@go-to-k/cdkd 0.248.0 → 0.250.0

package/dist/cli.js

@@ -1,10 +1,7 @@
 #!/usr/bin/env node
-import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
-import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
-import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
-import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-D6U-Cm8B.js";
-import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
-import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
+import { $ as ensureAssetStorage, A as WAFv2WebACLProvider, B as LockManager, Bt as LocalInvokeBuildError$1, C as findActionableSilentDrops, Ct as CFN_TEMPLATE_BODY_LIMIT, D as IntrinsicFunctionResolver, Dt as uploadCfnTemplate, E as isTerminationProtectionPropagationError, Et as findLargeInlineResources, F as assertRegionMatch, Ft as setAwsClients, G as stringifyValue, Gt as NestedStackChildDirectDestroyError, H as rebuildClientForBucketRegion, Ht as LocalStartServiceError, I as applyRoleArnIfSet, J as createAssetRedirectResolver, Jt as ResourceTimeoutError, K as WorkGraph, Kt as PartialFailureError, L as DiffCalculator, Lt as CdkdError, M as matchesCdkPath, Mt as AwsClients, N as normalizeAwsTagsToCfn, Nt as getAwsClients, O as cfnRefValueFromPhysicalId, Ot as expectedOwnerParam, P as resolveExplicitPhysicalId, Pt as resetAwsClients, Q as BOOTSTRAP_MARKER_PREFIX, R as DagBuilder, S as ProviderRegistry, St as warnDeprecatedNoPrefixCliFlag, T as disableInstanceApiTermination, Tt as MIGRATE_TMP_PREFIX, U as shouldRetainResource, V as S3StateBackend, Vt as LocalMigrateError, W as AssetPublisher, Wt as MissingCdkCliError, X as rewriteTemplateAssetReferences, Xt as StackHasActiveImportsError, Y as loadPublishableAssetManifest, Yt as ResourceUpdateNotSupportedError, Z as AssetModeResolver, Zt as StackTerminationProtectionError, _ as green, _t as resolveCaptureObservedState, a as withRetry, at as formatDockerLoginError, b as IAMRoleProvider, bt as resolveStateBucketWithDefaultAndSource, c as computeImplicitDeleteEdges, ct as runDockerStreaming, d as isStatefulRecreateTargetSync, dt as Synthesizer, et as getBootstrapMarkerKey, f as renderStatefulReason, ft as synthesisStatusMessage, g as gray, gt as resolveAutoAssetStorage, h as cyan, ht as resolveApp, i as withResourceDeadline, it as buildDockerImage, j as CDK_PATH_TAG, jt as resolveBucketRegion, k as refStateLookupFromResource, kt as AssemblyReader, l as extractDeploymentEventError, lt as AssetManifestLoader, m as bold, mt as getLegacyStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as normalizeAwsError, nt as validateAssetBucketName, o as isRetryableTransientError, ot as getDockerCmd, p as formatResourceLine, pt as getDefaultStateBucketName, q as buildAssetRedirectMap, qt as ProvisioningError, r as DeployEngine, rn as withErrorHandling, rt as validateContainerRepoName, s as IMPLICIT_DELETE_DEPENDENCIES, st as runDockerForeground, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as parseBootstrapMarker, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as getDockerImageBySourceHash, v as red, vt as resolveSkipPrefix, w as CloudControlProvider, wt as CFN_TEMPLATE_URL_LIMIT, x as collectInlinePolicyNamesManagedBySiblings, xt as resolveUseCdkBootstrapAssets, y as yellow, yt as resolveStateBucketWithDefault, z as TemplateParser } from "./deploy-engine-D-gBbMiZ.js";
+import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
+import { t as ASGProvider } from "./asg-provider-er3xGYRo.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -60,7 +57,7 @@ import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPer
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
-import { AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand as ListClustersCommand$1, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
+import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand as ListClustersCommand$1, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
@@ -321,7 +318,7 @@ function validateResourceTimeouts(opts) {
 	} else if (typeof globalWarn === "number" && globalWarn >= 18e5) throw new Error(`--resource-warn-after (${formatMs(globalWarn)}) must be less than --resource-timeout (default ${formatMs(DEFAULT_RESOURCE_TIMEOUT_MS)}). Pass --resource-timeout <duration> alongside it to raise the deadline.`);
 	const warnPerType = opts.resourceWarnAfter?.perTypeMs ?? {};
 	const timeoutPerType = timeout?.perTypeMs ?? {};
-	const types = new Set([...Object.keys(warnPerType), ...Object.keys(timeoutPerType)]);
+	const types = /* @__PURE__ */ new Set([...Object.keys(warnPerType), ...Object.keys(timeoutPerType)]);
 	for (const t of types) {
 		const explicitPerTypeWarn = warnPerType[t];
 		const explicitPerTypeTimeout = timeoutPerType[t];
@@ -1891,7 +1888,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.248.0";
+	return "0.250.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -2924,7 +2921,7 @@ function collectCrossStackRefs(node, onRef) {
 var IAMPolicyProvider = class {
 	iamClient;
 	logger = getLogger().child("IAMPolicyProvider");
-	handledProperties = new Map([["AWS::IAM::Policy", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::IAM::Policy", /* @__PURE__ */ new Set([
 		"PolicyName",
 		"PolicyDocument",
 		"Roles",
@@ -3258,7 +3255,7 @@ var IAMPolicyProvider = class {
 var IAMManagedPolicyProvider = class {
 	iamClient;
 	logger = getLogger().child("IAMManagedPolicyProvider");
-	handledProperties = new Map([["AWS::IAM::ManagedPolicy", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::IAM::ManagedPolicy", /* @__PURE__ */ new Set([
 		"ManagedPolicyName",
 		"Description",
 		"Path",
@@ -3759,7 +3756,7 @@ function derivePolicyNameFromArn(arn) {
 var IAMInstanceProfileProvider = class {
 	iamClient;
 	logger = getLogger().child("IAMInstanceProfileProvider");
-	handledProperties = new Map([["AWS::IAM::InstanceProfile", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::IAM::InstanceProfile", /* @__PURE__ */ new Set([
 		"InstanceProfileName",
 		"Path",
 		"Roles"
@@ -3979,8 +3976,8 @@ var IAMInstanceProfileProvider = class {
 var IAMUserGroupProvider = class {
 	iamClient;
 	logger = getLogger().child("IAMUserGroupProvider");
-	handledProperties = new Map([
-		["AWS::IAM::User", new Set([
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::IAM::User", /* @__PURE__ */ new Set([
 			"UserName",
 			"Path",
 			"Tags",
@@ -3990,13 +3987,13 @@ var IAMUserGroupProvider = class {
 			"Policies",
 			"PermissionsBoundary"
 		])],
-		["AWS::IAM::Group", new Set([
+		["AWS::IAM::Group", /* @__PURE__ */ new Set([
 			"GroupName",
 			"Path",
 			"ManagedPolicyArns",
 			"Policies"
 		])],
-		["AWS::IAM::UserToGroupAddition", new Set(["GroupName", "Users"])]
+		["AWS::IAM::UserToGroupAddition", /* @__PURE__ */ new Set(["GroupName", "Users"])]
 	]);
 	constructor() {
 		const awsClients = getAwsClients();
@@ -4880,7 +4877,7 @@ var IAMUserGroupProvider = class {
 var S3BucketProvider = class {
 	s3Client;
 	logger = getLogger().child("S3BucketProvider");
-	handledProperties = new Map([["AWS::S3::Bucket", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::S3::Bucket", /* @__PURE__ */ new Set([
 		"BucketName",
 		"VersioningConfiguration",
 		"Tags",
@@ -4901,7 +4898,7 @@ var S3BucketProvider = class {
 		"ObjectLockConfiguration",
 		"ObjectLockEnabled"
 	])]]);
-	unhandledByDesign = new Map([["AWS::S3::Bucket", new Map([["AccessControl", "Legacy canned ACL; AWS disables ACLs by default since 2023-04 — use BucketOwnershipControls + BucketPolicy / PublicAccessBlockConfiguration instead"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::S3::Bucket", /* @__PURE__ */ new Map([["AccessControl", "Legacy canned ACL; AWS disables ACLs by default since 2023-04 — use BucketOwnershipControls + BucketPolicy / PublicAccessBlockConfiguration instead"]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.s3Client = awsClients.s3;
@@ -6460,7 +6457,7 @@ function findTemplateCanonicalUser(awsStmt, templateStmts) {
 var S3BucketPolicyProvider = class {
 	s3Client;
 	logger = getLogger().child("S3BucketPolicyProvider");
-	handledProperties = new Map([["AWS::S3::BucketPolicy", new Set(["Bucket", "PolicyDocument"])]]);
+	handledProperties = /* @__PURE__ */ new Map([["AWS::S3::BucketPolicy", /* @__PURE__ */ new Set(["Bucket", "PolicyDocument"])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.s3Client = awsClients.s3;
@@ -6846,7 +6843,7 @@ var SQSQueueProvider = class {
 	sqsClient;
 	stsClient;
 	logger = getLogger().child("SQSQueueProvider");
-	handledProperties = new Map([["AWS::SQS::Queue", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::SQS::Queue", /* @__PURE__ */ new Set([
 		"QueueName",
 		"VisibilityTimeout",
 		"MaximumMessageSize",
@@ -7189,7 +7186,7 @@ var SQSQueueProvider = class {
 var SQSQueuePolicyProvider = class {
 	sqsClient;
 	logger = getLogger().child("SQSQueuePolicyProvider");
-	handledProperties = new Map([["AWS::SQS::QueuePolicy", new Set(["Queues", "PolicyDocument"])]]);
+	handledProperties = /* @__PURE__ */ new Map([["AWS::SQS::QueuePolicy", /* @__PURE__ */ new Set(["Queues", "PolicyDocument"])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.sqsClient = awsClients.sqs;
@@ -7396,7 +7393,7 @@ function isSqsQueueUrl(value) {
 var SNSTopicProvider = class {
 	snsClient;
 	logger = getLogger().child("SNSTopicProvider");
-	handledProperties = new Map([["AWS::SNS::Topic", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::SNS::Topic", /* @__PURE__ */ new Set([
 		"TopicName",
 		"FifoTopic",
 		"ContentBasedDeduplication",
@@ -8029,7 +8026,7 @@ function mapDeliveryStatusLogging(attrs, stateCaseMap = /* @__PURE__ */ new Map(
 var SNSSubscriptionProvider = class {
 	snsClient;
 	logger = getLogger().child("SNSSubscriptionProvider");
-	handledProperties = new Map([["AWS::SNS::Subscription", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::SNS::Subscription", /* @__PURE__ */ new Set([
 		"TopicArn",
 		"Protocol",
 		"Endpoint",
@@ -8041,7 +8038,7 @@ var SNSSubscriptionProvider = class {
 		"ReplayPolicy",
 		"SubscriptionRoleArn"
 	])]]);
-	unhandledByDesign = new Map([["AWS::SNS::Subscription", new Map([["Region", "CFn-only cross-region subscription hint; cdkd uses the SDK client region directly and has no per-resource region override"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::SNS::Subscription", /* @__PURE__ */ new Map([["Region", "CFn-only cross-region subscription hint; cdkd uses the SDK client region directly and has no per-resource region override"]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.snsClient = awsClients.sns;
@@ -8210,7 +8207,7 @@ var SNSSubscriptionProvider = class {
 */
 var SNSTopicPolicyProvider = class {
 	logger = getLogger().child("SNSTopicPolicyProvider");
-	handledProperties = new Map([["AWS::SNS::TopicPolicy", new Set(["Topics", "PolicyDocument"])]]);
+	handledProperties = /* @__PURE__ */ new Map([["AWS::SNS::TopicPolicy", /* @__PURE__ */ new Set(["Topics", "PolicyDocument"])]]);
 	/**
 	* Create an SNS topic policy
 	*
@@ -8446,7 +8443,7 @@ var LambdaFunctionProvider = class {
 	lambdaClient;
 	ec2Client;
 	logger = getLogger().child("LambdaFunctionProvider");
-	handledProperties = new Map([["AWS::Lambda::Function", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::Function", /* @__PURE__ */ new Set([
 		"FunctionName",
 		"Code",
 		"Role",
@@ -9284,7 +9281,7 @@ var LambdaFunctionProvider = class {
 var LambdaPermissionProvider = class {
 	lambdaClient;
 	logger = getLogger().child("LambdaPermissionProvider");
-	handledProperties = new Map([["AWS::Lambda::Permission", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::Permission", /* @__PURE__ */ new Set([
 		"FunctionName",
 		"Action",
 		"Principal",
@@ -9506,7 +9503,7 @@ var LambdaPermissionProvider = class {
 var LambdaUrlProvider = class {
 	lambdaClient;
 	logger = getLogger().child("LambdaUrlProvider");
-	handledProperties = new Map([["AWS::Lambda::Url", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::Url", /* @__PURE__ */ new Set([
 		"TargetFunctionArn",
 		"AuthType",
 		"Qualifier",
@@ -9757,12 +9754,12 @@ function classifyEventSourceFromProperties(properties) {
 		DocumentDBEventSourceConfig: properties["DocumentDBEventSourceConfig"]
 	});
 }
-const KINDS_WITH_FUNCTION_RESPONSE_TYPES = new Set([
+const KINDS_WITH_FUNCTION_RESPONSE_TYPES = /* @__PURE__ */ new Set([
 	"sqs",
 	"kinesis",
 	"dynamodb"
 ]);
-const KINDS_WITH_SOURCE_ACCESS_CONFIGURATIONS = new Set([
+const KINDS_WITH_SOURCE_ACCESS_CONFIGURATIONS = /* @__PURE__ */ new Set([
 	"kafka",
 	"mq",
 	"documentdb"
@@ -9775,7 +9772,7 @@ const KINDS_WITH_SOURCE_ACCESS_CONFIGURATIONS = new Set([
 * so the removal-on-UPDATE path only restores `0` for these kinds — see the
 * comment at the `MaximumBatchingWindowInSeconds` clear in `update()`.
 */
-const KINDS_WITH_ZERO_BATCHING_WINDOW_DEFAULT = new Set([
+const KINDS_WITH_ZERO_BATCHING_WINDOW_DEFAULT = /* @__PURE__ */ new Set([
 	"sqs",
 	"kinesis",
 	"dynamodb"
@@ -9788,7 +9785,7 @@ const KINDS_WITH_ZERO_BATCHING_WINDOW_DEFAULT = new Set([
 * removal-on-UPDATE default-restore path is gated on this set (see the numeric
 * restores in `update()`).
 */
-const KINDS_WITH_STREAM_NUMERICS = new Set(["kinesis", "dynamodb"]);
+const KINDS_WITH_STREAM_NUMERICS = /* @__PURE__ */ new Set(["kinesis", "dynamodb"]);
 /**
 * AWS Lambda Event Source Mapping Provider
 *
@@ -9799,7 +9796,7 @@ const KINDS_WITH_STREAM_NUMERICS = new Set(["kinesis", "dynamodb"]);
 var LambdaEventSourceMappingProvider = class {
 	lambdaClient;
 	logger = getLogger().child("LambdaEventSourceMappingProvider");
-	handledProperties = new Map([["AWS::Lambda::EventSourceMapping", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::EventSourceMapping", /* @__PURE__ */ new Set([
 		"FunctionName",
 		"EventSourceArn",
 		"BatchSize",
@@ -10124,7 +10121,7 @@ var LambdaEventSourceMappingProvider = class {
 var LambdaLayerVersionProvider = class {
 	lambdaClient;
 	logger = getLogger().child("LambdaLayerVersionProvider");
-	handledProperties = new Map([["AWS::Lambda::LayerVersion", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::LayerVersion", /* @__PURE__ */ new Set([
 		"LayerName",
 		"Content",
 		"CompatibleRuntimes",
@@ -10357,7 +10354,7 @@ var LambdaLayerVersionProvider = class {
 var LambdaEventInvokeConfigProvider = class {
 	lambdaClient;
 	logger = getLogger().child("LambdaEventInvokeConfigProvider");
-	handledProperties = new Map([["AWS::Lambda::EventInvokeConfig", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::EventInvokeConfig", /* @__PURE__ */ new Set([
 		"FunctionName",
 		"Qualifier",
 		"MaximumEventAgeInSeconds",
@@ -10569,7 +10566,7 @@ function mapSSESpecification(raw) {
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
 	logger = getLogger().child("DynamoDBTableProvider");
-	handledProperties = new Map([["AWS::DynamoDB::Table", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::DynamoDB::Table", /* @__PURE__ */ new Set([
 		"TableName",
 		"KeySchema",
 		"AttributeDefinitions",
@@ -10590,7 +10587,7 @@ var DynamoDBTableProvider = class {
 		"KinesisStreamSpecification",
 		"ContributorInsightsSpecification"
 	])]]);
-	unhandledByDesign = new Map([["AWS::DynamoDB::Table", new Map([["ImportSourceSpecification", "S3 import uses the separate ImportTable API (not CreateTable) and is create-only with no readback; deferred to a dedicated import-from-S3 PR"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::DynamoDB::Table", /* @__PURE__ */ new Map([["ImportSourceSpecification", "S3 import uses the separate ImportTable API (not CreateTable) and is create-only with no readback; deferred to a dedicated import-from-S3 PR"]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.dynamoDBClient = awsClients.dynamoDB;
@@ -11510,7 +11507,7 @@ var DynamoDBGlobalTableProvider = class {
 	* UpdateTable success.
 	*/
 	attributeCache = /* @__PURE__ */ new Map();
-	handledProperties = new Map([["AWS::DynamoDB::GlobalTable", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::DynamoDB::GlobalTable", /* @__PURE__ */ new Set([
 		"TableName",
 		"KeySchema",
 		"AttributeDefinitions",
@@ -12842,7 +12839,7 @@ var LogsLogGroupProvider = class {
 	logsClient;
 	stsClient;
 	logger = getLogger().child("LogsLogGroupProvider");
-	handledProperties = new Map([["AWS::Logs::LogGroup", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Logs::LogGroup", /* @__PURE__ */ new Set([
 		"LogGroupName",
 		"KmsKeyId",
 		"RetentionInDays",
@@ -13234,7 +13231,7 @@ var LogsLogGroupProvider = class {
 var CloudWatchAlarmProvider = class {
 	cloudWatchClient;
 	logger = getLogger().child("CloudWatchAlarmProvider");
-	handledProperties = new Map([["AWS::CloudWatch::Alarm", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudWatch::Alarm", /* @__PURE__ */ new Set([
 		"AlarmName",
 		"ComparisonOperator",
 		"EvaluationPeriods",
@@ -13272,7 +13269,7 @@ var CloudWatchAlarmProvider = class {
 	* SDK create input OR the CDK L1 is not backfillable), they are classified
 	* unhandled-by-design rather than left as a "not yet implemented" TODO.
