_cipher_suite.enabled": "false",
+	"routing.http.xff_client_port.enabled": "false",
+	"routing.http.xff_header_processing.mode": "append",
+	"routing.http2.enabled": "true",
+	"waf.fail_open.enabled": "false",
+	"zonal_shift.config.enabled": "false"
+};
+/** @see LOAD_BALANCER_ATTRIBUTE_DEFAULTS — same rule, Listener key table. */
+const LISTENER_ATTRIBUTE_DEFAULTS = { "routing.http.response.server.enabled": "true" };
+/**
 * AWS ELBv2 Provider
 *
 * Implements resource provisioning for ELBv2 resources:
@@ -28085,7 +28336,7 @@ var ELBv2Provider = class {
 			return out;
 		};
 		if (JSON.stringify(stripHandled(properties)) !== JSON.stringify(stripHandled(previousProperties))) throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place; for Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.");
-		const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["LoadBalancerAttributes"]), this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]));
+		const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["LoadBalancerAttributes"]), this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]), this.attributeRemovalResolver(LOAD_BALANCER_ATTRIBUTE_DEFAULTS));
 		if (submittedAttrs.length > 0) {
 			await this.getClient().send(new ModifyLoadBalancerAttributesCommand({
 				LoadBalancerArn: physicalId,
@@ -28309,10 +28560,13 @@ var ELBv2Provider = class {
 				UnhealthyThresholdCount: properties["UnhealthyThresholdCount"] !== void 0 ? Number(properties["UnhealthyThresholdCount"]) : void 0,
 				...matcher && { Matcher: matcher }
 			}));
-			const tgAttrDiff = this.diffAttributes(this.normalizeAttributes(properties["TargetGroupAttributes"]), this.normalizeAttributes(previousProperties["TargetGroupAttributes"]), (key) => {
-				const fallback = TARGET_GROUP_ATTRIBUTE_DEFAULTS[key];
-				if (fallback === void 0) this.logger.warn(`TargetGroup attribute ${key} was removed from the template but has no documented default cdkd can reset it to — the live value is retained. Set the attribute explicitly to change it.`);
-				return fallback;
+			const tgAttrDiff = this.diffAttributes(this.normalizeAttributes(properties["TargetGroupAttributes"]), this.normalizeAttributes(previousProperties["TargetGroupAttributes"]), (key, currentValue) => {
+				const fallback = Object.hasOwn(TARGET_GROUP_ATTRIBUTE_DEFAULTS, key) ? TARGET_GROUP_ATTRIBUTE_DEFAULTS[key] : void 0;
+				if (fallback === void 0) {
+					this.logger.warn(`TargetGroup attribute ${key} was removed from the template but has no documented default cdkd can reset it to — the live value is retained. Set the attribute explicitly to change it.`);
+					return;
+				}
+				return currentValue === fallback ? void 0 : fallback;
 			});
 			if (tgAttrDiff.length > 0) {
 				await this.getClient().send(new ModifyTargetGroupAttributesCommand({
@@ -28444,7 +28698,7 @@ var ELBv2Provider = class {
 				...alpnPolicy && alpnPolicy.length > 0 && { AlpnPolicy: alpnPolicy },
 				...mutualAuth !== void 0 && { MutualAuthentication: mutualAuth }
 			}));
-			const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["ListenerAttributes"]), this.normalizeAttributes(previousProperties["ListenerAttributes"]));
+			const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["ListenerAttributes"]), this.normalizeAttributes(previousProperties["ListenerAttributes"]), this.attributeRemovalResolver(LISTENER_ATTRIBUTE_DEFAULTS));
 			if (submittedAttrs.length > 0) {
 				await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
 					ListenerArn: physicalId,
@@ -28522,14 +28776,28 @@ var ELBv2Provider = class {
 	/**
 	* Key-diff two normalized `{Key, Value}` attribute lists into the payload
 	* for a Modify*Attributes call: changed values from `newAttrs` win, and
-	* keys present only in `oldAttrs` are pushed back through `removalValue` —
-	* by default the empty string, which ModifyLoadBalancerAttributes /
-	* ModifyListenerAttributes accept as "clear the override". A resolver
-	* returning `undefined` SKIPS the entry (the resolver owns any warn).
-	* An empty return means nothing changed and the call should be skipped.
-	* Shared by the LoadBalancer / TargetGroup / Listener update paths.
-	*/
-	diffAttributes(newAttrs, oldAttrs, removalValue = () => "") {
+	* keys present only in `oldAttrs` are pushed back through `removalValue`.
