@go-to-k/cdkd 0.248.0 → 0.250.0

package/dist/{deploy-engine-D6U-Cm8B.js → deploy-engine-D-gBbMiZ.js}

@@ -1,22 +1,24 @@
-import { a as getLiveRenderer, d as generateResourceNameWithFallback, l as applyDefaultNameForFallback, n as getLogger, p as withStackName, u as generateResourceName } from "./logger-BzO-joNR.js";
-import { E as SynthesisError, S as ResourceUpdateNotSupportedError, T as StateError, a as normalizeAwsTagsToCfn, b as ProvisioningError, c as AssetError, d as DependencyError, g as MacroExpansionError, h as LockError, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, s as assertRegionMatch, t as disableInstanceApiTermination, x as ResourceTimeoutError } from "./ec2-termination-protection-q-WGWgxa.js";
-import { r as getAwsClients } from "./aws-clients-B15NAPbL.js";
-import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
+import { a as getLiveRenderer, d as generateResourceNameWithFallback, l as applyDefaultNameForFallback, n as getLogger, p as withStackName, u as generateResourceName } from "./logger-BYMEE-BS.js";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
 import { AttachRolePolicyCommand, CreateRoleCommand, DeleteRoleCommand, DeleteRolePermissionsBoundaryCommand, DeleteRolePolicyCommand, DetachRolePolicyCommand, GetRoleCommand, GetRolePolicyCommand, IAMClient, ListAttachedRolePoliciesCommand, ListInstanceProfilesForRoleCommand, ListRolePoliciesCommand, ListRoleTagsCommand, ListRolesCommand, NoSuchEntityException, PutRolePermissionsBoundaryCommand, PutRolePolicyCommand, RemoveRoleFromInstanceProfileCommand, TagRoleCommand, UntagRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand } from "@aws-sdk/client-iam";
+import { SQSClient } from "@aws-sdk/client-sqs";
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
 import { GetFunctionCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client } from "@aws-sdk/client-ec2";
-import { DescribeTableCommand } from "@aws-sdk/client-dynamodb";
+import { DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
+import { DescribeTableCommand, DynamoDBClient } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeTypeCommand, GetTemplateCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
-import { GetRestApiCommand } from "@aws-sdk/client-api-gateway";
-import { DescribeApiDestinationCommand, DescribeConnectionCommand } from "@aws-sdk/client-eventbridge";
-import { GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
+import { APIGatewayClient, GetRestApiCommand } from "@aws-sdk/client-api-gateway";
+import { DescribeApiDestinationCommand, DescribeConnectionCommand, EventBridgeClient } from "@aws-sdk/client-eventbridge";
+import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
 import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
-import { GetCloudFrontOriginAccessIdentityCommand } from "@aws-sdk/client-cloudfront";
+import { CloudFrontClient, GetCloudFrontOriginAccessIdentityCommand } from "@aws-sdk/client-cloudfront";
+import { CloudWatchClient } from "@aws-sdk/client-cloudwatch";
+import { CloudWatchLogsClient } from "@aws-sdk/client-cloudwatch-logs";
+import { BedrockAgentCoreControlClient } from "@aws-sdk/client-bedrock-agentcore-control";
+import { ACMClient } from "@aws-sdk/client-acm";
 import { createReadStream, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, isAbsolute, join, resolve } from "node:path";
 import { spawn } from "node:child_process";
@@ -33,9 +35,962 @@ import { DescribeDBClustersCommand, DescribeDBInstancesCommand, RDSClient } from
 import { DescribeReplicationGroupsCommand, ElastiCacheClient } from "@aws-sdk/client-elasticache";
 import { DescribeClustersCommand, RedshiftClient } from "@aws-sdk/client-redshift";
 import { DescribeDomainCommand, OpenSearchClient } from "@aws-sdk/client-opensearch";
-import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, ListWebACLsCommand, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
+import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, ListWebACLsCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) {
+		__defProp(target, name, {
+			get: all[name],
+			enumerable: true
+		});
+	}
+	if (!no_symbols) {
+		__defProp(target, Symbol.toStringTag, { value: "Module" });
+	}
+	return target;
+};
+
+//#endregion
+//#region src/utils/error-handler.ts
+/**
+* Base error class for cdkd
+*/
+var CdkdError = class CdkdError extends Error {
+	code;
+	cause;
+	constructor(message, code, cause) {
+		super(message);
+		this.code = code;
+		this.cause = cause;
+		this.name = "CdkdError";
+		Object.setPrototypeOf(this, CdkdError.prototype);
+	}
+};
+/**
+* State management errors
+*/
+var StateError = class StateError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "STATE_ERROR", cause);
+		this.name = "StateError";
+		Object.setPrototypeOf(this, StateError.prototype);
+	}
+};
+/**
+* Lock acquisition errors
+*/
+var LockError = class LockError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "LOCK_ERROR", cause);
+		this.name = "LockError";
+		Object.setPrototypeOf(this, LockError.prototype);
+	}
+};
+/**
+* Synthesis errors
+*/
+var SynthesisError = class SynthesisError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "SYNTHESIS_ERROR", cause);
+		this.name = "SynthesisError";
+		Object.setPrototypeOf(this, SynthesisError.prototype);
+	}
+};
+/**
+* Asset errors
+*/
+var AssetError = class AssetError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "ASSET_ERROR", cause);
+		this.name = "AssetError";
+		Object.setPrototypeOf(this, AssetError.prototype);
+	}
+};
+/**
+* Local-invoke `docker build` failures.
+*
+* Surfaces the stderr captured from `docker build` so the user can
+* re-run the same command directly to debug Dockerfile syntax errors
+* or missing build context. Used by `src/local/docker-image-builder.ts`
+* (PR 5) for container Lambdas; the parallel `AssetError` covers the
+* `cdkd publish-assets` / `cdkd deploy` build path. Kept distinct from
+* `AssetError` so `cdkd local invoke` failures don't show up under the
+* "asset" error class.
+*/
+var LocalInvokeBuildError = class LocalInvokeBuildError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "LOCAL_INVOKE_BUILD_ERROR", cause);
+		this.name = "LocalInvokeBuildError";
+		Object.setPrototypeOf(this, LocalInvokeBuildError.prototype);
+	}
+};
+/**
+* Resource provisioning errors
+*/
+var ProvisioningError = class ProvisioningError extends CdkdError {
+	resourceType;
+	logicalId;
+	physicalId;
+	constructor(message, resourceType, logicalId, physicalId, cause) {
+		super(message, "PROVISIONING_ERROR", cause);
+		this.resourceType = resourceType;
+		this.logicalId = logicalId;
+		this.physicalId = physicalId;
+		this.name = "ProvisioningError";
+		Object.setPrototypeOf(this, ProvisioningError.prototype);
+	}
+};
+/**
+* Resource provisioning timeout errors (per-resource wall-clock deadline).
+*
+* Thrown by `withResourceDeadline` when a single CREATE / UPDATE / DELETE
+* operation exceeds the user-configured `--resource-timeout`. The deploy
+* engine catches this, wraps it in {@link ProvisioningError}, and lets the
+* existing failure path (interrupt siblings → pre-rollback save → rollback
+* unless `--no-rollback`) take over.
+*
+* The message intentionally names the resource, type, region, elapsed time
+* and operation, plus how to override the default. Long-running providers
+* (e.g. Custom Resource: 1h polling cap) self-report their needed budget
+* via `getMinResourceTimeoutMs()`, so the user only needs a per-type
+* override (`--resource-timeout TYPE=DURATION`) when they want to bump a
+* specific non-self-reporting type or shorten a self-reported one.
+*/
+var ResourceTimeoutError = class ResourceTimeoutError extends CdkdError {
+	logicalId;
+	resourceType;
+	region;
+	elapsedMs;
+	operation;
+	timeoutMs;
+	constructor(logicalId, resourceType, region, elapsedMs, operation, timeoutMs) {
+		const elapsedLabel = formatDuration(elapsedMs);
+		const timeoutLabel = formatDuration(timeoutMs);
+		super(`Resource ${logicalId} (${resourceType}) in ${region} timed out after ${timeoutLabel} during ${operation} (elapsed ${elapsedLabel}).\nThis may indicate a stuck Cloud Control polling loop, hung Custom Resource, or
+slow ENI provisioning. Re-run with --resource-timeout ${resourceType}=<DURATION>\nto bump the budget for this resource type only, or --verbose to see the
+underlying provider activity.`, "RESOURCE_TIMEOUT");
+		this.logicalId = logicalId;
+		this.resourceType = resourceType;
+		this.region = region;
+		this.elapsedMs = elapsedMs;
+		this.operation = operation;
+		this.timeoutMs = timeoutMs;
+		this.name = "ResourceTimeoutError";
+		Object.setPrototypeOf(this, ResourceTimeoutError.prototype);
+	}
+};
+/**
+* Format a duration in milliseconds as a short human-readable label
+* (`30m`, `1h30m`, `45s`). Used by {@link ResourceTimeoutError} so the
+* error message stays compact.
+*/
+function formatDuration(ms) {
+	if (ms < 6e4) return `${Math.round(ms / 1e3)}s`;
+	const totalMinutes = Math.round(ms / 6e4);
+	if (totalMinutes < 60) return `${totalMinutes}m`;
+	const hours = Math.floor(totalMinutes / 60);
+	const minutes = totalMinutes % 60;
+	return minutes === 0 ? `${hours}h` : `${hours}h${minutes}m`;
+}
+/**
+* Dependency resolution errors
+*/
+var DependencyError = class DependencyError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "DEPENDENCY_ERROR", cause);
+		this.name = "DependencyError";
+		Object.setPrototypeOf(this, DependencyError.prototype);
+	}
+};
+/**
+* Configuration errors
+*/
+var ConfigError = class ConfigError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "CONFIG_ERROR", cause);
+		this.name = "ConfigError";
+		Object.setPrototypeOf(this, ConfigError.prototype);
+	}
+};
+/**
+* Signals a partial-failure outcome that should map to exit code 2 (not 1).
+*
+* Used by `cdkd destroy` and `cdkd state destroy` when one or more
+* per-resource deletes failed but the overall command finished its work
+* (state.json is preserved, the rest of the stack was deleted, and the
+* user can re-run to clean up the remaining resources).
+*
+* Exit code conventions:
+*   - 0: command completed successfully, no resources left in error state.
+*   - 1: command-level failure (auth error, bad arguments, synth crash,
+*        unhandled exception). Default for any thrown error.
+*   - 2: partial failure — work completed but some resources are still in
+*        an error state. Re-running typically resolves it. Documented in
+*        README's "Exit codes" section.
+*
+* `handleError` recognizes this class via `instanceof` and uses its
+* `exitCode` instead of the default 1.
+*/
+var PartialFailureError = class PartialFailureError extends CdkdError {
+	exitCode = 2;
+	constructor(message, cause) {
+		super(message, "PARTIAL_FAILURE", cause);
+		this.name = "PartialFailureError";
+		Object.setPrototypeOf(this, PartialFailureError.prototype);
+	}
+};
+/**
+* Signals that a provider cannot perform an in-place `update` for a
+* resource type — most commonly because the AWS resource is structurally
+* immutable (`AWS::Lambda::LayerVersion`, `AWS::S3Tables::TableBucket` once
+* created, certain `AWS::EC2::*` sub-resources) or because the provider
+* surfaces a sub-resource attachment whose only mutation pattern is
+* delete + add (Lambda permission statements, IAM policy attachments).
+*
+* Surfaced through `cdkd drift --revert`, which calls
+* `provider.update(logicalId, physicalId, type, stateProps, awsProps)` to
+* push cdkd state values back into AWS for every drifted resource. When a
+* provider throws this error, the drift command collects it as a
+* per-resource outcome distinct from a generic AWS update failure: the
+* fix is to re-deploy with `--replace` (or recreate the resource), not to
+* retry the update.
+*
+* Carries the same `exitCode = 2` as {@link PartialFailureError} so a
+* drift run that hits one immutable resource is reported as partial-
+* success rather than fatal — the rest of the drifted resources still
+* had their `update` invoked, and the user has a clear next step printed
+* for the unsupported one.
+*/
+var ResourceUpdateNotSupportedError = class ResourceUpdateNotSupportedError extends CdkdError {
+	exitCode = 2;
+	resourceType;
+	logicalId;
+	/**
+	* Human-readable hint printed alongside the error. The default is
+	* "use cdkd deploy with --replace, or change the resource definition
+	* to create a new version" — providers are encouraged to override
+	* with a more specific suggestion when one is available (e.g.
+	* Lambda::Permission's "delete + add a new statement").
+	*/
+	suggestion;
+	constructor(resourceType, logicalId, suggestion, cause) {
+		super(`${resourceType} (${logicalId}) cannot be updated in place: ${suggestion ? suggestion : "use cdkd deploy with --replace, or change the resource definition to create a new version"}.`, "RESOURCE_UPDATE_NOT_SUPPORTED", cause);
+		this.resourceType = resourceType;
+		this.logicalId = logicalId;
+		this.suggestion = suggestion;
+		this.name = "ResourceUpdateNotSupportedError";
+		Object.setPrototypeOf(this, ResourceUpdateNotSupportedError.prototype);
+	}
+};
+/**
+* Signals a refusal to destroy a stack whose CDK manifest has
+* `terminationProtection: true`.
+*
+* Surfaced from `cdkd destroy <stack>` / `cdkd destroy --all` BEFORE
+* any lock acquisition or per-resource delete. In multi-stack runs
+* (e.g. `--all`) this counts as a per-stack failure and the rest of
+* the targets continue — the aggregated count is wrapped in
+* {@link PartialFailureError} so the command exits with code 2.
+*
+* The bypass workflow is documented in the message: edit the CDK code
+* (`new Stack(app, '...', { terminationProtection: false })`),
+* redeploy, then retry the destroy. A future `--remove-protection`
+* flag (separate scope) will provide an explicit one-shot bypass.
+*
+* Note: `cdkd state destroy` (state-only, no synth) does NOT honor
+* `terminationProtection` — the flag is a CDK property not persisted
+* in cdkd's state.json. Use `cdkd destroy` when synth is available.
+*/
+var StackTerminationProtectionError = class StackTerminationProtectionError extends CdkdError {
+	stackName;
+	constructor(stackName, cause) {
+		super(`Stack '${stackName}' has terminationProtection: true and cannot be destroyed. Set terminationProtection: false in the CDK code, redeploy, then retry 'cdkd destroy ${stackName}'.`, "STACK_TERMINATION_PROTECTION", cause);
+		this.stackName = stackName;
+		this.name = "StackTerminationProtectionError";
+		Object.setPrototypeOf(this, StackTerminationProtectionError.prototype);
+	}
+};
+/**
+* `cdkd destroy <child>` refused because the named stack is a nested
+* child of another stack. Mirrors CloudFormation's `you can't directly
+* destroy a nested stack` semantic — destroying the child without
+* touching the parent would leave the parent's `AWS::CloudFormation::Stack`
+* record pointing at non-existent resources, and the parent's next
+* deploy would silently try to re-create them.
+*
+* Detected by reading the loaded state's v6 `parentStack` field — only
+* state files written by `NestedStackProvider.create` (or by the
+* recursive `cdkd import --migrate-from-cloudformation` walk) carry
+* this field; top-level stacks have `parentStack: undefined` and pass
+* the guard unchanged.
+*
+* Fires from `cdkd destroy` AFTER state load but BEFORE lock
+* acquisition or any per-resource delete, so the refusal is cheap.