 	*/
-	unhandledByDesign = new Map([["AWS::CloudWatch::Alarm", new Map([["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."], ["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::CloudWatch::Alarm", /* @__PURE__ */ new Map([["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."], ["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."]])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.cloudWatchClient = awsClients.cloudWatch;
@@ -13576,7 +13573,7 @@ var CloudWatchAlarmProvider = class {
 var SecretsManagerSecretProvider = class {
 	smClient;
 	logger = getLogger().child("SecretsManagerSecretProvider");
-	handledProperties = new Map([["AWS::SecretsManager::Secret", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::SecretsManager::Secret", /* @__PURE__ */ new Set([
 		"Name",
 		"GenerateSecretString",
 		"SecretString",
@@ -13858,7 +13855,7 @@ var SecretsManagerSecretProvider = class {
 var SSMParameterProvider = class {
 	ssmClient;
 	logger = getLogger().child("SSMParameterProvider");
-	handledProperties = new Map([["AWS::SSM::Parameter", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::SSM::Parameter", /* @__PURE__ */ new Set([
 		"Name",
 		"Type",
 		"Value",
@@ -14169,7 +14166,7 @@ var SSMParameterProvider = class {
 var EventBridgeRuleProvider = class {
 	eventBridgeClient;
 	logger = getLogger().child("EventBridgeRuleProvider");
-	handledProperties = new Map([["AWS::Events::Rule", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Events::Rule", /* @__PURE__ */ new Set([
 		"Name",
 		"Description",
 		"EventBusName",
@@ -14564,7 +14561,7 @@ function sanitizeDeadLetterConfig(value) {
 var EventBridgeBusProvider = class {
 	eventBridgeClient;
 	logger = getLogger().child("EventBridgeBusProvider");
-	handledProperties = new Map([["AWS::Events::EventBus", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Events::EventBus", /* @__PURE__ */ new Set([
 		"Name",
 		"Tags",
 		"EventSourceName",
@@ -14817,24 +14814,24 @@ var EventBridgeBusProvider = class {
 var EC2Provider = class {
 	ec2Client;
 	logger = getLogger().child("EC2Provider");
-	handledProperties = new Map([
-		["AWS::EC2::VPC", new Set([
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::EC2::VPC", /* @__PURE__ */ new Set([
 			"CidrBlock",
 			"InstanceTenancy",
 			"EnableDnsHostnames",
 			"EnableDnsSupport",
 			"Tags"
 		])],
-		["AWS::EC2::Subnet", new Set([
+		["AWS::EC2::Subnet", /* @__PURE__ */ new Set([
 			"VpcId",
 			"CidrBlock",
 			"AvailabilityZone",
 			"MapPublicIpOnLaunch",
 			"Tags"
 		])],
-		["AWS::EC2::InternetGateway", new Set(["Tags"])],
-		["AWS::EC2::VPCGatewayAttachment", new Set(["VpcId", "InternetGatewayId"])],
-		["AWS::EC2::NatGateway", new Set([
+		["AWS::EC2::InternetGateway", /* @__PURE__ */ new Set(["Tags"])],
+		["AWS::EC2::VPCGatewayAttachment", /* @__PURE__ */ new Set(["VpcId", "InternetGatewayId"])],
+		["AWS::EC2::NatGateway", /* @__PURE__ */ new Set([
 			"AllocationId",
 			"SubnetId",
 			"ConnectivityType",
@@ -14845,8 +14842,8 @@ var EC2Provider = class {
 			"MaxDrainDurationSeconds",
 			"Tags"
 		])],
-		["AWS::EC2::RouteTable", new Set(["VpcId", "Tags"])],
-		["AWS::EC2::Route", new Set([
+		["AWS::EC2::RouteTable", /* @__PURE__ */ new Set(["VpcId", "Tags"])],
+		["AWS::EC2::Route", /* @__PURE__ */ new Set([
 			"RouteTableId",
 			"DestinationCidrBlock",
 			"DestinationIpv6CidrBlock",
@@ -14857,8 +14854,8 @@ var EC2Provider = class {
 			"NetworkInterfaceId",
 			"VpcPeeringConnectionId"
 		])],
-		["AWS::EC2::SubnetRouteTableAssociation", new Set(["SubnetId", "RouteTableId"])],
-		["AWS::EC2::SecurityGroup", new Set([
+		["AWS::EC2::SubnetRouteTableAssociation", /* @__PURE__ */ new Set(["SubnetId", "RouteTableId"])],
+		["AWS::EC2::SecurityGroup", /* @__PURE__ */ new Set([
 			"GroupDescription",
 			"GroupName",
 			"VpcId",
@@ -14866,7 +14863,7 @@ var EC2Provider = class {
 			"SecurityGroupEgress",
 			"Tags"
 		])],
-		["AWS::EC2::SecurityGroupIngress", new Set([
+		["AWS::EC2::SecurityGroupIngress", /* @__PURE__ */ new Set([
 			"GroupId",
 			"IpProtocol",
 			"FromPort",
@@ -14878,7 +14875,7 @@ var EC2Provider = class {
 			"SourceSecurityGroupOwnerId",
 			"SourcePrefixListId"
 		])],
-		["AWS::EC2::Instance", new Set([
+		["AWS::EC2::Instance", /* @__PURE__ */ new Set([
 			"ImageId",
 			"InstanceType",
 			"KeyName",
@@ -14895,8 +14892,8 @@ var EC2Provider = class {
 			"EbsOptimized",
 			"CreditSpecification"
 		])],
-		["AWS::EC2::NetworkAcl", new Set(["VpcId", "Tags"])],
-		["AWS::EC2::NetworkAclEntry", new Set([
+		["AWS::EC2::NetworkAcl", /* @__PURE__ */ new Set(["VpcId", "Tags"])],
+		["AWS::EC2::NetworkAclEntry", /* @__PURE__ */ new Set([
 			"NetworkAclId",
 			"RuleNumber",
 			"Protocol",
@@ -14907,12 +14904,12 @@ var EC2Provider = class {
 			"PortRange",
 			"Icmp"
 		])],
-		["AWS::EC2::SubnetNetworkAclAssociation", new Set(["SubnetId", "NetworkAclId"])]
+		["AWS::EC2::SubnetNetworkAclAssociation", /* @__PURE__ */ new Set(["SubnetId", "NetworkAclId"])]
 	]);
-	unhandledByDesign = new Map([
-		["AWS::EC2::Instance", new Map([["ElasticGpuSpecifications", "AWS Elastic GPU end-of-life (announced 2023-11); no replacement API"], ["ElasticInferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])],
-		["AWS::EC2::SecurityGroupIngress", new Map([["GroupName", "EC2-Classic-only — use GroupId for VPC security groups (EC2-Classic retired 2022-08-15)"], ["SourceSecurityGroupName", "EC2-Classic-only — use SourceSecurityGroupId for VPC peer security groups (EC2-Classic retired 2022-08-15)"]])],
-		["AWS::EC2::NatGateway", new Map([["VpcId", "AWS derives the VPC from SubnetId; the ec2:CreateNatGateway API has no VpcId parameter"]])]
+	unhandledByDesign = /* @__PURE__ */ new Map([
+		["AWS::EC2::Instance", /* @__PURE__ */ new Map([["ElasticGpuSpecifications", "AWS Elastic GPU end-of-life (announced 2023-11); no replacement API"], ["ElasticInferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])],
+		["AWS::EC2::SecurityGroupIngress", /* @__PURE__ */ new Map([["GroupName", "EC2-Classic-only — use GroupId for VPC security groups (EC2-Classic retired 2022-08-15)"], ["SourceSecurityGroupName", "EC2-Classic-only — use SourceSecurityGroupId for VPC peer security groups (EC2-Classic retired 2022-08-15)"]])],
+		["AWS::EC2::NatGateway", /* @__PURE__ */ new Map([["VpcId", "AWS derives the VPC from SubnetId; the ec2:CreateNatGateway API has no VpcId parameter"]])]
 	]);
 	constructor() {
 		const awsClients = getAwsClients();
@@ -17283,9 +17280,9 @@ function isDefaultEgressRule(rule) {
 var ApiGatewayProvider = class ApiGatewayProvider {
 	apiGatewayClient;
 	logger = getLogger().child("ApiGatewayProvider");
-	handledProperties = new Map([
-		["AWS::ApiGateway::Account", new Set(["CloudWatchRoleArn"])],
-		["AWS::ApiGateway::Authorizer", new Set([
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::ApiGateway::Account", /* @__PURE__ */ new Set(["CloudWatchRoleArn"])],
+		["AWS::ApiGateway::Authorizer", /* @__PURE__ */ new Set([
 			"RestApiId",
 			"Name",
 			"Type",
@@ -17297,13 +17294,13 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			"IdentityValidationExpression",
 			"AuthorizerResultTtlInSeconds"
 		])],
-		["AWS::ApiGateway::Resource", new Set([
+		["AWS::ApiGateway::Resource", /* @__PURE__ */ new Set([
 			"RestApiId",
 			"ParentId",
 			"PathPart"
 		])],
-		["AWS::ApiGateway::Deployment", new Set(["RestApiId", "Description"])],
-		["AWS::ApiGateway::Stage", new Set([
+		["AWS::ApiGateway::Deployment", /* @__PURE__ */ new Set(["RestApiId", "Description"])],
+		["AWS::ApiGateway::Stage", /* @__PURE__ */ new Set([
 			"RestApiId",
 			"StageName",
 			"DeploymentId",
@@ -17313,7 +17310,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			"Variables",
 			"MethodSettings"
 		])],
-		["AWS::ApiGateway::Method", new Set([
+		["AWS::ApiGateway::Method", /* @__PURE__ */ new Set([
 			"RestApiId",
 			"ResourceId",
 			"HttpMethod",
@@ -17329,7 +17326,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			"MethodResponses"
 		])]
 	]);
-	unhandledByDesign = new Map([["AWS::ApiGateway::Deployment", new Map([["StageName", "CFn-only convenience for inline-creating a Stage from a Deployment; declare AWS::ApiGateway::Stage explicitly to attach to this Deployment"], ["StageDescription", "CFn-only convenience for inline-creating a Stage; declare AWS::ApiGateway::Stage with the Description property instead"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ApiGateway::Deployment", /* @__PURE__ */ new Map([["StageName", "CFn-only convenience for inline-creating a Stage from a Deployment; declare AWS::ApiGateway::Stage explicitly to attach to this Deployment"], ["StageDescription", "CFn-only convenience for inline-creating a Stage; declare AWS::ApiGateway::Stage with the Description property instead"]])]]);
 	/** Maximum number of retries for IAM propagation delays */
 	static MAX_IAM_RETRIES = 3;
 	/** Delay between IAM propagation retries (ms) - exponential backoff */
@@ -18623,8 +18620,8 @@ var ApiGatewayV2Provider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("ApiGatewayV2Provider");
-	handledProperties = new Map([
-		["AWS::ApiGatewayV2::Api", new Set([
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::ApiGatewayV2::Api", /* @__PURE__ */ new Set([
 			"Name",
 			"ProtocolType",
 			"Description",
@@ -18636,7 +18633,7 @@ var ApiGatewayV2Provider = class {
 			"ApiKeySelectionExpression",
 			"IpAddressType"
 		])],
-		["AWS::ApiGatewayV2::Stage", new Set([
+		["AWS::ApiGatewayV2::Stage", /* @__PURE__ */ new Set([
 			"ApiId",
 			"StageName",
 			"AutoDeploy",
@@ -18645,7 +18642,7 @@ var ApiGatewayV2Provider = class {
 			"StageVariables",
 			"DefaultRouteSettings"
 		])],
-		["AWS::ApiGatewayV2::Integration", new Set([
+		["AWS::ApiGatewayV2::Integration", /* @__PURE__ */ new Set([
 			"ApiId",
 			"IntegrationType",
 			"IntegrationUri",
@@ -18655,7 +18652,7 @@ var ApiGatewayV2Provider = class {
 			"RequestParameters",
 			"Description"
 		])],
-		["AWS::ApiGatewayV2::Route", new Set([
+		["AWS::ApiGatewayV2::Route", /* @__PURE__ */ new Set([
 			"ApiId",
 			"RouteKey",
 			"Target",
@@ -18664,7 +18661,7 @@ var ApiGatewayV2Provider = class {
 			"AuthorizationScopes",
 			"OperationName"
 		])],
-		["AWS::ApiGatewayV2::Authorizer", new Set([
+		["AWS::ApiGatewayV2::Authorizer", /* @__PURE__ */ new Set([
 			"ApiId",
 			"AuthorizerType",
 			"Name",
@@ -18690,7 +18687,7 @@ var ApiGatewayV2Provider = class {
 	* Wiring them would require parsing OpenAPI semantics + a different
 	* mutation surface and is out of scope for the SDK-Provider safety net.
 	*/
-	unhandledByDesign = new Map([["AWS::ApiGatewayV2::Api", new Map([
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ApiGatewayV2::Api", /* @__PURE__ */ new Map([
 		["Body", "OpenAPI/Swagger inline spec; routed through ImportApi, not the field-by-field CreateApi path."],
 		["BodyS3Location", "OpenAPI/Swagger spec on S3; routed through ImportApi, not the field-by-field CreateApi path."],
 		["FailOnWarnings", "OpenAPI-import-only flag; meaningful only on the ImportApi code path."],
@@ -19536,7 +19533,7 @@ var ApiGatewayV2Provider = class {
 var CloudFrontOAIProvider = class {
 	cloudFrontClient;
 	logger = getLogger().child("CloudFrontOAIProvider");
-	handledProperties = new Map([["AWS::CloudFront::CloudFrontOriginAccessIdentity", new Set(["CloudFrontOriginAccessIdentityConfig"])]]);
+	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudFront::CloudFrontOriginAccessIdentity", /* @__PURE__ */ new Set(["CloudFrontOriginAccessIdentityConfig"])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.cloudFrontClient = awsClients.cloudFront;
@@ -19760,7 +19757,7 @@ const CACHE_BEHAVIOR_QUANTITY_FIELDS = [
 var CloudFrontDistributionProvider = class {
 	cloudFrontClient;
 	logger = getLogger().child("CloudFrontDistributionProvider");
-	handledProperties = new Map([["AWS::CloudFront::Distribution", new Set(["DistributionConfig", "Tags"])]]);
+	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudFront::Distribution", /* @__PURE__ */ new Set(["DistributionConfig", "Tags"])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.cloudFrontClient = awsClients.cloudFront;
@@ -20460,7 +20457,7 @@ function camelToPascalCaseKeys(value, preserveKeys) {
 var AgentCoreRuntimeProvider = class {
 	client;
 	logger = getLogger().child("AgentCoreRuntimeProvider");
-	handledProperties = new Map([["AWS::BedrockAgentCore::Runtime", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::BedrockAgentCore::Runtime", /* @__PURE__ */ new Set([
 		"AgentRuntimeName",
 		"RoleArn",
 		"AgentRuntimeArtifact",
@@ -20695,7 +20692,7 @@ const DEFAULT_BROWSER_ID = "aws.browser.v1";
 var AgentCoreBrowserProvider = class {
 	client;
 	logger = getLogger().child("AgentCoreBrowserProvider");
-	handledProperties = new Map([["AWS::BedrockAgentCore::Browser", /* @__PURE__ */ new Set([])]]);
+	handledProperties = /* @__PURE__ */ new Map([["AWS::BedrockAgentCore::Browser", /* @__PURE__ */ new Set([])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.client = awsClients.bedrockAgentCoreControl;
@@ -20810,7 +20807,7 @@ const DEFAULT_CODE_INTERPRETER_ID = "aws.codeinterpreter.v1";
 var AgentCoreCodeInterpreterProvider = class {
 	client;
 	logger = getLogger().child("AgentCoreCodeInterpreterProvider");
-	handledProperties = new Map([["AWS::BedrockAgentCore::CodeInterpreter", /* @__PURE__ */ new Set([])]]);
+	handledProperties = /* @__PURE__ */ new Map([["AWS::BedrockAgentCore::CodeInterpreter", /* @__PURE__ */ new Set([])]]);
 	constructor() {
 		const awsClients = getAwsClients();
 		this.client = awsClients.bedrockAgentCoreControl;
@@ -20928,8 +20925,8 @@ var AgentCoreCodeInterpreterProvider = class {
 * The `EvaluatorConfig` subtree keys whose values are free-form JSON
 * documents (user/model-defined keys) that must NOT be case-converted.