+	* A resolver returning `undefined` SKIPS the entry (the resolver owns any
+	* warn). An empty return means nothing changed and the call should be
+	* skipped. Shared by the LoadBalancer / TargetGroup / Listener update
+	* paths — and all three pass their OWN resolver, because the three APIs
+	* disagree about what resets an attribute:
+	*
+	* - LoadBalancer / Listener: the empty string clears a numeric or
+	*   free-form-string override, but a BOOLEAN / ENUM key rejects it and
+	*   fails the whole call, so those take a documented default
+	*   (`LOAD_BALANCER_ATTRIBUTE_DEFAULTS` / `LISTENER_ATTRIBUTE_DEFAULTS`).
+	* - TargetGroup: the empty string is rejected for EVERY key, so the
+	*   documented default is the only reset and an unknown key warns and
+	*   retains (`TARGET_GROUP_ATTRIBUTE_DEFAULTS`).
+	*
+	* All three behaviours were live-verified 2026-08-11. `removalValue` is
+	* REQUIRED rather than defaulted: there is no reset value that is correct
+	* for all three APIs, so a caller that forgets to pass one should fail to
+	* compile instead of silently inheriting the empty string that two of the
+	* three reject.
+	*/
+	diffAttributes(newAttrs, oldAttrs, removalValue) {
 		const newAttrMap = new Map(newAttrs.map((a) => [a.Key, a.Value]));
 		const oldAttrMap = new Map(oldAttrs.map((a) => [a.Key, a.Value]));
 		const submitted = [];
@@ -28537,8 +28805,8 @@ var ELBv2Provider = class {
 			Key: k,
 			Value: v
 		});
-		for (const [k] of oldAttrMap) if (!newAttrMap.has(k)) {
-			const value = removalValue(k);
+		for (const [k, currentValue] of oldAttrMap) if (!newAttrMap.has(k)) {
+			const value = removalValue(k, currentValue);
 			if (value !== void 0) submitted.push({
 				Key: k,
 				Value: value
@@ -28547,6 +28815,40 @@ var ELBv2Provider = class {
 		return submitted;
 	}
 	/**
+	* Build the `removalValue` resolver for the LoadBalancer / Listener attribute
+	* arms: reset a removed key to its documented default, or to `''` (which
+	* those two APIs accept as "clear the override") when no default is known.
+	*
+	* **A key already AT its default is SKIPPED, and that is a safety property,
+	* not an optimization.** The previous side is not always a template: `cdkd
+	* drift --revert` calls `update(..., newProperties, outcome.awsProperties)`
+	* (`src/cli/commands/drift.ts`), so `oldAttrs` can be the FULL
+	* `readCurrentState` snapshot — every attribute AWS reports, including the
+	* ~18 the user never templated. Against a state record with no
+	* `observedProperties` the desired side is the template's one or two keys,
+	* so every untemplated key looks REMOVED and would be "reset".
+	*
+	* Writing a documented default there would silently disable deletion
+	* protection, access / connection logs, HTTP/2, WAF fail-open and zonal
+	* shift on a live load balancer. Before the defaults table existed this was
+	* accidentally safe — `''` fails validation, so the whole revert aborted and
+	* changed nothing — so introducing the table without this guard would have
+	* converted a loud refusal into a silent destructive write.
+	*
+	* The skip is exact rather than heuristic: a key the user never templated is
+	* BY DEFINITION sitting at its default, so it is skipped; a key the template
+	* really did set is set to a NON-default value (otherwise templating it
+	* would be a no-op), so its reset still fires. A template that set a key to
+	* exactly its default and then dropped it is skipped too — correctly, since
+	* there is nothing to change.
+	*/
+	attributeRemovalResolver(defaults) {
+		return (key, currentValue) => {
+			const fallback = Object.hasOwn(defaults, key) ? defaults[key] : "";
+			return currentValue === fallback ? void 0 : fallback;
+		};
+	}
+	/**
 	* Normalize a CFn `Targets` value (an array of `{ Id, Port?,
 	* AvailabilityZone? }` objects) into the SDK's `TargetDescription[]` shape.
 	* Entries missing an `Id` are dropped (Id is the only required member);
@@ -33987,8 +34289,16 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		this.logger.debug(`Deleting Cloud Map namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		try {
-			const operationId = (await client.send(new DeleteNamespaceCommand({ Id: physicalId }))).OperationId;
-			if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			await withRetry(async () => {
+				const operationId = (await client.send(new DeleteNamespaceCommand({ Id: physicalId }))).OperationId;
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			}, logicalId, {
+				maxRetries: 24,
+				initialDelayMs: 3e3,
+				maxDelayMs: 15e3,
+				isRetryable: (message, error) => error instanceof ResourceInUse || /has associated services/i.test(message),
+				logger: this.logger
+			});
 			this.logger.debug(`Successfully deleted Cloud Map namespace ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NamespaceNotFound) {
@@ -69797,7 +70107,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.18");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.20");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;