+* Surfaced as a per-stack failure (wrapped in {@link PartialFailureError},
+* exit code 2) in multi-stack runs — siblings continue.
+*
+* Bypass paths (both intentional escape hatches):
+*
+*  1. `cdkd destroy <parent>` — the normal cascading-destroy path; the
+*     parent's reverse-DAG walks into the child via
+*     `NestedStackProvider.delete` and removes both layers atomically.
+*  2. `cdkd state destroy <child>` — state-only destroy with no parent
+*     coupling check. The state-driven entry point intentionally
+*     bypasses this guard for the same reason `cdkd state destroy`
+*     bypasses `terminationProtection`: it's the "I know what I'm
+*     doing" path for cleaning up state when synth is unavailable or
+*     the user accepts leaving the parent's reference dangling.
+*/
+var NestedStackChildDirectDestroyError = class NestedStackChildDirectDestroyError extends CdkdError {
+	stackName;
+	parentStack;
+	parentLogicalId;
+	constructor(stackName, parentStack, parentLogicalId, cause) {
+		const logicalIdSuffix = parentLogicalId ? ` (parent's logical id: ${parentLogicalId})` : "";
+		super(`Stack '${stackName}' is a nested child of '${parentStack}'${logicalIdSuffix}; directly destroying a nested stack is not supported. Either run 'cdkd destroy ${parentStack}' to cascade-delete this child along with its parent, or run 'cdkd state destroy ${stackName}' if you intentionally want to leave the parent's reference dangling (the state-only escape hatch).`, "NESTED_STACK_CHILD_DIRECT_DESTROY", cause);
+		this.stackName = stackName;
+		this.parentStack = parentStack;
+		if (parentLogicalId !== void 0) this.parentLogicalId = parentLogicalId;
+		this.name = "NestedStackChildDirectDestroyError";
+		Object.setPrototypeOf(this, NestedStackChildDirectDestroyError.prototype);
+	}
+};
+/**
+* `cdkd destroy <producer>` refused because at least one consumer stack
+* still records an `Fn::ImportValue` reference to one of the producer's
+* outputs. This matches CloudFormation's strong-reference semantics —
+* CFn rejects `DeleteStack` for an exporter while an importer exists.
+*
+* cdkd has no `--force` escape hatch for this (intentionally, mirroring
+* CFn). The error message lists every offending consumer and points the
+* user at the two valid resolution paths:
+*
+*  1. Destroy the consumer first: `cdkd destroy <consumer>`
+*  2. Remove the `Fn::ImportValue` from the consumer's template and
+*     redeploy, then retry the producer destroy.
+*
+* Weak-reference consumers (`Fn::GetStackOutput`, cdkd-specific) never
+* trigger this error by design — the producer stays deletable
+* independently of consumers when the user intentionally chose a weak
+* reference at template-authoring time.
+*
+* Exit code 2 (same as `PartialFailureError`) so multi-stack `cdkd
+* destroy --all` runs that partially succeed still surface as
+* non-zero without being indistinguishable from a fatal cdkd error.
+*/
+var StackHasActiveImportsError = class StackHasActiveImportsError extends CdkdError {
+	exitCode = 2;
+	producerStack;
+	producerRegion;
+	consumers;
+	constructor(producerStack, producerRegion, consumers, cause) {
+		const lines = consumers.map((c) => `  - ${c.consumerStack} (${c.consumerRegion}): imports export '${c.exportName}'`);
+		super(`Cannot destroy stack '${producerStack}' (${producerRegion}): the following stacks still import its outputs via Fn::ImportValue:\n${lines.join("\n")}\n\nThis matches CloudFormation's strong-reference semantics — exports are\nprotected as long as a consumer references them.\n\nTo proceed:\n  1. Destroy the consumer first: cdkd destroy <consumer-stack>\n  2. Or remove the Fn::ImportValue from the consumer's template\n     (e.g. inline the value, or refactor) and re-deploy the consumer,\n     then retry this destroy.\n\nNote: cdkd's Fn::GetStackOutput intrinsic is a weak alternative that\ndoes NOT protect the producer — use it when you intentionally want\nthe producer to be deletable independently of consumers.`, "STACK_HAS_ACTIVE_IMPORTS", cause);
+		this.producerStack = producerStack;
+		this.producerRegion = producerRegion;
+		this.consumers = consumers;
+		this.name = "StackHasActiveImportsError";
+		Object.setPrototypeOf(this, StackHasActiveImportsError.prototype);
+	}
+};
+/**
+* Signals a `cdkd local start-service` orchestration failure (Phase 2
+* of #262 — `AWS::ECS::Service` emulator). Distinct from
+* `LocalRunTaskError` because the service runner has its own lifecycle
+* (long-running replica pool, restart-on-exit), so a failure inside it
+* carries different operator semantics than a one-shot task failure.
+*/
+var LocalStartServiceError = class LocalStartServiceError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "LOCAL_START_SERVICE_ERROR", cause);
+		this.name = "LocalStartServiceError";
+		Object.setPrototypeOf(this, LocalStartServiceError.prototype);
+	}
+};
+/**
+* Signals that the upstream `cdk` CLI is not available on PATH (or at
+* the override path passed via `--cdk-bin`). Surfaced from `cdkd migrate`
+* (#465 PR A) before any other work runs.
+*
+* The message includes the install hint `npm install -g aws-cdk@latest`
+* so users on a fresh machine see exactly how to recover.
+*/
+var MissingCdkCliError = class MissingCdkCliError extends CdkdError {
+	constructor(detail, cause) {
+		super(`${detail ?? "upstream 'cdk' CLI not found on PATH"}. 'cdkd migrate' shells out to the upstream aws-cdk CLI for L1 codegen — install it with 'npm install -g aws-cdk@latest' (or pass --cdk-bin <path>).`, "MISSING_CDK_CLI", cause);
+		this.name = "MissingCdkCliError";
+		Object.setPrototypeOf(this, MissingCdkCliError.prototype);
+	}
+};
+/**
+* Generic local-migrate orchestration failure (#465 PR A). Used by
+* `cdkd migrate` for pre-flight rejections (Custom Resource / nested
+* stack / non-terminal CFn stack state), output-dir collisions, and
+* `cdk migrate` subprocess failures whose underlying stderr is folded
+* into the error message. Exit code 2 (partial-failure family) because
+* some pre-flight failures leave the user with a partially-populated
+* output directory that's still useful for debugging.
+*/
+var LocalMigrateError = class LocalMigrateError extends CdkdError {
+	exitCode = 2;
+	constructor(message, cause) {
+		super(message, "LOCAL_MIGRATE_ERROR", cause);
+		this.name = "LocalMigrateError";
+		Object.setPrototypeOf(this, LocalMigrateError.prototype);
+	}
+};
+/**
+* CloudFormation macro / `Fn::Transform` expansion failure (#463).
+*
+* cdkd hands templates that declare `Transform: [...]` (or carry
+* `Fn::Transform: {...}` snippets) to CloudFormation server-side via a
+* transient `CreateChangeSet --change-set-type CREATE` against a
+* `cdkd-macro-expand-<id>` stack name. This error wraps every failure
+* mode of that round-trip:
+*
+*   - `CreateChangeSet` rejection (bad template, missing macro IAM
+*     permission, custom macro not found in the account).
+*   - Changeset settles in `FAILED` (`StatusReason` from CFn is
+*     surfaced verbatim — typically a custom macro Lambda error).
+*   - Waiter timeout (the macro Lambda is stuck or oversized).
+*   - `GetTemplate --template-stage Processed` returns no body (would
+*     indicate a CFn-side regression — fail loud rather than silently
+*     proceed with the un-expanded template).
+*   - Multi-stage detection: the expanded template still contains
+*     macros, which cdkd v1 does not support (the design intentionally
+*     rejects this so a second round-trip is not silently triggered).
+*
+* The error surfaces at exit code 2 (partial-failure family) — the
+* cleanup `finally` in the expander always runs `DeleteChangeSet` +
+* `DeleteStack` regardless of this error firing, so a failed
+* expansion never leaves a transient CFn stack behind in a routine
+* case. The user can re-run `cdkd deploy` once the upstream cause is
+* fixed.
+*/
+var MacroExpansionError = class MacroExpansionError extends CdkdError {
+	exitCode = 2;
+	constructor(message, cause) {
+		super(message, "MACRO_EXPANSION_ERROR", cause);
+		this.name = "MacroExpansionError";
+		Object.setPrototypeOf(this, MacroExpansionError.prototype);
+	}
+};
+/**
+* Check if error is a cdkd error
+*/
+function isCdkdError(error) {
+	return error instanceof CdkdError;
+}
+/**
+* Format error for display
+*/
+function formatError(error) {
+	if (isCdkdError(error)) {
+		let message = `${error.name}: ${error.message}`;
+		if (error.cause) message += `\nCaused by: ${error.cause.message}`;
+		return message;
+	}
+	if (error instanceof Error) return `${error.name}: ${error.message}`;
+	return String(error);
+}
+/**
+* Global error handler
+*
+* Default exit code is 1 (general error). `PartialFailureError`
+* overrides it to 2 so callers can distinguish "command crashed /
+* unauthorized / bad arguments" from "command completed but some
+* resources are still in an error state, re-run to clean up".
+*
+* A {@link CdkdError} subclass may set `silent = true` to suppress the
+* default `logger.error` line — used by `cdkd drift` where the command
+* has already printed a richer report and only needs the exit code.
+*/
+function handleError(error) {
+	const logger = getLogger();
+	if (!(error instanceof CdkdError && error.silent)) logger.error(formatError(error));
+	if (error instanceof Error && error.stack) logger.debug("Stack trace:", error.stack);
+	const customExitCode = error instanceof CdkdError ? error.exitCode : void 0;
+	const exitCode = typeof customExitCode === "number" ? customExitCode : 1;
+	process.exit(exitCode);
+}
+/**
+* Wrap async function with error handling
+*
+* Note: Uses `any[]` for args to support Commander.js action handlers
+* which can have various parameter types
+*/
+function withErrorHandling(fn) {
+	return async (...args) => {
+		try {
+			await fn(...args);
+		} catch (error) {
+			handleError(error);
+		}
+	};
+}
+/**
+* Convert AWS SDK v3's synthetic `Unknown` / `UnknownError` exception into
+* an actionable `Error` keyed off `$metadata.httpStatusCode`.
+*
+* Background — why this helper exists:
+*   AWS SDK v3 produces a synthetic `name: 'Unknown'`, `message:
+*   'UnknownError'` exception when the protocol parser hits a HEAD response
+*   with an empty body. The most common trigger is `HeadBucket` against a
+*   bucket in a different region than the client (S3 returns 301
+*   PermanentRedirect with `x-amz-bucket-region` set, but the redirect
+*   middleware doesn't recover from the empty body). Surfacing the literal
+*   string `UnknownError` to users is uninformative.
+*
+* Behavior:
+*   - Non-AWS-SDK errors (anything where `name` is not `Unknown` and
+*     `message` is not `UnknownError`) pass through unchanged.
+*   - AWS SDK Unknown errors are mapped by HTTP status:
+*     - 301 → `Bucket '<name>' is in a different region…` (auto-resolved
+*       elsewhere; if this surfaces, it's a bug worth reporting).
+*     - 403 → `Access denied to bucket '<name>'.`
+*     - 404 → `Bucket '<name>' does not exist.`
+*     - other / unknown → `S3 error during <operation> on '<bucket>' (HTTP
+*       <status>).`
+*/
+function normalizeAwsError(err, context = {}) {
+	if (!(err instanceof Error)) return new Error(String(err));
+	if (!(err.name === "Unknown" || err.message === "UnknownError")) return err;
+	const status = err.$metadata?.httpStatusCode;
+	const bucket = context.bucket ?? "<unknown bucket>";
+	const operation = context.operation ?? "operation";
+	switch (status) {
+		case 301: {
+			const responseHeaders = err.$response?.headers;
+			const region = responseHeaders?.["x-amz-bucket-region"] ?? responseHeaders?.["X-Amz-Bucket-Region"];
+			const where = region ? ` (in ${region})` : "";
+			return /* @__PURE__ */ new Error(`Bucket '${bucket}'${where} is in a different region than the client. cdkd resolves this automatically; if you see this message, please report it.`);
+		}
+		case 403: return /* @__PURE__ */ new Error(`Access denied to bucket '${bucket}'. Verify credentials and bucket policy.`);
+		case 404: return /* @__PURE__ */ new Error(`Bucket '${bucket}' does not exist.`);
+		default: {
+			const statusStr = status !== void 0 ? `HTTP ${status}` : "unknown HTTP status";
+			return /* @__PURE__ */ new Error(`S3 error during ${operation} on '${bucket}' (${statusStr}). See CloudTrail for details.`);
+		}
+	}
+}
+
+//#endregion
+//#region src/utils/aws-clients.ts
+var aws_clients_exports = /* @__PURE__ */ __exportAll({
+	AwsClients: () => AwsClients,
+	getAwsClients: () => getAwsClients,
+	resetAwsClients: () => resetAwsClients,
+	setAwsClients: () => setAwsClients
+});
+/**
+* AWS clients manager
+*/
+var AwsClients = class {
+	s3Client;
+	cloudControlClient;
+	iamClient;
+	sqsClient;
+	snsClient;
+	lambdaClient;
+	stsClient;
+	ec2Client;
+	dynamoDBClient;
+	cloudFormationClient;
+	apiGatewayClient;
+	eventBridgeClient;
+	secretsManagerClient;
+	ssmClient;
+	cloudFrontClient;
+	cloudWatchClient;
+	cloudWatchLogsClient;
+	bedrockAgentCoreControlClient;
+	acmClient;
+	config;
+	constructor(config = {}) {
+		this.config = config;
+	}
+	/**
+	* Get S3 client
+	*
+	* Note: If region and credentials are not provided, AWS SDK will use:
+	* 1. Environment variables (AWS_REGION, AWS_ACCESS_KEY_ID, etc.)
+	* 2. AWS credentials file (~/.aws/credentials)
+	* 3. IAM role (if running on EC2/ECS/Lambda)
+	*/
+	getS3Client() {
+		if (!this.s3Client) this.s3Client = new S3Client({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials },
+			logger: {
+				debug: () => {},
+				info: () => {},
+				warn: () => {},
+				error: () => {}
+			}
+		});
+		return this.s3Client;
+	}
+	/**
+	* Get Cloud Control API client
+	*
+	* Note: If region and credentials are not provided, AWS SDK will use:
+	* 1. Environment variables (AWS_REGION, AWS_ACCESS_KEY_ID, etc.)
+	* 2. AWS credentials file (~/.aws/credentials)
+	* 3. IAM role (if running on EC2/ECS/Lambda)
+	*/
+	getCloudControlClient() {
+		if (!this.cloudControlClient) this.cloudControlClient = new CloudControlClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.cloudControlClient;
+	}
+	/**
+	* Get IAM client
+	*
+	* Note: IAM is a global service, but we accept region for consistency.
+	* If not specified, defaults to us-east-1.