 */
-const CFN_PRESERVE_KEYS = new Set(["AdditionalModelRequestFields"]);
-const SDK_PRESERVE_KEYS = new Set(["additionalModelRequestFields"]);
+const CFN_PRESERVE_KEYS = /* @__PURE__ */ new Set(["AdditionalModelRequestFields"]);
+const SDK_PRESERVE_KEYS = /* @__PURE__ */ new Set(["additionalModelRequestFields"]);
 /**
 * Extract the evaluator ID from an evaluator ARN
 * (`arn:...:evaluator/<id>` → `<id>`). Falls back to the input verbatim
@@ -20960,7 +20957,7 @@ function tagMapToCfnList(tags) {
 var AgentCoreEvaluatorProvider = class {
 	client;
 	logger = getLogger().child("AgentCoreEvaluatorProvider");
-	handledProperties = new Map([["AWS::BedrockAgentCore::Evaluator", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::BedrockAgentCore::Evaluator", /* @__PURE__ */ new Set([
 		"EvaluatorName",
 		"Description",
 		"EvaluatorConfig",
@@ -21171,7 +21168,7 @@ var StepFunctionsProvider = class {
 	s3Client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("StepFunctionsProvider");
-	handledProperties = new Map([["AWS::StepFunctions::StateMachine", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::StepFunctions::StateMachine", /* @__PURE__ */ new Set([
 		"StateMachineName",
 		"RoleArn",
 		"StateMachineType",
@@ -21653,8 +21650,8 @@ var ECSProvider = class {
 	ecsClient;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("ECSProvider");
-	handledProperties = new Map([
-		["AWS::ECS::Cluster", new Set([
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::ECS::Cluster", /* @__PURE__ */ new Set([
 			"ClusterName",
 			"CapacityProviders",
 			"DefaultCapacityProviderStrategy",
@@ -21663,7 +21660,7 @@ var ECSProvider = class {
 			"ServiceConnectDefaults",
 			"Tags"
 		])],
-		["AWS::ECS::TaskDefinition", new Set([
+		["AWS::ECS::TaskDefinition", /* @__PURE__ */ new Set([
 			"Family",
 			"ContainerDefinitions",
 			"Cpu",
@@ -21682,7 +21679,7 @@ var ECSProvider = class {
 			"EnableFaultInjection",
 			"Tags"
 		])],
-		["AWS::ECS::Service", new Set([
+		["AWS::ECS::Service", /* @__PURE__ */ new Set([
 			"Cluster",
 			"ServiceName",
 			"TaskDefinition",
@@ -21704,7 +21701,7 @@ var ECSProvider = class {
 			"Tags"
 		])]
 	]);
-	unhandledByDesign = new Map([["AWS::ECS::Service", new Map([["Role", "Legacy classic-ELB service-linked-role override; AWS uses the AWSServiceRoleForECS service-linked role automatically since 2017"]])], ["AWS::ECS::TaskDefinition", new Map([["InferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ECS::Service", /* @__PURE__ */ new Map([["Role", "Legacy classic-ELB service-linked-role override; AWS uses the AWSServiceRoleForECS service-linked role automatically since 2017"]])], ["AWS::ECS::TaskDefinition", /* @__PURE__ */ new Map([["InferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])]]);
 	getClient() {
 		if (!this.ecsClient) this.ecsClient = new ECSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.ecsClient;
@@ -22704,8 +22701,8 @@ var ELBv2Provider = class {
 	elbv2Client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("ELBv2Provider");
-	handledProperties = new Map([
-		["AWS::ElasticLoadBalancingV2::LoadBalancer", new Set([
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::ElasticLoadBalancingV2::LoadBalancer", /* @__PURE__ */ new Set([
 			"Name",
 			"Subnets",
 			"SubnetMappings",
@@ -22716,7 +22713,7 @@ var ELBv2Provider = class {
 			"LoadBalancerAttributes",
 			"Tags"
 		])],
-		["AWS::ElasticLoadBalancingV2::TargetGroup", new Set([
+		["AWS::ElasticLoadBalancingV2::TargetGroup", /* @__PURE__ */ new Set([
 			"Protocol",
 			"Port",
 			"VpcId",
@@ -22734,7 +22731,7 @@ var ELBv2Provider = class {
 			"Name",
 			"Tags"
 		])],
-		["AWS::ElasticLoadBalancingV2::Listener", new Set([
+		["AWS::ElasticLoadBalancingV2::Listener", /* @__PURE__ */ new Set([
 			"LoadBalancerArn",
 			"Certificates",
 			"DefaultActions",
@@ -22829,7 +22826,7 @@ var ELBv2Provider = class {
 		}
 	}
 	async updateLoadBalancer(logicalId, physicalId, _resourceType, properties, previousProperties) {
-		const handledKeys = new Set([
+		const handledKeys = /* @__PURE__ */ new Set([
 			"LoadBalancerAttributes",
 			"Subnets",
 			"SubnetMappings",
@@ -23463,14 +23460,14 @@ var RDSProvider = class {
 	rdsClient;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("RDSProvider");
-	handledProperties = new Map([
-		["AWS::RDS::DBSubnetGroup", new Set([
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::RDS::DBSubnetGroup", /* @__PURE__ */ new Set([
 			"DBSubnetGroupName",
 			"DBSubnetGroupDescription",
 			"SubnetIds",
 			"Tags"
 		])],
-		["AWS::RDS::DBCluster", new Set([
+		["AWS::RDS::DBCluster", /* @__PURE__ */ new Set([
 			"DBClusterIdentifier",
 			"Engine",
 			"EngineVersion",
@@ -23493,7 +23490,7 @@ var RDSProvider = class {
 			"EnableIAMDatabaseAuthentication",
 			"PubliclyAccessible"
 		])],
-		["AWS::RDS::DBInstance", new Set([
+		["AWS::RDS::DBInstance", /* @__PURE__ */ new Set([
 			"DBInstanceIdentifier",
 			"DBInstanceClass",
 			"Engine",
@@ -23517,7 +23514,7 @@ var RDSProvider = class {
 			"EnableIAMDatabaseAuthentication"
 		])]
 	]);
-	unhandledByDesign = new Map([["AWS::RDS::DBCluster", new Map([["DeleteAutomatedBackups", "cdkd hardcodes SkipFinalSnapshot=true on destroy; this CFn lifecycle flag has no equivalent on the runtime path"]])], ["AWS::RDS::DBInstance", new Map([
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::RDS::DBCluster", /* @__PURE__ */ new Map([["DeleteAutomatedBackups", "cdkd hardcodes SkipFinalSnapshot=true on destroy; this CFn lifecycle flag has no equivalent on the runtime path"]])], ["AWS::RDS::DBInstance", /* @__PURE__ */ new Map([
 		["DBSecurityGroups", "EC2-Classic-only feature retired by AWS (2022-08-15); new accounts cannot use this — use VPCSecurityGroups instead"],
 		["ApplyImmediately", "cdkd always applies modifications immediately (rds:ModifyDBInstance.ApplyImmediately=true is hardcoded); users wanting maintenance-window deferral should run aws rds modify-db-instance directly"],
 		["DeleteAutomatedBackups", "cdkd hardcodes SkipFinalSnapshot=true on destroy; this CFn lifecycle flag has no equivalent on the runtime path"]
@@ -24282,7 +24279,7 @@ var RDSDBProxyProvider = class {
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("RDSDBProxyProvider");
 	attributeCache = /* @__PURE__ */ new Map();
-	handledProperties = new Map([["AWS::RDS::DBProxy", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::RDS::DBProxy", /* @__PURE__ */ new Set([
 		"DBProxyName",
 		"EngineFamily",
 		"Auth",
@@ -24639,7 +24636,7 @@ var RDSDBProxyEndpointProvider = class {
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("RDSDBProxyEndpointProvider");
 	attributeCache = /* @__PURE__ */ new Map();
-	handledProperties = new Map([["AWS::RDS::DBProxyEndpoint", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::RDS::DBProxyEndpoint", /* @__PURE__ */ new Set([
 		"DBProxyEndpointName",
 		"DBProxyName",
 		"VpcSubnetIds",
@@ -24968,7 +24965,7 @@ var RDSDBProxyTargetGroupProvider = class {
 	rdsClient;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("RDSDBProxyTargetGroupProvider");
-	handledProperties = new Map([["AWS::RDS::DBProxyTargetGroup", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::RDS::DBProxyTargetGroup", /* @__PURE__ */ new Set([
 		"DBProxyName",
 		"TargetGroupName",
 		"DBClusterIdentifiers",
@@ -25252,14 +25249,14 @@ var DocDBProvider = class {
 	docdbClient;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("DocDBProvider");
-	handledProperties = new Map([
-		["AWS::DocDB::DBSubnetGroup", new Set([
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::DocDB::DBSubnetGroup", /* @__PURE__ */ new Set([
 			"DBSubnetGroupName",
 			"DBSubnetGroupDescription",
 			"SubnetIds",
 			"Tags"
 		])],
-		["AWS::DocDB::DBCluster", new Set([
+		["AWS::DocDB::DBCluster", /* @__PURE__ */ new Set([
 			"DBClusterIdentifier",
 			"EngineVersion",
 			"MasterUsername",
@@ -25276,7 +25273,7 @@ var DocDBProvider = class {
 			"DeletionProtection",
 			"Tags"
 		])],
-		["AWS::DocDB::DBInstance", new Set([
+		["AWS::DocDB::DBInstance", /* @__PURE__ */ new Set([
 			"DBInstanceIdentifier",
 			"DBInstanceClass",
 			"DBClusterIdentifier",
@@ -25914,14 +25911,14 @@ var NeptuneProvider = class {
 	neptuneClient;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("NeptuneProvider");
-	handledProperties = new Map([
-		["AWS::Neptune::DBSubnetGroup", new Set([
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::Neptune::DBSubnetGroup", /* @__PURE__ */ new Set([
 			"DBSubnetGroupName",
 			"DBSubnetGroupDescription",
 			"SubnetIds",
 			"Tags"
 		])],
-		["AWS::Neptune::DBCluster", new Set([
+		["AWS::Neptune::DBCluster", /* @__PURE__ */ new Set([
 			"DBClusterIdentifier",
 			"EngineVersion",
 			"DBPort",
@@ -25938,7 +25935,7 @@ var NeptuneProvider = class {
 			"DeletionProtection",
 			"Tags"
 		])],
-		["AWS::Neptune::DBInstance", new Set([
+		["AWS::Neptune::DBInstance", /* @__PURE__ */ new Set([
 			"DBInstanceIdentifier",
 			"DBInstanceClass",
 			"DBClusterIdentifier",
@@ -26572,14 +26569,14 @@ var Route53Provider = class {
 	route53Client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("Route53Provider");
-	handledProperties = new Map([["AWS::Route53::HostedZone", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Route53::HostedZone", /* @__PURE__ */ new Set([
 		"Name",
 		"HostedZoneConfig",
 		"HostedZoneTags",
 		"VPCs",
 		"QueryLoggingConfig",
 		"HostedZoneFeatures"
-	])], ["AWS::Route53::RecordSet", new Set([
+	])], ["AWS::Route53::RecordSet", /* @__PURE__ */ new Set([
 		"HostedZoneId",
 		"HostedZoneName",
 		"Name",
@@ -26790,7 +26787,7 @@ var Route53Provider = class {
 			}
 		};
 		const deadline = Date.now() + timeoutMs;
-		const TERMINAL_FAILED = new Set(["ENABLE_FAILED", "DISABLE_FAILED"]);
+		const TERMINAL_FAILED = /* @__PURE__ */ new Set(["ENABLE_FAILED", "DISABLE_FAILED"]);
 		const waitFor = async (targets, label) => {
 			while (Date.now() < deadline) {
 				const status = await readStatus();
@@ -26811,7 +26808,7 @@ var Route53Provider = class {
 		if (TERMINAL_FAILED.has(current)) throw new ProvisioningError(`Cannot delete hosted zone ${logicalId} (${physicalId}): AcceleratedRecoveryStatus is '${current}' — operator must resolve before destroy can proceed`, "AWS::Route53::HostedZone", logicalId, physicalId);
 		if (current === "ENABLING" || current === "ENABLING_HOSTED_ZONE_LOCKED") {
 			this.logger.debug(`Hosted zone ${physicalId} is ${current} (an enabling phase); waiting for it to settle before issuing disable`);
-			current = await waitFor(new Set(["ENABLED", "DISABLED"]), "ENABLED or DISABLED");
+			current = await waitFor(/* @__PURE__ */ new Set(["ENABLED", "DISABLED"]), "ENABLED or DISABLED");
 			if (current === void 0 || current === "DISABLED") return;
 		}
 		if (current === "ENABLED") {
@@ -26821,7 +26818,7 @@ var Route53Provider = class {
 				EnableAcceleratedRecovery: false
 			}));
 		} else if (current === "DISABLING" || current === "DISABLING_HOSTED_ZONE_LOCKED") this.logger.debug(`Hosted zone ${physicalId} AcceleratedRecovery is already ${current} (a disabling phase); waiting for settle`);
-		const settled = await waitFor(new Set(["DISABLED"]), "DISABLED");
+		const settled = await waitFor(/* @__PURE__ */ new Set(["DISABLED"]), "DISABLED");
 		this.logger.debug(`Hosted zone ${physicalId} AcceleratedRecoveryStatus settled to ${settled ?? "undefined (zone gone)"}`);
 	}
 	async getHostedZoneAttribute(physicalId, attributeName) {
@@ -27328,7 +27325,7 @@ var Route53Provider = class {
 * error (surfaced as a ProvisioningError, never a silent drop), so the failure
 * is loud and the fix is to append the new name here.
 */
-const STANDARD_USER_POOL_ATTRIBUTES = new Set([
+const STANDARD_USER_POOL_ATTRIBUTES = /* @__PURE__ */ new Set([
 	"address",
 	"birthdate",
 	"email",
@@ -27464,7 +27461,7 @@ var CognitoUserPoolProvider = class {
 	cognitoClient;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("CognitoUserPoolProvider");
-	handledProperties = new Map([["AWS::Cognito::UserPool", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Set([
 		"UserPoolName",
 		"AutoVerifiedAttributes",
 		"UsernameAttributes",
@@ -27495,7 +27492,7 @@ var CognitoUserPoolProvider = class {
 		"WebAuthnRelyingPartyID",
 		"WebAuthnUserVerification"
 	])]]);
-	unhandledByDesign = new Map([["AWS::Cognito::UserPool", new Map([["WebAuthnFactorConfiguration", "No SDK wire path: @aws-sdk/client-cognito-identity-provider has no field accepting SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION (not on CreateUserPool/UpdateUserPool, nor SetUserPoolMfaConfig.WebAuthnConfiguration which only carries RelyingPartyId/UserVerification); CC-API-registry-only property"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Cognito::UserPool", /* @__PURE__ */ new Map([["WebAuthnFactorConfiguration", "No SDK wire path: @aws-sdk/client-cognito-identity-provider has no field accepting SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION (not on CreateUserPool/UpdateUserPool, nor SetUserPoolMfaConfig.WebAuthnConfiguration which only carries RelyingPartyId/UserVerification); CC-API-registry-only property"]])]]);
 	getClient() {
 		if (!this.cognitoClient) this.cognitoClient = new CognitoIdentityProviderClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.cognitoClient;
@@ -27900,13 +27897,13 @@ var ElastiCacheProvider = class {
 	cachedAccountId;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("ElastiCacheProvider");
-	handledProperties = new Map([["AWS::ElastiCache::SubnetGroup", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::ElastiCache::SubnetGroup", /* @__PURE__ */ new Set([
 		"CacheSubnetGroupName",
 		"CacheSubnetGroupDescription",
 		"Description",
 		"SubnetIds",
 		"Tags"
-	])], ["AWS::ElastiCache::CacheCluster", new Set([
+	])], ["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Set([
 		"ClusterName",
 		"Engine",
 		"CacheNodeType",
@@ -27931,7 +27928,7 @@ var ElastiCacheProvider = class {
 		"IpDiscovery",
 		"TransitEncryptionEnabled"
 	])]]);
-	unhandledByDesign = new Map([["AWS::ElastiCache::CacheCluster", new Map([["CacheSecurityGroupNames", "EC2-Classic-only — use VpcSecurityGroupIds for VPC-deployed clusters (EC2-Classic retired 2022-08-15)"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::ElastiCache::CacheCluster", /* @__PURE__ */ new Map([["CacheSecurityGroupNames", "EC2-Classic-only — use VpcSecurityGroupIds for VPC-deployed clusters (EC2-Classic retired 2022-08-15)"]])]]);
 	getClient() {
 		if (!this.client) this.client = new ElastiCacheClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -28430,26 +28427,26 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	stsClient;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("ServiceDiscoveryProvider");
-	handledProperties = new Map([
-		["AWS::ServiceDiscovery::PrivateDnsNamespace", new Set([
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::ServiceDiscovery::PrivateDnsNamespace", /* @__PURE__ */ new Set([
 			"Name",
 			"Vpc",
 			"Description",
 			"Tags",
 			"Properties"
 		])],
-		["AWS::ServiceDiscovery::HttpNamespace", new Set([
+		["AWS::ServiceDiscovery::HttpNamespace", /* @__PURE__ */ new Set([
 			"Name",
 			"Description",
 			"Tags"
 		])],
-		["AWS::ServiceDiscovery::PublicDnsNamespace", new Set([
+		["AWS::ServiceDiscovery::PublicDnsNamespace", /* @__PURE__ */ new Set([
 			"Name",
 			"Description",
 			"Tags",
 			"Properties"
 		])],
-		["AWS::ServiceDiscovery::Service", new Set([
+		["AWS::ServiceDiscovery::Service", /* @__PURE__ */ new Set([
 			"Name",
 			"NamespaceId",
 			"DnsConfig",
@@ -29264,20 +29261,20 @@ var AppSyncProvider = class {
 	* and the old entry simply becomes unreachable.
