@go-to-k/cdkd 0.280.19 → 0.280.21

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-r4N9-tZD.js";
+import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-2LVq2qWa.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-B62D31jG.js";
+import { t as ASGProvider } from "./asg-provider-FOwZJoaD.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -49,7 +49,7 @@ import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, Delet
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
 import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$9, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ResourceInUse, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetGraphqlApiEnvironmentVariablesCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, PutGraphqlApiEnvironmentVariablesCommand, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
@@ -26391,6 +26391,15 @@ const DEPLOYMENT_CONFIG_PRESERVE_KEYS = /* @__PURE__ */ new Set(["HookDetails"])
 */
 const DEPLOYMENT_CONFIG_PRESERVE_KEYS_CAMEL = /* @__PURE__ */ new Set(["hookDetails"]);
 /**
+* `ServiceConnectConfiguration.LogConfiguration.Options` is a free-form
+* log-driver option map (e.g. `awslogs-group`) whose keys are user data, NOT
+* CloudFormation property names — copy the value subtree verbatim while the
+* `Options` key itself still flips to `options` (issue #609; same rule as
+* `DEPLOYMENT_CONFIG_PRESERVE_KEYS` above and the container-level
+* `LogConfiguration.Options` handling in `convertLogConfiguration`).
+*/
+const SERVICE_CONNECT_PRESERVE_KEYS = /* @__PURE__ */ new Set(["Options"]);
+/**
 * Derive the cluster name from a long-format ECS Service ARN
 * (`arn:<partition>:ecs:<region>:<account>:service/<clusterName>/<serviceName>`)
 * so `DescribeServices` can be scoped to the right cluster (issue #1170).
@@ -26418,6 +26427,12 @@ function clusterNameFromServiceArn(arn) {
 * The CC API adds unnecessary polling overhead for operations that
 * complete immediately. This SDK provider eliminates that polling.
 */
+/**
+* Test seam for `settleService`'s post-stability rollout poll (the sibling of
+* `finalSnapshotDelays` / `describeTypeRetryDelays`) — tests replace `sleep`
+* to skip the real 3s waits.
+*/
+const settleRolloutDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
 var ECSProvider = class {
 	ecsClient;
 	providerRegion = process.env["AWS_REGION"];
@@ -26470,10 +26485,18 @@ var ECSProvider = class {
 			"PropagateTags",
 			"EnableExecuteCommand",
 			"ServiceRegistries",
-			"Tags"
+			"Tags",
+			"AvailabilityZoneRebalancing",
+			"DeploymentController",
+			"ForceNewDeployment",
+			"Monitoring",
+			"Role",
+			"ServiceConnectConfiguration",
+			"VolumeConfigurations",
+			"VpcLatticeConfigurations"
 		])]
 	]);
-	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ECS::Service", /* @__PURE__ */ new Map([["Role", "Legacy classic-ELB service-linked-role override; AWS uses the AWSServiceRoleForECS service-linked role automatically since 2017"]])], ["AWS::ECS::TaskDefinition", /* @__PURE__ */ new Map([["InferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ECS::TaskDefinition", /* @__PURE__ */ new Map([["InferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])]]);
 	getClient() {
 		if (!this.ecsClient) this.ecsClient = new ECSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.ecsClient;
@@ -26688,7 +26711,14 @@ var ECSProvider = class {
 				propagateTags: properties["PropagateTags"],
 				enableExecuteCommand: properties["EnableExecuteCommand"],
 				serviceRegistries: this.convertServiceRegistries(properties["ServiceRegistries"]),
-				tags: convertTags(properties["Tags"])
+				tags: convertTags(properties["Tags"]),
+				availabilityZoneRebalancing: properties["AvailabilityZoneRebalancing"],
+				deploymentController: this.convertDeploymentController(properties["DeploymentController"]),
+				role: properties["Role"],
+				serviceConnectConfiguration: this.convertServiceConnectConfiguration(properties["ServiceConnectConfiguration"]),
+				volumeConfigurations: this.convertServiceVolumeConfigurations(properties["VolumeConfigurations"]),
+				vpcLatticeConfigurations: this.convertVpcLatticeConfigurations(properties["VpcLatticeConfigurations"]),
+				monitoring: this.convertMonitoringConfiguration(properties["Monitoring"])
 			}))).service;
 			if (!service || !service.serviceArn) throw new Error("CreateService did not return service ARN");
 			this.logger.debug(`Successfully created ECS service ${logicalId}: ${service.serviceArn}`);
@@ -26753,6 +26783,20 @@ var ECSProvider = class {