+	*/
+	getIAMClient() {
+		if (!this.iamClient) this.iamClient = new IAMClient({
+			region: this.config.region || "us-east-1",
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.iamClient;
+	}
+	/**
+	* Convenience getter for S3 client
+	*/
+	get s3() {
+		return this.getS3Client();
+	}
+	/**
+	* Convenience getter for Cloud Control client
+	*/
+	get cloudControl() {
+		return this.getCloudControlClient();
+	}
+	/**
+	* Convenience getter for IAM client
+	*/
+	get iam() {
+		return this.getIAMClient();
+	}
+	/**
+	* Get SQS client
+	*/
+	getSQSClient() {
+		if (!this.sqsClient) this.sqsClient = new SQSClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.sqsClient;
+	}
+	/**
+	* Convenience getter for SQS client
+	*/
+	get sqs() {
+		return this.getSQSClient();
+	}
+	/**
+	* Get SNS client
+	*/
+	getSNSClient() {
+		if (!this.snsClient) this.snsClient = new SNSClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.snsClient;
+	}
+	/**
+	* Convenience getter for SNS client
+	*/
+	get sns() {
+		return this.getSNSClient();
+	}
+	/**
+	* Get Lambda client
+	*/
+	getLambdaClient() {
+		if (!this.lambdaClient) this.lambdaClient = new LambdaClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.lambdaClient;
+	}
+	/**
+	* Convenience getter for Lambda client
+	*/
+	get lambda() {
+		return this.getLambdaClient();
+	}
+	/**
+	* Get EC2 client
+	*/
+	getEC2Client() {
+		if (!this.ec2Client) this.ec2Client = new EC2Client({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.ec2Client;
+	}
+	/**
+	* Convenience getter for EC2 client
+	*/
+	get ec2() {
+		return this.getEC2Client();
+	}
+	/**
+	* Get STS client
+	*/
+	getSTSClient() {
+		if (!this.stsClient) this.stsClient = new STSClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.stsClient;
+	}
+	/**
+	* Convenience getter for STS client
+	*/
+	get sts() {
+		return this.getSTSClient();
+	}
+	/**
+	* Get DynamoDB client
+	*/
+	getDynamoDBClient() {
+		if (!this.dynamoDBClient) this.dynamoDBClient = new DynamoDBClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.dynamoDBClient;
+	}
+	/**
+	* Convenience getter for DynamoDB client
+	*/
+	get dynamoDB() {
+		return this.getDynamoDBClient();
+	}
+	/**
+	* Get CloudFormation client
+	*/
+	getCloudFormationClient() {
+		if (!this.cloudFormationClient) this.cloudFormationClient = new CloudFormationClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.cloudFormationClient;
+	}
+	/**
+	* Convenience getter for CloudFormation client
+	*/
+	get cloudFormation() {
+		return this.getCloudFormationClient();
+	}
+	/**
+	* Get API Gateway client
+	*/
+	getAPIGatewayClient() {
+		if (!this.apiGatewayClient) this.apiGatewayClient = new APIGatewayClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.apiGatewayClient;
+	}
+	/**
+	* Convenience getter for API Gateway client
+	*/
+	get apiGateway() {
+		return this.getAPIGatewayClient();
+	}
+	/**
+	* Get EventBridge client
+	*/
+	getEventBridgeClient() {
+		if (!this.eventBridgeClient) this.eventBridgeClient = new EventBridgeClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.eventBridgeClient;
+	}
+	/**
+	* Convenience getter for EventBridge client
+	*/
+	get eventBridge() {
+		return this.getEventBridgeClient();
+	}
+	/**
+	* Get Secrets Manager client
+	*/
+	getSecretsManagerClient() {
+		if (!this.secretsManagerClient) this.secretsManagerClient = new SecretsManagerClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.secretsManagerClient;
+	}
+	/**
+	* Convenience getter for Secrets Manager client
+	*/
+	get secretsManager() {
+		return this.getSecretsManagerClient();
+	}
+	/**
+	* Get SSM client
+	*/
+	getSSMClient() {
+		if (!this.ssmClient) this.ssmClient = new SSMClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.ssmClient;
+	}
+	/**
+	* Convenience getter for SSM client
+	*/
+	get ssm() {
+		return this.getSSMClient();
+	}
+	/**
+	* Get CloudFront client
+	*/
+	getCloudFrontClient() {
+		if (!this.cloudFrontClient) this.cloudFrontClient = new CloudFrontClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.cloudFrontClient;
+	}
+	/**
+	* Convenience getter for CloudFront client
+	*/
+	get cloudFront() {
+		return this.getCloudFrontClient();
+	}
+	/**
+	* Get ACM client
+	*
+	* ACM is region-scoped. The client uses the configured AWS region so the
+	* deploy engine's per-stack region resolution carries through. CloudFront
+	* users must place their certificate stack in `us-east-1`.
+	*/
+	getACMClient() {
+		if (!this.acmClient) this.acmClient = new ACMClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.acmClient;
+	}
+	/**
+	* Convenience getter for ACM client
+	*/
+	get acm() {
+		return this.getACMClient();
+	}
+	/**
+	* Get CloudWatch client
+	*/
+	getCloudWatchClient() {
+		if (!this.cloudWatchClient) this.cloudWatchClient = new CloudWatchClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.cloudWatchClient;
+	}
+	/**
+	* Convenience getter for CloudWatch client
+	*/
+	get cloudWatch() {
+		return this.getCloudWatchClient();
+	}
+	/**
+	* Get CloudWatch Logs client
+	*/
+	getCloudWatchLogsClient() {
+		if (!this.cloudWatchLogsClient) this.cloudWatchLogsClient = new CloudWatchLogsClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.cloudWatchLogsClient;
+	}
+	/**
+	* Convenience getter for CloudWatch Logs client
+	*/
+	get cloudWatchLogs() {
+		return this.getCloudWatchLogsClient();
+	}
+	/**
+	* Get BedrockAgentCoreControl client
+	*/
+	getBedrockAgentCoreControlClient() {
+		if (!this.bedrockAgentCoreControlClient) this.bedrockAgentCoreControlClient = new BedrockAgentCoreControlClient({
+			...this.config.region && { region: this.config.region },
+			...this.config.credentials && { credentials: this.config.credentials }
+		});
+		return this.bedrockAgentCoreControlClient;
+	}
+	/**
+	* Convenience getter for BedrockAgentCoreControl client
+	*/
+	get bedrockAgentCoreControl() {
+		return this.getBedrockAgentCoreControlClient();
+	}
+	/**
+	* Destroy all clients
+	*/
+	destroy() {
+		this.s3Client?.destroy();
+		this.cloudControlClient?.destroy();
+		this.iamClient?.destroy();
+		this.sqsClient?.destroy();
+		this.snsClient?.destroy();
+		this.lambdaClient?.destroy();
+		this.stsClient?.destroy();
+		this.ec2Client?.destroy();
+		this.dynamoDBClient?.destroy();
+		this.cloudFormationClient?.destroy();
+		this.apiGatewayClient?.destroy();
+		this.eventBridgeClient?.destroy();
+		this.secretsManagerClient?.destroy();
+		this.ssmClient?.destroy();
+		this.cloudFrontClient?.destroy();
+		this.cloudWatchClient?.destroy();
+		this.cloudWatchLogsClient?.destroy();
+		this.bedrockAgentCoreControlClient?.destroy();
+		this.acmClient?.destroy();
+	}
+};
+/**
+* Global AWS clients instance
+*/
+let globalClients = null;
+/**
+* Get or create global AWS clients
+*/
+function getAwsClients(config) {
+	if (!globalClients) globalClients = new AwsClients(config);
+	return globalClients;
+}
+/**
+* Set global AWS clients instance
+*/
+function setAwsClients(clients) {
+	globalClients = clients;
+}
+/**
+* Reset global AWS clients (useful for testing)
+*/
+function resetAwsClients() {
+	globalClients?.destroy();
+	globalClients = null;
+}
+
+//#endregion
 //#region src/utils/aws-region-resolver.ts
 /**
 * Per-bucket region cache.
@@ -45,7 +1000,7 @@ import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 * request — the second caller awaits the same promise instead of issuing a
 * duplicate API call.
 */
-const cache = /* @__PURE__ */ new Map();
+const cache$1 = /* @__PURE__ */ new Map();
 /**
 * Resolve the AWS region of an S3 bucket via `GetBucketLocation`.
 *
@@ -70,7 +1025,7 @@ const cache = /* @__PURE__ */ new Map();
 *   `opts.fallbackRegion` if provided, else `us-east-1`.
 */
 async function resolveBucketRegion(bucketName, opts = {}) {
-	const cached = cache.get(bucketName);
+	const cached = cache$1.get(bucketName);
 	if (cached) return cached;
 	const promise = (async () => {
 		const client = new S3Client({
@@ -79,7 +1034,7 @@ async function resolveBucketRegion(bucketName, opts = {}) {
 			...opts.credentials && { credentials: opts.credentials }
 		});
 		try {
-			const { expectedOwnerParam } = await import("./expected-bucket-owner-BjEfUnkA.js").then((n) => n.n);
+			const { expectedOwnerParam } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 			return (await client.send(new GetBucketLocationCommand({
 				Bucket: bucketName,
 				...await expectedOwnerParam(client)
@@ -90,7 +1045,7 @@ async function resolveBucketRegion(bucketName, opts = {}) {
 			client.destroy();
 		}
 	})();
-	cache.set(bucketName, promise);
+	cache$1.set(bucketName, promise);
 	return promise;
 }
 /**
@@ -98,7 +1053,7 @@ async function resolveBucketRegion(bucketName, opts = {}) {
 * cases — production code never needs to call this.
 */
 function clearBucketRegionCache() {
-	cache.clear();
+	cache$1.clear();
 }
 /**
 * Resolve the cdkd state bucket name + region for a sibling AWS account.
@@ -1307,6 +2262,87 @@ function collectFnTransformNames(value, seen, out) {
 	}
 }
 
+//#endregion
+//#region src/utils/expected-bucket-owner.ts
+/**
+* `ExpectedBucketOwner` resolution for cdkd-owned buckets (the state-bucket
+* family: state / lock / exports-index / deployment-events / transient
+* template uploads).
+*
+* S3 bucket names are global and cdkd's default names are predictable
+* (`cdkd-state-{accountId}`). Without this header, a bucket pre-created in
+* ANOTHER account under that name — with a bucket policy that deliberately
+* ALLOWS this account — would silently accept cdkd's state reads/writes
+* (name-squatting: the attacker could then read resource properties and
+* tamper with physical ids). With the header, S3 itself rejects any call
+* whose bucket owner differs (403), regardless of what the bucket's policy
+* allows. The asset-storage family has carried the same defense since issue
+* #1002 PR 1; this module extends it to the state-bucket family.
+*
+* Best-effort by design: a test double without a standard `config`, or an
+* STS failure, resolves to `undefined` (header omitted — pre-hardening
+* behavior) rather than failing the operation. The S3 calls themselves run
+* with the same credentials, so a working S3 path implies a working STS
+* path in practice; the degradation exists for exotic credential setups and
+* unit-test doubles, not as an expected runtime branch.
+*/
+var expected_bucket_owner_exports = /* @__PURE__ */ __exportAll({
+	expectedOwnerParam: () => expectedOwnerParam,
+	resolveExpectedBucketOwner: () => resolveExpectedBucketOwner
+});
+const cache = /* @__PURE__ */ new WeakMap();
+/**
+* Resolve the AWS account id of the caller behind an S3 client's
+* credentials. Cached per client instance for the process lifetime (a
+* region-rebuilt replacement client re-resolves once — same credentials,
+* one extra STS call).
+*
+* Works for the cross-account state-read path too (`Fn::GetStackOutput`
+* `RoleArn`): the ephemeral backend's client carries the ASSUMED
+* credentials, so the resolved owner is the producer account — exactly the
+* owner its `cdkd-state-{producerAccountId}` bucket must have.
+*/
+function resolveExpectedBucketOwner(client) {
+	const cached = cache.get(client);
+	if (cached) return cached;
+	const promise = (async () => {
+		try {
+			const config = client.config;
+			if (!config || typeof config.region !== "function" || typeof config.credentials !== "function") return;
+			const region = await config.region();
+			const credentials = await config.credentials();
+			if (!credentials?.accessKeyId || !credentials.secretAccessKey) return;
+			const sts = new STSClient({
+				...typeof region === "string" && region ? { region } : {},
+				credentials: {
+					accessKeyId: credentials.accessKeyId,
+					secretAccessKey: credentials.secretAccessKey,
+					...credentials.sessionToken && { sessionToken: credentials.sessionToken }
+				}
+			});
+			try {
+				return (await sts.send(new GetCallerIdentityCommand({}))).Account;
+			} finally {
+				sts.destroy();
+			}
+		} catch (error) {
+			getLogger().debug(`ExpectedBucketOwner resolution skipped (header omitted): ${String(error)}`);
+			cache.delete(client);
+			return;
+		}
+	})();
+	cache.set(client, promise);
+	return promise;
+}
+/**
+* Spread helper: `{...(await expectedOwnerParam(client))}` adds
+* `ExpectedBucketOwner` when the owner resolved, nothing otherwise.