 	*/
 	arnCache = /* @__PURE__ */ new Map();
-	handledProperties = new Map([
-		["AWS::AppSync::GraphQLApi", new Set([
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::AppSync::GraphQLApi", /* @__PURE__ */ new Set([
 			"Name",
 			"AuthenticationType",
 			"XrayEnabled",
 			"LogConfig",
 			"Tags"
 		])],
-		["AWS::AppSync::GraphQLSchema", new Set([
+		["AWS::AppSync::GraphQLSchema", /* @__PURE__ */ new Set([
 			"ApiId",
 			"Definition",
 			"DefinitionS3Location"
 		])],
-		["AWS::AppSync::DataSource", new Set([
+		["AWS::AppSync::DataSource", /* @__PURE__ */ new Set([
 			"ApiId",
 			"Name",
 			"Type",
@@ -29287,7 +29284,7 @@ var AppSyncProvider = class {
 			"LambdaConfig",
 			"HttpConfig"
 		])],
-		["AWS::AppSync::Resolver", new Set([
+		["AWS::AppSync::Resolver", /* @__PURE__ */ new Set([
 			"ApiId",
 			"TypeName",
 			"FieldName",
@@ -29299,13 +29296,13 @@ var AppSyncProvider = class {
 			"Runtime",
 			"Code"
 		])],
-		["AWS::AppSync::ApiKey", new Set([
+		["AWS::AppSync::ApiKey", /* @__PURE__ */ new Set([
 			"ApiId",
 			"Description",
 			"Expires"
 		])]
 	]);
-	unhandledByDesign = new Map([["AWS::AppSync::DataSource", new Map([["ElasticsearchConfig", "Legacy Elasticsearch alias; use OpenSearchServiceConfig (AppSync deprecated the Elasticsearch DataSource type in favor of OpenSearch)"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::AppSync::DataSource", /* @__PURE__ */ new Map([["ElasticsearchConfig", "Legacy Elasticsearch alias; use OpenSearchServiceConfig (AppSync deprecated the Elasticsearch DataSource type in favor of OpenSearch)"]])]]);
 	getClient() {
 		if (!this.client) this.client = new AppSyncClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -30171,11 +30168,11 @@ var GlueProvider = class {
 	cachedAccountId;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("GlueProvider");
-	handledProperties = new Map([["AWS::Glue::Database", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Database", /* @__PURE__ */ new Set([
 		"DatabaseInput",
 		"DatabaseName",
 		"CatalogId"
-	])], ["AWS::Glue::Table", new Set([
+	])], ["AWS::Glue::Table", /* @__PURE__ */ new Set([
 		"DatabaseName",
 		"TableInput",
 		"Name",
@@ -30665,7 +30662,7 @@ var GlueWorkflowProvider = class {
 	cachedAccountId;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("GlueWorkflowProvider");
-	handledProperties = new Map([["AWS::Glue::Workflow", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Workflow", /* @__PURE__ */ new Set([
 		"Name",
 		"Description",
 		"DefaultRunProperties",
@@ -30843,7 +30840,7 @@ var GlueSecurityConfigurationProvider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("GlueSecurityConfigurationProvider");
-	handledProperties = new Map([["AWS::Glue::SecurityConfiguration", new Set(["Name", "EncryptionConfiguration"])]]);
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::SecurityConfiguration", /* @__PURE__ */ new Set(["Name", "EncryptionConfiguration"])]]);
 	getClient() {
 		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -31066,7 +31063,7 @@ var GlueJobProvider = class {
 	cachedAccountId;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("GlueJobProvider");
-	handledProperties = new Map([["AWS::Glue::Job", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Job", /* @__PURE__ */ new Set([
 		"Name",
 		"Role",
 		"Command",
@@ -31372,7 +31369,7 @@ var GlueCrawlerProvider = class {
 	cachedAccountId;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("GlueCrawlerProvider");
-	handledProperties = new Map([["AWS::Glue::Crawler", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Crawler", /* @__PURE__ */ new Set([
 		"Name",
 		"Role",
 		"Targets",
@@ -31609,7 +31606,7 @@ var GlueConnectionProvider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("GlueConnectionProvider");
-	handledProperties = new Map([["AWS::Glue::Connection", new Set(["ConnectionInput", "CatalogId"])]]);
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Connection", /* @__PURE__ */ new Set(["ConnectionInput", "CatalogId"])]]);
 	getClient() {
 		if (!this.client) this.client = new GlueClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -31759,7 +31756,7 @@ var GlueTriggerProvider = class {
 	cachedAccountId;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("GlueTriggerProvider");
-	handledProperties = new Map([["AWS::Glue::Trigger", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Trigger", /* @__PURE__ */ new Set([
 		"Name",
 		"Type",
 		"Schedule",
@@ -31975,7 +31972,7 @@ var KMSProvider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("KMSProvider");
-	handledProperties = new Map([["AWS::KMS::Key", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::KMS::Key", /* @__PURE__ */ new Set([
 		"Description",
 		"KeyPolicy",
 		"KeySpec",
@@ -31988,7 +31985,7 @@ var KMSProvider = class {
 		"RotationPeriodInDays",
 		"Origin",
 		"BypassPolicyLockoutSafetyCheck"
-	])], ["AWS::KMS::Alias", new Set(["AliasName", "TargetKeyId"])]]);
+	])], ["AWS::KMS::Alias", /* @__PURE__ */ new Set(["AliasName", "TargetKeyId"])]]);
 	getClient() {
 		if (!this.client) this.client = new KMSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -32442,7 +32439,7 @@ var BudgetsBudgetProvider = class {
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("BudgetsBudgetProvider");
 	accountIdPromise;
-	handledProperties = new Map([["AWS::Budgets::Budget", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Budgets::Budget", /* @__PURE__ */ new Set([
 		"Budget",
 		"NotificationsWithSubscribers",
 		"ResourceTags"
@@ -32916,7 +32913,7 @@ var KinesisStreamProvider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("KinesisProvider");
-	handledProperties = new Map([["AWS::Kinesis::Stream", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Kinesis::Stream", /* @__PURE__ */ new Set([
 		"Name",
 		"StreamModeDetails",
 		"ShardCount",
@@ -33288,7 +33285,7 @@ var KinesisStreamConsumerProvider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("KinesisStreamConsumerProvider");
-	handledProperties = new Map([["AWS::Kinesis::StreamConsumer", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Kinesis::StreamConsumer", /* @__PURE__ */ new Set([
 		"ConsumerName",
 		"StreamARN",
 		"Tags"
@@ -33555,7 +33552,7 @@ var SchedulerScheduleProvider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("SchedulerScheduleProvider");
-	handledProperties = new Map([["AWS::Scheduler::Schedule", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Scheduler::Schedule", /* @__PURE__ */ new Set([
 		"Name",
 		"GroupName",
 		"Description",
@@ -33750,8 +33747,8 @@ var EFSProvider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("EFSProvider");
-	handledProperties = new Map([
-		["AWS::EFS::FileSystem", new Set([
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::EFS::FileSystem", /* @__PURE__ */ new Set([
 			"FileSystemTags",
 			"Encrypted",
 			"KmsKeyId",
@@ -33765,19 +33762,19 @@ var EFSProvider = class {
 			"BypassPolicyLockoutSafetyCheck",
 			"FileSystemProtection"
 		])],
-		["AWS::EFS::MountTarget", new Set([
+		["AWS::EFS::MountTarget", /* @__PURE__ */ new Set([
 			"FileSystemId",
 			"SubnetId",
 			"SecurityGroups"
 		])],
-		["AWS::EFS::AccessPoint", new Set([
+		["AWS::EFS::AccessPoint", /* @__PURE__ */ new Set([
 			"FileSystemId",
 			"PosixUser",
 			"RootDirectory",
 			"AccessPointTags"
 		])]
 	]);
-	unhandledByDesign = new Map([["AWS::EFS::FileSystem", new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]])], ["AWS::EFS::AccessPoint", new Map([["ClientToken", "AWS SDK manages this idempotency token internally on CreateAccessPoint; no user-supplied value is honored"]])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::EFS::FileSystem", /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]])], ["AWS::EFS::AccessPoint", /* @__PURE__ */ new Map([["ClientToken", "AWS SDK manages this idempotency token internally on CreateAccessPoint; no user-supplied value is honored"]])]]);
 	getClient() {
 		if (!this.client) this.client = new EFSClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -34413,14 +34410,14 @@ var EFSProvider = class {
 * storage-capacity growth and deletes can take substantially longer —
 * mirror the Custom Resource provider's 1-hour ceiling.
 */
-const DEFAULT_MAX_WAIT_MS$1 = 3600 * 1e3;
-const DEFAULT_POLL_INTERVAL_MS$1 = 15e3;
+const DEFAULT_MAX_WAIT_MS$3 = 3600 * 1e3;
+const DEFAULT_POLL_INTERVAL_MS$3 = 15e3;
 /**
 * Lustre sub-properties that `UpdateFileSystem` accepts (the mutable
 * subset of the CFn `LustreConfiguration` block). Everything else in the
 * block is fixed at creation — FSx has no API to change it in place.
 */
-const LUSTRE_MUTABLE_SUBPROPS = new Set([
+const LUSTRE_MUTABLE_SUBPROPS = /* @__PURE__ */ new Set([
 	"WeeklyMaintenanceStartTime",
 	"DailyAutomaticBackupStartTime",
 	"AutomaticBackupRetentionDays",
@@ -34432,6 +34429,94 @@ const LUSTRE_MUTABLE_SUBPROPS = new Set([
 	"DataReadCacheConfiguration"
 ]);
 /**
+* `WindowsConfiguration` sub-properties `UpdateFileSystem` accepts (the
+* mutable subset — mirrors `UpdateFileSystemWindowsConfiguration`).
+* Everything else in the CFn block (ActiveDirectoryId, DeploymentType,
+* PreferredSubnetId, Aliases, ...) is fixed at creation, so a change on one
+* is rejected by update() with a `--replace` pointer.
+*/
+const WINDOWS_MUTABLE_SUBPROPS = /* @__PURE__ */ new Set([
+	"WeeklyMaintenanceStartTime",
+	"DailyAutomaticBackupStartTime",
+	"AutomaticBackupRetentionDays",
+	"ThroughputCapacity",
+	"SelfManagedActiveDirectoryConfiguration",
+	"AuditLogConfiguration",
+	"DiskIopsConfiguration",
+	"FsrmConfiguration"
+]);
+/**
+* `OntapConfiguration` sub-properties `UpdateFileSystem` accepts (mirrors
+* `UpdateFileSystemOntapConfiguration`). `RouteTableIds` is mutable but the
+* API expresses the change as Add/Remove deltas, computed in
+* {@link FSxFileSystemProvider.applyOntapUpdateField}.
+*/
+const ONTAP_MUTABLE_SUBPROPS = /* @__PURE__ */ new Set([
+	"AutomaticBackupRetentionDays",
+	"DailyAutomaticBackupStartTime",
+	"FsxAdminPassword",
+	"WeeklyMaintenanceStartTime",
+	"DiskIopsConfiguration",
+	"ThroughputCapacity",
+	"ThroughputCapacityPerHAPair",
+	"HAPairs",
+	"RouteTableIds",
+	"EndpointIpv6AddressRange"
+]);
+/**
+* `OpenZFSConfiguration` sub-properties `UpdateFileSystem` accepts (mirrors
+* `UpdateFileSystemOpenZFSConfiguration`). `RouteTableIds` is mutable via
+* Add/Remove deltas (see {@link FSxFileSystemProvider.applyOpenZFSUpdateField}).
+* `RootVolumeConfiguration` is NOT here — its fields change through the root
+* volume's own `UpdateVolume` API, which `UpdateFileSystem` cannot express,
+* so a change is rejected with a `--replace` pointer.
+*/
+const OPENZFS_MUTABLE_SUBPROPS = /* @__PURE__ */ new Set([
+	"AutomaticBackupRetentionDays",
+	"CopyTagsToBackups",
+	"CopyTagsToVolumes",
+	"DailyAutomaticBackupStartTime",
+	"ThroughputCapacity",
+	"WeeklyMaintenanceStartTime",
+	"DiskIopsConfiguration",
+	"RouteTableIds",
+	"ReadCacheConfiguration",
+	"EndpointIpv6AddressRange"
+]);
+/**
+* The four `FileSystemType` values → their CFn variant-config property name.
+* Each `CreateFileSystem`/`UpdateFileSystem` call carries at most one of
+* these blocks (the one matching the file system's type).
+*/
+const VARIANT_CONFIG_KEY = {
+	LUSTRE: "LustreConfiguration",
+	WINDOWS: "WindowsConfiguration",
+	ONTAP: "OntapConfiguration",
+	OPENZFS: "OpenZFSConfiguration"
+};
+const VARIANT_MUTABLE_SUBPROPS = {
+	LustreConfiguration: LUSTRE_MUTABLE_SUBPROPS,
+	WindowsConfiguration: WINDOWS_MUTABLE_SUBPROPS,
+	OntapConfiguration: ONTAP_MUTABLE_SUBPROPS,
+	OpenZFSConfiguration: OPENZFS_MUTABLE_SUBPROPS
+};
+/**
+* Compute the Add/Remove route-table-id deltas an ONTAP / OpenZFS
+* `UpdateFileSystem` needs from the previous vs. next `RouteTableIds` list.
+* Route table membership is an unordered set, so a pure reorder yields no
+* delta.
+*/
+const routeTableDelta = (next, prev) => {
+	const nextIds = new Set(next ?? []);
+	const prevIds = new Set(prev ?? []);
+	const add = [...nextIds].filter((id) => !prevIds.has(id));
+	const remove = [...prevIds].filter((id) => !nextIds.has(id));
+	return {
+		...add.length > 0 && { add },
+		...remove.length > 0 && { remove }
+	};
+};
+/**
 * Top-level properties that are create-only per the CFn registry schema
 * (`createOnlyProperties`). A change on any of these is routed through
 * DELETE+CREATE by the replacement-detection layer; if a diff somehow
@@ -34445,7 +34530,7 @@ const TOP_LEVEL_IMMUTABLE_PROPS = [
 	"KmsKeyId",
 	"BackupId"
 ];
-const toNumber$1 = (v) => v === void 0 ? void 0 : Number(v);
+const toNumber$3 = (v) => v === void 0 ? void 0 : Number(v);
 const toBoolean$1 = (v) => {
 	if (v === void 0) return void 0;
 	if (typeof v === "string") return v === "true";
@@ -34457,12 +34542,11 @@ const toBoolean$1 = (v) => {
 * The type is `ProvisioningType: NON_PROVISIONABLE` in the CFn registry,
 * so cdkd's Cloud Control fallback cannot handle it (issue #1042).
 *
-* v1 scope: the **Lustre** variant (the CDK L2, `aws-fsx.LustreFileSystem`).
-* The `WindowsConfiguration` / `OntapConfiguration` / `OpenZFSConfiguration`
-* sub-trees are declared `unhandledByDesign`, so templates using them are
-* rejected by the property-coverage pre-flight instead of silently dropping
-* the whole variant config (each non-Lustre `FileSystemType` REQUIRES its
-* variant block, so no non-Lustre template can slip past the pre-flight).
+* Supported variants: **Lustre** (the CDK L2 `aws-fsx.LustreFileSystem`),
+* **Windows** (FSx for Windows File Server), **ONTAP** (FSx for NetApp
+* ONTAP), and **OpenZFS** (FSx for OpenZFS) — each carries its own
+* `<Variant>Configuration` block, mapped per-variant on create and diffed
+* against the `UpdateFileSystem` mutable surface on update (issue #1068).
 *
 * Lifecycle handling — every mutation is async on AWS:
 *  - `create` → `CreateFileSystem` (or `CreateFileSystemFromBackup` when
@@ -34497,27 +34581,26 @@ var FSxFileSystemProvider = class {
 	pollIntervalMs;
 	maxWaitMs;
 	constructor(options) {
-		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$1;
-		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$1;
+		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$3;
+		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$3;
 	}
-	handledProperties = new Map([["AWS::FSx::FileSystem", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::FSx::FileSystem", /* @__PURE__ */ new Set([
 		"BackupId",
 		"FileSystemType",
 		"FileSystemTypeVersion",
 		"KmsKeyId",
 		"LustreConfiguration",
 		"NetworkType",
+		"OntapConfiguration",
+		"OpenZFSConfiguration",
 		"SecurityGroupIds",
 		"StorageCapacity",
 		"StorageType",
 		"SubnetIds",
-		"Tags"
-	])]]);
-	unhandledByDesign = new Map([["AWS::FSx::FileSystem", new Map([
-		["WindowsConfiguration", "FSx for Windows File Server variant — requires Active Directory wiring and Windows-specific update/delete semantics (final backups, throughput tiers) that v1 does not implement; only the Lustre variant (the CDK L2) is supported. Follow-up to issue #1042."],
-		["OntapConfiguration", "FSx for NetApp ONTAP variant — the file system is only a container for SVMs/volumes (separate AWS::FSx::StorageVirtualMachine / AWS::FSx::Volume types, both still unsupported), so shipping it alone would be misleading; only the Lustre variant is supported in v1. Follow-up to issue #1042."],
-		["OpenZFSConfiguration", "FSx for OpenZFS variant — root-volume semantics (RootVolumeId, child AWS::FSx::Volume trees) are not implemented in v1; only the Lustre variant is supported. Follow-up to issue #1042."]