 				cluster,
 				services: [serviceRef]
 			});
+			const rolloutDeadline = Date.now() + 12e4;
+			for (;;) {
+				const deployments = (await this.getClient().send(new DescribeServicesCommand({
+					cluster,
+					services: [serviceRef]
+				})))?.services?.[0]?.deployments;
+				const rolloutState = deployments && deployments.length === 1 ? deployments[0]?.rolloutState : void 0;
+				if (rolloutState === void 0 || rolloutState === "COMPLETED") break;
+				if (Date.now() >= rolloutDeadline) {
+					this.logger.warn(`ECS service ${logicalId} is steady but its rollout is still ${rolloutState} after the post-stability grace window; continuing`);
+					break;
+				}
+				await settleRolloutDelays.sleep(3e3);
+			}
 			this.logger.debug(`ECS service ${logicalId} reached steady state`);
 			return;
 		}
@@ -26786,6 +26830,13 @@ var ECSProvider = class {
 		const enableECSManagedTagsInput = clearOnUpdateRemoval(properties["EnableECSManagedTags"], previousProperties["EnableECSManagedTags"], false);
 		const propagateTagsInput = clearOnUpdateRemoval(properties["PropagateTags"], previousProperties["PropagateTags"], "NONE");
 		const enableExecuteCommandInput = clearOnUpdateRemoval(properties["EnableExecuteCommand"], previousProperties["EnableExecuteCommand"], false);
+		const availabilityZoneRebalancingInput = JSON.stringify(previousProperties["AvailabilityZoneRebalancing"] ?? null) !== JSON.stringify(properties["AvailabilityZoneRebalancing"] ?? null) && properties["AvailabilityZoneRebalancing"] !== void 0 ? properties["AvailabilityZoneRebalancing"] : void 0;
+		const deploymentControllerInput = JSON.stringify(previousProperties["DeploymentController"] ?? null) !== JSON.stringify(properties["DeploymentController"] ?? null) && properties["DeploymentController"] != null ? this.convertDeploymentController(properties["DeploymentController"]) : void 0;
+		const serviceConnectConfigurationInput = JSON.stringify(previousProperties["ServiceConnectConfiguration"] ?? null) !== JSON.stringify(properties["ServiceConnectConfiguration"] ?? null) ? clearOnUpdateRemoval(this.convertServiceConnectConfiguration(properties["ServiceConnectConfiguration"]), previousProperties["ServiceConnectConfiguration"], { enabled: false }) : void 0;
+		const volumeConfigurationsInput = JSON.stringify(previousProperties["VolumeConfigurations"] ?? null) !== JSON.stringify(properties["VolumeConfigurations"] ?? null) ? clearOnUpdateRemoval(this.convertServiceVolumeConfigurations(properties["VolumeConfigurations"]), previousProperties["VolumeConfigurations"], []) : void 0;
+		const vpcLatticeConfigurationsInput = JSON.stringify(previousProperties["VpcLatticeConfigurations"] ?? null) !== JSON.stringify(properties["VpcLatticeConfigurations"] ?? null) ? clearOnUpdateRemoval(this.convertVpcLatticeConfigurations(properties["VpcLatticeConfigurations"]), previousProperties["VpcLatticeConfigurations"], []) : void 0;
+		const monitoringInput = JSON.stringify(previousProperties["Monitoring"] ?? null) !== JSON.stringify(properties["Monitoring"] ?? null) && properties["Monitoring"] != null ? this.convertMonitoringConfiguration(properties["Monitoring"]) : void 0;
+		const forceNewDeploymentInput = this.resolveForceNewDeployment(properties, previousProperties);
 		try {
 			const service = (await client.send(new UpdateServiceCommand({
 				cluster: properties["Cluster"],
@@ -26803,7 +26854,14 @@ var ECSProvider = class {
 				propagateTags: propagateTagsInput,
 				enableExecuteCommand: enableExecuteCommandInput,
 				loadBalancers: loadBalancersInput,
-				serviceRegistries: serviceRegistriesInput
+				serviceRegistries: serviceRegistriesInput,
+				availabilityZoneRebalancing: availabilityZoneRebalancingInput,
+				deploymentController: deploymentControllerInput,
+				serviceConnectConfiguration: serviceConnectConfigurationInput,
+				volumeConfigurations: volumeConfigurationsInput,
+				vpcLatticeConfigurations: vpcLatticeConfigurationsInput,
+				monitoring: monitoringInput,
+				forceNewDeployment: forceNewDeploymentInput
 			}))).service;
 			if (service?.serviceArn) await this.applyTagDiff(service.serviceArn, previousProperties["Tags"], properties["Tags"]);
 			await this.settleService(logicalId, service?.serviceName ?? physicalId, properties["Cluster"]);
@@ -27537,6 +27595,96 @@ var ECSProvider = class {
 		return pascalToCamelCaseKeys(items);
 	}
 	/**
+	* Convert the CFn PascalCase `DeploymentController` block (`{Type}`) to the
+	* ECS SDK camelCase input shape (`{type}`) — a pure first-letter flip
+	* (issue #609).