+*/
+async function expectedOwnerParam(client) {
+	const owner = await resolveExpectedBucketOwner(client);
+	return owner ? { ExpectedBucketOwner: owner } : {};
+}
+
 //#endregion
 //#region src/cli/upload-cfn-template.ts
 /**
@@ -1936,7 +2972,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region) {
 	logger.debug("No state bucket specified, resolving default from account...");
 	const { GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 	const { S3Client } = await import("@aws-sdk/client-s3");
-	const { getAwsClients } = await import("./aws-clients-B15NAPbL.js").then((n) => n.n);
+	const { getAwsClients } = await Promise.resolve().then(() => aws_clients_exports);
 	const accountId = (await getAwsClients().sts.send(new GetCallerIdentityCommand({}))).Account;
 	const newName = getDefaultStateBucketName(accountId);
 	const legacyName = getLegacyStateBucketName(accountId, region);
@@ -1994,7 +3030,7 @@ async function resolveStateBucketWithDefaultAndSource(cliBucket, region) {
 */
 async function bucketHasAnyState(client, bucketName) {
 	const { ListObjectsV2Command } = await import("@aws-sdk/client-s3");
-	const { expectedOwnerParam } = await import("./expected-bucket-owner-BjEfUnkA.js").then((n) => n.n);
+	const { expectedOwnerParam } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 	try {
 		return ((await client.send(new ListObjectsV2Command({
 			Bucket: bucketName,
@@ -2021,7 +3057,7 @@ async function bucketHasAnyState(client, bucketName) {
 */
 async function bucketExists(client, bucketName) {
 	const { HeadBucketCommand } = await import("@aws-sdk/client-s3");
-	const { expectedOwnerParam } = await import("./expected-bucket-owner-BjEfUnkA.js").then((n) => n.n);
+	const { expectedOwnerParam } = await Promise.resolve().then(() => expected_bucket_owner_exports);
 	try {
 		await client.send(new HeadBucketCommand({
 			Bucket: bucketName,
@@ -3501,7 +4537,7 @@ function containsAnySource(value, map) {
 	}
 	return false;
 }
-const FOLDABLE_PSEUDO_PARAMS = new Set([
+const FOLDABLE_PSEUDO_PARAMS = /* @__PURE__ */ new Set([
 	"AWS::AccountId",
 	"AWS::Region",
 	"AWS::Partition",
@@ -3949,7 +4985,7 @@ var AssetPublisher = class {
 			graph.addNode({
 				id: publishNodeId,
 				type: "asset-publish",
-				dependencies: new Set([buildNodeId]),
+				dependencies: /* @__PURE__ */ new Set([buildNodeId]),
 				state: "pending",
 				data: {
 					kind: "docker-publish",
@@ -5420,7 +6456,7 @@ function defensiveDependsOnToSkip(resource, template) {
 //#endregion
 //#region src/analyzer/dag-builder.ts
 const { Graph, alg } = graphlib;
-const IAM_ROLE_POLICY_TYPES = new Set([
+const IAM_ROLE_POLICY_TYPES = /* @__PURE__ */ new Set([
 	"AWS::IAM::Policy",
 	"AWS::IAM::RolePolicy",
 	"AWS::IAM::ManagedPolicy"
@@ -5843,8 +6879,8 @@ var ReplacementRulesRegistry = class {
 	*/
 	initializeRules() {
 		this.rules.set("AWS::S3::Bucket", {
-			replacementProperties: new Set(["BucketName"]),
-			updateableProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set(["BucketName"]),
+			updateableProperties: /* @__PURE__ */ new Set([
 				"Tags",
 				"VersioningConfiguration",
 				"LifecycleConfiguration",
@@ -5857,8 +6893,8 @@ var ReplacementRulesRegistry = class {
 			])
 		});
 		this.rules.set("AWS::Lambda::Function", {
-			replacementProperties: new Set(["FunctionName"]),
-			updateableProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set(["FunctionName"]),
+			updateableProperties: /* @__PURE__ */ new Set([
 				"Code",
 				"Handler",
 				"Runtime",
@@ -5876,7 +6912,7 @@ var ReplacementRulesRegistry = class {
 				"Architectures"
 			])
 		});
-		this.rules.set("AWS::Lambda::LayerVersion", { replacementProperties: new Set([
+		this.rules.set("AWS::Lambda::LayerVersion", { replacementProperties: /* @__PURE__ */ new Set([
 			"Content",
 			"LayerName",
 			"Description",
@@ -5884,7 +6920,7 @@ var ReplacementRulesRegistry = class {
 			"CompatibleArchitectures",
 			"LicenseInfo"
 		]) });
-		this.rules.set("AWS::Lambda::Version", { replacementProperties: new Set([
+		this.rules.set("AWS::Lambda::Version", { replacementProperties: /* @__PURE__ */ new Set([
 			"CodeSha256",
 			"Description",
 			"FunctionName",
@@ -5892,16 +6928,16 @@ var ReplacementRulesRegistry = class {
 			"RuntimePolicy"
 		]) });
 		this.rules.set("AWS::Lambda::EventInvokeConfig", {
-			replacementProperties: new Set(["FunctionName", "Qualifier"]),
-			updateableProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set(["FunctionName", "Qualifier"]),
+			updateableProperties: /* @__PURE__ */ new Set([
 				"MaximumEventAgeInSeconds",
 				"MaximumRetryAttempts",
 				"DestinationConfig"
 			])
 		});
 		this.rules.set("AWS::DynamoDB::Table", {
-			replacementProperties: new Set(["TableName", "KeySchema"]),
-			updateableProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set(["TableName", "KeySchema"]),
+			updateableProperties: /* @__PURE__ */ new Set([
 				"BillingMode",
 				"ProvisionedThroughput",
 				"GlobalSecondaryIndexes",
@@ -5912,15 +6948,15 @@ var ReplacementRulesRegistry = class {
 				"TimeToLiveSpecification",
 				"PointInTimeRecoverySpecification"
 			]),
-			conditionalReplacements: new Map([["AttributeDefinitions", attributeTypeChangedForSharedAttribute]])
+			conditionalReplacements: /* @__PURE__ */ new Map([["AttributeDefinitions", attributeTypeChangedForSharedAttribute]])
 		});
 		this.rules.set("AWS::SQS::Queue", {
-			replacementProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set([
 				"QueueName",
 				"FifoQueue",
 				"ContentBasedDeduplication"
 			]),
-			updateableProperties: new Set([
+			updateableProperties: /* @__PURE__ */ new Set([
 				"DelaySeconds",
 				"MaximumMessageSize",
 				"MessageRetentionPeriod",
@@ -5931,8 +6967,8 @@ var ReplacementRulesRegistry = class {
 			])
 		});
 		this.rules.set("AWS::IAM::Role", {
-			replacementProperties: new Set(["RoleName"]),
-			updateableProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set(["RoleName"]),
+			updateableProperties: /* @__PURE__ */ new Set([
 				"AssumeRolePolicyDocument",
 				"Description",
 				"ManagedPolicyArns",
@@ -5944,8 +6980,8 @@ var ReplacementRulesRegistry = class {
 			])
 		});
 		this.rules.set("AWS::SNS::Topic", {
-			replacementProperties: new Set(["TopicName"]),
-			updateableProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set(["TopicName"]),
+			updateableProperties: /* @__PURE__ */ new Set([
 				"DisplayName",
 				"Subscription",
 				"KmsMasterKeyId",
@@ -5954,7 +6990,7 @@ var ReplacementRulesRegistry = class {
 		});
 		this.rules.set("AWS::CodeCommit::Repository", {
 			replacementProperties: /* @__PURE__ */ new Set([]),
-			updateableProperties: new Set([
+			updateableProperties: /* @__PURE__ */ new Set([
 				"RepositoryName",
 				"RepositoryDescription",
 				"KmsKeyId",
@@ -5962,8 +6998,8 @@ var ReplacementRulesRegistry = class {
 			])
 		});
 		this.rules.set("AWS::ECR::Repository", {
-			replacementProperties: new Set(["RepositoryName"]),
-			updateableProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set(["RepositoryName"]),
+			updateableProperties: /* @__PURE__ */ new Set([
 				"ImageScanningConfiguration",
 				"ImageTagMutability",
 				"LifecyclePolicy",
@@ -5972,12 +7008,12 @@ var ReplacementRulesRegistry = class {
 			])
 		});
 		this.rules.set("AWS::Logs::LogGroup", {
-			replacementProperties: new Set(["LogGroupName"]),
-			updateableProperties: new Set(["RetentionInDays", "KmsKeyId"])
+			replacementProperties: /* @__PURE__ */ new Set(["LogGroupName"]),
+			updateableProperties: /* @__PURE__ */ new Set(["RetentionInDays", "KmsKeyId"])
 		});
 		this.rules.set("AWS::Kinesis::Stream", {
-			replacementProperties: new Set(["Name"]),
-			updateableProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set(["Name"]),
+			updateableProperties: /* @__PURE__ */ new Set([
 				"RetentionPeriodHours",
 				"ShardCount",
 				"StreamModeDetails",
@@ -5986,8 +7022,8 @@ var ReplacementRulesRegistry = class {
 			])
 		});
 		this.rules.set("AWS::SecretsManager::Secret", {
-			replacementProperties: new Set(["Name"]),
-			updateableProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set(["Name"]),
+			updateableProperties: /* @__PURE__ */ new Set([
 				"Description",
 				"KmsKeyId",
 				"SecretString",
@@ -5997,8 +7033,8 @@ var ReplacementRulesRegistry = class {
 			])
 		});
 		this.rules.set("AWS::StepFunctions::StateMachine", {
-			replacementProperties: new Set(["StateMachineName", "StateMachineType"]),
-			updateableProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set(["StateMachineName", "StateMachineType"]),
+			updateableProperties: /* @__PURE__ */ new Set([
 				"DefinitionString",
 				"DefinitionS3Location",
 				"Definition",
@@ -6011,8 +7047,8 @@ var ReplacementRulesRegistry = class {
 			])
 		});
 		this.rules.set("AWS::Events::Rule", {
-			replacementProperties: new Set(["Name", "EventBusName"]),
-			updateableProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set(["Name", "EventBusName"]),
+			updateableProperties: /* @__PURE__ */ new Set([
 				"ScheduleExpression",
 				"EventPattern",
 				"State",
@@ -6022,8 +7058,8 @@ var ReplacementRulesRegistry = class {
 			])
 		});
 		this.rules.set("AWS::SSM::Parameter", {
-			replacementProperties: new Set(["Name"]),
-			updateableProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set(["Name"]),
+			updateableProperties: /* @__PURE__ */ new Set([
 				"Value",
 				"Description",
 				"Type",
@@ -6036,12 +7072,12 @@ var ReplacementRulesRegistry = class {
 		});
 		this.rules.set("AWS::Budgets::Budget", {
 			replacementProperties: /* @__PURE__ */ new Set(),
-			updateableProperties: new Set(["NotificationsWithSubscribers", "ResourceTags"]),
-			conditionalReplacements: new Map([["Budget", budgetNameChanged]])
+			updateableProperties: /* @__PURE__ */ new Set(["NotificationsWithSubscribers", "ResourceTags"]),
+			conditionalReplacements: /* @__PURE__ */ new Map([["Budget", budgetNameChanged]])
 		});
 		this.rules.set("AWS::CloudWatch::Alarm", {
-			replacementProperties: new Set(["AlarmName"]),
-			updateableProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set(["AlarmName"]),
+			updateableProperties: /* @__PURE__ */ new Set([
 				"ComparisonOperator",
 				"EvaluationPeriods",
 				"DatapointsToAlarm",
@@ -6066,8 +7102,8 @@ var ReplacementRulesRegistry = class {
 			])
 		});
 		this.rules.set("AWS::ApiGateway::RestApi", {
-			replacementProperties: new Set(["Name"]),
-			updateableProperties: new Set([
+			replacementProperties: /* @__PURE__ */ new Set(["Name"]),
+			updateableProperties: /* @__PURE__ */ new Set([
 				"Description",
 				"Policy",
 				"EndpointConfiguration",
@@ -6076,20 +7112,20 @@ var ReplacementRulesRegistry = class {
 				"Tags"
 			])
 		});
-		this.rules.set("AWS::RDS::DBProxy", { replacementProperties: new Set([
+		this.rules.set("AWS::RDS::DBProxy", { replacementProperties: /* @__PURE__ */ new Set([
 			"DBProxyName",
 			"EngineFamily",
 			"VpcSubnetIds"
 		]) });
-		this.rules.set("AWS::RDS::DBProxyEndpoint", { replacementProperties: new Set([
+		this.rules.set("AWS::RDS::DBProxyEndpoint", { replacementProperties: /* @__PURE__ */ new Set([
 			"DBProxyName",
 			"DBProxyEndpointName",
 			"VpcSubnetIds",
 			"TargetRole"
 		]) });
-		this.rules.set("AWS::RDS::DBProxyTargetGroup", { replacementProperties: new Set(["DBProxyName", "TargetGroupName"]) });
-		this.rules.set("AWS::EC2::Instance", { replacementProperties: new Set(["EbsOptimized"]) });
-		this.rules.set("AWS::ECS::TaskDefinition", { replacementProperties: new Set([
+		this.rules.set("AWS::RDS::DBProxyTargetGroup", { replacementProperties: /* @__PURE__ */ new Set(["DBProxyName", "TargetGroupName"]) });
+		this.rules.set("AWS::EC2::Instance", { replacementProperties: /* @__PURE__ */ new Set(["EbsOptimized"]) });
+		this.rules.set("AWS::ECS::TaskDefinition", { replacementProperties: /* @__PURE__ */ new Set([
 			"Family",
 			"ContainerDefinitions",
 			"Cpu",
@@ -6310,7 +7346,7 @@ function unescapeJsonPointerSegment$1(segment) {
 * NOT track in-place edits (e.g. a Lambda `Arn`) never trigger spurious
 * dependent promotion.
 */
-const IN_PLACE_UPDATE_DERIVED_ATTRS = Object.freeze({ "AWS::EC2::LaunchTemplate": new Set(["LatestVersionNumber", "DefaultVersionNumber"]) });
+const IN_PLACE_UPDATE_DERIVED_ATTRS = Object.freeze({ "AWS::EC2::LaunchTemplate": /* @__PURE__ */ new Set(["LatestVersionNumber", "DefaultVersionNumber"]) });
 /**
 * Diff calculator for comparing desired state (template) with current state
 */
@@ -6708,7 +7744,7 @@ var DiffCalculator = class DiffCalculator {
 	*/
 	async compareProperties(resourceType, currentProperties, desiredProperties) {
 		const changes = [];
-		const allKeys = new Set([...Object.keys(currentProperties), ...Object.keys(desiredProperties)]);
+		const allKeys = /* @__PURE__ */ new Set([...Object.keys(currentProperties), ...Object.keys(desiredProperties)]);
 		const ignoredProperties = /* @__PURE__ */ new Set();
 		if (resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::")) ignoredProperties.add("Timestamp");
 		let createOnlyPaths;
@@ -6736,7 +7772,7 @@ var DiffCalculator = class DiffCalculator {
 		}
 		return changes;
 	}
-	static INTRINSIC_KEYS = new Set([
+	static INTRINSIC_KEYS = /* @__PURE__ */ new Set([
 		"Ref",
 		"Fn::Sub",
 		"Fn::GetAtt",
@@ -7055,6 +8091,130 @@ async function applyRoleArnIfSet(opts) {
 	}
 }
 
+//#endregion
+//#region src/provisioning/region-check.ts
+/**
+* Verify that the AWS client's region matches the region the resource is
+* expected to live in before treating a `NotFound` error as idempotent
+* delete success.
+*
+* Why: a destroy run with the wrong region would otherwise receive
+* `*NotFound` for every resource and silently strip them all from state,
+* leaving the actual AWS resources orphaned in the real region. The
+* silent-failure incident that motivated this check was a Lambda in
+* `us-west-2` removed from state by a destroy that ran with a `us-east-1`
+* client.
+*
+* Behavior:
+* - If `expectedRegion` is unset, this is a no-op (back-compat: existing
+*   idempotent semantics preserved for callers that have not been
+*   threaded with state region).
+* - If `clientRegion` matches `expectedRegion`, returns silently.
+* - Otherwise throws `ProvisioningError` so the caller surfaces the
+*   mismatch instead of swallowing the NotFound.
+*
+* @param clientRegion Region resolved from the AWS SDK client config
+*   (typically `await client.config.region()`).
+* @param expectedRegion Region recorded in stack state, or undefined if
+*   the caller has no expected region.
+* @param resourceType CloudFormation resource type, used in the error
+*   message and on the thrown ProvisioningError.
+* @param logicalId Logical ID of the resource, used in the error message
+*   and on the thrown ProvisioningError.
+* @param physicalId Optional physical ID, used in the error message and
+*   on the thrown ProvisioningError.
+*/
+function assertRegionMatch(clientRegion, expectedRegion, resourceType, logicalId, physicalId) {
+	if (!expectedRegion) return;
+	if (!clientRegion) throw new ProvisioningError(`Refusing to treat NotFound as idempotent delete success for ${logicalId} (${resourceType}): AWS client region is unknown but stack state expects ${expectedRegion}. The resource may exist in ${expectedRegion} and would be silently removed from state if this NotFound were trusted.`, resourceType, logicalId, physicalId);
+	if (clientRegion !== expectedRegion) throw new ProvisioningError(`Refusing to treat NotFound as idempotent delete success for ${logicalId} (${resourceType}): AWS client region ${clientRegion} does not match stack state region ${expectedRegion}. The resource likely still exists in ${expectedRegion}; rerun the destroy with the correct region (e.g. --region ${expectedRegion}).`, resourceType, logicalId, physicalId);
+}
+
+//#endregion
+//#region src/provisioning/import-helpers.ts
+/**
+* Read an explicit name field from template properties. Returns `undefined`
+* when the property is missing or not a string — callers fall back to
+* tag-based lookup in that case.