+		"Tags",
+		"WindowsConfiguration"
 	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map();
 	getClient() {
 		if (!this.client) this.client = new FSxClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
@@ -34535,7 +34618,7 @@ var FSxFileSystemProvider = class {
 		if (resourceType !== "AWS::FSx::FileSystem") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
 		const backupId = properties["BackupId"];
 		const fileSystemType = properties["FileSystemType"];
-		if (backupId === void 0 && fileSystemType !== "LUSTRE") throw new ProvisioningError(`AWS::FSx::FileSystem: FileSystemType '${fileSystemType ?? "(unset)"}' is not supported by cdkd yet — only the LUSTRE variant is implemented (issue #1042). Windows / ONTAP / OpenZFS file systems can follow in a later PR.`, resourceType, logicalId);
+		if (backupId === void 0 && !(fileSystemType !== void 0 && fileSystemType in VARIANT_CONFIG_KEY)) throw new ProvisioningError(`AWS::FSx::FileSystem: FileSystemType '${fileSystemType ?? "(unset)"}' is not supported by cdkd — expected one of ${Object.keys(VARIANT_CONFIG_KEY).join(" / ")}.`, resourceType, logicalId);
 		this.logger.debug(`Creating FSx FileSystem ${logicalId}`);
 		const tokenHash = createHash("sha256").update([
 			properties["FileSystemType"],
@@ -34552,10 +34635,13 @@ var FSxFileSystemProvider = class {
 			SecurityGroupIds: properties["SecurityGroupIds"],
 			KmsKeyId: properties["KmsKeyId"],
 			StorageType: properties["StorageType"],
-			StorageCapacity: toNumber$1(properties["StorageCapacity"]),
+			StorageCapacity: toNumber$3(properties["StorageCapacity"]),
 			FileSystemTypeVersion: properties["FileSystemTypeVersion"],
 			NetworkType: properties["NetworkType"],
 			LustreConfiguration: this.toCreateLustreConfiguration(properties["LustreConfiguration"]),
+			WindowsConfiguration: this.toCreateWindowsConfiguration(properties["WindowsConfiguration"]),
+			OntapConfiguration: this.toCreateOntapConfiguration(properties["OntapConfiguration"]),
+			OpenZFSConfiguration: this.toCreateOpenZFSConfiguration(properties["OpenZFSConfiguration"]),
 			Tags: tags?.map((t) => ({
 				Key: t.Key,
 				Value: t.Value
@@ -34605,27 +34691,158 @@ var FSxFileSystemProvider = class {
 			WeeklyMaintenanceStartTime: config["WeeklyMaintenanceStartTime"],
 			ImportPath: config["ImportPath"],
 			ExportPath: config["ExportPath"],
-			ImportedFileChunkSize: toNumber$1(config["ImportedFileChunkSize"]),
+			ImportedFileChunkSize: toNumber$3(config["ImportedFileChunkSize"]),
 			DeploymentType: config["DeploymentType"],
 			AutoImportPolicy: config["AutoImportPolicy"],
-			PerUnitStorageThroughput: toNumber$1(config["PerUnitStorageThroughput"]),
+			PerUnitStorageThroughput: toNumber$3(config["PerUnitStorageThroughput"]),
 			DailyAutomaticBackupStartTime: config["DailyAutomaticBackupStartTime"],
-			AutomaticBackupRetentionDays: toNumber$1(config["AutomaticBackupRetentionDays"]),
+			AutomaticBackupRetentionDays: toNumber$3(config["AutomaticBackupRetentionDays"]),
 			CopyTagsToBackups: toBoolean$1(config["CopyTagsToBackups"]),
 			DriveCacheType: config["DriveCacheType"],
 			DataCompressionType: config["DataCompressionType"],
 			EfaEnabled: toBoolean$1(config["EfaEnabled"]),
-			ThroughputCapacity: toNumber$1(config["ThroughputCapacity"]),
+			ThroughputCapacity: toNumber$3(config["ThroughputCapacity"]),
 			MetadataConfiguration: metadata ? {
 				Mode: metadata["Mode"],
-				Iops: toNumber$1(metadata["Iops"])
+				Iops: toNumber$3(metadata["Iops"])
 			} : void 0,
 			DataReadCacheConfiguration: readCache ? {
 				SizingMode: readCache["SizingMode"],
-				SizeGiB: toNumber$1(readCache["SizeGiB"])
+				SizeGiB: toNumber$3(readCache["SizeGiB"])
 			} : void 0
 		};
 	}
+	/** Map the CFn `WindowsConfiguration` block to the SDK create shape. */
+	toCreateWindowsConfiguration(config) {
+		if (!config) return void 0;
+		return {
+			ActiveDirectoryId: config["ActiveDirectoryId"],
+			SelfManagedActiveDirectoryConfiguration: this.toSelfManagedAdConfiguration(config["SelfManagedActiveDirectoryConfiguration"]),
+			DeploymentType: config["DeploymentType"],
+			PreferredSubnetId: config["PreferredSubnetId"],
+			ThroughputCapacity: toNumber$3(config["ThroughputCapacity"]),
+			WeeklyMaintenanceStartTime: config["WeeklyMaintenanceStartTime"],
+			DailyAutomaticBackupStartTime: config["DailyAutomaticBackupStartTime"],
+			AutomaticBackupRetentionDays: toNumber$3(config["AutomaticBackupRetentionDays"]),
+			CopyTagsToBackups: toBoolean$1(config["CopyTagsToBackups"]),
+			Aliases: config["Aliases"],
+			AuditLogConfiguration: this.toWindowsAuditLogConfiguration(config["AuditLogConfiguration"]),
+			DiskIopsConfiguration: this.toDiskIopsConfiguration(config["DiskIopsConfiguration"]),
+			FsrmConfiguration: this.toWindowsFsrmConfiguration(config["FsrmConfiguration"])
+		};
+	}
+	/** Map the CFn `OntapConfiguration` block to the SDK create shape. */
+	toCreateOntapConfiguration(config) {
+		if (!config) return void 0;
+		return {
+			AutomaticBackupRetentionDays: toNumber$3(config["AutomaticBackupRetentionDays"]),
+			DailyAutomaticBackupStartTime: config["DailyAutomaticBackupStartTime"],
+			DeploymentType: config["DeploymentType"],
+			EndpointIpAddressRange: config["EndpointIpAddressRange"],
+			FsxAdminPassword: config["FsxAdminPassword"],
+			DiskIopsConfiguration: this.toDiskIopsConfiguration(config["DiskIopsConfiguration"]),
+			PreferredSubnetId: config["PreferredSubnetId"],
+			RouteTableIds: config["RouteTableIds"],
+			ThroughputCapacity: toNumber$3(config["ThroughputCapacity"]),
+			WeeklyMaintenanceStartTime: config["WeeklyMaintenanceStartTime"],
+			HAPairs: toNumber$3(config["HAPairs"]),
+			ThroughputCapacityPerHAPair: toNumber$3(config["ThroughputCapacityPerHAPair"]),
+			EndpointIpv6AddressRange: config["EndpointIpv6AddressRange"]
+		};
+	}
+	/** Map the CFn `OpenZFSConfiguration` block to the SDK create shape. */
+	toCreateOpenZFSConfiguration(config) {
+		if (!config) return void 0;
+		return {
+			AutomaticBackupRetentionDays: toNumber$3(config["AutomaticBackupRetentionDays"]),
+			CopyTagsToBackups: toBoolean$1(config["CopyTagsToBackups"]),
+			CopyTagsToVolumes: toBoolean$1(config["CopyTagsToVolumes"]),
+			DailyAutomaticBackupStartTime: config["DailyAutomaticBackupStartTime"],
+			DeploymentType: config["DeploymentType"],
+			ThroughputCapacity: toNumber$3(config["ThroughputCapacity"]),
+			WeeklyMaintenanceStartTime: config["WeeklyMaintenanceStartTime"],
+			DiskIopsConfiguration: this.toDiskIopsConfiguration(config["DiskIopsConfiguration"]),
+			RootVolumeConfiguration: this.toOpenZFSRootVolumeConfiguration(config["RootVolumeConfiguration"]),
+			PreferredSubnetId: config["PreferredSubnetId"],
+			EndpointIpAddressRange: config["EndpointIpAddressRange"],
+			EndpointIpv6AddressRange: config["EndpointIpv6AddressRange"],
+			RouteTableIds: config["RouteTableIds"],
+			ReadCacheConfiguration: this.toOpenZFSReadCacheConfiguration(config["ReadCacheConfiguration"])
+		};
+	}
+	toDiskIopsConfiguration(config) {
+		if (!config) return void 0;
+		return {
+			Mode: config["Mode"],
+			Iops: toNumber$3(config["Iops"])
+		};
+	}
+	toSelfManagedAdConfiguration(config) {
+		if (!config) return void 0;
+		return {
+			DomainName: config["DomainName"],
+			OrganizationalUnitDistinguishedName: config["OrganizationalUnitDistinguishedName"],
+			FileSystemAdministratorsGroup: config["FileSystemAdministratorsGroup"],
+			UserName: config["UserName"],
+			Password: config["Password"],
+			DnsIps: config["DnsIps"],
+			DomainJoinServiceAccountSecret: config["DomainJoinServiceAccountSecret"]
+		};
+	}
+	toSelfManagedAdConfigurationUpdates(config) {
+		if (!config) return void 0;
+		return {
+			UserName: config["UserName"],
+			Password: config["Password"],
+			DnsIps: config["DnsIps"],
+			DomainName: config["DomainName"],
+			OrganizationalUnitDistinguishedName: config["OrganizationalUnitDistinguishedName"],
+			FileSystemAdministratorsGroup: config["FileSystemAdministratorsGroup"],
+			DomainJoinServiceAccountSecret: config["DomainJoinServiceAccountSecret"]
+		};
+	}
+	toWindowsAuditLogConfiguration(config) {
+		if (!config) return void 0;
+		return {
+			FileAccessAuditLogLevel: config["FileAccessAuditLogLevel"],
+			FileShareAccessAuditLogLevel: config["FileShareAccessAuditLogLevel"],
+			AuditLogDestination: config["AuditLogDestination"]
+		};
+	}
+	toWindowsFsrmConfiguration(config) {
+		if (!config) return void 0;
+		return {
+			FsrmServiceEnabled: toBoolean$1(config["FsrmServiceEnabled"]),
+			EventLogDestination: config["EventLogDestination"]
+		};
+	}
+	toOpenZFSRootVolumeConfiguration(config) {
+		if (!config) return void 0;
+		const nfsExports = config["NfsExports"];
+		const quotas = config["UserAndGroupQuotas"];
+		return {
+			RecordSizeKiB: toNumber$3(config["RecordSizeKiB"]),
+			DataCompressionType: config["DataCompressionType"],
+			NfsExports: nfsExports?.map((exp) => ({ ClientConfigurations: (exp["ClientConfigurations"] ?? []).map((cc) => ({
+				Clients: cc["Clients"],
+				Options: cc["Options"]
+			})) })),
+			UserAndGroupQuotas: quotas?.map((q) => ({
+				Type: q["Type"],
+				Id: toNumber$3(q["Id"]),
+				StorageCapacityQuotaGiB: toNumber$3(q["StorageCapacityQuotaGiB"])
+			})),
+			CopyTagsToSnapshots: toBoolean$1(config["CopyTagsToSnapshots"]),
+			ReadOnly: toBoolean$1(config["ReadOnly"])
+		};
+	}
+	toOpenZFSReadCacheConfiguration(config) {
+		if (!config) return void 0;
+		return {
+			SizingMode: config["SizingMode"],
+			SizeGiB: toNumber$3(config["SizeGiB"])
+		};
+	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		const changed = (key) => JSON.stringify(properties[key]) !== JSON.stringify(previousProperties[key]);
 		for (const key of TOP_LEVEL_IMMUTABLE_PROPS) {
@@ -34633,55 +34850,17 @@ var FSxFileSystemProvider = class {
 			const prev = previousProperties[key];
 			if (JSON.stringify(next ?? null) !== JSON.stringify(prev ?? null)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${key} is immutable on AWS — UpdateFileSystem does not accept ${key}; the property is fixed at creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
 		}
-		const nextLustre = properties["LustreConfiguration"] ?? {};
-		const prevLustre = previousProperties["LustreConfiguration"] ?? {};
-		const lustreKeys = new Set([...Object.keys(nextLustre), ...Object.keys(prevLustre)]);
-		const lustreMutableDiff = {};
-		let lustreHasMutableDiff = false;
-		for (const key of lustreKeys) {
-			const next = nextLustre[key];
-			const prev = prevLustre[key];
-			if (JSON.stringify(next) === JSON.stringify(prev)) continue;
-			if (!LUSTRE_MUTABLE_SUBPROPS.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem LustreConfiguration.${key} is immutable on AWS — UpdateFileSystem cannot change it after creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
-			lustreHasMutableDiff = true;
-			switch (key) {
-				case "WeeklyMaintenanceStartTime":
-				case "DailyAutomaticBackupStartTime":
-					lustreMutableDiff[key] = next;
-					break;
-				case "AutomaticBackupRetentionDays":
-				case "PerUnitStorageThroughput":
-				case "ThroughputCapacity":
-					lustreMutableDiff[key] = toNumber$1(next);
-					break;
-				case "AutoImportPolicy":
-				case "DataCompressionType":
-					lustreMutableDiff[key] = next;
-					break;
-				case "MetadataConfiguration": {
-					const metadata = next;
-					lustreMutableDiff.MetadataConfiguration = metadata ? {
-						Mode: metadata["Mode"],
-						Iops: toNumber$1(metadata["Iops"])
-					} : void 0;
-					break;
-				}
-				case "DataReadCacheConfiguration": {
-					const readCache = next;
-					lustreMutableDiff.DataReadCacheConfiguration = readCache ? {
-						SizingMode: readCache["SizingMode"],
-						SizeGiB: toNumber$1(readCache["SizeGiB"])
-					} : void 0;
-					break;
-				}
-			}
-		}
+		const variantConfigKey = this.detectVariantConfigKey(properties, previousProperties);
+		const { diff: variantDiff, hasMutableDiff: variantHasMutableDiff } = variantConfigKey ? this.computeVariantConfigDiff(resourceType, logicalId, variantConfigKey, properties[variantConfigKey] ?? {}, previousProperties[variantConfigKey] ?? {}) : {
+			diff: {},
+			hasMutableDiff: false
+		};
 		const storageCapacityChanged = changed("StorageCapacity");
 		const storageTypeChanged = changed("StorageType");
 		const typeVersionChanged = changed("FileSystemTypeVersion");
 		const networkTypeChanged = changed("NetworkType");
 		const tagsChanged = changed("Tags");
-		if (!lustreHasMutableDiff && !storageCapacityChanged && !storageTypeChanged && !typeVersionChanged && !networkTypeChanged && !tagsChanged) {
+		if (!variantHasMutableDiff && !storageCapacityChanged && !storageTypeChanged && !typeVersionChanged && !networkTypeChanged && !tagsChanged) {
 			this.logger.debug(`No mutable diff for FSx FileSystem ${logicalId}, skipping update`);
 			return {
 				physicalId,
@@ -34690,17 +34869,17 @@ var FSxFileSystemProvider = class {
 		}
 		this.logger.debug(`Updating FSx FileSystem ${logicalId}: ${physicalId}`);
 		try {
-			const needsUpdateCall = lustreHasMutableDiff || storageCapacityChanged || storageTypeChanged || typeVersionChanged || networkTypeChanged;
+			const needsUpdateCall = variantHasMutableDiff || storageCapacityChanged || storageTypeChanged || typeVersionChanged || networkTypeChanged;
 			let updatedFs;
 			if (needsUpdateCall) {
 				const callTimeMs = Date.now();
 				const respPendingActions = ((await this.getClient().send(new UpdateFileSystemCommand$1({
 					FileSystemId: physicalId,
-					...storageCapacityChanged && { StorageCapacity: toNumber$1(properties["StorageCapacity"]) },
+					...storageCapacityChanged && { StorageCapacity: toNumber$3(properties["StorageCapacity"]) },
 					...storageTypeChanged && { StorageType: properties["StorageType"] },
 					...typeVersionChanged && { FileSystemTypeVersion: properties["FileSystemTypeVersion"] },
 					...networkTypeChanged && { NetworkType: properties["NetworkType"] },
-					...lustreHasMutableDiff && { LustreConfiguration: lustreMutableDiff }
+					...variantHasMutableDiff && variantConfigKey ? { [variantConfigKey]: variantDiff } : {}
 				}))).FileSystem?.AdministrativeActions ?? []).filter((a) => a.AdministrativeActionType === "FILE_SYSTEM_UPDATE" && (a.Status === "PENDING" || a.Status === "IN_PROGRESS"));
 				const requestTimes = respPendingActions.map((a) => a.RequestTime?.getTime()).filter((t) => t !== void 0);
 				const actionThresholdMs = requestTimes.length > 0 ? Math.min(...requestTimes) : callTimeMs - 6e4;
@@ -34725,6 +34904,156 @@ var FSxFileSystemProvider = class {
 		}
 	}
 	/**
+	* Which `<Variant>Configuration` block (if any) is present on either side
+	* of the update. At most one is expected — the file system's type never
+	* changes (FileSystemType is registry-createOnly, guarded above).
+	*/
+	detectVariantConfigKey(properties, previousProperties) {
+		for (const key of Object.values(VARIANT_CONFIG_KEY)) if (properties[key] !== void 0 || previousProperties[key] !== void 0) return key;
+	}
+	/**
+	* Diff a variant config block's sub-properties into the SDK
+	* `UpdateFileSystem<Variant>Configuration` shape. A changed sub-field that
+	* is NOT in the variant's mutable set is rejected with a `--replace`
+	* pointer (UpdateFileSystem cannot express it).
+	*/
+	computeVariantConfigDiff(resourceType, logicalId, configKey, next, prev) {
+		const mutable = VARIANT_MUTABLE_SUBPROPS[configKey] ?? /* @__PURE__ */ new Set();
+		const keys = /* @__PURE__ */ new Set([...Object.keys(next), ...Object.keys(prev)]);
+		const diff = {};
+		let hasMutableDiff = false;
+		for (const key of keys) {
+			const nextVal = next[key];
+			const prevVal = prev[key];
+			if (JSON.stringify(nextVal) === JSON.stringify(prevVal)) continue;
+			if (!mutable.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${configKey}.${key} is immutable on AWS — UpdateFileSystem cannot change it after creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+			if (configKey === "LustreConfiguration" ? this.applyLustreUpdateField(key, nextVal, diff) : configKey === "WindowsConfiguration" ? this.applyWindowsUpdateField(key, nextVal, diff) : configKey === "OntapConfiguration" ? this.applyOntapUpdateField(key, nextVal, prevVal, diff) : this.applyOpenZFSUpdateField(key, nextVal, prevVal, diff)) hasMutableDiff = true;
+		}
+		return {
+			diff,
+			hasMutableDiff
+		};
+	}
+	applyLustreUpdateField(key, next, diff) {
+		const out = diff;
+		switch (key) {
+			case "WeeklyMaintenanceStartTime":
+			case "DailyAutomaticBackupStartTime":
+				diff[key] = next;
+				break;
+			case "AutomaticBackupRetentionDays":
+			case "PerUnitStorageThroughput":
+			case "ThroughputCapacity":
+				diff[key] = toNumber$3(next);
+				break;
+			case "AutoImportPolicy":
+			case "DataCompressionType":
+				diff[key] = next;
+				break;
+			case "MetadataConfiguration": {
+				const metadata = next;
+				out.MetadataConfiguration = metadata ? {
+					Mode: metadata["Mode"],
+					Iops: toNumber$3(metadata["Iops"])
+				} : void 0;
+				break;
+			}
+			case "DataReadCacheConfiguration": {
+				const readCache = next;
+				out.DataReadCacheConfiguration = readCache ? {
+					SizingMode: readCache["SizingMode"],
+					SizeGiB: toNumber$3(readCache["SizeGiB"])
+				} : void 0;
+				break;
+			}
+		}
+		return true;
+	}
+	applyWindowsUpdateField(key, next, diff) {
+		const out = diff;
+		switch (key) {
+			case "WeeklyMaintenanceStartTime":
+			case "DailyAutomaticBackupStartTime":
+				diff[key] = next;
+				break;
+			case "AutomaticBackupRetentionDays":
+			case "ThroughputCapacity":
+				diff[key] = toNumber$3(next);
+				break;
+			case "SelfManagedActiveDirectoryConfiguration":
+				out.SelfManagedActiveDirectoryConfiguration = this.toSelfManagedAdConfigurationUpdates(next);
+				break;
+			case "AuditLogConfiguration":
+				out.AuditLogConfiguration = this.toWindowsAuditLogConfiguration(next);
+				break;
+			case "DiskIopsConfiguration":
+				out.DiskIopsConfiguration = this.toDiskIopsConfiguration(next);
+				break;
+			case "FsrmConfiguration":
+				out.FsrmConfiguration = this.toWindowsFsrmConfiguration(next);
+				break;
+		}
+		return true;
+	}
+	applyOntapUpdateField(key, next, prev, diff) {
+		const out = diff;
+		switch (key) {
+			case "DailyAutomaticBackupStartTime":
+			case "WeeklyMaintenanceStartTime":
+			case "FsxAdminPassword":
+			case "EndpointIpv6AddressRange":
+				diff[key] = next;
+				break;
+			case "AutomaticBackupRetentionDays":
+			case "ThroughputCapacity":
+			case "ThroughputCapacityPerHAPair":
+			case "HAPairs":
+				diff[key] = toNumber$3(next);
+				break;
+			case "DiskIopsConfiguration":
+				out.DiskIopsConfiguration = this.toDiskIopsConfiguration(next);
+				break;
+			case "RouteTableIds": {
+				const { add, remove } = routeTableDelta(next, prev);
+				if (add) out.AddRouteTableIds = add;
+				if (remove) out.RemoveRouteTableIds = remove;
+				return add !== void 0 || remove !== void 0;
+			}
+		}
+		return true;
+	}
+	applyOpenZFSUpdateField(key, next, prev, diff) {
+		const out = diff;
+		switch (key) {
+			case "DailyAutomaticBackupStartTime":
+			case "WeeklyMaintenanceStartTime":
+			case "EndpointIpv6AddressRange":
+				diff[key] = next;
+				break;
+			case "CopyTagsToBackups":
+			case "CopyTagsToVolumes":
+				diff[key] = toBoolean$1(next);
+				break;
+			case "AutomaticBackupRetentionDays":
+			case "ThroughputCapacity":
+				diff[key] = toNumber$3(next);
+				break;
+			case "DiskIopsConfiguration":
+				out.DiskIopsConfiguration = this.toDiskIopsConfiguration(next);
+				break;
+			case "ReadCacheConfiguration":
+				out.ReadCacheConfiguration = this.toOpenZFSReadCacheConfiguration(next);
+				break;
+			case "RouteTableIds": {
+				const { add, remove } = routeTableDelta(next, prev);
+				if (add) out.AddRouteTableIds = add;
+				if (remove) out.RemoveRouteTableIds = remove;
+				return add !== void 0 || remove !== void 0;
+			}
+		}
+		return true;
+	}
+	/**
 	* Apply a `Tags` diff via `TagResource` / `UntagResource` (the FSx
 	* `UpdateFileSystem` API does not accept tags). Needs the ARN — resolve
 	* it from `DescribeFileSystems`.