+	*/
+	convertDeploymentController(config) {
+		if (!config) return void 0;
+		return pascalToCamelCaseKeys(config);
+	}
+	/**
+	* Convert the CFn PascalCase `ServiceConnectConfiguration` block to the ECS
+	* SDK camelCase input shape (issue #609). Every key in the subtree is a pure
+	* first-letter flip (`Enabled` / `Namespace` / `Services[].{PortName,
+	* DiscoveryName, ClientAliases, IngressPortOverride, Timeout, Tls}` /
+	* `LogConfiguration` / `AccessLogConfiguration`), so the shared recursive
+	* converter delivers the whole subtree — EXCEPT
+	* `LogConfiguration.Options`, a free-form log-driver option map copied
+	* verbatim (see {@link SERVICE_CONNECT_PRESERVE_KEYS}).
+	*/
+	convertServiceConnectConfiguration(config) {
+		if (!config) return void 0;
+		return pascalToCamelCaseKeys(config, SERVICE_CONNECT_PRESERVE_KEYS);
+	}
+	/**
+	* Convert the CFn PascalCase `VolumeConfigurations` array to the ECS SDK
+	* camelCase input shape (issue #609). Every key is a pure first-letter flip
+	* — including the two spellings worth calling out: `ManagedEBSVolume` ->
+	* `managedEBSVolume` and `SizeInGiB` -> `sizeInGiB` (both verified against
+	* the SDK model; only the FIRST character flips, the interior case is
+	* identical), so the shared recursive converter delivers the whole subtree
+	* (`Encrypted` / `KmsKeyId` / `VolumeType` / `SnapshotId` /
+	* `VolumeInitializationRate` / `Iops` / `Throughput` / `TagSpecifications`
+	* / `RoleArn` / `FilesystemType`).
+	*/
+	convertServiceVolumeConfigurations(items) {
+		if (!items) return void 0;
+		return pascalToCamelCaseKeys(items);
+	}
+	/**
+	* Convert the CFn PascalCase `VpcLatticeConfigurations` array to the ECS
+	* SDK camelCase input shape (issue #609). Each element `{RoleArn,
+	* TargetGroupArn, PortName}` is a pure first-letter flip.
+	*/
+	convertVpcLatticeConfigurations(items) {
+		if (!items) return void 0;
+		return pascalToCamelCaseKeys(items);
+	}
+	/**
+	* Convert the CFn PascalCase `Monitoring` block to the ECS SDK camelCase
+	* `monitoring` input shape (issue #609). Every key is a pure first-letter
+	* flip (`MetricConfigurations[].{MetricNames, ResolutionSeconds}`).
+	*/
+	convertMonitoringConfiguration(config) {
+		if (!config) return void 0;
+		return pascalToCamelCaseKeys(config);
+	}
+	/**
+	* Translate the CFn-only `ForceNewDeployment` trigger object
+	* (`{EnableForceNewDeployment, ForceNewDeploymentNonce}`) into the SDK's
+	* plain `forceNewDeployment` boolean on UpdateService (issue #609).
+	*
+	* A forced rollout is requested when EITHER the template says
+	* `EnableForceNewDeployment: true` OR the nonce changed vs the previous
+	* deploy's recorded value (introducing a nonce counts as a change). On any
+	* other shape — block absent, malformed, enable false with an unchanged
+	* nonce — return `undefined` so the field is omitted (AWS's documented
+	* default: deployments are not forced).
+	*
+	* Create-path: deliberate no-op — CreateService has no such member, and the
+	* initial deployment IS a fresh rollout by definition.