+*/
+function readNameProperty(input, propertyName) {
+	const value = input.properties?.[propertyName];
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+/**
+* Resolve the physical id when the template provides an explicit name OR the
+* caller passed `--resource`/`--resource-mapping`. Returns `undefined` when
+* neither shortcut applies — caller must then fall back to tag-based lookup.
+*
+* Does NOT verify the resource exists: callers should follow up with a
+* service-specific `Head*`/`Get*`/`Describe*` to fail fast if the named
+* resource is missing.
+*/
+function resolveExplicitPhysicalId(input, nameProperty) {
+	if (input.knownPhysicalId) return input.knownPhysicalId;
+	if (nameProperty) {
+		const name = readNameProperty(input, nameProperty);
+		if (name) return name;
+	}
+}
+/**
+* The standard tag CDK puts on every deployed resource — its construct path
+* within the app, e.g. `MyStack/MyConstruct/MyBucket`. Used as the lookup key
+* when no explicit name is in the template.
+*/
+const CDK_PATH_TAG = "aws:cdk:path";
+/**
+* Match an AWS resource's tag set against the CDK path the template carries.
+* Returns true if the resource was deployed by the same CDK construct.
+*/
+function matchesCdkPath(tags, cdkPath) {
+	if (!tags || !cdkPath) return false;
+	for (const t of tags) if (t.Key === "aws:cdk:path" && t.Value === cdkPath) return true;
+	return false;
+}
+/**
+* Re-shape an AWS tag list (any of the common shapes — array of `{Key, Value}`,
+* map keyed by tag name, or v2-style array of `{TagKey, TagValue}`) into the
+* canonical CFn shape (`Array<{Key, Value}>`) that cdkd state holds, with
+* `aws:`-prefixed entries filtered out.
+*
+* AWS reserves the `aws:` tag prefix; CDK injects `aws:cdk:path` (and
+* sometimes `aws:cdk:metadata`) on every resource it deploys. Those tags are
+* NOT in cdkd state's `Tags` (they come from CDK template `Metadata`, not
+* `Properties.Tags`), so leaving them in the AWS-current snapshot would fire
+* false-positive drift on every CDK-deployed resource.
+*
+* Returns an empty array `[]` when AWS reports no user tags. Callers decide
+* whether to surface `Tags: []` (most providers — matches the typical
+* CFn behavior of always emitting Tags in templates) or omit the key
+* entirely (when the corresponding `create()` only sets Tags when the user
+* explicitly passes them — see each provider's docstring).
+*/
+function normalizeAwsTagsToCfn(tags) {
+	if (!tags) return [];
+	const out = [];
+	if (Array.isArray(tags)) for (const t of tags) {
+		const obj = t;
+		const k = (typeof obj["Key"] === "string" ? obj["Key"] : void 0) ?? (typeof obj["TagKey"] === "string" ? obj["TagKey"] : void 0) ?? (typeof obj["key"] === "string" ? obj["key"] : void 0);
+		const v = (typeof obj["Value"] === "string" ? obj["Value"] : void 0) ?? (typeof obj["TagValue"] === "string" ? obj["TagValue"] : void 0) ?? (typeof obj["value"] === "string" ? obj["value"] : void 0);
+		if (typeof k !== "string" || k.length === 0) continue;
+		if (k.startsWith("aws:")) continue;
+		out.push({
+			Key: k,
+			Value: typeof v === "string" ? v : ""
+		});
+	}
+	else for (const [k, v] of Object.entries(tags)) {
+		if (!k || k.startsWith("aws:")) continue;
+		out.push({
+			Key: k,
+			Value: typeof v === "string" ? v : ""
+		});
+	}
+	out.sort((a, b) => a.Key < b.Key ? -1 : a.Key > b.Key ? 1 : 0);
+	return out;
+}
+
 //#endregion
 //#region src/provisioning/providers/wafv2-provider.ts
 /**
@@ -7110,7 +8270,7 @@ var WAFv2WebACLProvider = class {
 	wafv2Client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("WAFv2WebACLProvider");
-	handledProperties = new Map([["AWS::WAFv2::WebACL", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::WAFv2::WebACL", /* @__PURE__ */ new Set([
 		"Name",
 		"Scope",
 		"Tags",
@@ -7276,14 +8436,14 @@ var WAFv2WebACLProvider = class {
 		const tagsToRemove = [];
 		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$9({
+			await this.getClient().send(new UntagResourceCommand$12({
 				ResourceARN: arn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from WAFv2 WebACL ${arn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$9({
+			await this.getClient().send(new TagResourceCommand$12({
 				ResourceARN: arn,
 				Tags: tagsToAdd
 			}));
@@ -7334,7 +8494,7 @@ var WAFv2WebACLProvider = class {
 		result["TokenDomains"] = webACL.TokenDomains ? [...webACL.TokenDomains] : [];
 		if (webACL.AssociationConfig) result["AssociationConfig"] = webACL.AssociationConfig;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$8({ ResourceARN: physicalId }))).TagInfoForResource?.TagList);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$11({ ResourceARN: physicalId }))).TagInfoForResource?.TagList);
 		} catch (err) {
 			this.logger.debug(`WAFv2 ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -7379,7 +8539,7 @@ var WAFv2WebACLProvider = class {
 			}));
 			for (const item of list.WebACLs ?? []) {
 				if (!item.ARN) continue;
-				const tagList = (await this.getClient().send(new ListTagsForResourceCommand$8({ ResourceARN: item.ARN }))).TagInfoForResource?.TagList;
+				const tagList = (await this.getClient().send(new ListTagsForResourceCommand$11({ ResourceARN: item.ARN }))).TagInfoForResource?.TagList;
 				if (matchesCdkPath(tagList, input.cdkPath)) return {
 					physicalId: item.ARN,
 					attributes: {}
@@ -7473,7 +8633,7 @@ const AWS_NO_VALUE = Symbol("AWS::NoValue");
 *      after-last-pipe extraction would return the PARENT id for them.
 *   5. Pin each addition with a unit test in intrinsic-functions.test.ts.
 */
-const REF_RETURNS_SEGMENT_AFTER_PIPE = new Set([
+const REF_RETURNS_SEGMENT_AFTER_PIPE = /* @__PURE__ */ new Set([
 	"AWS::ApiGateway::Model",
 	"AWS::ApiGateway::RequestValidator",
 	"AWS::ApiGateway::Stage",
@@ -7526,7 +8686,7 @@ const REF_RETURNS_SEGMENT_AFTER_PIPE = new Set([
 * Deployment is `[ApiId, DeploymentId]` (after-pipe). Always re-check the
 * type's own `describe-type` primaryIdentifier.
 */
-const REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE = new Set([
+const REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE = /* @__PURE__ */ new Set([
 	"AWS::ApiGateway::Deployment",
 	"AWS::ApiGateway::DocumentationPart",
 	"AWS::ApiGatewayV2::Authorizer",
@@ -7544,7 +8704,7 @@ const REF_RETURNS_SEGMENT_BEFORE_FIRST_PIPE = new Set([
 *   - `AWS::CloudTrail::Trail` → the trail name (`arn:…:trail/<name>`).
 * Value: the ARN resource-type marker after which the CFn `Ref` value starts.
 */
-const REF_RETURNS_NAME_FROM_ARN = new Map([["AWS::Events::Rule", ":rule/"], ["AWS::CloudTrail::Trail", ":trail/"]]);
+const REF_RETURNS_NAME_FROM_ARN = /* @__PURE__ */ new Map([["AWS::Events::Rule", ":rule/"], ["AWS::CloudTrail::Trail", ":trail/"]]);
 /**
 * Build a {@link RefStateLookup} from a resource's stored state maps, checking
 * `properties` first (the template value CFn `Ref` mirrors) then `attributes`.
@@ -7628,7 +8788,7 @@ function cfnRefValueFromPhysicalId(resourceType, physicalId, stateLookup) {
 * resolver ever runs, so by resolution time it should already be gone. Listing
 * it here keeps a stray (already-expanded) occurrence from hard-erroring.
 */
-const HANDLED_INTRINSIC_KEYS = new Set([
+const HANDLED_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
 	"Ref",
 	"Fn::GetAtt",
 	"Fn::Join",
@@ -9082,6 +10242,36 @@ var IntrinsicFunctionResolver = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/ec2-termination-protection.ts
+/**
+* Flip `DisableApiTermination` off on an instance. Idempotent — EC2 accepts the
+* call when the attribute is already false. Non-fatal: a NotFound (already
+* gone) or any other error is swallowed at debug so the actual delete still
+* proceeds (it will surface the real failure if the instance truly cannot be
+* deleted).
+*/
+async function disableInstanceApiTermination(client, instanceId, logger) {
+	try {
+		await client.send(new ModifyInstanceAttributeCommand({
+			InstanceId: instanceId,
+			DisableApiTermination: { Value: false }
+		}));
+		logger.debug(`Disabled DisableApiTermination on EC2 Instance ${instanceId} before deletion`);
+	} catch (flipError) {
+		logger.debug(`Could not disable DisableApiTermination on ${instanceId}: ${flipError instanceof Error ? flipError.message : String(flipError)}`);
+	}
+}
+/**
+* Does this error message indicate the terminate / delete raced the
+* `DisableApiTermination` flip-off propagation (so re-flipping + retrying is
+* the right move)? Matches both the SDK `TerminateInstances` 400 and the Cloud
+* Control `DeleteResource` wrapper of the same underlying EC2 error.
+*/
+function isTerminationProtectionPropagationError(message) {
+	return /may not be terminated|disableApiTermination/i.test(message);
+}
+
 //#endregion
 //#region src/provisioning/json-patch-generator.ts
 /**
@@ -9287,7 +10477,7 @@ function unescapeJsonPointerSegment(segment) {
 * pre-flight rejects these fast with an actionable message instead of letting
 * the optimistic Cloud Control fallthrough fail mid-deploy.
 */
-const NON_PROVISIONABLE_TYPES = new Set([
+const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"Alexa::ASK::Skill",
 	"AWS::AmazonMQ::ConfigurationAssociation",
 	"AWS::ApiGatewayV2::ApiGatewayManagedOverrides",
@@ -9335,8 +10525,6 @@ const NON_PROVISIONABLE_TYPES = new Set([
 	"AWS::ElastiCache::SecurityGroupIngress",
 	"AWS::ElasticLoadBalancingV2::ListenerCertificate",
 	"AWS::Elasticsearch::Domain",
-	"AWS::EMR::InstanceFleetConfig",
-	"AWS::EMR::InstanceGroupConfig",
 	"AWS::FSx::Snapshot",
 	"AWS::FSx::StorageVirtualMachine",
 	"AWS::FSx::Volume",
@@ -9496,7 +10684,7 @@ function unsupportedTypeIssueUrl(resourceType) {
 * CC API schema declares these as type: ["string", "object"] but
 * the implementation only accepts strings.
 */
-const JSON_STRING_PROPERTIES = { "AWS::Events::Rule": new Set(["EventPattern"]) };
+const JSON_STRING_PROPERTIES = { "AWS::Events::Rule": /* @__PURE__ */ new Set(["EventPattern"]) };
 /**
 * Stringify object properties that CC API expects as JSON strings.
 */
@@ -9685,7 +10873,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-Dbl1_mwT.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-er3xGYRo.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -10086,7 +11274,7 @@ var CloudControlProvider = class {
 	* even if they appear to be supported.