@@ -34878,6 +35207,7 @@ var FSxFileSystemProvider = class {
 		if (fs.ResourceARN !== void 0) attributes["ResourceARN"] = fs.ResourceARN;
 		if (fs.DNSName !== void 0) attributes["DNSName"] = fs.DNSName;
 		if (fs.LustreConfiguration?.MountName !== void 0) attributes["LustreMountName"] = fs.LustreConfiguration.MountName;
+		if (fs.OpenZFSConfiguration?.RootVolumeId !== void 0) attributes["RootVolumeId"] = fs.OpenZFSConfiguration.RootVolumeId;
 		if (fs.FileSystemId !== void 0) attributes["FileSystemId"] = fs.FileSystemId;
 		return attributes;
 	}
@@ -34899,10 +35229,23 @@ var FSxFileSystemProvider = class {
 	*    interface ids, never the original security group list.
 	*  - `BackupId` — creation-source input, not surfaced on the deployed
 	*    file system.
+	*  - `WindowsConfiguration` / `OntapConfiguration` / `OpenZFSConfiguration`
+	*    — `readCurrentState` maps only the Lustre block back to CFn shape
+	*    today, so drift on the non-Lustre variant blocks is not yet computed;
+	*    marking them unknown avoids a guaranteed false positive on every run
+	*    (variant-config drift is a follow-up). Only the block matching the
+	*    file system's type is ever present in state, so listing all three is
+	*    harmless.
 	*/
 	getDriftUnknownPaths(resourceType) {
 		if (resourceType !== "AWS::FSx::FileSystem") return [];
-		return ["SecurityGroupIds", "BackupId"];
+		return [
+			"SecurityGroupIds",
+			"BackupId",
+			"WindowsConfiguration",
+			"OntapConfiguration",
+			"OpenZFSConfiguration"
+		];
 	}
 	/**
 	* Read the AWS-current file system configuration in CFn-property shape
@@ -35010,16 +35353,16 @@ var FSxFileSystemProvider = class {
 * FSx providers' 1-hour ceiling so the slowest realistic create/terminate
 * still fits inside the per-resource deadline.
 */
-const DEFAULT_MAX_WAIT_MS = 3600 * 1e3;
-const DEFAULT_POLL_INTERVAL_MS = 15e3;
+const DEFAULT_MAX_WAIT_MS$2 = 3600 * 1e3;
+const DEFAULT_POLL_INTERVAL_MS$2 = 15e3;
 /** Cluster states that mean "create succeeded, the cluster is up". */
-const CREATE_READY_STATES = new Set(["WAITING", "RUNNING"]);
+const CREATE_READY_STATES = /* @__PURE__ */ new Set(["WAITING", "RUNNING"]);
 /**
 * Cluster states that mean "the cluster is gone" (for delete polling and
 * delete idempotency). `TERMINATED_WITH_ERRORS` still counts as gone — the
 * cluster no longer bills — but is logged so a failed terminate is visible.
 */
-const TERMINAL_STATES = new Set(["TERMINATED", "TERMINATED_WITH_ERRORS"]);
+const TERMINAL_STATES = /* @__PURE__ */ new Set(["TERMINATED", "TERMINATED_WITH_ERRORS"]);
 /**
 * Cluster states that mean "the cluster is alive" — the `ListClusters` filter
 * used by `import()` discovery so a long-gone `TERMINATED*` cluster is never
@@ -35038,14 +35381,14 @@ const NON_TERMINATED_STATES = [
 * replacement-detection layer) or lives inside the `Instances` block (handled
 * specially in `update()` — only `TerminationProtected` is mutable there).
 */
-const MUTABLE_TOP_LEVEL_PROPS = new Set([
+const MUTABLE_TOP_LEVEL_PROPS = /* @__PURE__ */ new Set([
 	"Tags",
 	"VisibleToAllUsers",
 	"StepConcurrencyLevel",
 	"ManagedScalingPolicy",
 	"AutoTerminationPolicy"
 ]);
-const toNumber = (v) => {
+const toNumber$2 = (v) => {
 	if (v === void 0) return void 0;
 	const n = Number(v);
 	return Number.isNaN(n) ? void 0 : n;
@@ -35055,7 +35398,7 @@ const toBoolean = (v) => {
 	if (typeof v === "string") return v === "true";
 	return Boolean(v);
 };
-const jsonEqual = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+const jsonEqual$2 = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 /**
 * SDK Provider for `AWS::EMR::Cluster` (EMR on EC2).
 *
@@ -35101,10 +35444,10 @@ var EMRClusterProvider = class {
 	pollIntervalMs;
 	maxWaitMs;
 	constructor(options) {
-		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS;
+		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$2;
+		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$2;
 	}
-	handledProperties = new Map([["AWS::EMR::Cluster", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::EMR::Cluster", /* @__PURE__ */ new Set([
 		"AdditionalInfo",
 		"Applications",
 		"AutoScalingRole",
@@ -35174,10 +35517,10 @@ var EMRClusterProvider = class {
 				CustomAmiId: properties["CustomAmiId"],
 				OSReleaseLabel: properties["OSReleaseLabel"],
 				SecurityConfiguration: properties["SecurityConfiguration"],
-				EbsRootVolumeSize: toNumber(properties["EbsRootVolumeSize"]),
-				EbsRootVolumeIops: toNumber(properties["EbsRootVolumeIops"]),
-				EbsRootVolumeThroughput: toNumber(properties["EbsRootVolumeThroughput"]),
-				StepConcurrencyLevel: toNumber(properties["StepConcurrencyLevel"]),
+				EbsRootVolumeSize: toNumber$2(properties["EbsRootVolumeSize"]),
+				EbsRootVolumeIops: toNumber$2(properties["EbsRootVolumeIops"]),
+				EbsRootVolumeThroughput: toNumber$2(properties["EbsRootVolumeThroughput"]),
+				StepConcurrencyLevel: toNumber$2(properties["StepConcurrencyLevel"]),
 				VisibleToAllUsers: toBoolean(properties["VisibleToAllUsers"]),
 				Applications: properties["Applications"],
 				Configurations: properties["Configurations"],
@@ -35266,7 +35609,7 @@ var EMRClusterProvider = class {
 		return {
 			InstanceRole: role,
 			InstanceType: raw["InstanceType"],
-			InstanceCount: toNumber(raw["InstanceCount"]),
+			InstanceCount: toNumber$2(raw["InstanceCount"]),
 			Name: raw["Name"],
 			Market: raw["Market"],
 			BidPrice: raw["BidPrice"],
@@ -35280,8 +35623,8 @@ var EMRClusterProvider = class {
 		return {
 			InstanceFleetType: type,
 			Name: raw["Name"],
-			TargetOnDemandCapacity: toNumber(raw["TargetOnDemandCapacity"]),
-			TargetSpotCapacity: toNumber(raw["TargetSpotCapacity"]),
+			TargetOnDemandCapacity: toNumber$2(raw["TargetOnDemandCapacity"]),
+			TargetSpotCapacity: toNumber$2(raw["TargetSpotCapacity"]),
 			InstanceTypeConfigs: raw["InstanceTypeConfigs"],
 			LaunchSpecifications: raw["LaunchSpecifications"],
 			ResizeSpecifications: raw["ResizeSpecifications"]
@@ -35294,28 +35637,28 @@ var EMRClusterProvider = class {
 		return {
 			ComputeLimits: {
 				UnitType: limits["UnitType"],
-				MinimumCapacityUnits: toNumber(limits["MinimumCapacityUnits"]),
-				MaximumCapacityUnits: toNumber(limits["MaximumCapacityUnits"]),
-				MaximumOnDemandCapacityUnits: toNumber(limits["MaximumOnDemandCapacityUnits"]),
-				MaximumCoreCapacityUnits: toNumber(limits["MaximumCoreCapacityUnits"])
+				MinimumCapacityUnits: toNumber$2(limits["MinimumCapacityUnits"]),
+				MaximumCapacityUnits: toNumber$2(limits["MaximumCapacityUnits"]),
+				MaximumOnDemandCapacityUnits: toNumber$2(limits["MaximumOnDemandCapacityUnits"]),
+				MaximumCoreCapacityUnits: toNumber$2(limits["MaximumCoreCapacityUnits"])
 			},
-			UtilizationPerformanceIndex: toNumber(config["UtilizationPerformanceIndex"]),
+			UtilizationPerformanceIndex: toNumber$2(config["UtilizationPerformanceIndex"]),
 			ScalingStrategy: config["ScalingStrategy"]
 		};
 	}
 	toAutoTerminationPolicy(config) {
 		if (!config) return void 0;
-		return { IdleTimeout: toNumber(config["IdleTimeout"]) };
+		return { IdleTimeout: toNumber$2(config["IdleTimeout"]) };
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
-		const changed = (key) => !jsonEqual(properties[key], previousProperties[key]);
+		const changed = (key) => !jsonEqual$2(properties[key], previousProperties[key]);
 		const nextInstances = properties["Instances"] ?? {};
 		const prevInstances = previousProperties["Instances"] ?? {};
 		let terminationProtectedChanged = false;
 		if (changed("Instances")) {
-			const instanceKeys = new Set([...Object.keys(nextInstances), ...Object.keys(prevInstances)]);
+			const instanceKeys = /* @__PURE__ */ new Set([...Object.keys(nextInstances), ...Object.keys(prevInstances)]);
 			for (const key of instanceKeys) {
-				if (jsonEqual(nextInstances[key], prevInstances[key])) continue;
+				if (jsonEqual$2(nextInstances[key], prevInstances[key])) continue;
 				if (key === "TerminationProtected") {
 					terminationProtectedChanged = true;
 					continue;
@@ -35355,7 +35698,7 @@ var EMRClusterProvider = class {
 			}));
 			if (stepConcurrencyChanged) await this.getClient().send(new ModifyClusterCommand({
 				ClusterId: physicalId,
-				StepConcurrencyLevel: toNumber(properties["StepConcurrencyLevel"])
+				StepConcurrencyLevel: toNumber$2(properties["StepConcurrencyLevel"])
 			}));
 			if (managedScalingChanged) {
 				const next = this.toManagedScalingPolicy(properties["ManagedScalingPolicy"]);
@@ -35807,6 +36150,570 @@ var EMRClusterProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/emr-instance-group-config-provider.ts
+/**
+* Default polling budget for an instance group reaching RUNNING. Adding a
+* group to an already-WAITING cluster provisions + bootstraps its EC2
+* instances (typically 2-6 minutes); a resize settles faster. Reuse the
+* EMR Cluster provider's 1-hour ceiling so the slowest realistic add still
+* fits inside the per-resource deadline.
+*/
+const DEFAULT_MAX_WAIT_MS$1 = 3600 * 1e3;
+const DEFAULT_POLL_INTERVAL_MS$1 = 15e3;
+/** Instance-group state that means "the group is up and idle/serving". */
+const READY_STATES$1 = /* @__PURE__ */ new Set(["RUNNING"]);
+/**
+* Instance-group states that mean "the group is gone / failed" — a hard
+* error during a create/resize wait (an ARRESTED group failed to provision;
+* TERMINATED/ENDED mean it will never reach RUNNING).
+*/
+const FAILED_STATES$1 = /* @__PURE__ */ new Set([
+	"ARRESTED",
+	"TERMINATED",
+	"ENDED"
+]);
+const toNumber$1 = (v) => {
+	if (v === void 0) return void 0;
+	const n = Number(v);
+	return Number.isNaN(n) ? void 0 : n;
+};
+const jsonEqual$1 = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+/**
+* SDK Provider for `AWS::EMR::InstanceGroupConfig` (issue #1070).
+*
+* This type adds a standalone instance group (MASTER / CORE / TASK) to an
+* EXISTING EMR cluster (referenced by `JobFlowId`), rather than declaring the
+* group inline in `AWS::EMR::Cluster.Instances`. It is
+* `ProvisioningType: NON_PROVISIONABLE` in the CFn registry, so Cloud Control
+* cannot handle it — pre-flight would otherwise reject it via
+* `unsupported-types.generated.ts`.
+*
+* Lifecycle:
+*  - `create` → `AddInstanceGroups` (one group per call) + poll
+*    `ListInstanceGroups` until the new group is `RUNNING`. A failed terminal
+*    (`ARRESTED` / `TERMINATED` / `ENDED`) during the wait is a hard error.
+*  - `update` → only the two AWS-mutable properties: `InstanceCount`
+*    (`ModifyInstanceGroups`, resize; polled until settled) and
+*    `AutoScalingPolicy` (`PutAutoScalingPolicy` / `RemoveAutoScalingPolicy`).
+*    Every other property is registry-createOnly → routed through
+*    DELETE+CREATE by the replacement-detection layer; a createOnly change
+*    that reaches `update()` anyway is refused with a `--replace` pointer.
+*  - `delete` → **no standalone AWS API exists.** EMR cannot remove an
+*    instance group from a running cluster; a group's only lifecycle end is
+*    cluster termination. In the normal `cdkd destroy` the parent
+*    `AWS::EMR::Cluster` is terminated in the same run (its `TerminateJobFlows`
+*    releases every group + its EC2 instances), so this delete is a no-op that
+*    just drops cdkd state — leaving ZERO orphans. As a best effort for the
+*    less common "delete only the group, keep the cluster" case, a TASK group
+*    is scaled to 0 instances (`ModifyInstanceGroups InstanceCount: 0`) to
+*    release its instances; MASTER/CORE groups cannot be scaled to 0 and are a
+*    pure no-op. Never blocks the destroy (warn-and-continue).
+*
+* `getMinResourceTimeoutMs()` lifts the deploy engine's per-resource deadline
+* to the polling ceiling (mirrors `EMRClusterProvider`) so a slow add/resize
+* does not require `--resource-timeout`.
+*/
+var EMRInstanceGroupConfigProvider = class {
+	/**
+	* Cloud Control has NO handlers for this type
+	* (`ProvisioningType: NON_PROVISIONABLE`), so the deploy engine's #614
+	* silent-drop auto-route MUST NOT send an unhandled-property template to CC
+	* — it would fail at provisioning time with an opaque
+	* UnsupportedActionException. With this opt-out the ProviderRegistry rejects
+	* such templates pre-flight with a clear error instead.