+	*
+	* This is UPDATE-path code, so a malformed desired block WARNS and skips
+	* rather than throwing (the config-shape doctrine: a rollback replays
+	* `update()` with a historical state record as the desired bag).
+	*/
+	resolveForceNewDeployment(properties, previousProperties) {
+		const desired = properties["ForceNewDeployment"];
+		if (desired == null) return void 0;
+		if (typeof desired !== "object" || Array.isArray(desired)) {
+			this.logger.warn(`AWS::ECS::Service ForceNewDeployment is not an object (got ${Array.isArray(desired) ? "array" : typeof desired}); skipping the forced-rollout translation`);
+			return;
+		}
+		const block = desired;
+		const enable = this.coerceBool(block["EnableForceNewDeployment"]);
+		const nonce = block["ForceNewDeploymentNonce"];
+		const previous = previousProperties["ForceNewDeployment"];
+		const previousNonce = previous != null && typeof previous === "object" && !Array.isArray(previous) ? previous["ForceNewDeploymentNonce"] : void 0;
+		const nonceChanged = nonce !== void 0 && JSON.stringify(nonce) !== JSON.stringify(previousNonce);
+		return enable === true || nonceChanged ? true : void 0;
+	}
+	/**
 	* Convert the CFn PascalCase `TaskDefinition.RuntimePlatform` to the ECS SDK
 	* camelCase input shape (issue #1165). `{CpuArchitecture,
 	* OperatingSystemFamily}` -> `{cpuArchitecture, operatingSystemFamily}`.
@@ -27645,6 +27793,35 @@ var ECSProvider = class {
 		return false;
 	}
 	/**
+	* State property paths `readCurrentState` deliberately cannot read back
+	* from AWS (issue #609) — fed into the drift comparator's `ignorePaths` so
+	* a template that sets them does not phantom-drift as "removed" on every
+	* run:
+	*   - `ServiceConnectConfiguration` / `VolumeConfigurations` /
+	*     `VpcLatticeConfigurations`: DescribeServices does not return them on
+	*     the top-level `Service` shape (they surface only per-deployment
+	*     under `deployments[]`, which is rollout metadata, not service
+	*     config). `VolumeConfigurations` is also registry-recorded write-only.
+	*   - `Monitoring`: not returned by DescribeServices at all.
+	*   - `ForceNewDeployment`: a write-only rollout trigger, not persisted
+	*     service state.
+	*   - `Role`: AWS reports `Service.roleArn` as the service-linked
+	*     AWSServiceRoleForECS ARN when the template omits Role, and always as
+	*     a full ARN when the template may carry a bare role name — a
+	*     mechanical reverse-map would manufacture drift in both directions.
+	*/
+	getDriftUnknownPaths(resourceType) {
+		if (resourceType === "AWS::ECS::Service") return [
+			"ServiceConnectConfiguration",
+			"VolumeConfigurations",
+			"VpcLatticeConfigurations",
+			"Monitoring",
+			"ForceNewDeployment",
+			"Role"
+		];
+		return [];
+	}
+	/**
 	* Read the AWS-current ECS resource configuration in CFn-property shape.
 	*
 	* Dispatches by resource type:
@@ -27748,6 +27925,8 @@ var ECSProvider = class {
 			result["PlacementStrategies"] = strategy;
 		}
 		result["ServiceRegistries"] = camelToPascalCaseKeys(s.serviceRegistries ?? []);
+		if (s.availabilityZoneRebalancing !== void 0) result["AvailabilityZoneRebalancing"] = s.availabilityZoneRebalancing;
+		result["DeploymentController"] = { Type: s.deploymentController?.type ?? "ECS" };
 		result["Tags"] = normalizeAwsTagsToCfn(s.tags);
 		return result;
 	}
@@ -34110,8 +34289,16 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		this.logger.debug(`Deleting Cloud Map namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		try {
-			const operationId = (await client.send(new DeleteNamespaceCommand({ Id: physicalId }))).OperationId;
-			if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			await withRetry(async () => {
+				const operationId = (await client.send(new DeleteNamespaceCommand({ Id: physicalId }))).OperationId;
+				if (operationId) await this.pollOperation(operationId, logicalId, resourceType);
+			}, logicalId, {
+				maxRetries: 24,
+				initialDelayMs: 3e3,
+				maxDelayMs: 15e3,
+				isRetryable: (message, error) => error instanceof ResourceInUse || /has associated services/i.test(message),
+				logger: this.logger
+			});
 			this.logger.debug(`Successfully deleted Cloud Map namespace ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NamespaceNotFound) {
@@ -52746,7 +52933,7 @@ function findRevertDroppedAwsKeys(drifts, desiredProperties, awsProperties) {
 	}
 	for (const key of driftedTopLevelKeys) {
 		if (!(key in desiredProperties)) continue;
-		collectMissingPaths(awsProperties[key], desiredProperties[key], key, dropped);
+		collectMissingPaths(awsProperties[key], desiredProperties[key], key, dropped, isTagListKey(key) ? isServiceManagedTagKey : void 0);
 	}
 	return [...dropped].sort();
 }
@@ -52754,12 +52941,46 @@ function findRevertDroppedAwsKeys(drifts, desiredProperties, awsProperties) {
 * Walk the AWS-side value against the desired-side value, recording every path
 * present on the AWS side and absent on the desired side.