 	*/
 	static isSupportedResourceType(resourceType) {
-		if (new Set([
+		if ((/* @__PURE__ */ new Set([
 			"AWS::IAM::Role",
 			"AWS::IAM::Policy",
 			"AWS::IAM::User",
@@ -10102,7 +11290,7 @@ var CloudControlProvider = class {
 			"Custom::CDKBucketDeployment",
 			"Custom::S3AutoDeleteObjects",
 			"AWS::Route53::HostedZone"
-		]).has(resourceType)) return false;
+		])).has(resourceType)) return false;
 		if (resourceType.startsWith("Custom::") || resourceType.startsWith("AWS::CloudFormation::CustomResource")) return false;
 		if (isNonProvisionable(resourceType)) return false;
 		return resourceType.startsWith("AWS::");
@@ -10862,13 +12050,13 @@ var CustomResourceProvider = class CustomResourceProvider {
 
 //#endregion
 //#region src/provisioning/property-coverage.generated.ts
-const PROPERTY_COVERAGE_BY_TYPE = new Map([
+const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	["AWS::ApiGateway::Account", {
-		handled: new Set(["CloudWatchRoleArn"]),
+		handled: /* @__PURE__ */ new Set(["CloudWatchRoleArn"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::ApiGateway::Authorizer", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AuthorizerCredentials",
 			"AuthorizerResultTtlInSeconds",
 			"AuthorizerUri",
@@ -10883,15 +12071,15 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::ApiGateway::Deployment", {
-		handled: new Set(["Description", "RestApiId"]),
-		silentDrop: new Map([
+		handled: /* @__PURE__ */ new Set(["Description", "RestApiId"]),
+		silentDrop: /* @__PURE__ */ new Map([
 			["DeploymentCanarySettings", "not yet implemented by cdkd"],
 			["StageDescription", "CFn-only convenience for inline-creating a Stage; declare AWS::ApiGateway::Stage with the Description property instead"],
 			["StageName", "CFn-only convenience for inline-creating a Stage from a Deployment; declare AWS::ApiGateway::Stage explicitly to attach to this Deployment"]
 		])
 	}],
 	["AWS::ApiGateway::Method", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ApiKeyRequired",
 			"AuthorizationScopes",
 			"AuthorizationType",
@@ -10909,7 +12097,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::ApiGateway::Resource", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ParentId",
 			"PathPart",
 			"RestApiId"
@@ -10917,7 +12105,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::ApiGateway::Stage", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"DeploymentId",
 			"Description",
 			"MethodSettings",
@@ -10927,7 +12115,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"TracingEnabled",
 			"Variables"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["AccessLogSetting", "not yet implemented by cdkd"],
 			["CacheClusterEnabled", "not yet implemented by cdkd"],
 			["CacheClusterSize", "not yet implemented by cdkd"],
@@ -10937,7 +12125,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::ApiGatewayV2::Api", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ApiKeySelectionExpression",
 			"CorsConfiguration",
 			"Description",
@@ -10949,7 +12137,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"Tags",
 			"Version"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["BasePath", "OpenAPI-import-only basePath override; meaningful only on the ImportApi code path."],
 			["Body", "OpenAPI/Swagger inline spec; routed through ImportApi, not the field-by-field CreateApi path."],
 			["BodyS3Location", "OpenAPI/Swagger spec on S3; routed through ImportApi, not the field-by-field CreateApi path."],
@@ -10961,7 +12149,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::ApiGatewayV2::Authorizer", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ApiId",
 			"AuthorizerCredentialsArn",
 			"AuthorizerPayloadFormatVersion",
@@ -10977,7 +12165,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::ApiGatewayV2::Integration", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ApiId",
 			"Description",
 			"IntegrationMethod",
@@ -10987,7 +12175,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"RequestParameters",
 			"TimeoutInMillis"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["ConnectionId", "not yet implemented by cdkd"],
 			["ConnectionType", "not yet implemented by cdkd"],
 			["ContentHandlingStrategy", "not yet implemented by cdkd"],
@@ -11001,7 +12189,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::ApiGatewayV2::Route", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ApiId",
 			"AuthorizationScopes",
 			"AuthorizationType",
@@ -11010,7 +12198,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"RouteKey",
 			"Target"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["ApiKeyRequired", "not yet implemented by cdkd"],
 			["ModelSelectionExpression", "not yet implemented by cdkd"],
 			["RequestModels", "not yet implemented by cdkd"],
@@ -11019,7 +12207,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::ApiGatewayV2::Stage", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ApiId",
 			"AutoDeploy",
 			"DefaultRouteSettings",
@@ -11028,7 +12216,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"StageVariables",
 			"Tags"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["AccessLogSettings", "not yet implemented by cdkd"],
 			["ClientCertificateId", "not yet implemented by cdkd"],
 			["DeploymentId", "not yet implemented by cdkd"],
@@ -11036,7 +12224,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::AppSync::ApiKey", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ApiId",
 			"Description",
 			"Expires"
@@ -11044,7 +12232,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::AppSync::DataSource", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ApiId",
 			"Description",
 			"DynamoDBConfig",
@@ -11054,7 +12242,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"ServiceRoleArn",
 			"Type"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["ElasticsearchConfig", "Legacy Elasticsearch alias; use OpenSearchServiceConfig (AppSync deprecated the Elasticsearch DataSource type in favor of OpenSearch)"],
 			["EventBridgeConfig", "not yet implemented by cdkd"],
 			["MetricsConfig", "not yet implemented by cdkd"],
@@ -11063,14 +12251,14 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::AppSync::GraphQLApi", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AuthenticationType",
 			"LogConfig",
 			"Name",
 			"Tags",
 			"XrayEnabled"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["AdditionalAuthenticationProviders", "not yet implemented by cdkd"],
 			["ApiType", "not yet implemented by cdkd"],
 			["EnhancedMetricsConfig", "not yet implemented by cdkd"],
@@ -11087,7 +12275,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::AppSync::GraphQLSchema", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ApiId",
 			"Definition",
 			"DefinitionS3Location"
@@ -11095,7 +12283,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::AppSync::Resolver", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ApiId",
 			"Code",
 			"DataSourceName",
@@ -11107,7 +12295,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"Runtime",
 			"TypeName"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["CachingConfig", "not yet implemented by cdkd"],
 			["CodeS3Location", "not yet implemented by cdkd"],
 			["MaxBatchSize", "not yet implemented by cdkd"],
@@ -11118,7 +12306,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::AutoScaling::AutoScalingGroup", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AutoScalingGroupName",
 			"AvailabilityZoneDistribution",
 			"AvailabilityZoneImpairmentPolicy",
@@ -11153,7 +12341,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"TrafficSources",
 			"VPCZoneIdentifier"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["AvailabilityZoneIds", "not yet implemented by cdkd"],
 			["InstanceId", "not yet implemented by cdkd"],
 			["InstanceLifecyclePolicy", "not yet implemented by cdkd"],
@@ -11171,7 +12359,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::BedrockAgentCore::Evaluator", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Description",
 			"EvaluatorConfig",
 			"EvaluatorName",
@@ -11182,7 +12370,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::BedrockAgentCore::Runtime", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AgentRuntimeArtifact",
 			"AgentRuntimeName",
 			"AuthorizerConfiguration",
@@ -11194,14 +12382,14 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"ProtocolConfiguration",
 			"RoleArn"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["FilesystemConfigurations", "not yet implemented by cdkd"],
 			["RequestHeaderConfiguration", "not yet implemented by cdkd"],
 			["Tags", "not yet implemented by cdkd"]
 		])
 	}],
 	["AWS::Budgets::Budget", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Budget",
 			"NotificationsWithSubscribers",
 			"ResourceTags"
@@ -11209,7 +12397,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::CertificateManager::Certificate", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"CertificateAuthorityArn",
 			"CertificateExport",
 			"CertificateTransparencyLoggingPreference",
@@ -11223,8 +12411,8 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::CloudFormation::Stack", {
-		handled: new Set(["Parameters", "TemplateURL"]),
-		silentDrop: new Map([
+		handled: /* @__PURE__ */ new Set(["Parameters", "TemplateURL"]),
+		silentDrop: /* @__PURE__ */ new Map([
 			["Capabilities", "CFn-only IAM capability declaration — cdkd does not go through CloudFormation so capabilities have no equivalent"],
 			["Description", "CFn-only informational — no semantic effect on the recursive deploy"],
 			["DisableRollback", "CFn-only — cdkd controls rollback via the top-level deploy-engine --no-rollback flag, not per nested stack"],
@@ -11245,15 +12433,15 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::CloudFront::CloudFrontOriginAccessIdentity", {
-		handled: new Set(["CloudFrontOriginAccessIdentityConfig"]),
+		handled: /* @__PURE__ */ new Set(["CloudFrontOriginAccessIdentityConfig"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::CloudFront::Distribution", {
-		handled: new Set(["DistributionConfig", "Tags"]),
+		handled: /* @__PURE__ */ new Set(["DistributionConfig", "Tags"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::CloudTrail::Trail", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"CloudWatchLogsLogGroupArn",
 			"CloudWatchLogsRoleArn",
 			"EnableLogFileValidation",
@@ -11270,10 +12458,10 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"Tags",
 			"TrailName"
 		]),
-		silentDrop: new Map([["AdvancedEventSelectors", "not yet implemented by cdkd"], ["AggregationConfigurations", "not yet implemented by cdkd"]])
+		silentDrop: /* @__PURE__ */ new Map([["AdvancedEventSelectors", "not yet implemented by cdkd"], ["AggregationConfigurations", "not yet implemented by cdkd"]])
 	}],
 	["AWS::CloudWatch::Alarm", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ActionsEnabled",
 			"AlarmActions",
 			"AlarmDescription",
@@ -11297,10 +12485,10 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"TreatMissingData",
 			"Unit"
 		]),
-		silentDrop: new Map([["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."], ["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."]])
+		silentDrop: /* @__PURE__ */ new Map([["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."], ["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."]])
 	}],
 	["AWS::CodeBuild::Project", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Artifacts",
 			"AutoRetryLimit",
 			"BadgeEnabled",
@@ -11324,14 +12512,14 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"TimeoutInMinutes",
 			"VpcConfig"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["ResourceAccessRole", "not yet implemented by cdkd"],
 			["Triggers", "not yet implemented by cdkd"],
 			["Visibility", "not yet implemented by cdkd"]
 		])
 	}],
 	["AWS::CodeCommit::Repository", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Code",
 			"KmsKeyId",
 			"RepositoryDescription",
@@ -11342,7 +12530,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Cognito::UserPool", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AccountRecoverySetting",
 			"AdminCreateUserConfig",
 			"AliasAttributes",
@@ -11373,10 +12561,10 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"WebAuthnRelyingPartyID",
 			"WebAuthnUserVerification"
 		]),
-		silentDrop: new Map([["WebAuthnFactorConfiguration", "No SDK wire path: @aws-sdk/client-cognito-identity-provider has no field accepting SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION (not on CreateUserPool/UpdateUserPool, nor SetUserPoolMfaConfig.WebAuthnConfiguration which only carries RelyingPartyId/UserVerification); CC-API-registry-only property"]])
+		silentDrop: /* @__PURE__ */ new Map([["WebAuthnFactorConfiguration", "No SDK wire path: @aws-sdk/client-cognito-identity-provider has no field accepting SINGLE_FACTOR | MULTI_FACTOR_WITH_USER_VERIFICATION (not on CreateUserPool/UpdateUserPool, nor SetUserPoolMfaConfig.WebAuthnConfiguration which only carries RelyingPartyId/UserVerification); CC-API-registry-only property"]])
 	}],
 	["AWS::DLM::LifecyclePolicy", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"CopyTags",
 			"CreateInterval",
 			"CrossRegionCopyTargets",
@@ -11393,7 +12581,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::DocDB::DBCluster", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"BackupRetentionPeriod",
 			"DBClusterIdentifier",
 			"DBClusterParameterGroupName",
@@ -11410,7 +12598,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"Tags",
 			"VpcSecurityGroupIds"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["AvailabilityZones", "not yet implemented by cdkd"],
 			["CopyTagsToSnapshot", "not yet implemented by cdkd"],
 			["EnableCloudwatchLogsExports", "not yet implemented by cdkd"],
@@ -11429,7 +12617,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::DocDB::DBInstance", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AutoMinorVersionUpgrade",
 			"AvailabilityZone",
 			"DBClusterIdentifier",
@@ -11438,14 +12626,14 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"PreferredMaintenanceWindow",
 			"Tags"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["CACertificateIdentifier", "not yet implemented by cdkd"],
 			["CertificateRotationRestart", "not yet implemented by cdkd"],
 			["EnablePerformanceInsights", "not yet implemented by cdkd"]
 		])
 	}],
 	["AWS::DocDB::DBSubnetGroup", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"DBSubnetGroupDescription",
 			"DBSubnetGroupName",
 			"SubnetIds",
@@ -11454,7 +12642,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::DynamoDB::GlobalTable", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AttributeDefinitions",
 			"BillingMode",
 			"DeletionProtectionEnabled",
@@ -11470,7 +12658,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"WriteOnDemandThroughputSettings",
 			"WriteProvisionedThroughputSettings"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["GlobalTableSourceArn", "not yet implemented by cdkd"],
 			["GlobalTableWitnesses", "not yet implemented by cdkd"],
 			["MultiRegionConsistency", "not yet implemented by cdkd"],
@@ -11480,7 +12668,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::DynamoDB::Table", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AttributeDefinitions",
 			"BillingMode",
 			"ContributorInsightsSpecification",
@@ -11501,10 +12689,10 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"TimeToLiveSpecification",
 			"WarmThroughput"
 		]),
-		silentDrop: new Map([["ImportSourceSpecification", "S3 import uses the separate ImportTable API (not CreateTable) and is create-only with no readback; deferred to a dedicated import-from-S3 PR"]])
+		silentDrop: /* @__PURE__ */ new Map([["ImportSourceSpecification", "S3 import uses the separate ImportTable API (not CreateTable) and is create-only with no readback; deferred to a dedicated import-from-S3 PR"]])
 	}],
 	["AWS::EC2::Instance", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"BlockDeviceMappings",
 			"CreditSpecification",
 			"DisableApiTermination",
@@ -11521,7 +12709,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"Tags",
 			"UserData"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["AdditionalInfo", "not yet implemented by cdkd"],
 			["Affinity", "not yet implemented by cdkd"],
 			["AvailabilityZone", "not yet implemented by cdkd"],
@@ -11551,11 +12739,11 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::EC2::InternetGateway", {
-		handled: new Set(["Tags"]),
+		handled: /* @__PURE__ */ new Set(["Tags"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::EC2::NatGateway", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AllocationId",
 			"ConnectivityType",
 			"MaxDrainDurationSeconds",
@@ -11566,18 +12754,18 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"SubnetId",
 			"Tags"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["AvailabilityMode", "not yet implemented by cdkd"],
 			["AvailabilityZoneAddresses", "not yet implemented by cdkd"],
 			["VpcId", "AWS derives the VPC from SubnetId; the ec2:CreateNatGateway API has no VpcId parameter"]
 		])
 	}],
 	["AWS::EC2::NetworkAcl", {
-		handled: new Set(["Tags", "VpcId"]),
+		handled: /* @__PURE__ */ new Set(["Tags", "VpcId"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::EC2::NetworkAclEntry", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"CidrBlock",
 			"Egress",
 			"Icmp",
@@ -11591,7 +12779,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::EC2::Route", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"DestinationCidrBlock",
 			"DestinationIpv6CidrBlock",
 			"EgressOnlyInternetGatewayId",
@@ -11602,7 +12790,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"RouteTableId",
 			"VpcPeeringConnectionId"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["CarrierGatewayId", "not yet implemented by cdkd"],
 			["CoreNetworkArn", "not yet implemented by cdkd"],
 			["DestinationPrefixListId", "not yet implemented by cdkd"],
@@ -11612,11 +12800,11 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::EC2::RouteTable", {
-		handled: new Set(["Tags", "VpcId"]),
+		handled: /* @__PURE__ */ new Set(["Tags", "VpcId"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::EC2::SecurityGroup", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"GroupDescription",
 			"GroupName",
 			"SecurityGroupEgress",
@@ -11627,7 +12815,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::EC2::SecurityGroupIngress", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"CidrIp",
 			"CidrIpv6",
 			"Description",
@@ -11639,17 +12827,17 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"SourceSecurityGroupOwnerId",
 			"ToPort"
 		]),
-		silentDrop: new Map([["GroupName", "EC2-Classic-only — use GroupId for VPC security groups (EC2-Classic retired 2022-08-15)"], ["SourceSecurityGroupName", "EC2-Classic-only — use SourceSecurityGroupId for VPC peer security groups (EC2-Classic retired 2022-08-15)"]])
+		silentDrop: /* @__PURE__ */ new Map([["GroupName", "EC2-Classic-only — use GroupId for VPC security groups (EC2-Classic retired 2022-08-15)"], ["SourceSecurityGroupName", "EC2-Classic-only — use SourceSecurityGroupId for VPC peer security groups (EC2-Classic retired 2022-08-15)"]])
 	}],
 	["AWS::EC2::Subnet", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AvailabilityZone",
 			"CidrBlock",
 			"MapPublicIpOnLaunch",
 			"Tags",
 			"VpcId"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["AssignIpv6AddressOnCreation", "not yet implemented by cdkd"],
 			["AvailabilityZoneId", "not yet implemented by cdkd"],
 			["EnableDns64", "not yet implemented by cdkd"],
@@ -11665,29 +12853,29 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::EC2::SubnetNetworkAclAssociation", {
-		handled: new Set(["NetworkAclId", "SubnetId"]),
+		handled: /* @__PURE__ */ new Set(["NetworkAclId", "SubnetId"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::EC2::SubnetRouteTableAssociation", {
-		handled: new Set(["RouteTableId", "SubnetId"]),
+		handled: /* @__PURE__ */ new Set(["RouteTableId", "SubnetId"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::EC2::VPC", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"CidrBlock",
 			"EnableDnsHostnames",
 			"EnableDnsSupport",
 			"InstanceTenancy",
 			"Tags"
 		]),
-		silentDrop: new Map([["Ipv4IpamPoolId", "not yet implemented by cdkd"], ["Ipv4NetmaskLength", "not yet implemented by cdkd"]])
+		silentDrop: /* @__PURE__ */ new Map([["Ipv4IpamPoolId", "not yet implemented by cdkd"], ["Ipv4NetmaskLength", "not yet implemented by cdkd"]])
 	}],
 	["AWS::EC2::VPCGatewayAttachment", {
-		handled: new Set(["InternetGatewayId", "VpcId"]),
-		silentDrop: new Map([["VpnGatewayId", "not yet implemented by cdkd"]])
+		handled: /* @__PURE__ */ new Set(["InternetGatewayId", "VpcId"]),
+		silentDrop: /* @__PURE__ */ new Map([["VpnGatewayId", "not yet implemented by cdkd"]])
 	}],
 	["AWS::ECR::Repository", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"EmptyOnDelete",
 			"EncryptionConfiguration",
 			"ImageScanningConfiguration",
@@ -11701,7 +12889,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::ECS::Cluster", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"CapacityProviders",
 			"ClusterName",
 			"ClusterSettings",
@@ -11713,7 +12901,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::ECS::Service", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"CapacityProviderStrategy",
 			"Cluster",
 			"DeploymentConfiguration",
@@ -11734,7 +12922,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"Tags",
 			"TaskDefinition"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["AvailabilityZoneRebalancing", "not yet implemented by cdkd"],
 			["DeploymentController", "not yet implemented by cdkd"],
 			["ForceNewDeployment", "not yet implemented by cdkd"],
@@ -11745,7 +12933,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::ECS::TaskDefinition", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ContainerDefinitions",
 			"Cpu",
 			"EnableFaultInjection",
@@ -11764,19 +12952,19 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"TaskRoleArn",
 			"Volumes"
 		]),
-		silentDrop: new Map([["InferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])
+		silentDrop: /* @__PURE__ */ new Map([["InferenceAccelerators", "AWS Elastic Inference end-of-life 2024-04; use AWS Inferentia / Trainium accelerator instance families instead"]])
 	}],
 	["AWS::EFS::AccessPoint", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AccessPointTags",
 			"FileSystemId",
 			"PosixUser",
 			"RootDirectory"
 		]),
-		silentDrop: new Map([["ClientToken", "AWS SDK manages this idempotency token internally on CreateAccessPoint; no user-supplied value is honored"]])
+		silentDrop: /* @__PURE__ */ new Map([["ClientToken", "AWS SDK manages this idempotency token internally on CreateAccessPoint; no user-supplied value is honored"]])
 	}],
 	["AWS::EFS::FileSystem", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AvailabilityZoneName",
 			"BackupPolicy",
 			"BypassPolicyLockoutSafetyCheck",
@@ -11790,22 +12978,22 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"ProvisionedThroughputInMibps",
 			"ThroughputMode"
 		]),
-		silentDrop: new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]])
+		silentDrop: /* @__PURE__ */ new Map([["ReplicationConfiguration", "Cross-region EFS replication (CreateReplicationConfiguration) provisions a separate destination file system in another region with its own lifecycle, KMS key, and availability-zone placement; replicating + then tearing down the destination on destroy is a multi-resource, cross-region orchestration that is out of scope for the single-resource SDK provider. Tracked as a follow-up to issue #609."]])