+	*/
+	disableCcApiFallback = true;
+	client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("EMRInstanceGroupConfigProvider");
+	pollIntervalMs;
+	maxWaitMs;
+	constructor(options) {
+		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$1;
+		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$1;
+	}
+	handledProperties = /* @__PURE__ */ new Map([["AWS::EMR::InstanceGroupConfig", /* @__PURE__ */ new Set([
+		"AutoScalingPolicy",
+		"BidPrice",
+		"Configurations",
+		"CustomAmiId",
+		"EbsConfiguration",
+		"InstanceCount",
+		"InstanceRole",
+		"InstanceType",
+		"JobFlowId",
+		"Market",
+		"Name"
+	])]]);
+	getClient() {
+		if (!this.client) this.client = new EMRClient(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.client;
+	}
+	getMinResourceTimeoutMs() {
+		return this.maxWaitMs + this.pollIntervalMs;
+	}
+	async create(logicalId, resourceType, properties) {
+		if (resourceType !== "AWS::EMR::InstanceGroupConfig") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
+		const jobFlowId = properties["JobFlowId"];
+		if (!jobFlowId) throw new ProvisioningError(`EMR InstanceGroupConfig ${logicalId} is missing JobFlowId (the parent cluster id)`, resourceType, logicalId);
+		this.logger.debug(`Adding EMR instance group ${logicalId} to cluster ${jobFlowId}`);
+		try {
+			const group = this.toInstanceGroupConfig(properties);
+			const groupId = (await this.getClient().send(new AddInstanceGroupsCommand({
+				JobFlowId: jobFlowId,
+				InstanceGroups: [group]
+			}))).InstanceGroupIds?.[0];
+			if (!groupId) throw new ProvisioningError(`EMR AddInstanceGroups for ${logicalId} returned no instance group id`, resourceType, logicalId);
+			await this.waitForGroupReady(jobFlowId, groupId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0);
+			this.logger.debug(`Successfully added EMR instance group ${logicalId}: ${groupId}`);
+			return {
+				physicalId: groupId,
+				attributes: { Id: groupId }
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to add EMR instance group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	toInstanceGroupConfig(properties) {
+		return {
+			InstanceRole: properties["InstanceRole"],
+			InstanceType: properties["InstanceType"],
+			InstanceCount: toNumber$1(properties["InstanceCount"]),
+			Name: properties["Name"],
+			Market: properties["Market"],
+			BidPrice: properties["BidPrice"],
+			Configurations: properties["Configurations"],
+			EbsConfiguration: properties["EbsConfiguration"],
+			AutoScalingPolicy: properties["AutoScalingPolicy"],
+			CustomAmiId: properties["CustomAmiId"]
+		};
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		const changed = (key) => !jsonEqual$1(properties[key], previousProperties[key]);
+		const MUTABLE = /* @__PURE__ */ new Set(["InstanceCount", "AutoScalingPolicy"]);
+		for (const key of Object.keys({
+			...properties,
+			...previousProperties
+		})) {
+			if (!changed(key)) continue;
+			if (!MUTABLE.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EMR InstanceGroupConfig ${key} is immutable on AWS — it is fixed when the instance group is created. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+		}
+		const instanceCountChanged = changed("InstanceCount");
+		const autoScalingChanged = changed("AutoScalingPolicy");
+		if (!instanceCountChanged && !autoScalingChanged) {
+			this.logger.debug(`No mutable diff for EMR instance group ${logicalId}, skipping update`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		}
+		const jobFlowId = properties["JobFlowId"];
+		this.logger.debug(`Updating EMR instance group ${logicalId}: ${physicalId}`);
+		try {
+			if (instanceCountChanged) {
+				await this.getClient().send(new ModifyInstanceGroupsCommand({
+					...jobFlowId && { ClusterId: jobFlowId },
+					InstanceGroups: [{
+						InstanceGroupId: physicalId,
+						InstanceCount: toNumber$1(properties["InstanceCount"])
+					}]
+				}));
+				if (jobFlowId) await this.waitForGroupReady(jobFlowId, physicalId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0);
+			}
+			if (autoScalingChanged) {
+				if (!jobFlowId) throw new ProvisioningError(`EMR InstanceGroupConfig ${logicalId} AutoScalingPolicy update needs JobFlowId (the cluster id), which is absent`, resourceType, logicalId, physicalId);
+				const policy = properties["AutoScalingPolicy"];
+				if (policy) await this.getClient().send(new PutAutoScalingPolicyCommand({
+					ClusterId: jobFlowId,
+					InstanceGroupId: physicalId,
+					AutoScalingPolicy: policy
+				}));
+				else await this.getClient().send(new RemoveAutoScalingPolicyCommand({
+					ClusterId: jobFlowId,
+					InstanceGroupId: physicalId
+				}));
+			}
+			this.logger.debug(`Successfully updated EMR instance group ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: { Id: physicalId }
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError || error instanceof ResourceUpdateNotSupportedError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update EMR instance group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, properties, context) {
+		const role = properties?.["InstanceRole"];
+		const jobFlowId = properties?.["JobFlowId"];
+		if (role === "TASK" && jobFlowId) {
+			try {
+				await this.getClient().send(new ModifyInstanceGroupsCommand({
+					ClusterId: jobFlowId,
+					InstanceGroups: [{
+						InstanceGroupId: physicalId,
+						InstanceCount: 0
+					}]
+				}));
+				this.logger.debug(`Scaled EMR TASK instance group ${physicalId} to 0 to release its instances (no standalone delete API exists)`);
+			} catch (error) {
+				if (error instanceof InvalidRequestException) {
+					assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					this.logger.debug(`EMR instance group ${physicalId} scale-to-0 skipped (cluster/group gone): ${error.message}`);
+				} else this.logger.warn(`Best-effort scale-to-0 of EMR instance group ${physicalId} failed: ${error instanceof Error ? error.message : String(error)} — its instances are released when the parent cluster terminates`);
+			}
+			return;
+		}
+		this.logger.debug(`EMR instance group ${physicalId} (role ${role ?? "unknown"}) has no standalone delete API; its instances are released when the parent cluster terminates. Removing cdkd state only.`);
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "Id") return physicalId;
+	}
+	/**
+	* Poll until the group is `RUNNING` AND its `RunningInstanceCount` equals
+	* `expectedCount`. The count check is load-bearing on a resize: right after
+	* `ModifyInstanceGroups` the group is still in the PRE-resize `RUNNING`
+	* state (EMR has not flipped it to `RESIZING` yet), so a State-only wait
+	* would return before the resize even starts. Waiting on the running count
+	* reaching the requested target settles both create (0 -> N provisioning)
+	* and resize (M -> N add/remove) correctly.
+	*/
+	async waitForGroupReady(clusterId, groupId, logicalId, resourceType, expectedCount) {
+		const startTime = Date.now();
+		const transientState = { count: 0 };
+		while (Date.now() - startTime < this.maxWaitMs) {
+			const group = await this.findGroupForPoll(clusterId, groupId, transientState);
+			const state = group?.Status?.State;
+			if (state && READY_STATES$1.has(state) && group?.RunningInstanceCount === expectedCount) return;
+			if (state && FAILED_STATES$1.has(state)) throw new ProvisioningError(`EMR instance group ${groupId} entered failed state ${state}: ${group?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, groupId);
+			this.logger.debug(`EMR instance group ${groupId} state: ${state ?? "unknown"}, running ${group?.RunningInstanceCount ?? "?"}/${expectedCount}, waiting...`);
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+		throw new ProvisioningError(`Timed out waiting for EMR instance group ${groupId} to reach RUNNING with ${expectedCount} instance(s) (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, groupId);
+	}
+	/**
+	* `ListInstanceGroups` (paginated) for the cluster, returning the single
+	* group whose `Id` matches. Absorbs up to `maxConsecutiveTransient`
+	* consecutive transient errors (throttle / 5xx / reset) so a single blip
+	* during a 10-minute poll does not spuriously fail the create.
+	*/
+	async findGroupForPoll(clusterId, groupId, transientState, maxConsecutiveTransient = 5) {
+		try {
+			let marker;
+			do {
+				const resp = await this.getClient().send(new ListInstanceGroupsCommand({
+					ClusterId: clusterId,
+					...marker && { Marker: marker }
+				}));
+				const found = (resp.InstanceGroups ?? []).find((g) => g.Id === groupId);
+				if (found) {
+					transientState.count = 0;
+					return found;
+				}
+				marker = resp.Marker;
+			} while (marker);
+			transientState.count = 0;
+			return;
+		} catch (error) {
+			const name = error instanceof Error ? error.name : "";
+			const msg = error instanceof Error ? error.message : String(error);
+			if ((name === "ThrottlingException" || name === "InternalServerException" || name === "InternalServerError" || name === "TimeoutError" || /rate exceeded|too many requests|throttl|timed? ?out|ECONNRESET|EPIPE|socket hang up/i.test(msg)) && transientState.count < maxConsecutiveTransient) {
+				transientState.count += 1;
+				this.logger.debug(`Transient ListInstanceGroups error while polling ${groupId} (${transientState.count}/${maxConsecutiveTransient}): ${msg} — retrying`);
+				return;
+			}
+			throw error;
+		}
+	}
+};
+
+//#endregion
+//#region src/provisioning/providers/emr-instance-fleet-config-provider.ts
+/**
+* Default polling budget for an instance fleet reaching RUNNING. Adding a
+* fleet to an already-WAITING cluster provisions + bootstraps its EC2
+* instances (typically 2-6 minutes); a resize settles faster. Reuse the
+* EMR Cluster provider's 1-hour ceiling so the slowest realistic add still
+* fits inside the per-resource deadline.
+*/
+const DEFAULT_MAX_WAIT_MS = 3600 * 1e3;
+const DEFAULT_POLL_INTERVAL_MS = 15e3;
+/** Instance-fleet state that means "the fleet is up and idle/serving". */
+const READY_STATES = /* @__PURE__ */ new Set(["RUNNING"]);
+/**
+* Instance-fleet states that mean "the fleet is gone" — a hard error during a
+* create/resize wait (it will never reach RUNNING).
+*/
+const FAILED_STATES = /* @__PURE__ */ new Set(["TERMINATED"]);
+const toNumber = (v) => {
+	if (v === void 0) return void 0;
+	const n = Number(v);
+	return Number.isNaN(n) ? void 0 : n;
+};
+const jsonEqual = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+/**
+* SDK Provider for `AWS::EMR::InstanceFleetConfig` (issue #1070).
+*
+* This type adds a standalone instance fleet (MASTER / CORE / TASK) to an
+* EXISTING EMR cluster (referenced by `ClusterId`), rather than declaring the
+* fleet inline in `AWS::EMR::Cluster.Instances`. It is
+* `ProvisioningType: NON_PROVISIONABLE` in the CFn registry, so Cloud Control
+* cannot handle it — pre-flight would otherwise reject it via
+* `unsupported-types.generated.ts`.
+*
+* Lifecycle:
+*  - `create` → `AddInstanceFleet` + poll `ListInstanceFleets` until the new
+*    fleet is `RUNNING`. A `TERMINATED` terminal during the wait is a hard
+*    error.
+*  - `update` → only the AWS-mutable properties: `TargetOnDemandCapacity`,
+*    `TargetSpotCapacity`, `ResizeSpecifications`, and `InstanceTypeConfigs`
+*    (all via `ModifyInstanceFleet`; the resize is polled until settled).
+*    `Name` / `LaunchSpecifications` / `InstanceFleetType` are
+*    registry-createOnly → routed through DELETE+CREATE by the
+*    replacement-detection layer; a createOnly change that reaches `update()`
+*    anyway is refused with a `--replace` pointer.
+*  - `delete` → **no standalone AWS API exists.** EMR cannot remove an
+*    instance fleet from a running cluster; a fleet's only lifecycle end is
+*    cluster termination. In the normal `cdkd destroy` the parent
+*    `AWS::EMR::Cluster` is terminated in the same run (its `TerminateJobFlows`
+*    releases every fleet + its EC2 instances), so this delete is a no-op that
+*    just drops cdkd state — leaving ZERO orphans. As a best effort for the
+*    less common "delete only the fleet, keep the cluster" case, a TASK fleet
+*    is scaled to 0 target capacity (`ModifyInstanceFleet`) to release its
+*    instances; MASTER/CORE fleets cannot be scaled to 0 and are a pure no-op.
+*    Never blocks the destroy (warn-and-continue).
+*
+* `getMinResourceTimeoutMs()` lifts the deploy engine's per-resource deadline
+* to the polling ceiling (mirrors `EMRClusterProvider`) so a slow add/resize
+* does not require `--resource-timeout`.
+*/
+var EMRInstanceFleetConfigProvider = class {
+	/**
+	* Cloud Control has NO handlers for this type
+	* (`ProvisioningType: NON_PROVISIONABLE`), so the deploy engine's #614
+	* silent-drop auto-route MUST NOT send an unhandled-property template to CC
+	* — it would fail at provisioning time with an opaque
+	* UnsupportedActionException. With this opt-out the ProviderRegistry rejects
+	* such templates pre-flight with a clear error instead.
+	*/
+	disableCcApiFallback = true;
+	client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("EMRInstanceFleetConfigProvider");
+	pollIntervalMs;
+	maxWaitMs;
+	constructor(options) {
+		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS;
+	}
+	handledProperties = /* @__PURE__ */ new Map([["AWS::EMR::InstanceFleetConfig", /* @__PURE__ */ new Set([
+		"ClusterId",
+		"InstanceFleetType",
+		"InstanceTypeConfigs",
+		"LaunchSpecifications",
+		"Name",
+		"ResizeSpecifications",
+		"TargetOnDemandCapacity",
+		"TargetSpotCapacity"
+	])]]);
+	getClient() {
+		if (!this.client) this.client = new EMRClient(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.client;
+	}
+	getMinResourceTimeoutMs() {
+		return this.maxWaitMs + this.pollIntervalMs;
+	}
+	async create(logicalId, resourceType, properties) {
+		if (resourceType !== "AWS::EMR::InstanceFleetConfig") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
+		const clusterId = properties["ClusterId"];
+		if (!clusterId) throw new ProvisioningError(`EMR InstanceFleetConfig ${logicalId} is missing ClusterId (the parent cluster id)`, resourceType, logicalId);
+		this.logger.debug(`Adding EMR instance fleet ${logicalId} to cluster ${clusterId}`);
+		try {
+			const fleet = this.toInstanceFleetConfig(properties);
+			const fleetId = (await this.getClient().send(new AddInstanceFleetCommand({
+				ClusterId: clusterId,
+				InstanceFleet: fleet
+			}))).InstanceFleetId;
+			if (!fleetId) throw new ProvisioningError(`EMR AddInstanceFleet for ${logicalId} returned no instance fleet id`, resourceType, logicalId);
+			await this.waitForFleetReady(clusterId, fleetId, logicalId, resourceType, this.targetCapacity(properties), true);
+			this.logger.debug(`Successfully added EMR instance fleet ${logicalId}: ${fleetId}`);
+			return {
+				physicalId: fleetId,
+				attributes: { Id: fleetId }
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to add EMR instance fleet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	toInstanceFleetConfig(properties) {
+		return {
+			InstanceFleetType: properties["InstanceFleetType"],
+			Name: properties["Name"],
+			TargetOnDemandCapacity: toNumber(properties["TargetOnDemandCapacity"]),
+			TargetSpotCapacity: toNumber(properties["TargetSpotCapacity"]),
+			InstanceTypeConfigs: properties["InstanceTypeConfigs"],
+			LaunchSpecifications: properties["LaunchSpecifications"],
+			ResizeSpecifications: properties["ResizeSpecifications"]
+		};
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		const changed = (key) => !jsonEqual(properties[key], previousProperties[key]);
+		const MUTABLE = /* @__PURE__ */ new Set([
+			"TargetOnDemandCapacity",
+			"TargetSpotCapacity",
+			"ResizeSpecifications",
+			"InstanceTypeConfigs"
+		]);
+		for (const key of Object.keys({
+			...properties,
+			...previousProperties
+		})) {
+			if (!changed(key)) continue;
+			if (!MUTABLE.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EMR InstanceFleetConfig ${key} is immutable on AWS — it is fixed when the instance fleet is created. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+		}
+		if (![...MUTABLE].some((k) => changed(k))) {
+			this.logger.debug(`No mutable diff for EMR instance fleet ${logicalId}, skipping update`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		}
+		const clusterId = properties["ClusterId"];
+		if (!clusterId) throw new ProvisioningError(`EMR InstanceFleetConfig ${logicalId} update needs ClusterId (the cluster id), which is absent`, resourceType, logicalId, physicalId);
+		this.logger.debug(`Updating EMR instance fleet ${logicalId}: ${physicalId}`);
+		try {
+			const modify = {
+				InstanceFleetId: physicalId,
+				TargetOnDemandCapacity: toNumber(properties["TargetOnDemandCapacity"]),
+				TargetSpotCapacity: toNumber(properties["TargetSpotCapacity"]),
+				ResizeSpecifications: properties["ResizeSpecifications"],
+				InstanceTypeConfigs: properties["InstanceTypeConfigs"]
+			};
+			await this.getClient().send(new ModifyInstanceFleetCommand({
+				ClusterId: clusterId,
+				InstanceFleet: modify
+			}));
+			const newTarget = this.targetCapacity(properties);
+			const prevTarget = this.targetCapacity(previousProperties);
+			await this.waitForFleetReady(clusterId, physicalId, logicalId, resourceType, newTarget, newTarget >= prevTarget);
+			this.logger.debug(`Successfully updated EMR instance fleet ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: { Id: physicalId }
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError || error instanceof ResourceUpdateNotSupportedError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update EMR instance fleet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, properties, context) {
+		const fleetType = properties?.["InstanceFleetType"];
+		const clusterId = properties?.["ClusterId"];
+		if (fleetType === "TASK" && clusterId) {
+			try {
+				await this.getClient().send(new ModifyInstanceFleetCommand({
+					ClusterId: clusterId,
+					InstanceFleet: {
+						InstanceFleetId: physicalId,
+						TargetOnDemandCapacity: 0,
+						TargetSpotCapacity: 0
+					}
+				}));
+				this.logger.debug(`Scaled EMR TASK instance fleet ${physicalId} to 0 to release its instances (no standalone delete API exists)`);
+			} catch (error) {
+				if (error instanceof InvalidRequestException) {
+					assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					this.logger.debug(`EMR instance fleet ${physicalId} scale-to-0 skipped (cluster/fleet gone): ${error.message}`);
+				} else this.logger.warn(`Best-effort scale-to-0 of EMR instance fleet ${physicalId} failed: ${error instanceof Error ? error.message : String(error)} — its instances are released when the parent cluster terminates`);
+			}
+			return;
+		}
+		this.logger.debug(`EMR instance fleet ${physicalId} (type ${fleetType ?? "unknown"}) has no standalone delete API; its instances are released when the parent cluster terminates. Removing cdkd state only.`);
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "Id") return physicalId;
+	}
+	/** Total target capacity (On-Demand + Spot) requested for the fleet. */
+	targetCapacity(properties) {
+		return (toNumber(properties["TargetOnDemandCapacity"]) ?? 0) + (toNumber(properties["TargetSpotCapacity"]) ?? 0);
+	}
+	/**
+	* Poll until the fleet is `RUNNING` AND its provisioned capacity
+	* (On-Demand + Spot) has settled at `targetCapacity`. The capacity check is
+	* load-bearing on a resize: right after `ModifyInstanceFleet` the fleet is
+	* still in the PRE-resize `RUNNING` state, so a State-only wait would return
+	* before the resize even starts.
+	*
+	* `atLeast` selects the settle direction:
+	*  - `true` (create / scale-UP): ready when `provisioned >= targetCapacity`
+	*    (`>=`, not `==`, because a weighted-capacity allocation may overshoot).
+	*  - `false` (scale-DOWN): ready when `provisioned <= targetCapacity` — the
+	*    stale pre-resize provisioned capacity is ABOVE the new lower target, so
+	*    an `>=` check would return instantly before instances drain.
+	*
+	* A `targetCapacity` of 0 on the up path (never valid for a real create —
+	* at least one target must be > 0) degrades to a State-only wait.
+	*/
+	async waitForFleetReady(clusterId, fleetId, logicalId, resourceType, targetCapacity, atLeast) {
+		const startTime = Date.now();
+		const transientState = { count: 0 };
+		while (Date.now() - startTime < this.maxWaitMs) {
+			const fleet = await this.findFleetForPoll(clusterId, fleetId, transientState);
+			const state = fleet?.Status?.State;
+			const provisioned = (fleet?.ProvisionedOnDemandCapacity ?? 0) + (fleet?.ProvisionedSpotCapacity ?? 0);
+			const capacityReady = atLeast ? provisioned >= targetCapacity : provisioned <= targetCapacity;
+			if (state && READY_STATES.has(state) && capacityReady) return;
+			if (state && FAILED_STATES.has(state)) throw new ProvisioningError(`EMR instance fleet ${fleetId} entered failed state ${state}: ${fleet?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, fleetId);
+			this.logger.debug(`EMR instance fleet ${fleetId} state: ${state ?? "unknown"}, provisioned ${provisioned}/${targetCapacity}, waiting...`);
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+		throw new ProvisioningError(`Timed out waiting for EMR instance fleet ${fleetId} to reach RUNNING with capacity ${targetCapacity} (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, fleetId);
+	}
+	/**
+	* `ListInstanceFleets` (paginated) for the cluster, returning the single
+	* fleet whose `Id` matches. Absorbs up to `maxConsecutiveTransient`
+	* consecutive transient errors (throttle / 5xx / reset) so a single blip
+	* during a 10-minute poll does not spuriously fail the create.