 *
-* Only plain objects are descended into. An ARRAY is compared wholesale — the
-* drift comparator itself treats arrays as single values (its paths never
+* Plain objects are descended into. A POSITIONAL array is compared wholesale —
+* the drift comparator itself treats arrays as single values (its paths never
 * carry an index), so an element-wise walk here would report positions the
 * rest of the revert path cannot reason about.
-*/
-function collectMissingPaths(awsValue, desiredValue, path, out) {
+*
+* A KEYED list is the exception, and it is the shape with the most to drop
+* (issue [#1626](https://github.com/go-to-k/cdkd/issues/1626)). An
+* `[{Key, Value}]` list is semantically a MAP that CFn spells as an array —
+* ELBv2 `LoadBalancerAttributes`, `ListenerAttributes`, `TargetGroupAttributes`
+* and every `Tags` list are this shape — so its entries have stable identities,
+* not positions, and `Key` is exactly what the user would act on. Skipping it
+* left the pass blind precisely where `readCurrentState` returns AWS's FULL
+* attribute set (~20 entries) against a template that declares one or two: the
+* plan warned about nothing while the revert was about to touch eighteen keys.
+*
+* Keyed-list entries are reported in BRACKET form (`LoadBalancerAttributes
+* [deletion_protection.enabled]`) rather than dotted, because attribute keys
+* contain dots themselves and a dotted path would be ambiguous with a nested
+* object.
+*
+* `isPreservedKey` exempts entries the revert does NOT actually drop — the
+* caller passes {@link isServiceManagedTagKey} for a top-level TAG LIST, whose
+* revert goes through {@link mergeTagListForRevert} and keeps `aws:`-prefixed /
+* `AmazonECSManaged` entries (issue #1501). Reporting those would be a warning
+* about a loss that cannot happen.
+*/
+function collectMissingPaths(awsValue, desiredValue, path, out, isPreservedKey) {
+	if (isKeyedList(awsValue)) {
+		if (!isKeyedList(desiredValue)) {
+			if (desiredValue === void 0) out.add(path);
+			return;
+		}
+		const desiredKeys = new Set(desiredValue.map((e) => e.Key));
+		for (const entry of awsValue) {
+			if (desiredKeys.has(entry.Key)) continue;
+			if (isPreservedKey?.(entry.Key)) continue;
+			out.add(`${path}[${entry.Key}]`);
+		}
+		return;
+	}
 	if (!isPlainRecord(awsValue)) return;
 	if (!isPlainRecord(desiredValue)) {
 		if (desiredValue === void 0) out.add(path);
@@ -52774,6 +52995,17 @@ function collectMissingPaths(awsValue, desiredValue, path, out) {
 		collectMissingPaths(value, desiredValue[key], childPath, out);
 	}
 }
+/**
+* A NON-EMPTY array whose every element is an object carrying a string `Key`.
+*
+* Emptiness is deliberately excluded: `[]` carries no identities, so treating
+* it as keyed would report nothing on the AWS side and — as the DESIRED side —
+* would claim every AWS entry is dropped, which is already what the
+* whole-list arm reports more legibly.
+*/
+function isKeyedList(value) {
+	return Array.isArray(value) && value.length > 0 && value.every((e) => typeof e === "object" && e !== null && typeof e.Key === "string");
+}
 function isPlainRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -69920,7 +70152,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.19");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.21");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;