 	}],
 	["AWS::EFS::MountTarget", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"FileSystemId",
 			"SecurityGroups",
 			"SubnetId"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["IpAddress", "not yet implemented by cdkd"],
 			["IpAddressType", "not yet implemented by cdkd"],
 			["Ipv6Address", "not yet implemented by cdkd"]
 		])
 	}],
 	["AWS::ElastiCache::CacheCluster", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AutoMinorVersionUpgrade",
 			"AZMode",
 			"CacheNodeType",
@@ -11830,10 +13018,10 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"TransitEncryptionEnabled",
 			"VpcSecurityGroupIds"
 		]),
-		silentDrop: new Map([["CacheSecurityGroupNames", "EC2-Classic-only — use VpcSecurityGroupIds for VPC-deployed clusters (EC2-Classic retired 2022-08-15)"], ["SnapshotArns", "not yet implemented by cdkd"]])
+		silentDrop: /* @__PURE__ */ new Map([["CacheSecurityGroupNames", "EC2-Classic-only — use VpcSecurityGroupIds for VPC-deployed clusters (EC2-Classic retired 2022-08-15)"], ["SnapshotArns", "not yet implemented by cdkd"]])
 	}],
 	["AWS::ElastiCache::SubnetGroup", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"CacheSubnetGroupDescription",
 			"CacheSubnetGroupName",
 			"Description",
@@ -11843,7 +13031,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::ElasticLoadBalancingV2::Listener", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AlpnPolicy",
 			"Certificates",
 			"DefaultActions",
@@ -11857,7 +13045,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::ElasticLoadBalancingV2::LoadBalancer", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"IpAddressType",
 			"LoadBalancerAttributes",
 			"Name",
@@ -11868,7 +13056,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"Tags",
 			"Type"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["EnableCapacityReservationProvisionStabilize", "not yet implemented by cdkd"],
 			["EnablePrefixForIpv6SourceNat", "not yet implemented by cdkd"],
 			["EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic", "not yet implemented by cdkd"],
@@ -11877,7 +13065,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::ElasticLoadBalancingV2::TargetGroup", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"HealthCheckEnabled",
 			"HealthCheckIntervalSeconds",
 			"HealthCheckPath",
@@ -11895,7 +13083,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"UnhealthyThresholdCount",
 			"VpcId"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["IpAddressType", "not yet implemented by cdkd"],
 			["TargetControlPort", "not yet implemented by cdkd"],
 			["TargetGroupAttributes", "not yet implemented by cdkd"],
@@ -11903,7 +13091,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::EMR::Cluster", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AdditionalInfo",
 			"Applications",
 			"AutoScalingRole",
@@ -11934,8 +13122,37 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
+	["AWS::EMR::InstanceFleetConfig", {
+		handled: /* @__PURE__ */ new Set([
+			"ClusterId",
+			"InstanceFleetType",
+			"InstanceTypeConfigs",
+			"LaunchSpecifications",
+			"Name",
+			"ResizeSpecifications",
+			"TargetOnDemandCapacity",
+			"TargetSpotCapacity"
+		]),
+		silentDrop: /* @__PURE__ */ new Map()
+	}],
+	["AWS::EMR::InstanceGroupConfig", {
+		handled: /* @__PURE__ */ new Set([
+			"AutoScalingPolicy",
+			"BidPrice",
+			"Configurations",
+			"CustomAmiId",
+			"EbsConfiguration",
+			"InstanceCount",
+			"InstanceRole",
+			"InstanceType",
+			"JobFlowId",
+			"Market",
+			"Name"
+		]),
+		silentDrop: /* @__PURE__ */ new Map()
+	}],
 	["AWS::Events::EventBus", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"DeadLetterConfig",
 			"Description",
 			"EventSourceName",
@@ -11948,7 +13165,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Events::Rule", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Description",
 			"EventBusName",
 			"EventPattern",
@@ -11962,31 +13179,30 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::FSx::FileSystem", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"BackupId",
 			"FileSystemType",
 			"FileSystemTypeVersion",
 			"KmsKeyId",
 			"LustreConfiguration",
 			"NetworkType",
+			"OntapConfiguration",
+			"OpenZFSConfiguration",
 			"SecurityGroupIds",
 			"StorageCapacity",
 			"StorageType",
 			"SubnetIds",
-			"Tags"
+			"Tags",
+			"WindowsConfiguration"
 		]),
-		silentDrop: new Map([
-			["OntapConfiguration", "FSx for NetApp ONTAP variant — the file system is only a container for SVMs/volumes (separate AWS::FSx::StorageVirtualMachine / AWS::FSx::Volume types, both still unsupported), so shipping it alone would be misleading; only the Lustre variant is supported in v1. Follow-up to issue #1042."],
-			["OpenZFSConfiguration", "FSx for OpenZFS variant — root-volume semantics (RootVolumeId, child AWS::FSx::Volume trees) are not implemented in v1; only the Lustre variant is supported. Follow-up to issue #1042."],
-			["WindowsConfiguration", "FSx for Windows File Server variant — requires Active Directory wiring and Windows-specific update/delete semantics (final backups, throughput tiers) that v1 does not implement; only the Lustre variant (the CDK L2) is supported. Follow-up to issue #1042."]
-		])
+		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Glue::Connection", {
-		handled: new Set(["CatalogId", "ConnectionInput"]),
+		handled: /* @__PURE__ */ new Set(["CatalogId", "ConnectionInput"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Glue::Crawler", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Classifiers",
 			"Configuration",
 			"CrawlerSecurityConfiguration",
@@ -12006,7 +13222,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Glue::Database", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"CatalogId",
 			"DatabaseInput",
 			"DatabaseName"
@@ -12014,7 +13230,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Glue::Job", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AllocatedCapacity",
 			"Command",
 			"Connections",
@@ -12043,11 +13259,11 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Glue::SecurityConfiguration", {
-		handled: new Set(["EncryptionConfiguration", "Name"]),
+		handled: /* @__PURE__ */ new Set(["EncryptionConfiguration", "Name"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Glue::Table", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"CatalogId",
 			"DatabaseName",
 			"Name",
@@ -12057,7 +13273,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Glue::Trigger", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Actions",
 			"Description",
 			"EventBatchingCondition",
@@ -12072,7 +13288,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Glue::Workflow", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"DefaultRunProperties",
 			"Description",
 			"MaxConcurrentRuns",
@@ -12082,7 +13298,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::IAM::Group", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"GroupName",
 			"ManagedPolicyArns",
 			"Path",
@@ -12091,7 +13307,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::IAM::InstanceProfile", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"InstanceProfileName",
 			"Path",
 			"Roles"
@@ -12099,7 +13315,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::IAM::ManagedPolicy", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Description",
 			"Groups",
 			"ManagedPolicyName",
@@ -12112,7 +13328,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::IAM::Policy", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Groups",
 			"PolicyDocument",
 			"PolicyName",
@@ -12122,7 +13338,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::IAM::Role", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AssumeRolePolicyDocument",
 			"Description",
 			"ManagedPolicyArns",
@@ -12136,7 +13352,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::IAM::User", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Groups",
 			"LoginProfile",
 			"ManagedPolicyArns",
@@ -12149,11 +13365,11 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::IAM::UserToGroupAddition", {
-		handled: new Set(["GroupName", "Users"]),
+		handled: /* @__PURE__ */ new Set(["GroupName", "Users"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Kinesis::Stream", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Name",
 			"RetentionPeriodHours",
 			"ShardCount",
@@ -12161,14 +13377,14 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"StreamModeDetails",
 			"Tags"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["DesiredShardLevelMetrics", "not yet implemented by cdkd"],
 			["MaxRecordSizeInKiB", "not yet implemented by cdkd"],
 			["WarmThroughputMiBps", "not yet implemented by cdkd"]
 		])
 	}],
 	["AWS::Kinesis::StreamConsumer", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ConsumerName",
 			"StreamARN",
 			"Tags"
@@ -12176,7 +13392,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::KinesisFirehose::DeliveryStream", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AmazonOpenSearchServerlessDestinationConfiguration",
 			"AmazonopensearchserviceDestinationConfiguration",
 			"DeliveryStreamEncryptionConfigurationInput",
@@ -12191,7 +13407,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"SplunkDestinationConfiguration",
 			"Tags"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["DatabaseSourceConfiguration", "not yet implemented by cdkd"],
 			["DirectPutSourceConfiguration", "not yet implemented by cdkd"],
 			["IcebergDestinationConfiguration", "not yet implemented by cdkd"],
@@ -12200,11 +13416,11 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::KMS::Alias", {
-		handled: new Set(["AliasName", "TargetKeyId"]),
+		handled: /* @__PURE__ */ new Set(["AliasName", "TargetKeyId"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::KMS::Key", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"BypassPolicyLockoutSafetyCheck",
 			"Description",
 			"Enabled",
@@ -12221,7 +13437,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Lambda::EventInvokeConfig", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"DestinationConfig",
 			"FunctionName",
 			"MaximumEventAgeInSeconds",
@@ -12231,7 +13447,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Lambda::EventSourceMapping", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AmazonManagedKafkaEventSourceConfig",
 			"BatchSize",
 			"BisectBatchOnFunctionError",
@@ -12264,7 +13480,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Lambda::Function", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Architectures",
 			"Code",
 			"DeadLetterConfig",
@@ -12290,7 +13506,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"TracingConfig",
 			"VpcConfig"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["CapacityProviderConfig", "not yet implemented by cdkd"],
 			["CodeSigningConfigArn", "not yet implemented by cdkd"],
 			["DurableConfig", "not yet implemented by cdkd"],
@@ -12301,7 +13517,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::Lambda::LayerVersion", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"CompatibleArchitectures",
 			"CompatibleRuntimes",
 			"Content",
@@ -12312,7 +13528,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Lambda::Permission", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Action",
 			"EventSourceToken",
 			"FunctionName",
@@ -12326,7 +13542,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Lambda::Url", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AuthType",
 			"Cors",
 			"InvokeMode",
@@ -12336,7 +13552,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Logs::LogGroup", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"BearerTokenAuthenticationEnabled",
 			"DataProtectionPolicy",
 			"DeletionProtectionEnabled",
@@ -12351,7 +13567,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Neptune::DBCluster", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"BackupRetentionPeriod",
 			"DBClusterIdentifier",
 			"DBClusterParameterGroupName",
@@ -12368,7 +13584,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"Tags",
 			"VpcSecurityGroupIds"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["AssociatedRoles", "not yet implemented by cdkd"],
 			["AvailabilityZones", "not yet implemented by cdkd"],
 			["CopyTagsToSnapshot", "not yet implemented by cdkd"],
@@ -12383,7 +13599,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::Neptune::DBInstance", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AutoMinorVersionUpgrade",
 			"AvailabilityZone",
 			"DBClusterIdentifier",
@@ -12395,14 +13611,14 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"PreferredMaintenanceWindow",
 			"Tags"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["AllowMajorVersionUpgrade", "not yet implemented by cdkd"],
 			["DBSnapshotIdentifier", "not yet implemented by cdkd"],
 			["PubliclyAccessible", "not yet implemented by cdkd"]
 		])
 	}],
 	["AWS::Neptune::DBSubnetGroup", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"DBSubnetGroupDescription",
 			"DBSubnetGroupName",
 			"SubnetIds",
@@ -12411,7 +13627,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::RDS::DBCluster", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"BackupRetentionPeriod",
 			"DatabaseName",
 			"DBClusterIdentifier",
@@ -12434,7 +13650,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"Tags",
 			"VpcSecurityGroupIds"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["AllocatedStorage", "not yet implemented by cdkd"],
 			["AssociatedRoles", "not yet implemented by cdkd"],
 			["AutoMinorVersionUpgrade", "not yet implemented by cdkd"],
@@ -12478,7 +13694,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::RDS::DBInstance", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AllocatedStorage",
 			"DBClusterIdentifier",
 			"DBInstanceClass",
@@ -12501,7 +13717,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"Tags",
 			"VPCSecurityGroups"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["AdditionalStorageVolumes", "not yet implemented by cdkd"],
 			["AllowMajorVersionUpgrade", "not yet implemented by cdkd"],
 			["ApplyImmediately", "cdkd always applies modifications immediately (rds:ModifyDBInstance.ApplyImmediately=true is hardcoded); users wanting maintenance-window deferral should run aws rds modify-db-instance directly"],
@@ -12567,7 +13783,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::RDS::DBProxy", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Auth",
 			"DBProxyName",
 			"DebugLogging",
@@ -12579,14 +13795,14 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"VpcSecurityGroupIds",
 			"VpcSubnetIds"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["DefaultAuthScheme", "not yet implemented by cdkd"],
 			["EndpointNetworkType", "not yet implemented by cdkd"],
 			["TargetConnectionNetworkType", "not yet implemented by cdkd"]
 		])
 	}],
 	["AWS::RDS::DBProxyEndpoint", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"DBProxyEndpointName",
 			"DBProxyName",
 			"Tags",
@@ -12594,10 +13810,10 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"VpcSecurityGroupIds",
 			"VpcSubnetIds"
 		]),
-		silentDrop: new Map([["EndpointNetworkType", "not yet implemented by cdkd"]])
+		silentDrop: /* @__PURE__ */ new Map([["EndpointNetworkType", "not yet implemented by cdkd"]])
 	}],
 	["AWS::RDS::DBProxyTargetGroup", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ConnectionPoolConfigurationInfo",
 			"DBClusterIdentifiers",
 			"DBInstanceIdentifiers",
@@ -12607,7 +13823,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::RDS::DBSubnetGroup", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"DBSubnetGroupDescription",
 			"DBSubnetGroupName",