+	*/
+	async findFleetForPoll(clusterId, fleetId, transientState, maxConsecutiveTransient = 5) {
+		try {
+			let marker;
+			do {
+				const resp = await this.getClient().send(new ListInstanceFleetsCommand({
+					ClusterId: clusterId,
+					...marker && { Marker: marker }
+				}));
+				const found = (resp.InstanceFleets ?? []).find((f) => f.Id === fleetId);
+				if (found) {
+					transientState.count = 0;
+					return found;
+				}
+				marker = resp.Marker;
+			} while (marker);
+			transientState.count = 0;
+			return;
+		} catch (error) {
+			const name = error instanceof Error ? error.name : "";
+			const msg = error instanceof Error ? error.message : String(error);
+			if ((name === "ThrottlingException" || name === "InternalServerException" || name === "InternalServerError" || name === "TimeoutError" || /rate exceeded|too many requests|throttl|timed? ?out|ECONNRESET|EPIPE|socket hang up/i.test(msg)) && transientState.count < maxConsecutiveTransient) {
+				transientState.count += 1;
+				this.logger.debug(`Transient ListInstanceFleets error while polling ${fleetId} (${transientState.count}/${maxConsecutiveTransient}): ${msg} — retrying`);
+				return;
+			}
+			throw error;
+		}
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/firehose-provider.ts
 /**
@@ -35818,7 +36725,7 @@ var EMRClusterProvider = class {
 * Membership grows as each follow-up PR lands. Keep alphabetical
 * to minimize merge conflicts when multiple follow-ups race.
 */
-const SUPPORTED_UPDATE_DESTINATIONS = new Set([
+const SUPPORTED_UPDATE_DESTINATIONS = /* @__PURE__ */ new Set([
 	"AmazonOpenSearchServerlessDestinationConfiguration",
 	"AmazonopensearchserviceDestinationConfiguration",
 	"ElasticsearchDestinationConfiguration",
@@ -35842,7 +36749,7 @@ var FirehoseProvider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("FirehoseProvider");
-	handledProperties = new Map([["AWS::KinesisFirehose::DeliveryStream", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::KinesisFirehose::DeliveryStream", /* @__PURE__ */ new Set([
 		"DeliveryStreamName",
 		"DeliveryStreamType",
 		"S3DestinationConfiguration",
@@ -37088,7 +37995,7 @@ var CloudTrailProvider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("CloudTrailProvider");
-	handledProperties = new Map([["AWS::CloudTrail::Trail", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudTrail::Trail", /* @__PURE__ */ new Set([
 		"S3BucketName",
 		"TrailName",
 		"S3KeyPrefix",
@@ -37431,7 +38338,7 @@ var CodeBuildProvider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("CodeBuildProvider");
-	handledProperties = new Map([["AWS::CodeBuild::Project", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::CodeBuild::Project", /* @__PURE__ */ new Set([
 		"Name",
 		"Source",
 		"Environment",
@@ -37963,7 +38870,7 @@ var CodeCommitRepositoryProvider = class {
 	s3Client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("CodeCommitRepositoryProvider");
-	handledProperties = new Map([["AWS::CodeCommit::Repository", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::CodeCommit::Repository", /* @__PURE__ */ new Set([
 		"RepositoryName",
 		"RepositoryDescription",
 		"KmsKeyId",
@@ -38415,7 +39322,7 @@ var DLMLifecyclePolicyProvider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("DLMLifecyclePolicyProvider");
-	handledProperties = new Map([["AWS::DLM::LifecyclePolicy", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::DLM::LifecyclePolicy", /* @__PURE__ */ new Set([
 		"Description",
 		"ExecutionRoleArn",
 		"State",
@@ -38665,7 +39572,7 @@ var S3VectorsProvider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("S3VectorsProvider");
-	handledProperties = new Map([["AWS::S3Vectors::VectorBucket", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::S3Vectors::VectorBucket", /* @__PURE__ */ new Set([
 		"VectorBucketName",
 		"EncryptionConfiguration",
 		"Tags"
@@ -38926,7 +39833,7 @@ var S3DirectoryBucketProvider = class {
 	s3Client;
 	stsClient;
 	logger = getLogger().child("S3DirectoryBucketProvider");
-	handledProperties = new Map([["AWS::S3Express::DirectoryBucket", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::S3Express::DirectoryBucket", /* @__PURE__ */ new Set([
 		"DataRedundancy",
 		"LocationName",
 		"BucketName"
@@ -39173,10 +40080,10 @@ var S3TablesProvider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("S3TablesProvider");
-	handledProperties = new Map([
-		["AWS::S3Tables::TableBucket", new Set(["TableBucketName", "Tags"])],
-		["AWS::S3Tables::Namespace", new Set(["TableBucketARN", "Namespace"])],
-		["AWS::S3Tables::Table", new Set([
+	handledProperties = /* @__PURE__ */ new Map([
+		["AWS::S3Tables::TableBucket", /* @__PURE__ */ new Set(["TableBucketName", "Tags"])],
+		["AWS::S3Tables::Namespace", /* @__PURE__ */ new Set(["TableBucketARN", "Namespace"])],
+		["AWS::S3Tables::Table", /* @__PURE__ */ new Set([
 			"TableBucketARN",
 			"Namespace",
 			"TableName",
@@ -39793,7 +40700,7 @@ var ECRProvider = class {
 	client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("ECRProvider");
-	handledProperties = new Map([["AWS::ECR::Repository", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::ECR::Repository", /* @__PURE__ */ new Set([
 		"RepositoryName",
 		"ImageScanningConfiguration",
 		"ImageTagMutability",
@@ -40140,8 +41047,8 @@ const PROTECTION_PROPERTY_BY_TYPE = {
 * (boolean `true`).
 */
 const PROTECTION_ACTIVE_VALUES_BY_TYPE = {
-	"AWS::Cognito::UserPool": new Set(["ACTIVE"]),
-	"AWS::AutoScaling::AutoScalingGroup": new Set(["prevent-force-deletion", "prevent-all-deletion"])
+	"AWS::Cognito::UserPool": /* @__PURE__ */ new Set(["ACTIVE"]),
+	"AWS::AutoScaling::AutoScalingGroup": /* @__PURE__ */ new Set(["prevent-force-deletion", "prevent-all-deletion"])
 };
 /**
 * Count how many resources in a stack's recorded state appear to have
@@ -40675,7 +41582,7 @@ var NestedStackProvider = class {
 	* parameter map forwarded as `DeployEngineOptions.parameters` to the
 	* child engine.
 	*/
-	handledProperties = new Map([["AWS::CloudFormation::Stack", new Set(["TemplateURL", "Parameters"])]]);
+	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudFormation::Stack", /* @__PURE__ */ new Set(["TemplateURL", "Parameters"])]]);
 	/**
 	* Every other property on `AWS::CloudFormation::Stack` is intentionally
 	* not threaded through — cdkd does not go through CloudFormation, so
@@ -40687,7 +41594,7 @@ var NestedStackProvider = class {
 	* `<parent>~<logicalId>` key per design §3, and `TemplateBody` is
 	* superseded by the local `Metadata['aws:asset:path']` lookup.
 	*/
-	unhandledByDesign = new Map([["AWS::CloudFormation::Stack", new Map([
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::CloudFormation::Stack", /* @__PURE__ */ new Map([
 		["TemplateBody", "CFn-only inline template — cdkd reads the child template from the synth output via Metadata['aws:asset:path'] instead of accepting it inline"],
 		["Capabilities", "CFn-only IAM capability declaration — cdkd does not go through CloudFormation so capabilities have no equivalent"],
 		["Description", "CFn-only informational — no semantic effect on the recursive deploy"],
@@ -40880,7 +41787,7 @@ var NestedStackProvider = class {
 */
 var WaitConditionHandleProvider = class {
 	logger = getLogger().child("WaitConditionHandleProvider");
-	handledProperties = new Map([["AWS::CloudFormation::WaitConditionHandle", /* @__PURE__ */ new Set([])]]);
+	handledProperties = /* @__PURE__ */ new Map([["AWS::CloudFormation::WaitConditionHandle", /* @__PURE__ */ new Set([])]]);
 	/**
 	* "Create" the handle: synthesize a unique placeholder physical id.
 	* `Ref` on the handle resolves to this id. It is deliberately NOT
@@ -40976,7 +41883,7 @@ var ACMCertificateProvider = class {
 	constructor() {
 		this.acmClient = getAwsClients().acm;
 	}
-	handledProperties = new Map([["AWS::CertificateManager::Certificate", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::CertificateManager::Certificate", /* @__PURE__ */ new Set([
 		"DomainName",
 		"ValidationMethod",
 		"SubjectAlternativeNames",
@@ -41419,6 +42326,8 @@ function registerAllProviders(registry) {
 	registry.register("AWS::EFS::AccessPoint", efsProvider);
 	registry.register("AWS::FSx::FileSystem", new FSxFileSystemProvider());
 	registry.register("AWS::EMR::Cluster", new EMRClusterProvider());
+	registry.register("AWS::EMR::InstanceGroupConfig", new EMRInstanceGroupConfigProvider());
+	registry.register("AWS::EMR::InstanceFleetConfig", new EMRInstanceFleetConfigProvider());
 	registry.register("AWS::KinesisFirehose::DeliveryStream", new FirehoseProvider());
 	registry.register("AWS::CloudTrail::Trail", new CloudTrailProvider());
 	registry.register("AWS::CodeBuild::Project", new CodeBuildProvider());
@@ -41954,7 +42863,7 @@ function createDeployCommand() {
 * `cdkd import --migrate-from-cloudformation` retirement flow
 * (`src/cli/commands/retire-cfn-stack.ts`).
 */
-const STABLE_TERMINAL_STATUSES = new Set([
+const STABLE_TERMINAL_STATUSES = /* @__PURE__ */ new Set([
 	"CREATE_COMPLETE",
 	"UPDATE_COMPLETE",
 	"UPDATE_ROLLBACK_COMPLETE",
@@ -43084,7 +43993,7 @@ function diffTreeToJson(node) {
 		children: node.children.map(diffTreeToJson)
 	};
 }
-const INTRINSIC_KEYS = new Set([
+const INTRINSIC_KEYS = /* @__PURE__ */ new Set([
 	"Ref",
 	"Fn::Sub",
 	"Fn::GetAtt",
@@ -43494,7 +44403,7 @@ function isIgnoredPath(path, ignorePaths) {
 function diffAt(path, stateValue, awsValue, out, ignorePaths, unionWalkObjects) {
 	if (deepEqual(stateValue, awsValue)) return;
 	if (isPlainObject(stateValue) && isPlainObject(awsValue) && !Array.isArray(stateValue) && !Array.isArray(awsValue)) {
-		const keys = unionWalkObjects ? new Set([...Object.keys(stateValue), ...Object.keys(awsValue)]) : Object.keys(stateValue);
+		const keys = unionWalkObjects ? /* @__PURE__ */ new Set([...Object.keys(stateValue), ...Object.keys(awsValue)]) : Object.keys(stateValue);
 		for (const key of keys) {
 			const childPath = `${path}.${key}`;
 			if (isIgnoredPath(childPath, ignorePaths)) continue;
@@ -43624,7 +44533,7 @@ const CC_API_FALLBACK_DENY_LIST = {
 * managed field — the deny-list catches per-type structural divergence;
 * this helper catches generic noise.
 */
-const ALWAYS_STRIPPED_FIELDS = new Set([
+const ALWAYS_STRIPPED_FIELDS = /* @__PURE__ */ new Set([
 	"CreationDate",
 	"CreationTime",
 	"CreatedTime",
@@ -46736,7 +47645,7 @@ function stackTreeToJson(roots) {
 * support for import are surfaced as errors by the CreateChangeSet call
 * itself; we do not try to maintain a closed allowlist here.
 */
-const NEVER_IMPORTABLE_TYPES = new Set(["AWS::CDK::Metadata"]);
+const NEVER_IMPORTABLE_TYPES = /* @__PURE__ */ new Set(["AWS::CDK::Metadata"]);
 /**
 * Per-non-root-child lock-acquisition retry budget for the nested-stack
 * export loop (`runPerStackImportLoop`). `acquireLockWithRetry` retries
@@ -46887,7 +47796,7 @@ function readStringProperty(properties, key, resourceType) {
 * (no `read` / `list` — inline policy attachments have no first-class
 * AWS resource id). See the per-entry comment for each addition.
 */
-const IMPORT_UNSUPPORTED_RECREATABLE_TYPES = new Set(["AWS::ApiGatewayV2::Stage", "AWS::IAM::Policy"]);
+const IMPORT_UNSUPPORTED_RECREATABLE_TYPES = /* @__PURE__ */ new Set(["AWS::ApiGatewayV2::Stage", "AWS::IAM::Policy"]);
 const PRE_DELETE_HANDLERS = {
 	"AWS::ApiGatewayV2::Stage": async (entry) => {
 		const { ApiGatewayV2Client, DeleteStageCommand, NotFoundException } = await import("@aws-sdk/client-apigatewayv2");
@@ -53054,7 +53963,7 @@ async function runDetached(opts) {
 		const ro = mount.readOnly ? ":ro" : "";
 		args.push("-v", `${mount.hostPath}:${mount.containerPath}${ro}`);
 	}
-	const sensitiveKeys = opts.sensitiveEnvKeys && opts.sensitiveEnvKeys.size > 0 ? new Set([...SENSITIVE_ENV_KEYS, ...opts.sensitiveEnvKeys]) : SENSITIVE_ENV_KEYS;
+	const sensitiveKeys = opts.sensitiveEnvKeys && opts.sensitiveEnvKeys.size > 0 ? /* @__PURE__ */ new Set([...SENSITIVE_ENV_KEYS, ...opts.sensitiveEnvKeys]) : SENSITIVE_ENV_KEYS;
 	const passthroughEnv = {};
 	for (const [k, v] of Object.entries(opts.env)) if (sensitiveKeys.has(k)) {
 		args.push("-e", k);
@@ -53178,7 +54087,7 @@ function pickFreePort() {
 * into stdout / log files. Only the matching `-e <KEY>=<value>` pair is
 * redacted; non-credential `-e KEY=val` entries pass through unchanged.
 */
-const REDACTED_ENV_KEYS = new Set([
+const REDACTED_ENV_KEYS = /* @__PURE__ */ new Set([
 	"AWS_ACCESS_KEY_ID",
 	"AWS_SECRET_ACCESS_KEY",
 	"AWS_SESSION_TOKEN"
@@ -53194,7 +54103,7 @@ const REDACTED_ENV_KEYS = new Set([
 * AgentCore local-invoke path to keep decrypted `--from-cfn-stack`
 * SecureString SSM values off the argv).
 */
-const SENSITIVE_ENV_KEYS = new Set([
+const SENSITIVE_ENV_KEYS = /* @__PURE__ */ new Set([
 	"AWS_ACCESS_KEY_ID",
 	"AWS_SECRET_ACCESS_KEY",
 	"AWS_SESSION_TOKEN"
@@ -56838,7 +57747,7 @@ function buildDockerRunArgs(opts) {
 	args.push("--network", network);
 	args.push("--network-alias", container.name);
 	if (opts.networkAliases && opts.networkAliases.length > 0) {
-		const seen = new Set([container.name]);
+		const seen = /* @__PURE__ */ new Set([container.name]);
 		for (const a of opts.networkAliases) if (!seen.has(a)) {
 			args.push("--network-alias", a);
 			seen.add(a);
@@ -59661,7 +60570,7 @@ function compareSemver(a, b) {
 *  - `Custom::*` — any user-defined Custom Resource type prefix.
 *    Same rationale as `AWS::CloudFormation::CustomResource`.
 */
-const HARD_REJECT_RESOURCE_TYPES = new Set(["AWS::CloudFormation::CustomResource", "AWS::CloudFormation::Stack"]);
+const HARD_REJECT_RESOURCE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", "AWS::CloudFormation::Stack"]);
 /**
 * Fetch the source CFn stack's current state + resources + transform
 * info. Issues 3 read-only AWS API calls (`DescribeStacks`,
@@ -59862,7 +60771,8 @@ async function spawnCdkMigrate(opts) {
 				]
 			});
 		} catch (err) {
-			rejectPromise(new LocalMigrateError(`Failed to spawn '${cdkBin} migrate': ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0));
+			const detail = err instanceof Error ? err.message : String(err);
+			rejectPromise(new LocalMigrateError(`Failed to spawn '${cdkBin} migrate': ${detail}`, err instanceof Error ? err : void 0));
 			return;
 		}
 		child.stdout?.on("data", (chunk) => {
@@ -59889,7 +60799,8 @@ async function spawnCdkMigrate(opts) {
 				});
 				return;
 			}
-			rejectPromise(new LocalMigrateError(`'${cdkBin} migrate' ${signal !== null ? `killed by signal ${signal}` : code !== null ? `exited with code ${code}` : "process closed without a code or signal"}.\n--- stdout ---\n${stdout || "(empty)"}\n--- stderr ---\n${stderr || "(empty)"}\n`));
+			const exitDetail = signal !== null ? `killed by signal ${signal}` : code !== null ? `exited with code ${code}` : "process closed without a code or signal";
+			rejectPromise(new LocalMigrateError(`'${cdkBin} migrate' ${exitDetail}.\n--- stdout ---\n${stdout || "(empty)"}\n--- stderr ---\n${stderr || "(empty)"}\n`));
 		});
 	});
 }
@@ -60655,7 +61566,7 @@ function installPipeCloseHandler(streams = [process.stdout, process.stderr], exi
 
 //#endregion
 //#region src/cli/index.ts
-const SUBCOMMANDS = new Set([
+const SUBCOMMANDS = /* @__PURE__ */ new Set([
 	"bootstrap",
 	"synth",
 	"list",
@@ -60697,7 +61608,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.248.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.250.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());