 			"SubnetIds",
@@ -12616,7 +13832,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Route53::HostedZone", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"HostedZoneConfig",
 			"HostedZoneFeatures",
 			"HostedZoneTags",
@@ -12627,7 +13843,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Route53::RecordSet", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AliasTarget",
 			"CidrRoutingConfig",
 			"Comment",
@@ -12649,7 +13865,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::S3::Bucket", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AccelerateConfiguration",
 			"AnalyticsConfigurations",
 			"BucketEncryption",
@@ -12670,7 +13886,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"VersioningConfiguration",
 			"WebsiteConfiguration"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["AbacStatus", "not yet implemented by cdkd"],
 			["AccessControl", "Legacy canned ACL; AWS disables ACLs by default since 2023-04 — use BucketOwnershipControls + BucketPolicy / PublicAccessBlockConfiguration instead"],
 			["BucketNamePrefix", "not yet implemented by cdkd"],
@@ -12680,16 +13896,16 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::S3::BucketPolicy", {
-		handled: new Set(["Bucket", "PolicyDocument"]),
+		handled: /* @__PURE__ */ new Set(["Bucket", "PolicyDocument"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::S3Express::DirectoryBucket", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"BucketName",
 			"DataRedundancy",
 			"LocationName"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["BucketEncryption", "not yet implemented by cdkd"],
 			["InventoryConfigurations", "not yet implemented by cdkd"],
 			["LifecycleConfiguration", "not yet implemented by cdkd"],
@@ -12698,11 +13914,11 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::S3Tables::Namespace", {
-		handled: new Set(["Namespace", "TableBucketARN"]),
+		handled: /* @__PURE__ */ new Set(["Namespace", "TableBucketARN"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::S3Tables::Table", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Format",
 			"Name",
 			"Namespace",
@@ -12711,7 +13927,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"TableName",
 			"Tags"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["Compaction", "not yet implemented by cdkd"],
 			["IcebergMetadata", "not yet implemented by cdkd"],
 			["SnapshotManagement", "not yet implemented by cdkd"],
@@ -12720,8 +13936,8 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::S3Tables::TableBucket", {
-		handled: new Set(["TableBucketName", "Tags"]),
-		silentDrop: new Map([
+		handled: /* @__PURE__ */ new Set(["TableBucketName", "Tags"]),
+		silentDrop: /* @__PURE__ */ new Map([
 			["EncryptionConfiguration", "not yet implemented by cdkd"],
 			["MetricsConfiguration", "not yet implemented by cdkd"],
 			["ReplicationConfiguration", "not yet implemented by cdkd"],
@@ -12730,7 +13946,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		])
 	}],
 	["AWS::S3Vectors::VectorBucket", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"EncryptionConfiguration",
 			"Tags",
 			"VectorBucketName"
@@ -12738,7 +13954,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::Scheduler::Schedule", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Description",
 			"EndDate",
 			"FlexibleTimeWindow",
@@ -12754,7 +13970,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::SecretsManager::Secret", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Description",
 			"GenerateSecretString",
 			"KmsKeyId",
@@ -12767,7 +13983,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::ServiceDiscovery::HttpNamespace", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Description",
 			"Name",
 			"Tags"
@@ -12775,7 +13991,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::ServiceDiscovery::PrivateDnsNamespace", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Description",
 			"Name",
 			"Properties",
@@ -12785,7 +14001,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::ServiceDiscovery::PublicDnsNamespace", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Description",
 			"Name",
 			"Properties",
@@ -12794,7 +14010,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::ServiceDiscovery::Service", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Description",
 			"DnsConfig",
 			"HealthCheckConfig",
@@ -12808,7 +14024,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::SNS::Subscription", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"DeliveryPolicy",
 			"Endpoint",
 			"FilterPolicy",
@@ -12820,10 +14036,10 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"SubscriptionRoleArn",
 			"TopicArn"
 		]),
-		silentDrop: new Map([["Region", "CFn-only cross-region subscription hint; cdkd uses the SDK client region directly and has no per-resource region override"]])
+		silentDrop: /* @__PURE__ */ new Map([["Region", "CFn-only cross-region subscription hint; cdkd uses the SDK client region directly and has no per-resource region override"]])
 	}],
 	["AWS::SNS::Topic", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ArchivePolicy",
 			"ContentBasedDeduplication",
 			"DataProtectionPolicy",
@@ -12841,11 +14057,11 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::SNS::TopicPolicy", {
-		handled: new Set(["PolicyDocument", "Topics"]),
+		handled: /* @__PURE__ */ new Set(["PolicyDocument", "Topics"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::SQS::Queue", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"ContentBasedDeduplication",
 			"DeduplicationScope",
 			"DelaySeconds",
@@ -12866,11 +14082,11 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::SQS::QueuePolicy", {
-		handled: new Set(["PolicyDocument", "Queues"]),
+		handled: /* @__PURE__ */ new Set(["PolicyDocument", "Queues"]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::SSM::Parameter", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AllowedPattern",
 			"DataType",
 			"Description",
@@ -12884,7 +14100,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::StepFunctions::StateMachine", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"Definition",
 			"DefinitionS3Location",
 			"DefinitionString",
@@ -12900,7 +14116,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
 	["AWS::WAFv2::WebACL", {
-		handled: new Set([
+		handled: /* @__PURE__ */ new Set([
 			"AssociationConfig",
 			"CaptchaConfig",
 			"ChallengeConfig",
@@ -12914,7 +14130,7 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 			"TokenDomains",
 			"VisibilityConfig"
 		]),
-		silentDrop: new Map([
+		silentDrop: /* @__PURE__ */ new Map([
 			["ApplicationConfig", "not yet implemented by cdkd"],
 			["DataProtectionConfig", "not yet implemented by cdkd"],
 			["OnSourceDDoSProtectionConfig", "not yet implemented by cdkd"]
@@ -13050,7 +14266,7 @@ function findActionableSilentDrops(resourceType, templateProperties, allowedKeys
 *   bare schedule name as physicalId, and the state properties carry
 *   GroupName, so the SDK provider addresses existing records correctly.
 */
-const STICKY_CC_MIGRATION_EXEMPT = new Set(["AWS::Scheduler::Schedule"]);
+const STICKY_CC_MIGRATION_EXEMPT = /* @__PURE__ */ new Set(["AWS::Scheduler::Schedule"]);
 var ProviderRegistry = class {
 	logger = getLogger().child("ProviderRegistry");
 	providers = /* @__PURE__ */ new Map();
@@ -13387,7 +14603,7 @@ function isCustomResource(resourceType) {
 var IAMRoleProvider = class {
 	iamClient;
 	logger = getLogger().child("IAMRoleProvider");
-	handledProperties = new Map([["AWS::IAM::Role", new Set([
+	handledProperties = /* @__PURE__ */ new Map([["AWS::IAM::Role", /* @__PURE__ */ new Set([
 		"RoleName",
 		"AssumeRolePolicyDocument",
 		"Description",
@@ -14084,7 +15300,7 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 * Both conditional checks live in {@link isStatefulRecreateTarget};
 * the bare {@link STATEFUL_TYPES} set is the type-only first-cut.
 */
-const STATEFUL_TYPES = new Set([
+const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::RDS::DBInstance",
 	"AWS::RDS::DBCluster",
 	"AWS::DocDB::DBInstance",
@@ -14120,7 +15336,7 @@ const STATEFUL_TYPES = new Set([
 * loss (bypassable with `--force-stateful-recreation`); this set is
 * an out-of-scope refusal (no bypass).
 */
-const MULTI_REGION_RECREATE_BLOCKED_TYPES = new Set(["AWS::DynamoDB::GlobalTable"]);
+const MULTI_REGION_RECREATE_BLOCKED_TYPES = /* @__PURE__ */ new Set(["AWS::DynamoDB::GlobalTable"]);
 /**
 * Cheap, synchronous read of the resource's recorded properties only.
 * For `AWS::S3::Bucket` this returns `null` — the live `ListObjectsV2`
@@ -14416,7 +15632,7 @@ function extractReferencedAlarmNames(alarmRule) {
 */
 function computeImplicitDeleteEdges(resources) {
 	const edges = [];
-	const alarmTypes = new Set(["AWS::CloudWatch::Alarm", "AWS::CloudWatch::CompositeAlarm"]);
+	const alarmTypes = /* @__PURE__ */ new Set(["AWS::CloudWatch::Alarm", "AWS::CloudWatch::CompositeAlarm"]);
 	const nameToLogicalId = /* @__PURE__ */ new Map();
 	for (const [logicalId, resource] of Object.entries(resources)) {
 		if (!alarmTypes.has(resource.resourceType)) continue;
@@ -14479,6 +15695,7 @@ const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
 	"Policy contains a statement with one or more invalid principals",
 	"Invalid IAM Instance Profile",
 	"Invalid InstanceProfile",
+	"Failed to authorize instance profile",
 	"Could not deliver test message",
 	"wait 60 seconds",
 	"concurrent update operation",
@@ -14489,7 +15706,7 @@ const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
 * HTTP status codes that always indicate a transient failure worth retrying.
 * 429 = Too Many Requests (throttle), 503 = Service Unavailable.
 */
-const RETRYABLE_HTTP_STATUS_CODES = new Set([429, 503]);
+const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
 /**
 * AWS SDK v3 canonical throttling error names. Mirrors
 * `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
@@ -14499,7 +15716,7 @@ const RETRYABLE_HTTP_STATUS_CODES = new Set([429, 503]);
 * (not 429) with the throttling signal carried only in the error code / name
 * (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
 */
-const THROTTLING_ERROR_NAMES = new Set([
+const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
 	"BandwidthLimitExceeded",
 	"EC2ThrottledException",
 	"LimitExceededException",
@@ -16176,5 +17393,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { getDockerCmd as $, DiffCalculator as A, buildAssetRedirectMap as B, findActionableSilentDrops as C, resolveBucketRegion as Ct, refStateLookupFromResource as D, cfnRefValueFromPhysicalId as E, rebuildClientForBucketRegion as F, BOOTSTRAP_MARKER_PREFIX as G, loadPublishableAssetManifest as H, shouldRetainResource as I, parseBootstrapMarker as J, ensureAssetStorage as K, AssetPublisher as L, TemplateParser as M, LockManager as N, WAFv2WebACLProvider as O, S3StateBackend as P, formatDockerLoginError as Q, stringifyValue as R, ProviderRegistry as S, clearBucketRegionCache as St, IntrinsicFunctionResolver as T, rewriteTemplateAssetReferences as U, createAssetRedirectResolver as V, AssetModeResolver as W, validateContainerRepoName as X, validateAssetBucketName as Y, buildDockerImage as Z, green as _, CFN_TEMPLATE_URL_LIMIT as _t, withRetry as a, synthesisStatusMessage as at, IAMRoleProvider as b, uploadCfnTemplate as bt, computeImplicitDeleteEdges as c, resolveApp as ct, isStatefulRecreateTargetSync as d, resolveSkipPrefix as dt, runDockerForeground as et, renderStatefulReason as f, resolveStateBucketWithDefault as ft, gray as g, CFN_TEMPLATE_BODY_LIMIT as gt, cyan as h, warnDeprecatedNoPrefixCliFlag as ht, withResourceDeadline as i, Synthesizer as it, DagBuilder as j, applyRoleArnIfSet as k, extractDeploymentEventError as l, resolveAutoAssetStorage as lt, bold as m, resolveUseCdkBootstrapAssets as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetManifestLoader as nt, isRetryableTransientError as o, getDefaultStateBucketName as ot, formatResourceLine as p, resolveStateBucketWithDefaultAndSource as pt, getBootstrapMarkerKey as q, DeployEngine as r, getDockerImageBySourceHash as rt, IMPLICIT_DELETE_DEPENDENCIES as s, getLegacyStateBucketName as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, runDockerStreaming as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, resolveCaptureObservedState as ut, red as v, MIGRATE_TMP_PREFIX as vt, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, AssemblyReader as xt, yellow as y, findLargeInlineResources as yt, WorkGraph as z };
-//# sourceMappingURL=deploy-engine-D6U-Cm8B.js.map
+export { ensureAssetStorage as $, SynthesisError as $t, WAFv2WebACLProvider as A, clearBucketRegionCache as At, LockManager as B, LocalInvokeBuildError as Bt, findActionableSilentDrops as C, CFN_TEMPLATE_BODY_LIMIT as Ct, IntrinsicFunctionResolver as D, uploadCfnTemplate as Dt, isTerminationProtectionPropagationError as E, findLargeInlineResources as Et, assertRegionMatch as F, setAwsClients as Ft, stringifyValue as G, NestedStackChildDirectDestroyError as Gt, rebuildClientForBucketRegion as H, LocalStartServiceError as Ht, applyRoleArnIfSet as I, AssetError as It, createAssetRedirectResolver as J, ResourceTimeoutError as Jt, WorkGraph as K, PartialFailureError as Kt, DiffCalculator as L, CdkdError as Lt, matchesCdkPath as M, AwsClients as Mt, normalizeAwsTagsToCfn as N, getAwsClients as Nt, cfnRefValueFromPhysicalId as O, expectedOwnerParam as Ot, resolveExplicitPhysicalId as P, resetAwsClients as Pt, BOOTSTRAP_MARKER_PREFIX as Q, StateError as Qt, DagBuilder as R, ConfigError as Rt, ProviderRegistry as S, warnDeprecatedNoPrefixCliFlag as St, disableInstanceApiTermination as T, MIGRATE_TMP_PREFIX as Tt, shouldRetainResource as U, LockError as Ut, S3StateBackend as V, LocalMigrateError as Vt, AssetPublisher as W, MissingCdkCliError as Wt, rewriteTemplateAssetReferences as X, StackHasActiveImportsError as Xt, loadPublishableAssetManifest as Y, ResourceUpdateNotSupportedError as Yt, AssetModeResolver as Z, StackTerminationProtectionError as Zt, green as _, resolveCaptureObservedState as _t, withRetry as a, formatDockerLoginError as at, IAMRoleProvider as b, resolveStateBucketWithDefaultAndSource as bt, computeImplicitDeleteEdges as c, runDockerStreaming as ct, isStatefulRecreateTargetSync as d, Synthesizer as dt, formatError as en, getBootstrapMarkerKey as et, renderStatefulReason as f, synthesisStatusMessage as ft, gray as g, resolveAutoAssetStorage as gt, cyan as h, resolveApp as ht, withResourceDeadline as i, __exportAll as in, buildDockerImage as it, CDK_PATH_TAG as j, resolveBucketRegion as jt, refStateLookupFromResource as k, AssemblyReader as kt, extractDeploymentEventError as l, AssetManifestLoader as lt, bold as m, getLegacyStateBucketName as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, normalizeAwsError as nn, validateAssetBucketName as nt, isRetryableTransientError as o, getDockerCmd as ot, formatResourceLine as p, getDefaultStateBucketName as pt, buildAssetRedirectMap as q, ProvisioningError as qt, DeployEngine as r, withErrorHandling as rn, validateContainerRepoName as rt, IMPLICIT_DELETE_DEPENDENCIES as s, runDockerForeground as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isCdkdError as tn, parseBootstrapMarker as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, getDockerImageBySourceHash as ut, red as v, resolveSkipPrefix as vt, CloudControlProvider as w, CFN_TEMPLATE_URL_LIMIT as wt, collectInlinePolicyNamesManagedBySiblings as x, resolveUseCdkBootstrapAssets as xt, yellow as y, resolveStateBucketWithDefault as yt, TemplateParser as z, DependencyError as zt };
+//# sourceMappingURL=deploy-engine-D-gBbMiZ.js.map